Subject: RE: [Mip6] about DSMIPv6

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 20 Mar 2006 16:43:15 -0800

>  In your previous mail you wrote:
 > 
 >    Can the DT summarize your discussions how you reach to 
 > use IPv4 mapped
 >    address?
 >    
 > => note this issue is in fact bound to the IPsec setup one. For
 > instance if we decide for the UDP tunnel mode the home address
 > will be used in place of the mapped care-of address in the 
 > IPv6 header.

=> I disagree. Tunnel mode can be done in either case. As I said 
earlier I'll create a separate thread for these topics. 

 > 
 > I am afraid the IPsec NAT traversal will give all the answers which
 > is a good thing (get a solution without work) and a bad thing (work
 > for nothing)...

=> I really don't understand what you mean here. IPsec is not a mobility
management protocol and neither is mobike. I don't see how we can
use those protocols to: get a stable address, manage macro and micro
mobility, work independently of security....

Hesham

 > 
 > Regards
 > 
 > [email-masked]
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 21 Mar 2006 02:02:02 +0100

=> I believe you don't understand my comment: what it is put in the IPv6
header really depends on what kind of IPsec is used. So even they are
separated topics there are some relationships between them.

   => I really don't understand what you mean here. IPsec is not a mobility
   management protocol and neither is mobike.

=> yes but with NAT traversal you don't need a mobility management protocol
because the equivalent of the care-of address at the HA/SG is simply
the last seen address. Mobike is the same but with an explicit control
of the address when NAT-T is fully implicit.

   I don't see how we can use those protocols to: get a stable address,

=> CP (RFC 4306 section 3.15 Configuration Payload)

   manage macro

=> done (exactly: hidden by NAT-T and included into Mobike)

   and micro mobility,

=> MIPv6 has no real micro mobility today.

   work independently of security....

=> is it a desirable feature?
   
I am serious, the "road warrior" with NAT traversal IPsec VPN is already
largely deployed and to make it more IP version flexible is just a matter
of time (it is just a market issue, there is technical problem at all).

Regards

---

From: <[email-masked]>
Date: Tue, 21 Mar 2006 06:01:51 +0200

Francis,
   
>I am serious, the "road warrior" with NAT traversal IPsec VPN 
>is already largely deployed and to make it more IP version 
>flexible is just a matter of time (it is just a market issue, 
>there is technical problem at all).

Do you think that the VPN gateway and the home agent functionality
will be combined?  If so, your comment makes some sense - however,
if these are not combined, then I'm not so sure these will be
exactly solved.

I'll agree with the "road warrior" scenario, but I'm don't agree
that this matches with all of the use cases I'm consideration.
I'm happy to send examples, if they would be of use.

John

---

From: Francis Dupont <[email-masked]>
Date: Tue, 21 Mar 2006 21:40:33 +0100

will be combined?

=> the word "combined" is not the best one but I claim that an IPsec
SG (Security Gateway) and a MIPv6 HA (Home Agent) provide nearly the same
thing in this context.

=> if you use the protect any traffic on the tunnel option the
only differences between a SG and a HA are:
 - MIPv6 supports RO (routing optimization) but if you use a RO scheme
   which doesn't involve the HA directly (as the current standard one
   and nearly all "improved" proposals) you can do RO over an IPsec VPN
 - the signalings are not the same
 - genuine traffic between the MN and the HA/SG is encapsulated in IPsec
   but not in MIPv6 because the HA is considered in this case as a CN.
I come back to the signaling: in IPsec you have the choice between
the NAT traversal where the signaling is implicit (i.e., any valid packet
from the MN can be a BU) and MOBIKE where the signaling is explicit
(i.e., the MN controls its care-of address at the HA/SG side).

The NAT traversal style is very efficient, fully specified and supported
today, even by firewalls, but is a bit less secure than the MOBIKE style
(this is why the MOBIKE WG was created).
   
Regards

PS: references are RFC 3948 and 4306 with this quote last one:

      There are cases where a NAT box decides to remove mappings that
      are still alive (for example, the keepalive interval is too long,
      or the NAT box is rebooted).  To recover in these cases, hosts
      that are not behind a NAT SHOULD send all packets (including
      retransmission packets) to the IP address and port from the last
      valid authenticated packet from the other end (i.e., dynamically
      update the address).  A host behind a NAT SHOULD NOT do this
      because it opens a DoS attack possibility.  Any authenticated IKE
      packet or any authenticated UDP-encapsulated ESP packet can be
      used to detect that the IP address or the port has changed.