Subject: RE: [Mip6] about DSMIPv6

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 20 Mar 2006 17:17:31 -0800

>     > I am afraid the IPsec NAT traversal will give all the 
 > answers which
 >     > is a good thing (get a solution without work) and a 
 > bad thing (work
 >     > for nothing)...
 >    
 >    => I really don't understand what you mean here. IPsec is 
 > not a mobility
 >    management protocol and neither is mobike.
 > 
 > => yes but with NAT traversal you don't need a mobility 
 > management protocol
 > because the equivalent of the care-of address at the HA/SG is simply
 > the last seen address. Mobike is the same but with an 
 > explicit control
 > of the address when NAT-T is fully implicit.

=> Huh?? We didn't design a mobility for NAT traversal. Traversal
is needed for obvious reasons though. 

 > 
 >    I don't see how we can use those protocols to: get a 
 > stable address,
 > 
 > => CP (RFC 4306 section 3.15 Configuration Payload)

=> Ok, I'll look into that.

 > 
 >    manage macro
 > 
 > => done (exactly: hidden by NAT-T and included into Mobike)

=> So you want everyone to use VPNs to get mobility ???

 > 
 >    and micro mobility,
 > 
 > => MIPv6 has no real micro mobility today.

=> See MIPSHOP docs, RFC 4140 and 4068. I can't believe you're saying
this. 

 > 
 >    work independently of security....
 > 
 > => is it a desirable feature?
 >    
 > I am serious, 

=> I hope not! 

   the "road warrior" with NAT traversal IPsec 
 > VPN is already
 > largely deployed and to make it more IP version flexible is 
 > just a matter
 > of time (it is just a market issue, there is technical 
 > problem at all).

=> MIP is not designed for the "road warrior"...You know that Francis. 
It's to be used in a generic manner whether you need a VPN or not.

Hesham

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 21 Mar 2006 02:45:51 +0100

=> what you don't want to understand is for a tunnel protocol at the fixed end
to have a NAT or to have a mobile peer end is exactly the same thing:
from time to time the peer address/port changes. So as soon as you have
introduce the NAT traversal you have lost the mobility requirement.

   
=> first you have IPsec somewhere in you specs, second why not,
third don't forget your favorite weapon for the next HIP session
because this is exactly the HIP idea...

=> "road warrior" is the IPsec world term for a nomadic client.

=> in your case as it is not fully specified I don't know.
Remember I asked at a previous IETF if the BU/BA encapsulation is special
and I still have no clear answer, for instance is the same port used
(it seems a good idea but in this case you have a set of IPsec ESP SAs
in UDP tunnel mode with at least one with non null authentication for
BU/BA protection).
BTW with the current scenarios it seems than a real VPN is a good
default solution... i.e., if the only difference between the existing
IPsec VPN solution and the proposal is the lack of security there is
something like a problem, (:-).

Regards
   
[email-masked]