Subject: RE: [Mip6] about DSMIPv6

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 20 Mar 2006 17:55:18 -0800

> => what you don't want to understand is for a tunnel 
 > protocol at the fixed end
 > to have a NAT or to have a mobile peer end is exactly the same thing:

=> Of course it's the same thing, but one protocol doesn't require
IPsec and the other works with or without IPsec.

 > from time to time the peer address/port changes. So as soon 
 > as you have
 > introduce the NAT traversal you have lost the mobility requirement.

=> I don't get that last sentence. We're doing this for pragmatic
reasons, hopefully it won't be needed in 5-10 years. 

 >    => So you want everyone to use VPNs to get mobility ???
 >    
 > => first you have IPsec somewhere in you specs, 

=> To protect SIGNALLING.

   second why not,

=> Because it's dumb to mandate that my VoIP packet be encrypted
with ESP. I'm using VoIP as an example to illustrate the inflexibility
of requiring security for every packet.

 > third don't forget your favorite weapon for the next HIP session
 > because this is exactly the HIP idea...

=> This WG is not working on HIP.

 >    It's to be used in a generic manner whether you need a VPN or not.
 >    
 > => in your case as it is not fully specified I don't know.
 > Remember I asked at a previous IETF if the BU/BA 
 > encapsulation is special
 > and I still have no clear answer, for instance is the same port used
 > (it seems a good idea but in this case you have a set of 
 > IPsec ESP SAs
 > in UDP tunnel mode with at least one with non null authentication for
 > BU/BA protection).

=> You did get an answer in the last IETF and today: We use one port
for all communication. Please let us know if this is not clear in the
draft.

 > BTW with the current scenarios it seems than a real VPN is a good
 > default solution... i.e., if the only difference between the existing
 > IPsec VPN solution and the proposal is the lack of security there is
 > something like a problem, (:-).

=> Well, I think we'll be doing well to allow IPsec but not 
require it of course, i.e. continue the way MIPv6 was designed. 

Hesham

 > 
 > Regards
 >    
 > [email-masked]
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 21 Mar 2006 21:23:56 +0100

In your previous mail you wrote:

=> what is not clear is how the SA pair for signaling protection is
setup and what are its selectors and mode.

Regards

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 27 Mar 2006 17:13:42 +0200

Soliman, Hesham wrote:
[...]
> for all communication. Please let us know if this is not clear in the

Side question...

What is that port number?  The doc doesn't seem to specify any real port 
number, other than just it being UDP.

Alex