Subject: VS: Re: [Mip6] Dynamic HoA assignment

From: [email-masked]
Date: Fri, 13 Apr 2007 22:35:26 +0300

Hi Jean,

I doubt the the fw rules (or other filtering) would be based on HoA, at least not for BUs. Of course it is up to the operator's deployment but I would not generalize..

/jouni

[snip]

The second issue is that, normally, security policy (i.e. filtering
rules) at the border of an  administrative domain (i.e. HA's domain
here) should be based on HoA. If the BU has HoA=0::0, the packet
should be rejected.

Best regards.

JMC.

>
> The intent is to allow the MN to send a BU with HoA=0:0 only in the case
> when IPsec is not used between the MN and HA (i.e 4285 mode).
>
> -Raj
>
>
>
>
> On 4/13/07 12:22 AM, "ext Chowdhury, Kuntal"
> <[email-masked]> wrote:
>
> > IPv6CP is used to negotiate the IID only which helps in producing the
> > link local address. RS/RA or DHCPv6 is used to configure the global
> > scope address.
> >
> > -Kuntal
> >
> >
> >> -----Original Message-----
> >> From: Vijay Devarapalli [mailto:[email-masked]]
> >> Sent: Thursday, April 12, 2007 2:07 PM
> >> To: Alper Yegin
> >> Cc: [email-masked]; [email-masked]
> >> Subject: Re: [Mip6] Dynamic HoA assignment
> >>
> >> Alper Yegin wrote:
> >>>> The base PMIPv6 protocol assumes that the home prefix is sent
> >>>> to the mobile node using a router advertisement and then the
> >>>> mobile node auto-configures a home address from this prefix.
> >>>
> >>> Isn't an IPv6 host in charge of whether it uses address
> >> autoconfiguration or
> >>> DHCP? If so, PMIPv6 spec shall accommodate that, assuming it does
> > not
> >> want
> >>> to dictate any particular behaviour on the hosts.
> >>
> >> 2461bis says
> >>
> >>     Router Advertisements (and per-prefix flags) allow routers to
> > inform
> >>     hosts how to perform Address Autoconfiguration.  For example,
> > routers
> >>     can specify whether hosts should use DHCPv6 and/or
> >>     autonomous (stateless) address configuration.
> >>
> >> Stateful address configuration is not mandatory to support.
> >> RFC 4294 says
> >>
> >>     Stateful Address Autoconfiguration MAY be supported.
> >>
> >> But I do agree DHCPv6 could be used between the mobile node
> >> and the MAG (Mobile Access Gateway).
> >>
> >> However, the address configuration for PMIPv6 depends to a
> >> large extent on what kind of link layer is used between the
> >> mobile node and the MAG. If the link layer is PPP, for e.g.,
> >> IPv6CP is used. If the link layer is an IPsec tunnel then
> >> IKEv2 configuration payloads are used. The PMIPv6 protocol
> >> does consider this and has some text addressing this.
> >>
> >> Anyway, this discussion needs to happen on the NETLMM
> >> mailing list.
> >>
> >> Vijay
> >>
> >> _______________________________________________
> >> Mip6 mailing list
> >> [email-masked]
> >> https://www1.ietf.org/mailman/listinfo/mip6
> >
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
>
>
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
>

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Jean-Michel Combes" <[email-masked]>
Date: Mon, 16 Apr 2007 12:22:22 +0200

Hi Jouni,

2007/4/13, [email-masked] <[email-masked]>:
> Hi Jean,
>
> I doubt the the fw rules (or other filtering) would be based on HoA,

Why not?
IMHO, this is the more logical:
- the HoA is the more 'permanent' IP address for a MN which is needed
for the stateful function of a FW
- the HoA is owned by the operator and so the security administrator
is aware of them and can set up the security policy easily
- the MIPv6 aware FWs I have tested work with HoA policy based

>  at least not for BUs. Of course it is up to the operator's deployment but I would not generalize..

I agree on this point. But this is just an advertisement in the case
where security policy would be based on HoAs.

Best regards.

JMC.