Subject: [MOBILE-IP] A question on reverse tunnelling

From: "BINAR, Simon" <[email-masked]>
Date: Thu, 2 Sep 1999 13:49:31 +0100

Hello.

I would have a question on reverse tunnelling. I understand that the
motivation for the specification of reverse tunnelling was to enable MNs
to send packets to correspondent nodes even when the MNs are located
behind a firewall that has implemented ingress filtering.

Now I have the following question. I assume that ingress filtering in
firewalls is a "silent process", meaning that the firewall will not
notify a user that his packets have been filtered. Now the question I
have is how a mobile node should know when it has arrived in a domain
that is protected by this type of firewall?

I guess one scenario would be for the MN to send several registration
requests, and after not having received any registration replys to
conclude that it might be located in a network that is protected by a
firewall. The MN would then revert to the use of reverse tunnels.
However, this process doesn't sound very efficient, and could easily
frustrate the user (because it takes ages to get registered).

The other possibility would be for the MN to always use reverse tunnels.
However, this could result in sub-optimal routes, and would not be in
line with the goals of route optimisation. Is there any way out of this
dilemma?

Simon Binar

DISCLAIMER:  Any views or opinions expressed in
this E-Mail message should be considered as the
personal views/opinions of the author.  They do
not  necessarily  represent  the  views  of the
author's employer.