Subject: RE: [mobile-ip] Re: IPv6 ingress filtering early access

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Sat, 5 Jan 2002 14:50:30 +0100

Hi Francis, 

Thanks for the draft. Some comments:

While I do believe that AAA will be available at
some stage, in most networks, I still don't 
favour this solution because:

- I firmly believe that an infrastructureless
solution is the natural, scalable and more reliable
way to go here. It is a natural continuation of the
MIPv6 philosophy which is always e2e. 
This might sound wishy washy but I really think that
relying on AAA for ingress filtering will just 
complicate things too much.

- Relying on ingress filtering at all for the HAO
is not a good idea. Relying on some intermediate
node to do something, when no one will ever have 
a clue about whether this node has done it or not,
seems like the wrong approach to me. Basically this
is telling the CN to accept packets, because the 
MIPv6 spec says (potentially if this approach
is adopted) that ingress filtering was done at 
the sender's default router. Doesn't seem right. 

- From a practical point of view, it will take a very
long time before we can get the entire framework
for AAAv6 finished. So if timing is a concern
(I'm regularly reminded !) then it's probably 
a good idea not to delay the spec more than
we have to. 

- Looking at this from a different angle, does
it really matter if the MN reverse tunnels to
the HA ? I mean, if the CN doesn't accept the 
BU, currently, there will be triangular routing. 
So, do we really know that reverse tunnelling
will make the situation much worse ?? I don't
know.

That's all from me. Needless to say, that I did
write a draft on using AAA for generating keys
for BU authentication, but frankly, after 
investigating the CGA mechanisms, I won't pursue
the AAA option anymore. Infrastructureless 
solutions are much more scalable and easier to
deploy IMHO.

Regards,

Hesham

  > -----Original Message-----
  > From: Francis Dupont [mailto:[email-masked]]
  > Sent: Friday, January 04, 2002 5:22 PM
  > To: [email-masked]
  > Subject: Re: [mobile-ip] Re: IPv6 ingress filtering early access 
  > 
  > 
  >    I may have missed some discussion due to high volume on 
  > this topic,
  >    but I like to inject one scenario of Home Address option use...
  >    
  >      If MN and CN have IPSEC session between them, then I
  >      suppose HAO within such session is safe.
  > 
  > => this depends on what is an IPsec session (AH makes HAO safe,
  > more details are needed for other cases).
  > 
  >      (I leave it open for now,
  >      whether the session should be between care of addresses or home
  >      addresses of MN and CN, but either should work?).
  >    
  > => if the IPsec SA is with a care-of address it has to be rebuilt
  > after each movement. But the ISAKMP SA can be with the care-of
  > or the home address (i.e. IKE session can use the care-of or the
  > home address) at the exception of the IKE session for a first home
  > registration (i.e. before the home agent - mobile node tunnel is
  > established, mobile IPv6 drafts have a MUST because of this case).
  > 
  > Regards
  > 
  > [email-masked]
  >

---

From: Francis Dupont <[email-masked]>
Date: Sun, 06 Jan 2002 18:32:46 +0100

=> but can you describe an infrastructureless solution better
than BCE checks by CNs (which work only for HAOs sent by MN
with active bindings)?

   is not a good idea.

=> you've reversed the proposal. The issue is that HAOs defeat
simple ingress filtering (and similar security features), the
proposal just gets back ingress filtering (with all the technical
and practical limitations of ingress filtering).

   Relying on some intermediate
   
=> first I never proposed to do ingress filtering at the
sender's default router (this kind of job is more for a real firewall).
Second you lost sight of the target: provide ingress filtering
in presence of HAOs.

=> this is not a problem, remember the target.
Now we have no more to discuss if the ingress filtering
with HAOs issue is an important issue (i.e. enough for drastic solutions)
or not (i.e. just forget it): we have a workable (in the future)
solution.

   the HA ?

=> this is another issue. I believe we *must* keep this solution
(so I insisted to have a short statement in the I-D about it).
But I'd like to have a better standard mode (i.e. the triangular
routing). The main obstacle was the ingress filtering issue,
it is no more in the way.

   I mean, if the CN doesn't accept the 
   BU, currently, there will be triangular routing. 
   So, do we really know that reverse tunnelling
   will make the situation much worse ?? I don't
   know.
   
=> For security or simplicity the reverse tunneling is far better
but triangular routing should be more efficient if the home agent
is not in the path between the MN and the CN or if it is not
very close to the MN or the CN (for instance for communication
with CNs in the home site the bidir tunneling is better, and
works with site-local addresses (consider the tunnel being an extension
of the home site)).

=> I prefer to use AAA as a trusted third party and
for the transport of security stuff for the BSA establishment
before the home registration.

=> the issue with CGA mechanisms is they seems to be encumbred by IPRs.

=> AAA has never been a candidate for all cases. But when you have it
IMHO you should use it. Today there is no discussion about the security
of the home registration but AAA has its place there.

Regards