Subject: RE: [mobile-ip] Re: IPv6 ingress filtering early access

From: "Glenn Morrow"<[email-masked]>
Date: Tue, 8 Jan 2002 12:54:01 -0600

Mike,

This sounds like a pretty good idea to me to remove the need for tunneling
overhead. 

How can we guarantee that topological checks are not on anywhere in the
interior of the network, though?

Glenn

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: Tuesday, January 08, 2002 12:20 PM
> To: Francis Dupont
> Cc: Michael Thomas; Pekka Nikander; Jari Arkko;
> [email-masked]; [email-masked]
> Subject: Re: [mobile-ip] Re: IPv6 ingress filtering early access
> 
> 
> [Phil suggested I add mobileip back which was
>  dropped somewhere along the way]
> 
> Francis,
> 
> I'm not sure we're communicating, so let me be a little
> more explicit with what I had in mind:
> 
> 1) MN arrives on new AR
> 2) It sends a packet using its home address as the 
>    *source* address -- no HAO at all.
> 3) AR recognizes that the source address is not one of
>    the subnets it subtends and sends an ICMP message
>    to MN which explains the problem
> 4) MN sends AR a normal CN binding update
> 5) AR lifts the restriction for that source address
> 6) MN now sends packets as in (2), but unimpeded
> 
> If MN knows that there is likely to be a source
> address check on AR, it can delete steps 2 and 3.
> ICMP seems like a natural here because the router
> really is reporting a network problem back to MN
> (or not MN if a host were incorrectly configured,
> etc).
> 
> If this is a subset of your proposal, fine. It
> does seem that what I propose gets rid of the HAO
> altogether which you don't seem to agree with.
> However, may I suggest that it's the AAA part that
> has become the lightning rod? And that maybe it
> shouldn't be quite so ambitious? :-)
> 
> 	 Mike
> 
> Francis Dupont writes:
>  >  In your previous mail you wrote:
>  > 
>  >       No, actually, it was to have the MN send the
>  >       BU's directly to the access router. On a router
>  >       the BU just has an additional effect of removing
>  >       any restrictions on source addresses it will 
>  >       let through.
>  > 
>  > => I believed your proposal was BU snooping. But you can name it
>  > as you'd like, the purpose is to provide the knowledge of bindings,
>  > so there is no deep difference with my proposal (i.e. I can say
>  > you use a non-standard network access control device, as I don't
>  > specify one (I only give an example with AAA because it is the best
>  > on the paper) I could argue your proposal is included in mine :-).
>  > 
>  >       Hence Pekka's question about use of ICMP was correct.
>  > 
>  > => I am reluctant to define new ICMPs for anything. There 
> is already
>  > a format for BUs, why a new thing?
>  > 
>  > Another point: HAOs are inside packets, to look at them is 
> legitimate
>  > for my firewall but not for any router on the path, i.e. I'd like
>  > to have the check done once and others to trust it (this idea is
>  > exactly the network access control).
>  > 
>  > Regards
>  > 
>  > [email-masked]
>

---

From: Francis Dupont <[email-masked]>
Date: Wed, 09 Jan 2002 12:27:20 +0100

=> I agree but you can also remove the routing header too, i.e. the
tunneling overhead in the other way. This is named micro-mobility or
mobility based on host routing, and is almost as applicable as
Michael's proposal (i.e. it has exactly the same scalability issue,
all involved ingress filtering devices must be configured, for micro
mobility this is for all involved routers).

Regards

PS: Michael's proposal is like a combination of path MTU discovery
(ingress filter devices send back ICMP errors when they drop packets)
and signaling (in order to punch holes in ingress filters).