Subject: RE: [mobile-ip] Comments on Draft 16

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 2 Apr 2002 14:58:02 +0200

Erik,

  > I don't think allowing reverse tunnels without IPsec 
  > protection adds any
  > new residual threats as long as the HA verifies that packets contain
  > an outer source = CoA and an inner source = HoA (where 
  > there is a valid
  > binding between HoA and CoA).

=> I was thinking of the case where ingress
filtering is used in the visited network, but
in the case of multiaccess links this would not 
stop someone from spoofing another node's CoA.
So I'm not sure it's due to the absence of ingress
filtering , it's more due to the absence access
control. 
But my point was, if I want to talk to a site-local
address inside ericsson.com, while I'm at the IETF
I would have to have some sort of VPN access
(IPsec tunnel) to the firewall. I'm assuming that
someone might want to use site-local addresses 
inside a site to prevent anyone from reaching the 
server from outside the site. 
So if we allow any MN to tunnel a site-local HoA from 
a CoA through the HA, don't we want to make sure that 
the tunnel is authenticated to prevent anyone snooping 
the traffic from creating this tunnel?
Or do we assume that there will be a secured tunnel
anyway to the firewall in the home network, in order
for the MN to reach the HA? I guess this would work
as well. But the spec in general does not assume the 
existence of firewalls in every site.

  > 
  > For example, in the site-local case, if there is no 
  > internal ingress filtering
  > within a site then anybody could spoof site-local source addresses
  > without using MIPv6.

=> Sure, but I was concerned about the case where
they can reach a site-local address in the home
site, while located at a visited site. Which is 
normally impossible.

  > 
  > Did you mean "IPsec" when you said "authenticated" or did you mean
  > "verified"? (the term we used for HAO verification by CNs)

=> I meant IPsec.

Hesham

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 2 Apr 2002 16:22:53 +0200 (CEST)

> the traffic from creating this tunnel?

Yes, but that is because you have a policy, independent of MIPv6, of
wanting VPN protection for your data packets.

That is one possible policy. But there might be other policies
that don't require an IPsec VPN when packets are tunneled to home
site-local addresses.
There shouldn't be a need to pick and cast in stone any particular policy here
as far as I can tell.

> site, while located at a visited site. Which is 

But even that isn't unique to MIPv6. A node could run an IPv6-in-IPv6 tunnel
endpoint - one entity outside the firwall and one inside.

BTW: Section 11 in draft-ietf-ipngwg-scoping-arch-03.txt
is quite restrictive in this space, while previous versions where more open.
Do people think it should be more or less restrictive when it
comes to tunning site-locals?

  Erik