Subject: RE: [mobile-ip] Unresolved issue #14: RR ESP protection keyword

From: "Karen E Nielsen (TED)" <[email-masked]>
Date: Thu, 11 Apr 2002 09:49:25 +0200

This of course mean that the IPSEC selectors should be able to scan
the Mobility Header Type field (RR HOT is MH type 3, BU is MH type 5 etc.)
Does anyone see a problem with this ?

Karen

> -----Original Message-----
> From: Michael Thomas [mailto:[email-masked]]
> Sent: 11. april 2002 00:12
> To: Karen E Nielsen (TED)
> Cc: [email-masked]; [email-masked]'
> Subject: RE: [mobile-ip] Unresolved issue #14: RR ESP 
> protection keyword
> 
> 
> Karen E Nielsen (TED) writes:
>  > Don't you need to specify whether the ESP should be 
> deployed in tunnel or in transport mode
>  > in the SPD ? As I understand you, ESP transport mode 
> should be used for the BU/BAck whereas the RR should
>  > be covered by ESP tunnel mode, how can they then be 
> covered by the same SP ? 
> 
>    This is a good observation. I think we meet the
>    security and flexibility requirements if we
>    make transport mode for the MN/HA a MUST, but 
>    allow the use of an ipsec HA/MN tunnel as well
>    (MAY/SHOULD). 
> 
> 		Mike
>

---

From: Jari Arkko <[email-masked]>
Date: Thu, 11 Apr 2002 10:14:27 +0300

I agree that the RR going through the HA and the home registration traffic
can't be protected by the same SPD entry, as the mode is different.

I don't think we need to scan the contents of the mobility header type field,
though. One rule can specify what to do for HoA <-> HA: MH traffic and another
rule for HoA <-> Any: MH traffic. If the rules are presented in this order,
it should work. (Per RFC 2401, the SPD entries are ordered.)

Jari