Subject: RE: [mobile-ip] confusion about prefix sol/adv

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 25 Jun 2002 08:24:22 +0200

> > Presumably the IPsec SA used to secure the home BUs could also be
  > > applied to the prefix sol/adv messages. But perhaps the 
  > spec doesn't say this.
  > > Should it?

  > > 
  > Here is from the description of MPS/MPA on page 63:
  > 
  > :         If a Security Association for the IP Authentication Header
  > :         exists between the sender and the destination 
  > address, then the
  > :         sender SHOULD include this header.  [subject to change]
  > 
  > and on p 65:
  > 
  > :         An AH header MUST be included unless the mobile 
  > node has yet to
  > :         configure a home address.

=> This is where I don't think the sentence makes 
sense. How is it possible that the MN does not 
have a home address, but somehow knows the 
HA's address? Can someone please explain?

Otherwise, I think the rest is fine, use the 
existing IPsec SA...simple.

Hesham

---

From: "Pascal Thubert" <[email-masked]>
Date: Tue, 25 Jun 2002 11:17:57 +0200

Hi Hesham

=> This is where I don't think the sentence makes sense. How is it possible that
the MN does not have a home address, but somehow knows the HA's address? Can
someone please explain?
- In IPv4, we use the NAI feature to perform a DHCP-like function. I believe
this can be extended to v6 in a different draft. Now, it could be possible to
use the NAI to index the SA on the HA side, in which case AH is still possible
and even required, IMHO

Pascal

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Hesham Soliman (ERA)
Sent: Tuesday, June 25, 2002 8:24 AM
To: 'T.J. Kniveton'; Erik Nordmark
Cc: Hesham Soliman (ERA); [email-masked]
Subject: RE: [mobile-ip] confusion about prefix sol/adv

Hesham

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 25 Jun 2002 12:16:00 +0200 (CEST)

> use the NAI to index the SA on the HA side, in which case AH is still
> possible and even required, IMHO

Looking forward to your draft specifying all of this.

Until then I don't see why we should let this concern clutter
the spec.

  Erik

---

From: "James Kempf" <[email-masked]>
Date: Tue, 25 Jun 2002 09:07:10 -0700

> the MN does not have a home address, but somehow knows the HA's address? Can

If it knows the subnet prefix, it can use the HA anycast address for the subnet.

            jak

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 25 Jun 2002 12:08:33 -0700

> existing IPsec SA...simple.

just a clarification. there is no existing IPsec SA. this is another
SA. the existing IPsec is only for protecting Mobility Header traffic
between the MN and HA. there has to be a separate SA for protecting
the ICMP traffic between MN and HA.

Vijay

---

From: "T.J. Kniveton" <[email-masked]>
Date: Tue, 25 Jun 2002 14:45:27 -0700

> From: "Hesham Soliman (ERA)" <[email-masked]>
> Date: Tue, 25 Jun 2002 08:24:22 +0200
> To: "'T.J. Kniveton'" <[email-masked]>, Erik Nordmark <[email-masked]>
> Cc: "Hesham Soliman (ERA)" <[email-masked]>,
> [email-masked]

Sure. If you have read Appendix A, or any of the MIP-list conversations
about MPS/MPA and bootstrapping, then it does make sense: for any node that
wants to store a minimum amount of info, it can use DNS, DHAD, and MPS to
configure itself. After it has done DHAD, it knows all the home agents on
the home link..but has not configured its own address. It sends an MPS with
the CoA as source address.

> existing IPsec SA...simple.

Not quite so simple -- there is no existing SA for securing ICMP traffic, so
one would need to be established. It would be simpler not to use IPsec.

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 26 Jun 2002 12:09:41 +0200 (CEST)

> the CoA as source address.

But how useful is this?
Is it merely a nice to have or is it a 'must' requirement?

From an address space concern there should be no issue with having the
MN use a fixed interface id on the home link i.e. as long as the
home link doesn't renumber the MN uses a fixed HoA.
And the MN presumably knows its home interface ID (in its configuration,
on the Ethernet card, or in the SIM?).
In fact, if the MN doesn't know its interface ID I have no idea how
there could be an IPsec SA between the MN and HA for the BU
that prevents a MN from injecting a bogus BU for another MN which is using
the same HA. Thus as far as I can tell a fixed interface ID for the MN
is required in order to bootstrap the security needed for the home registration
BU.

So the MN needs to know this plus the home subnet prefix; hence it needs
to know a possible Home Address for itself.

  Erik

---

From: "T.J. Kniveton" <[email-masked]>
Date: Thu, 27 Jun 2002 15:12:41 -0700

Hi, sorry my response reflexes have been slow lately..

> From: Erik Nordmark <[email-masked]>
> Reply-To: Erik Nordmark <[email-masked]>
> Date: Wed, 26 Jun 2002 12:09:41 +0200 (CEST)
> To: "T.J. Kniveton" <[email-masked]>
> Cc: "Hesham Soliman (ERA)" <[email-masked]>, Erik Nordmark
> <[email-masked]>, [email-masked]
> Subject: Re: [mobile-ip] confusion about prefix sol/adv
> 

I guess it depends on your point of view. Things that were architected a
while back as being the "right" way to do things might need to make way for
more expediency. I don't have any objection to agree with your proposition
that MNs must first configure an HoA with the same prefix as the HA.

I believe the intent of the original mechanisms (tunneled router
advertisement) was to keep the v6 stack and autoconfiguration virtually the
same as it was for a non-mobile node. Since we hope a MN will know its HoA
and have an SA almost all the time, then this still leaves a lot of
breathing room for MPS with SA. Assuming we can get one to cover ICMP
traffic.
> is required in order to bootstrap the security needed for the home

Yes, I can buy the tradeoff that nodes that want mobility must be "more"
configured (i.e. have the IID known by the HA, and have more config about
the home network). That doesn't necessarily satisfy the finicky beast called
IPsec.

> to know a possible Home Address for itself.

Well it's not just knowing the home address -- basically the node must have
an SA for that home address too, right? so we are assuming we can skip steps
1,2,3... and just start with an HoA (or quickly derive one), but already
have the SA..meaning deriving the HoA might be the *easy* part.

---

From: Jari Arkko <[email-masked]>
Date: Fri, 28 Jun 2002 22:54:57 +0300

> the home network). That doesn't necessarily satisfy the finicky beast called

Right.

> have the SA..meaning deriving the HoA might be the *easy* part.

True. But on the other hand, as has been discussed a possible home address
indeed is available for the mobile node. This does not mean that the discovery
process is useless - it might be that another home address is discovered through
it, e.g. during renumbering.

I agree that having the SA is the hard part. I really needs to be configured,
and this is a change from the regular IPv6 ND situation, where the connectivity
proves your right to ask and get information.

Jari