Subject: RE: [mobile-ip] [mobile-IP]: Comments on draft-ietf-mobileip-vpn- problem-statemen t-00

From: "Adrangi, Farid" <[email-masked]>
Date: Tue, 4 Jun 2002 19:24:45 -0700

Hi Behcet,
I downloaded those two draft a while ago -- they might've
been obsoleted by now.  The solution described in 
draft-bpatil-mobileip-sec-quide-01.txt was provided for
a different problem -- but I found it sort of related to
this topic.

The draft-ietf-mobileip-nat-traversal-03.txt describes a 
solution for Mobile IP traversal across NAT gateways (not
involving any VPNs).  The problem statement draft does not
consider any foreign NATs, because 1) we wanted to make the 
problem statement focused on MIP/VPN.  2) NAT traversal problem
has already been solved.  

However, a solution for MIP/VPN traversal can leverage the 
draft-ietf-mobileip-nat-traversal-03.txt to provide a 
Mobile IP VPN or "NAT and VPN" solution.  We have also
proposed a solution to the MIP/VPN problem in the past, and we
are going to submit an update on that draft soon.

Hope this helps, please let me know if you have any 
questions.

regards,
Farid

-----Original Message-----
From: Behcet Sarikaya [mailto:[email-masked]]
Sent: Tuesday, June 04, 2002 4:32 PM
To: Adrangi, Farid
Cc: [email-masked]
Subject: Re: [mobile-ip] [mobile-IP]: Comments on
draft-ietf-mobileip-vpn- problem-statemen t-00

Hi Farid,
  Here are my questions on the draft:
- where is draft-bpatil-mobileip-sec-guide-01.txt? It does not seem to 
be at the drafts directory any more. Same for

draft-ietf-mobileip-ipsec-use-00.txt?
- Are you trying then to come up with similar solutions as in these two
drafts?
- How is the problem domain different than
draft-ietf-mobileip-nat-traversal-03.txt? Especially if you are not
considering MNs behind foreign NATs?

Regards,

Adrangi, Farid wrote:

>Hello Serge
>Thanks for reading the draft, and providing feedback. Please
>see my reply below (marked by Farid Writes>).
>Best regards,
>Farid
>
--behcet

---

From: "Adrangi, Farid" <[email-masked]>
Date: Thu, 20 Jun 2002 15:00:08 -0700

Hello Serge,
Thanks for your reply.  I removed the parts that we are in
agreement.  And please see my comments marked by "Farid Writes>"
Best regards,
Farid

> e. Page 5:
(..)
> Farid Writes > In my mind, the draft should not suggest any 
> tunneling order
> -
> this falls into the solution space.  Agree/Disagre?

Serge Writes>
Of course I agree but then why do you want to state again (I quote the text
you proposed in your reply)
"This also implies that the MIPv4 traffic destined to the home network has
to run inside an IPsec tunnel (..)"
?

Farid Writes> Consider an MN that wants to connect to its home network
protected by the VPN gateway.  The first thing that MN needs to do is to
establish
an IPsec tunnel to the VPN gateway. Agree/Disagree?  If yes, in order for
the MN to 
register with its home agent inside the VPN domain, the MN is forced to send
the 
MIP packet inside the IPsec tunnel -- because, the MN's home agent will not
directly be reachable from the outside.  Agree/Disagree?  If you disagree,
please
explain us how a node outside the VPN domain can communicate with a node in
the home
network protected by the VPN gateway, without sending the traffic inside the
IPsec
tunnel established between the MN and the VPN gateway.  

Also, maybe the proposed text should be modified to :  "This also implies
that the MIPv4 traffic destined to the home network is FORCED to run inside
an IPsec tunnel (..)".

We should solicit other people's opinion on this too.  Maybe,I am missing
your
point here -- if so, my apologies.  BTW, I removed your remark on page 7. 
Figure 6.1b because it refers to the same problem.