Subject: RE: [mobile-ip] Sub: Identifying link changes

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Thu, 20 Jun 2002 12:30:35 +0200

Do we know how to secure a BU to a random AR?
Is the assumption that we will use RR for this?

If the answer is no to either question, then this
scenario should not exist.

Hesham

  > -----Original Message-----
  > From: [email-masked]
  > [mailto:[email-masked]]
  > Sent: Wednesday, June 19, 2002 6:25 AM
  > To: [email-masked]
  > Cc: [email-masked]
  > Subject: [mobile-ip] Sub: Identifying link changes
  > 
  > 
  > > > Now the selected router turns to Host, by advertising 
  > with router
  > lifetime
  > > > set to Zero. But the router is still advertising the 
  > prefixes for
  > > > autoconfiguration (not acting as default router).
  > > > MN selects the next default router in the same link. 
  > But MN is unaware
  > a
  > > > router change or network change in the same link or a 
  > different link.
  > So it
  > > > forms primary care-of address and registers with 
  > Previous HA (Smooth
  > > > Handoff). In this case, the BU with 'D' bit set is sent 
  > to HA in the
  > same
  > > > link.
  > 
  > Samita wrote :
  > 
  > > How do you mean by "previous" HA ? Why does it need to change HA ?
  > > Your scenario does not describe that. How do you mean by 
  > "HA in the
  > > same link" ?
  > 
  > Probably, I may not have explained it properly in my previous mail.
  >                 __
  >   --           |MN|                 --
  >  |R1|----------------------------- |R2|
  >   --       (Foreign Link)  |         --
  > 3ffe:1::0                  --      2ffe:1::0
  > 3ffe:2::0             |HA|    2ffe:2::0
  >                            --
  > 
  > Assume that MN has selected R1, has default router which 
  > advertises the
  > prefixes,
  > 3ffe:1::0, 3ffe:2::0. Now, this has changed to Host. So, MN 
  > is switching to
  > another default router on the same link which is advertising with
  > 2ffe:1::0,
  > 2ffe:2::0. As far as MN is concerned, it is unaware whether 
  > it is a router
  > change
  > from the same link or from a different link.
  > 
  > MN forms primary care-of address and registers with HA in 
  > its Home link
  > (which performs DAD on the Home link for its Home 
  > addresses, not shown
  > in the diagram).
  > 
  > Since, the prefixes are different there is a network 
  > change.  Hence MN will
  > send
  > a BU to previous network HA (which is in our case, nothing 
  > but the HA in
  > the same
  > link as the MN is currently in).
  > 
  > My question is, can MN avoid sending BU to HA when there is 
  > no link change?
  > If so, how to identify the link changes?
  > 
  > > The above scenario does not seem to be valid.
  > > DAD is performed on the home-address by the home-agent on 
  > the home-link.
  > The
  > > assumption is home-link is separate from the foreign link.
  > 
  > Is DAD, not performed by the HA in the foreign link?
  > 
  > Srinivasan
  >

---

From: Jari Arkko <[email-masked]>
Date: Thu, 20 Jun 2002 16:12:09 +0300

> Is the assumption that we will use RR for this?

The spec says the temporary HA should be treated as
a regular HA. In other words, either you have security
associations, can establish them on the fly, or you
don't do this.

> scenario should not exist.

Yes. (But we are also discussion other ways to avoid
this scenario.)

Jari

---

From: "James Kempf" <[email-masked]>
Date: Thu, 20 Jun 2002 10:12:17 -0700

> scenario should not exist.

I think the answer is, in fact, no.

In MIP, the AR functions as an "on-link home agent" if it is processing
BUs. Thus, I think we need to consider security that is at least as good
as that with the home agent. Unlike the CN, the BU will be forwarding
traffic to the MN, and thus in the perfect position to act as a man in
the middle if security is compromised.

            jak