Subject: [mobile-ip] Re: AW: benafits and drawbacks with nat traversal

From: Hans Sjöstrand <[email-masked]>
Date: Mon, 24 Jun 2002 17:08:25 +0200

Serge,

With regards to NAT traversal  scheme I think they are pretty equal. I 
have seen the mobile IP version from inside now for almost a year and 
actually know very little about the ipsec one,so I guess I'm also quite 
biased. The only noticable difference is that the Mobile IP NAT 
traversal is a more mature draft-whise and has gone further in the RFC 
process (at IETF last call). So, the RFC is most likely to happen before 
the IPsec counterpart. But thats neglectable when it comes to 
implementation. The major IPsec vendors have also had propriatory 
mechanisms for IPsec NAT traversal in their products for some time. I'd 
say a draw, both are bound to occure since they come from different 
vendors addressing different needs.

But I thought your benafit/drawback approach was a little "over the top" 
which seamed more aimed to get a favourable ratio ;-)

I apprechiated your draft which was a good and clear one. The thing 
about it for my perspective is that the requirement for seamless 
mobility is "non-negotiable", a MUST. Then we find a technical solution 
to that problem. I also think that the FA is a good thing, it speeds up 
handover and provides access control with AAA in a scalable manner.

Additionally I think that you have some misunderstandings in your "3.1. 
IPSec tunnel inside the Mobile IP tunnel" section. You seam to try to go 
inside the ip-ip tunnel with your VPN firewall which I don't understand 
how you do it. Thats also why you get kind of contradictions like "It 
prevents integration of Mobile IP in already existing IPSec-based VPN 
products"

Also, the statement
"- In the case where FA care-of-address is used, security association 
needs to be hop-by-hop established"
is not valid for the same reason. The scenario (which corresponds to the 
scenario "3.2 Mobile IP home agent in DMZ" in  
draft-sjostrand-mobileip-vpn-problem-stat-00.txt) is more like this;
First you have a IPsec tunnel MN<->VPN GW, THEN you put that into an 
outer Mobile IP tunnel MN<=>HA (or FA<=>HA in case 2).

   <---------Internet--------> <--DMZ--> <--Intranet--> 
                   
   1. MN[(====================)HA---]VPN GW .........CN 
   2. MN[----------FA(========)HA---]VPN GW .........CN 
                   
     [--] IPSec tunnel    (==) MIP tunnel    .... traffic in clear

The Mobile IP tunnel provides you with a stable IP address from which 
you setup your IPsec SA. Regardless how you move, if you use CCOA or FA, 
the IPsec SA stays up on the stable IP. There could be a bundled SA 
between MN<->CN but thats beond this discussion and doesn't add any 
complexity.

Regards
/// Hasse

Tessier, Serge wrote:

>Hasse,
>
>NAT is anyway a problem but in the first case ("Mobile IP tunnel in IPSec VPN tunnel") it must be solved by an new solution specific to Mobile IP usage scenario i.e. draft-ietf-mobileip-nat-traversal-04.txt, while in the second case, ("IPSec VPN tunnel in Mobile IP tunnel") it is supposed to be solved by a solution specific to IPSec, i.e. draft-ietf-ipsec-udp-encaps-03.txt.
>
>To summarize: In order to do NAT traversal, you have two solutions: IPSec NAT traversal or Mobile IP NAT traversal. The criteria according to which you will choose between both solution depends on the tunneling order (IPsec in Mobile IP or vice-versa) that is, in turn, left to the fantasy of protocols' users.
>Benefits and drawbacks are here written with regard to Mobile IP. I omited any consideration regarding IPSec NAT traversal problem. It is a subjective approach, which pertinence is debatable.
>
>Do you have any idea, if a solution is 'better' (more likely to occur, more scalable, etc.) than the other one?
>
>Regards
>-Serge
>
>  
>
>>-----Ursprüngliche Nachricht-----
>>Von: Hans Sjöstrand [mailto:[email-masked]]
>>Gesendet: Montag, 24. Juni 2002 14:38
>>An: Tessier, Serge
>>Cc: mobile-ip
>>Betreff: benafits and drawbacks with nat traversal
>>
>>
>>Serge,
>>
>>Could you explain why implementing NAT traversal with "UDP 
>>Encapsulation 
>>of IPsec Packets" is an benafit while implementing it with "Mobile IP 
>>NAT/NAPT Traversal using UDP Tunnelling" is a drawback?
>>
>> From draft-tessier-mobileip-ipsec-00.txt
>>
>>    
>>
>>>  Figure 1: Mobile IP tunnel in IPSec VPN tunnel 
>>>
>>>  While the drawbacks are: 
>>>  - Since local networks use usually private addresses, NAPT is a 
>>>    major problem. A solution like the one described in [7] needs 
>>>    to be applied 
>>>
>>>      
>>>
>>>  Figure 2: IPSec VPN tunnel in Mobile IP tunnel   
>>>                  
>>>  The benefits are:
>>>  - NAPT is not a problem for Mobile IP since it is solved by the
>>>    IPSec tunnel  
>>>
>>>      
>>>
>>Regards
>>/// Hasse
>>
>>
>>    
>>
>
>  
>

---

From: "Tessier, Serge" <[email-masked]>
Date: Mon, 24 Jun 2002 15:35:34 +0200

Hasse,

Regards
-Serge

-----UrsprB8ngliche Nachricht-----
Von: Hans SjK4. Juni 2002 14:38
An: Tessier, Serge
Cc: mobile-ip
Betreff: benafits and drawbacks with nat traversal

Serge,

  While the drawbacks are: 

  The benefits are:

Regards
/// Hasse