Subject: RE: [mobile-ip] confusion about prefix sol/adv

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Wed, 26 Jun 2002 11:02:01 +0200

=> Yeah I read them at the time, I think I was one of 
the people that sent you comments...
But, excuse me for being a bit slow, but are you 
saying that the MN does DHAAD, yest it still 
does not know _one_ of its home addresses???
Even after the supposed DNS lookup?
That's what I don't understand...

Here is a scenario where a MN knows _nothing_
(I think I sent the same thing before) :

1. Finds out its HoA address from the DNS
2. From that it finds the HA's anycast
3. Does DHAAD
4. Sends BU with one of the Home addresses
4. Sends MPS

In this scenario, MPS and MPA can be secured 
with the same SA that is used for the BU.

Having said that, I agree with Erik's response to
Pascal, for the sake of the current spec, we can 
assume that the MN already knows its home address/prefix. 
Later we can add well studied mechanisms for complete
plug n play. But either way, I think the scenario
above would work. Comments?

  > 
  > 
  > > 
  > > Otherwise, I think the rest is fine, use the
  > > existing IPsec SA...simple.
  > 
  > Not quite so simple -- there is no existing SA for securing 
  > ICMP traffic, so
  > one would need to be established. It would be simpler not 
  > to use IPsec.

=> This is for you and Vijay because he made the same 
comment. Why can't we use the same preconfigured (
this is the current assumption) SA for the BU?
All you need is to copy it and create anew SPD
entry dynamically or when configuring the original
SA for the BU. 

Hesham

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 26 Jun 2002 11:54:55 -0700

> entry dynamically or when configuring the original

not so easy. both ends (HA and MN) have to decide on a new SPI 
value. you need some kind of negotiation. it is possible to come 
up with a derived SA from the original SA, but both ends need to 
do the same. 

anyway, you dont have to do such a thing. it is not difficult
creating one more IPsec SA pair to protect all ICMP traffic. 
currently there are two already (1) to protect Mobility Header 
traffic between MN and HA (2) to protect tunneled HoTI and HoT
messages.

for your other question 

> Another thing to add, is there any other ICMP 
> message that is currently sent to the HA? 

ICMP errors??

Vijay