Subject: [mobile-ip] Minutes from Bar BoF on mobile IPv4 VPN traveral

From: "Iyer, Prakash" <[email-masked]>
Date: Mon, 15 Jul 2002 18:10:01 -0700

Meeting Logistics:
The group met on 7/15/02 at the IETF-54 meeting location in Yokohama.

Attendees:
Hiroyuki Ohnishi 
Joe Lau 
Alan O'neill 
Atsushi Inouye 
Henrik Levkowetz 
Sami Varaala 
Antti Nueppoen 
Gopal Dommety 
Kent Leung
Milind Kulkarni
Gaetan Feige
Uri Blumenthal 
Farid Adrangi 
Prakash Iyer

We started off with Farid reviewing current status:
- Requirements draft updated and posted as a working group draft with
feedback received 
to date incorporated
Per Phil Roberts' suggestion, the problem statement and solution
requirements draft will be 
combined and an updated draft will be posted soon

Discussion:
The group agreed that the meta problem being solved is the need to support
mobile IP for 
an MN that roams inside and outside an Enterprise network (protected by a
firewall).

In the course of discussions, the group identified some scenarios
(combinations of HA and VPN 
gateway deployments) that the problem statement should mention with issues
concerning each. 
The group also suggested that the problem statement identify scenarios that
solution(s) will attempt 
to address. Solution draft(s) will clearly identify the scenarios and
problems outlined in the problem 
statement draft that they are specifically addressing.

The scenarios identified are described below:

	1.	HA outside the DMZ and VPN inside the DMZ 
* Big problem is - How do you move inside and maintain connectivity
* Issue - Untrusted traffic from CN to MN inside the Enterprise is a problem
* A possible workaround inside the Enterprise would be to disable reverse
tunneling however that 
could break with ingress filtering. If we use reverse tunneling, all packets
(even between nodes in 
the Enterprise) have to be routed via the external HA

	2.	HA and VPN gateway connected in parallel in the DMZ
* Only difference from previous case is that HA and VPN gateway now belong
to the same 
administrative domain
* All traffic (including internal traffic) will hit the DMZ, which may not
be acceptable to 
large Enterprises
* CN outside cannot talk to MN inside
* Needs a virtual home network

	3.	HA and VPN gateway combined in 1 box in the DMZ
* This results in signaling optimization makes it somewhat simpler but
previous problems exist
* There may be no need to standardize the signaling between the 2 boxes
* Needs a virtual home network

A variant of the previous scenario is where HA+VPN is combined in a
distributed manner inside 
the Enterprise - in other words not centralized as described in scenario 3.
This may not be 
acceptable especially for large Enterprises as it requires IPsec traffic
termination on these 
distribution HA+VPN boxes

	4.	VPN gateway in the DMZ and HA in the Intranet
* Main issue here is that the HAs are not visible from the Internet
* The issue of maintaining VPN tunnels across IP subnets needs to be
addressed. One possible 
approach is to deploy another layer of mobile IP in the external network
that essentially results 
in a more persistent care-of address. 

	5.	Reverse Tunneling with IPsec
The approach addresses the problem of MIP and VPN encapsulation overhead by
optimizing the 
combination of these protocols. This could result in protocol changes to MIP
and/or IPsec. Other 
issues are for further study.

Next Steps:

-Include the above-mentioned scenarios in an updated problem statement /
requirements draft.
-Chairs will issue a last call on the problem statement / requirements draft

-Form a design team to evaluate solution(s) addressing the draft mentioned
above