Subject: [mobile-ip] comments on mobileip-vpn-problem-statement-req

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 28 Aug 2002 10:36:35 -0400

I have two comments on
draft-ietf-mobileip-vpn-problem-statement-req-00.txt.

First, I'm not sure the model explained in Figure 3.2c (the MN in
non-trusted FA region) is a valid one.  If there is no trust
relationship or security association between the FA in an outside
network and the HA in the enterprise network, Mobile IP registration
is not possible between the FA and HA regardless of whether Mobile IP
runs over VPN or not.  So it seems that we do not have to consider
this scenario.

Second, Problem 2 in section 4 can be solved if we use Mobile IP over
IPsec over PPP over L2TP, where an IPsec tunnel is created in the
enterprise address space, if the mobile proposes to use the same IP
address in the enterprise space during the PPP IPCP negotiation (and
the VPN gateway accepts the IP address) each time the L2TP tunnel is
re-established when handoff occurs.  This can eliminate the need for
re-negotiating the IPsec SA when handoff occurs, since the IP address
used by the IPsec tunnel does not change.  This may not be pure
IPsec-based VPN, but still Mobile IP over IPsec.  Are there any reason
for focusing on IPsec-based VPN?  I think it would be more useful if
the draft is written in more generic manner so that the considration
is applicable to other VPN methods also.

Regards,
Yoshihiro Ohba

---

From: "Qiang Zhang" <[email-masked]>
Date: Wed, 28 Aug 2002 11:08:35 -0400

Yoshihiro,

Some comments below, thanks

Qiang

----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, August 28, 2002 10:36 AM
Subject: [mobile-ip] comments on mobileip-vpn-problem-statement-req

> runs over VPN or not.  So it seems that we do not have to consider

==> Non-trusted FA refers to the scenario that the FA outside has no any SA
with enterprise network (e.g. VPN gateway at the border).   Thus the MN, in
order to work with HA, is responsible for setting up the VPN connection in
order to tunnel MIP traffic through the VPN gateway and reach the HA.

In addtion an offnote, as a matter of fact, if the HA allowes, FA-HA SA such
as MD5 binding is optional.

> is applicable to other VPN methods also.

==>The problem statement tends to collect problematic scenarios which MIP
may have difficulty working with properly. Reason to put IPsec because there
are other VPNs around such as MPLS (if they do consider it a VPN) and L2TP.
This scenario you depicted uses L2TP as tunneling mechanism for IPsec VPN,
maybe considered as a solution which will go in different drafts.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 28 Aug 2002 14:52:55 -0400

Qiang,

Thank you for your reply.

> as MD5 binding is optional.

OK.  But I still do not understand this usage, because when we use VPN
we usually assume that all packets (including Mobile IP) in the
enterprise address space are transparently carried over the VPN tunnel
through the Internet.  So why the untrusted FA outside the enterprise
network should involve Mobile IP running inside the enterprise network
through VPN?

> maybe considered as a solution which will go in different drafts.

OK.  Then I think such an explanation about why the draft focuses on
IPsec-based VPN would be helpful.

Thanks,
Yoshihiro Ohba

---

From: "Qiang Zhang" <[email-masked]>
Date: Wed, 28 Aug 2002 15:23:37 -0400

Yoshihiro,

Are you sending mails from Japan?

Regarding the first question, pls see comment

Thanks
Qiang
----- Original Message -----
From: "Yoshihiro Ohba" <[email-masked]>
To: "Qiang Zhang" <[email-masked]>
Cc: <[email-masked]>; "Yoshihiro Ohba"
<[email-masked]>; "Adrangi, Farid" <[email-masked]>; "Iyer,
Prakash" <[email-masked]>; <[email-masked]>; "'Milind Kulkarni'"
<[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Wednesday, August 28, 2002 2:52 PM
Subject: Re: [mobile-ip] comments on mobileip-vpn-problem-statement-req

> network should involve Mobile IP running inside the enterprise network

==> When the FA is in the middle( like below) and MN is the VPN tunnel end,
apparently FA who is adding
the MIP tunnel will intervene the VPN tunnel between MN and VPNGW.

MN---FA  ------------------------VPNGW----HA

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 28 Aug 2002 19:24:26 -0400

Qiang,

> MN---FA  ------------------------VPNGW----HA

Although this does not answer to my question, I think we should 
not dig into this twisted model.  Instead, just running Mobile IP 
with co-located mode over VPN seems to be much cleaner.

Thanks,
Yoshihiro Ohba

P.S.  I'm sending emails from new jersey.