Subject: RE: [mobile-ip] comments on mobileip-vpn-problem-statement-req

From: "Adrangi, Farid" <[email-masked]>
Date: Thu, 29 Aug 2002 11:07:00 -0700

Hello Yoshihiro,
Please see my replies below.
Best regards,
Farid

-----Original Message-----
From: Yoshihiro Ohba [mailto:[email-masked]]
Sent: Thursday, August 29, 2002 7:39 AM
To: Adrangi, Farid
Cc: 'Yoshihiro Ohba'; Qiang Zhang; [email-masked]; Iyer,
Prakash; [email-masked]; 'Milind Kulkarni'; [email-masked]; [email-masked].
com
Subject: Re: [mobile-ip] comments on mobileip-vpn-problem-statement-req

Hello Farid,

> Farid Writes > I guess the point here is that you cannot assume that
> the MN outside the intranet can always use co-located mode over VPN.
> MN may roam into a foreign network in which it MUST use FA services
> to route MIP packets.

OK.  Basically, there is a phylosophycal conflict in Problem 2.  VPN
is used because the enterprise network needs to be logically separated
from the Internet.  On the other hand, Problem 2 of the draft is
trying to privide seamless connectivity with Mobile IP spread over the
enterprise network and the Internet as if those two networks were the
single network.  I don't believe both separation and seamless
connectivity can be achieved.

Farid Writes > Why is so?  why do you think that is not achievable?
We are treating the two network (intranet and interent) as a single
network from Mobile IP perspective, but there are still separated
from each other (in this case, by an IPsec-based VPN gateway).  In
other words, MNs roaming outside will still need a secure way to 
access resources inside the intranet.

This makes me confused on what is the actual problem that Problem 2
addresses.  I think we can solve either (i) Mobile IP (in the
enterprise domain) over VPN, OR (ii) Mobile IP (in the enterprise
domain) over VPN over Mobile IP (in the provider domain), but cannot
solve seamless Mobile IP over VPN due to the phylosophycal conflict.

FArid Writes> I think here you are again jumping into the solution 
space (i.e.,  what is doable or not doable).  Here we are trying to define 
a problem statement pertaining to MObile IP and IPsec-based VPN
co-existence.

Anyway, I think Problem 2 requires more clarification.

FArid Writes > Ok.  Perhaps, you can help us understand exactly what
clarification needs to be done.

Thanks,
Yoshihiro Ohba

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Aug 2002 14:53:35 -0400

Farid,

Please see my comments below.

> access resources inside the intranet.

If the last sentence above is the goal, it is not necessarily to treat
intranet and interent as a single network from Mobile IP perspective.
For example, Mobile IP (in the enterprise domain) over VPN over Mobile
IP (in the provider domain) can solve the problem when the provider in
the visiting network forces FA services to the MN.  Perhaps Bahcet has
a similer view as mine.  The other issue is on security.  Allowing the
internal HA to communicate with external untrusted FA can be a
security hole which would be unacceptable for enterprise use.

> clarification needs to be done.

Clarification is needed for why it is necessary to treat intranet and
interent as a single network for Mobile IP only, while non-MIP
services does not require that.

Thanks.

Yoshihiro Ohba