Subject: RE: [mobile-ip] comments on mobileip-vpn-problem-statement-req

From: "Adrangi, Farid" <[email-masked]>
Date: Wed, 28 Aug 2002 17:12:36 -0700

Hello Yoshihiro,
Please see my comment below (marked by Farid Writes>).
thanks,
Farid

-----Original Message-----
From: Yoshihiro Ohba [mailto:[email-masked]]
Sent: Wednesday, August 28, 2002 4:24 PM
To: Qiang Zhang
Cc: Yoshihiro Ohba; [email-masked]; Adrangi, Farid; Iyer,
Prakash; [email-masked]; 'Milind Kulkarni'; [email-masked]; [email-masked].
com
Subject: Re: [mobile-ip] comments on mobileip-vpn-problem-statement-req

Qiang,

On Wed, Aug 28, 2002 at 03:23:37PM -0400, Qiang Zhang wrote:
> Yoshihiro,
> 
> Are you sending mails from Japan?
> 
> Regarding the first question, pls see comment
> 
> Thanks
> Qiang
> ----- Original Message -----
> 
> > OK.  But I still do not understand this usage, because when we use VPN
> > we usually assume that all packets (including Mobile IP) in the
> > enterprise address space are transparently carried over the VPN tunnel
> > through the Internet.  So why the untrusted FA outside the enterprise
> > network should involve Mobile IP running inside the enterprise network
> > through VPN?
> 
> ==> When the FA is in the middle( like below) and MN is the VPN tunnel
end,
> apparently FA who is adding
> the MIP tunnel will intervene the VPN tunnel between MN and VPNGW.
> 
> MN---FA  ------------------------VPNGW----HA
> 

Although this does not answer to my question, I think we should 
not dig into this twisted model.  Instead, just running Mobile IP 
with co-located mode over VPN seems to be much cleaner.

Farid Writes > I guess the point here is that you cannot assume that
the MN outside the intranet can always use co-located mode over VPN.
MN may roam into a foreign network in which it MUST use FA services
to route MIP packets.

Thanks,
Yoshihiro Ohba

P.S.  I'm sending emails from new jersey.

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Aug 2002 10:39:26 -0400

Hello Farid,

> MN may roam into a foreign network in which it MUST use FA services

OK.  Basically, there is a phylosophycal conflict in Problem 2.  VPN
is used because the enterprise network needs to be logically separated
from the Internet.  On the other hand, Problem 2 of the draft is
trying to privide seamless connectivity with Mobile IP spread over the
enterprise network and the Internet as if those two networks were the
single network.  I don't believe both separation and seamless
connectivity can be achieved.

This makes me confused on what is the actual problem that Problem 2
addresses.  I think we can solve either (i) Mobile IP (in the
enterprise domain) over VPN, OR (ii) Mobile IP (in the enterprise
domain) over VPN over Mobile IP (in the provider domain), but cannot
solve seamless Mobile IP over VPN due to the phylosophycal conflict.

Anyway, I think Problem 2 requires more clarification.

Thanks,
Yoshihiro Ohba

---

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 29 Aug 2002 10:08:24 -0500

Hello Farid,
In addition to Yoshi's comments, I have some comments:
1. In section 2 on deployment scenarios, what about HA's address? Do you
assume that HA does not have a public address? Also HoA? Is it private?
If your answer is yes then you are talking about a private MIP network,
is it of interest to IETF?
2. In section 4.1 you state that your draft is not suggesting an IPsec
over MIP solution. Why not? I think that there are some commercial
products offering this.
3. For scenarios of 2.2 - 2.4, what does the draft offer as to IPsec
over MIP or MIP over IPsec?
4. I am just curious if it is at all possible to establish MIP from
somebody else's intranet, assuming no change to the present VPN solutions?

Regards,

--behcet

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 29 Aug 2002 11:04:03 -0400