Subject: RE: [mobile-ip] comments on mobileip-vpn-problem-statement-req

From: "Adrangi, Farid" <[email-masked]>
Date: Thu, 29 Aug 2002 12:12:05 -0700

Hello behcet,
Please see my replies (marked by Farid Writes>).
Please let me know if you still have any questions.
Best regards,
FArid

-----Original Message-----
From: Behcet Sarikaya [mailto:[email-masked]]
Sent: Thursday, August 29, 2002 8:08 AM
To: Adrangi, Farid
Cc: [email-masked]
Subject: Re: [mobile-ip] comments on mobileip-vpn-problem-statement-req

Hello Farid,
In addition to Yoshi's comments, I have some comments:
1. In section 2 on deployment scenarios, what about HA's address? Do you
assume that HA does not have a public address? Also HoA? Is it private?
If your answer is yes then you are talking about a private MIP network,
is it of interest to IETF?

Farid Writes>  It depends on which particular deployment scenario(s) you
are referring to in section 2.  For example, section 2.1 describes a 
deoployment scenario in which all HAs are inside intratnet protected 
by a VPN gateway.  In this case, you have a private MIP network (i.e.,
your intranet) -- and the mobility within the intranet is solved by 
RFC 3220.  However, enabling MN to roam outside the intranet, or
enabling MN to roam inside and outside the intranet might also be desried
-- this requires Mobile IP and VPN to co-exist, and this draft attempts
to describe the problems resulting from this co-existence.

2. In section 4.1 you state that your draft is not suggesting an IPsec
over MIP solution. Why not? I think that there are some commercial
products offering this.

Farid Writes > This is a problem statement draft -- we have tried to 
make it clear that we are not suggesting any solution (i.e., IPsec
over MIP or vice a versa).  

3. For scenarios of 2.2 - 2.4, what does the draft offer as to IPsec
over MIP or MIP over IPsec?

Farid Writes> The draf is NOT offering any solutions, but it is simply
defining
problems resulting from MObile IP and VPN co-existence.

4. I am just curious if it is at all possible to establish MIP from
somebody else's intranet, assuming no change to the present VPN solutions?

Farid Writes> That's someting that we need to discuss when we start
evaluating the solution proposals.

Regards,

--behcet

---

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 29 Aug 2002 14:50:04 -0500

Hello Farid,
Thanks for your reply. Two more quick questions:
1. Section 2.1 the draft states
This (i.e. private MIP network) can be considered a typical deployment
scenario in
enterprise environments with a large and growing number of mobile
users.
Is this really true? I would not say so.

2. In Section 4.1 on p.9 the draft states
It is important to note that the mobile node connecting to the
home network is forced to establish an IPsec tunnel SA to the
VPN gateway first.

This means that handover occurs first for VPN, which I think, defeats
the purpose of MIP.
What do you think?

Regards,

--behcet