Subject: [mobile-ip] question on protecting MN - HA communication

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 9 Oct 2002 18:01:55 +0200

In draft-ietf-mobileip-mipv6-ha-ipsec-00 section 7.3.2:

       mobile node SPD OUT:
         - IF interface = tunnel to home agent &
           source = home address & destination = any & proto = MH
           THEN CREATE ESP TUNNEL SA: gateway = home agent &
                                      local phase 1 identity = user1

My question is, what is the reason behind this:
IF interface = tunnel to home agent

Is this done to distinguish between MH traffic tunnelled
to the HA and MH traffic addressed to a CN when RO
is used? 

I can understand this as a reason (only reason?).
I'm curious because this route information might 
not be available at this stage of processing the
outgoing packet.

Hesham

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 09 Oct 2002 10:27:57 -0700

> to the HA and MH traffic addressed to a CN when RO

actually no. it is easy to distinguish the above because
the destination IPv6 address would be the HA in the tunneled
MH traffic (for eg, HoTi). and in the MH traffic addressed 
to the CN, the destination IPv6 address is the CN.

by using tunnel interface as one of the selectors we can 
have a packet on the wire which looks like the following

   IPv6 header (source = care-of address, destination = home agent)
   ESP header
   IPv6 header (source = home address, destination = correspondent node)
   Mobility Header
      Home Test Init

otherwise the packet would be

   IPv6 header (source = care-of address, destination = home agent)
   Dst Opts Hdr
      HAO
   ESP header
   IPv6 header (source = home address, destination = correspondent node)
   Mobility Header
      Home Test Init

notice the home address option (24 bytes). this 24 bytes 
overhead is removed by making the tunnel interface as one of 
the selectors and by changing the gateway address (towards the 
MN) whenever the MN moves and changes its CoA. the gateway
addresses for the ESP tunnel are MN's CoA and HA's address.

> not be available at this stage of processing the

this is listed as an open issue currently. we are working on 
01 version of this draft, which lists this under implementation
considerations with some more info.

regards
Vijay