Subject: RE: [mobile-ip] question on protecting MN - HA communication

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 9 Oct 2002 20:55:45 +0200

> >   > notice the home address option (24 bytes). this 24 bytes
  > >   > overhead is removed by making the tunnel interface as one of
  > >   > the selectors and by changing the gateway address (towards the
  > >   > MN) whenever the MN moves and changes its CoA. the gateway
  > >   > addresses for the ESP tunnel are MN's CoA and HA's address.
  > > 
  > > => Understood, but given the rarity of this message
  > > compared to normal traffic and the unnecessary assumptions
  > > that it makes, I'm not too sure that it's worth it.
  > 
  > the only assumption here is the existense of this API. and 
  > in the draft, we are not leaving it as an assumption. we are 
  > requiring it. almost always, the SA database exists in the 
  > kernel. so, it shouldnt be difficult to have this API.

=> I think there is a bigger assumption and that is
the SPD will be processed after the route lookup.
I don't think this routing information is always
available when the SPD is processed. 

Hesham

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 09 Oct 2002 16:01:31 -0700

> available when the SPD is processed.

I see your concern.

but I always thought it is possible to have an SPD entry 
which says "if packets go through a particular interface, 
apply SA". so what does a typical IPsec implementation do 
in such a case?

anyway, the new text in the HA-MN IPsec draft says

     - We have chosen to require policy entries that are specific to a
     tunnel interface. This means that implementations have to regard
     the Home Agent - Mobile Node tunnel as a separate interface on
     which IPsec SPDs can be based.

this is under implementations considerations. 

regards
Vijay

ps: we need to resolve this soon.