Subject: RE: [mobile-ip] question on protecting MN - HA communication

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 10 Oct 2002 09:52:33 -0700

> 
>   > > => I think there is a bigger assumption and that is
>   > > the SPD will be processed after the route lookup.
>   > > I don't think this routing information is always
>   > > available when the SPD is processed.
>   > 
>   > I see your concern.
>   > 
>   > but I always thought it is possible to have an SPD entry 
>   > which says "if packets go through a particular interface, 
>   > apply SA". so what does a typical IPsec implementation do 
>   > in such a case?
>   > 
>   > anyway, the new text in the HA-MN IPsec draft says
>   > 
>   >      - We have chosen to require policy entries that are 
>   > specific to a
>   >      tunnel interface. This means that implementations have 
>   > to regard
>   >      the Home Agent - Mobile Node tunnel as a separate 
> interface on
>   >      which IPsec SPDs can be based.
>   > 
>   > this is under implementations considerations. 
> 
> => ok. I completely understand the logic, but I
> can't see a great benefit from it really. 
> 
In any case, HA should be able to process both forms of tunneled packets
that Vijay showed in his earlier mail. I don't see any harm in
documenting both of them and point out the 24 bytes savings in
the case of tunnel interface known.

-mohan

> 
> 
>   > ps: we need to resolve this soon.
> 
> => Yes, let's see what others think.
> 
> Hesham
>

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 14 Oct 2002 16:16:46 -0700

hi Mohan

> Mohan Parthasarathy wrote:

> the case of tunnel interface known.

I prefer specifying just one wire format. IPsec - MIPv6
interaction has been a source of confusion for a long time
now. we should be simplifying things.

Vijay