Subject: RE: [mobile-ip] question on protecting MN - HA communication

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Thu, 10 Oct 2002 12:01:34 +0200

=> My statement was on how to distinguish between MH
sent to the CN directly (COTI, BU ...etc) and MH
packets going to the HA. The policy is fine for 
MH packets going to the HA but I don't see how 
it can be used as is to distinguish between CN
packets with MH and HA packets with MH, if the 
check on the tunnel i/f is removed.

Hesham

---

From: Marc Hasson <[email-masked]>
Date: Thu, 10 Oct 2002 23:34:20 -0700

Hesham,

> sent to the CN directly (COTI, BU ...etc) and MH
                           ^^^^
Did you mean HOTI here?

> check on the tunnel i/f is removed.

I don't see the confusion, perhaps you can show me what
I'm missing.  The 7.3.1 policies will take care of the MN
MH packets going to/from the HA, agreed.  The MN's HOTI packets
to the CN will be handled by the 7.3.2 policy we've been
citing since those have a source address of "home address"
and must be tunneled through the HA using an IPsec tunnel.
The MN's COTI packets to the CN will not be covered by any
of the 7.3.x policies since the source address is the COA
which isn't listed in any policy.  Ditto for the BU.  Note
that this doesn't preclude using IPsec between the MN and
the CN, if available, but it seems distinguishable to me
that those would be separate security policies.

   -- Marc --