Subject: RE: [mobile-ip] observation on the mip/ipsec draft + filtering

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 29 Oct 2002 21:14:39 +0100

> >   > in the solution you have described, by the time the MIPv6
  > >   > module gets the packet, the decapsulation is done. the outer
  > >   > header is lost. how does the MIPv6 module perform the check?
  > > 
  > > => I think this is fixable without much trouble.
  > > Transport mode ESP can be used to protect HOTI/HOT.
  > > The packet is tunnelled _before_  IPsec gets hold
  > > of it (in the MN). This way you will still get the
  > > original header in the MIPv6 code in the HA.
  > 
  > if I understood the above paragraph right, the packet will
  > then look like the following
  > 
  > IPv6 hdr (src = CoA, dst = HA)
  > ESP hdr
  > IPv6 hdr (src = CoA, dst = HA)
  > IPv6 hdr (src = HoA, dst = CN)
  > Mobility Hdr
  >     HoTi
  > 
  > is this right? I am trying to understand what you wrote.

=> No, I meant:

   IPv6 hdr (src = CoA, dst = HA)
   ESP hdr
   IPv6 hdr (src = HoA, dst = CN)
   Mobility Hdr
       HoTi 

I'm also implicitly asking that the packet be tunnelled
outside IPsec, then IPsec applies ESP in transport mode.

Hesham

Hesham

  > Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 29 Oct 2002 12:38:09 -0800

> outside IPsec, then IPsec applies ESP in transport mode.

as far as I know, this does not work. for a transport mode SA, 
the protocol header (the next header) cannot be an IPv6 hdr.
IPsec chains through extension headers till it reaches a 
transport protocol. but it does not include an IPv6 hdr.

I am claiming IPsec wont be able to distinguish between

and

UDP hdr

Vijay