Subject: RE: [mobile-ip] Proposals for resolution of Issue #94

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 23 Oct 2002 20:54:51 +0200

> >> > There is one issue which may need further comment, although
  > >> > I thought it had already been decided.  The question is
  > >> > whether a mobile node with only a site-local address is allowed
  > >> > to roam to a new site and get a global care-of address.  The
  > >> > tunneling might still work.  Nevertheless, I thought
  > >> > that this behavior had been prohibited, and I worded the
  > >> > paragraph below with that in mind.  I can just as easily
  > >> > change it to lift the prohibition if that is desired.
  > >>
  > >>Hmm... doesn't seem like this tunneling is allowed to work.
  > > 
  > > 
  > > I think Charlie is talking about bi-directional (encapsulated)
  > > communication, not route optimized (routing header) communication.
  > 
  > But how does the BA get back to the MN from the HA?

=> Suppose the HA was tunnelling the BA instead, would 
that make the situation different? I suspect that the 
essense of the restriction to the RH would still apply
to the tunnelled packet. Except in this case the BA
is authenticated by the HA. So perhaps we can relax
the restiction for BAs coming from the HA. 

Yes, it's ugly ! 

Hesham

---

From: gabriel montenegro <[email-masked]>
Date: Thu, 24 Oct 2002 01:03:21 +0200

> the restiction for BAs coming from the HA. 

Regardless of esthetics, this, though *possible* in
some potential variation of the spec, is not
contemplated today in the base MIPv6 spec. Unless
I've missed something, there is no detailed
specification of how this BA tunneling would
be accomplished.

So I think all we can say today in this base MIPv6
spec is that this scenario will not work with the
current protocol specifications. We can then add
the now notorious and always convenient weasel
wording to the effect that "... alternate
specifications may allow for this scenario
to work."

We could then close the issue.

The point is: this particular scenario of a
site-local MN roaming successfully beyond its
site is not needed for MIPv6 base spec. One
may even question if it's *ever* needed, but
that's another debate.

-gabriel

---

From: Jari Arkko <[email-masked]>
Date: Thu, 24 Oct 2002 02:17:09 +0300

> the restiction for BAs coming from the HA. 

I think the rules on how to send BAs are complicated
enough as they are, so I'm not sure I want to add this.
Furthermore, the BUs will have to accompanied by a HAO,
and since the HAO is site-local it could be that firewalls
or other devices on the other site might not like this.

So, even if the tunnel could be made to work, I don't
think that solves the whole problem. My recommendation
is to keep the restriction on going outside the site
with the site-local addresses. But we do need to have
the right formulation of the text to prohibit this.
So let's get to the details:

1) Keiichi complained that the definition of multi-site link wasn't
    a correct one. He is right. Here's a proposed reformulation
    of the last paragraph:

      Operations affecting multi-sited IPv6 nodes are not completely
      understood, especially when mobility management is involved.
      For this reason, home agents SHOULD NOT be multi-sited.
      Similarly, a mobile node that uses site-local home, care-of, or
      home agent addresses SHOULD NOT be multi-sited.

2) I'm concerned that the requirements to mobile nodes to not
    roam to other sites and that the packets must stay within
    the site aren't really implementable. How would a site-local
    laptop know that it just roamed to the neighboring site's WLAN
    cell? Thus I wonder if the approach taken in scoping-arch-04
    section 11 would be better. What that draft says that it
    is recommended to use global addrs unless you are assured
    e.g. by configuration that you can use site-local addresses.
    Suggested reformulation of the first paragraph from Charlie's
    text:

      Mobile nodes are free to move from site to site, but the use of
      site-local addresses must be carefully managed.  When a mobile node
      or home agent address is site-local, then packets that use those
      address need to stay within the site. The mobile node SHOULD use
      such addresses only when it somehow has a guarantee -- for instance,
      by configuration -- that it is safe to do so. Thus, a mobile
      node MAY use a site-local home address for roaming within a site, but
      not for roaming to another site.  This is true even though the mobile
      node may be able to obtain a globally addressable care-of address at
      the new site.

3) Issue #78 added some text which appears to be too strict for
    the purposes of allowing site-local mobility within a site.

      While not at its home link, the mobile node MUST NOT use its home
      address (or the home address destination option) in Neighbor
      Discovery communications on the visited link. The mobile node also
      MUST NOT use its home address when communicating with link-local or
      site-local peers on the visited link.

    This would prevent site-local home addresses. So lets write instead:

      While not at its home link, the mobile node MUST NOT use its home
      address (or the home address destination option) in Neighbor
      Discovery communications on the visited link. The mobile node also
      MUST NOT use its home address when communicating with link-local
      or site-local peers on the visited link, if the scope of the
      home address is larger than the scope of the peer's address.

Jari