Subject: [mobile-ip] FW: Mobile IPv4 Traversal across IPSEC-based VPNS

From: "Adrangi, Farid" <[email-masked]>
Date: Mon, 7 Oct 2002 17:29:56 -0700

Hello brijesh,
Thanks for reading the draft and providing feedbacks.  Please see
my replies below (marked by Farid Writes>).  Please let me know
if you have any questions.
Best regards,
FArid

-----Original Message-----
From: Brijesh Kumar [mailto:[email-masked]]
Sent: Monday, October 07, 2002 12:20 PM
To: [email-masked]
Cc: [email-masked]
Subject: Mobile IPv4 Traversal across IPSEC-based VPNS

I was reading <draft-ietf-mobileip-vpn-problem-statement-req-00> yesterday,
and I have a few comments with regards to the example roaming scenario in
the draft for the authors.

1. First, the  "Dr. Joe in the hospital" case example is somewhat
misleading. A few years ago, I was involved in a project that proposed the
use of bluetooth in  hospitals, and the project has to be abandoned because
hospitals apparently had a blanket ban on the use of any wireless device
including cellphones and 2-way pagers in the premises. The question of
hypothetical Dr. Joe using 802.11 wireless device in an hospital and being
able to carry his transport sessions between lab to his office is out of
question. The example should be replaced with a realistic example, if you
need one at all.

Farid Writes> First, is this policy for all hostipals?  Because, I have
myself
used cell phones inside hospitals (of course I wasn't  in operation or
emergency
rooms).  The idea was to demonstrate roaming scenarios within an
organization
irrespective to the current wireless-use policies imposed in the
organization.
In any case, we can use a different example if this turns out to be a
confusing 
issue -- thank for bringing this up.
this up.

2. My main question relates to finding out a real and useful application
based on scenario discussed in the draft (section 2.1), i.e., the FA is in
the public domain and the HA is behind the firewall and the VPN gateway. The
technically scenario is fine, but I am having difficulty in finding any real
application that would need any thing other than an IPSEC VPN tunnel from a
mobile device. Afterall, all of us do use VPNs and corporate applications
from hotels and airports, and also, in somecases, do NAT traversal with
IPSEC clients. Why does someone need  IPv4 mobility when he has access to
the office VPN and can use all applications.  What appplications are
depenedent on the ability to maintain IP address mobility via home agent?

Farad Writes>  Interesting question.  I have asked myself this question a
number of times :-)  You are right about if the hot spots that employ a
single
subnet.  However, large hot spots like hotels and airports will mostly
likely
employ more than a single subnet -- and you don't want to restart your
connections
to nodes inside the Intranet and re-establish the VPN connection every 
time that you change your point of network attachment within the hotspot. 
Application examples could be anything like file-transfer, VoIP, Media
streaming, 
etc.  

This question is not answered in the draft. Just saying Dr. Joe would "like
to maintain his transport connection" is not sufficient since it is not
clear why he needs this (afterall, it requires one extra layer of ipsec
tunnel)? 

Farid Writes> The whole motivation behind Mobile IP is to enable a mobile
user
to maintain its current transport connections and constant reachability -- 
unless here you are questiong the need for Mobile IP.   If you are convinced
about the need for Mobile IP, the challange here it to make sure that
Mobile-IP
and IPsec-based VPN can coexist.  

Also, it is quite unlikely that transport connection will survive
visit from his hospital to the hot-spot. (voice calls over ip aren't useful
application because cell phones aren't going to be out of fashion and
replaced by ip phone calls any time soon.). Will it not be interesting  to
first find a useful application, before discussing the solution?

FArid Writes>  Why is so?  Think about this in the context of switching from
GPRS to WLAN 
or vice a versa.  Maybe, our hospital example is not the best one and we
should come
up with a better example to motivate the reader.

3. Also perhaps draft should have references to basic NAT traversal drafts -
IPsec-NAT Compatibility Requirements <draft-ietf-ipsec-nat-reqts-02.txt> and
<Negotiation of NAT-Traversal in the IKE draft-ietf-ipsec-nat-t-ike-03.txt>

FArid Writes>
Sure.

Cheers,

--brijesh

---

From: "Brijesh Kumar" <[email-masked]>
Date: Tue, 8 Oct 2002 08:38:55 -0700

Hi Farid,

Thanks for the response.
The my purpose was to point out the areas in which draft can be improved.

----- Original Message ----- > Farid Writes> First, is this policy for all
hostipals?  Because, I have
> issue -- thank for bringing this up.

 In all Hospitals, you will be asked to turn off your wireless devices in
the hospital lobby because of intereference they may cause with sensitive
medical equipments (but there may be people who may not have read that
notice). In any case, I think, now you have discovered some better examples.

> up with a better example to motivate the reader.

The clarification to this regard will greatly improve the readability and
the technical value of the draft.

Thanks for taking time to respond.

Cheers,

--brijesh