Subject: RE: [mobile-ip] observation on the mip/ipsec draft + filtering

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 29 Oct 2002 20:49:08 +0100

> in the solution you have described, by the time the MIPv6
  > module gets the packet, the decapsulation is done. the outer
  > header is lost. how does the MIPv6 module perform the check?

=> I think this is fixable without much trouble. 
Transport mode ESP can be used to protect HOTI/HOT. 
The packet is tunnelled _before_  IPsec gets hold
of it (in the MN). This way you will still get the 
original header in the MIPv6 code in the HA. 

What does this buy you? According to my understanding
1 SA for BU/HOTI/HOT/ICMP. 

Hesham

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 29 Oct 2002 12:03:13 -0800

> 1 SA for BU/HOTI/HOT/ICMP.

but not fewer SPD entries. you have to remember that.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 29 Oct 2002 12:00:53 -0800

> original header in the MIPv6 code in the HA.

if I understood the above paragraph right, the packet will
then look like the following

IPv6 hdr (src = CoA, dst = HA)
ESP hdr
IPv6 hdr (src = CoA, dst = HA)
IPv6 hdr (src = HoA, dst = CN)
Mobility Hdr
    HoTi

is this right? I am trying to understand what you wrote.

Vijay