Subject: Re: [Fwd: RE: [mobile-ip] question on protecting MN - HA communication]

From: Jari Arkko <[email-masked]>
Date: Sun, 20 Oct 2002 22:26:56 +0300

Jarno wrote:

> I have also a question on the SPD rule referred by this thread:
> 
>        mobile node SPD OUT:
>          - IF interface = tunnel to home agent &
>            source = home address & destination = any & proto = MH
>            THEN CREATE ESP TUNNEL SA: gateway = home agent &
>                                       local phase 1 identity = user1
> 
> Assuming that "tunnel to the home agent" is just any interface (as seen
> by IPsec), wouldn't the policy rule create ANOTHER tunnel *within* the
> "tunnel to the home agent" interface (2 levels of inner headers)? If
> not, then why not? (it should be clear that the above rule should create
> another layer of IP tunneling, if the interface "selector" would be e.g.
> "eth0").

There may be several tunnels. But the condition "interface = tunnel
to home agent" should be interpreted as being specific to the particular
MIPv6 tunnel to the home agent, not any tunnel. So I think the policy
match will happen on the correct tunnel.

> The following should produce the wire-format specified in the draft:
> 
>        mobile node SPD OUT:
>          - IF source = home address & destination = any & proto = MH
>            THEN CREATE ESP TUNNEL SA: gateway = home agent &
>                                       local phase 1 identity = user1
> 
> As per RFC 2401 (see the NOTE: on page 32) an appropriate source address
> for the outer header will be automatically selected (should be CoA).
> (The outer source address is ignored by IPsec).
> 
> And as already noted in another message, a more specific rule for the HA
> destined MHs before the above rule should take care of the MN-HA
> signaling.

Yes, but this new rule would have a different problem: what about all MH
traffic to other destinations? In particular, what about BUs to CNs that
have a HAO which makes them match "source = home address"? Of course, we
could create specific policy entries for every CN that we know of and set
the priority of these entries higher than the above one. However, we could
never create another "destination = any" entry. So I think the only
practical alternative is to require a tunnel-interface specific SPD entry.

Jari

---

From: [email-masked]
Date: Wed, 23 Oct 2002 18:49:31 +0300

> match will happen on the correct tunnel.

Does this mean that the IPsec implementation must be
tailored for Mobile IPv6?

> practical alternative is to require a tunnel-interface 

Yes, due to the rule I presented all MH messages with source
address = home address would be tunneled via the HA (and
therefore they would actually never get a HAO). Is this a
problem? (I have understood that the processing order of
IPsec and HAO is that when sending, IPsec s processed first,
before HAO is added and addresses swapped.)

	Jarno