Subject: Re: [mobile-ip] Using IPSec to Protect Mobile IPv6 Signaling between Mobile Nodes and Home Agents

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 07 Oct 2002 17:09:26 -0700

hi Joe,

Joe Lau wrote:
> 
> Jari,
> 
> On your draft "Using IPsec to Protect Mobie IPv6 Signaling between Mobile
> Nodes and Home Agents,
> 
> 7.2.4 Payload Packets
> 
>        mobile node SPD OUT:
>          - IF interface = tunnel to home agent & source = home address &
>               destination = any & proto = any
>            THEN USE SA7
>        ...
> 
> When the MN register with the HA with the S-flag set to 0, the HA creates
> multiple Binding Cache entries, one for each of possibly several home
> addresses.  Am I correct, that each home address will require a separate
> mobile node SPD OUT/IN policy, similarly for the SAD?

the general practice is to treat all these BCEs as a result of
one BU. these BCEs cannot be deleted individually. they can 
only be deleted by a deregistration BU with S bit set to 0. 
thats what we had conlcuded earlier.

as long as the MN does not use any of the other home addresses
to send a BU, there is no need for SPD/SAD entries for each
home address. 

and it is obvious that if an MN is planning to use a particular
home address for sending a BU, it needs to have a security 
association for that. it has nothing to do with the 'S' bit.

regards
Vijay