Subject: RE: [mobile-ip] 3 pairs of IPSec SA for MN/HA signaling protectio n

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 15 Oct 2002 01:23:47 +0200

> Literally speaking, IPSec has a SPD entry with 5 tuple
  > ( src, dst, protocal, srcport, dstport ) as selector,
  > and uses the 5 tuple in IP packet to match the selector
  > in a SPD entry. IPSec works when everybody follows this
  > same rule, and it will still work if everybody agrees
  > to follow a different rule ( specifically for MIPv6,
  > maybe ).
  > 
  > An alternative could be something like this:
  > * Have a virtual protocol, say MIPv6_MN_HA_SIGNALING,
  >   for MIPv6/IPSec SPD entry, and for key nogotiation ( IKE ).
  > * Instead of using the 5 tuple from IP packet to match
  >   an SPD entry, first use a translating function to map from
  >   original 5 tuple ( from IP packet ) to a new 5 tuple,
  >   and then use the new 5 tuple to match SPD entry.
  >   This translating function only kicks in when the
  >   packet is MIPv6 MN/HA signaling packet, and of course
  >   uses the virtual MIPv6_MN_HA_SIGNALING protocol in the 
  > new 5 tuple.
  > 

=> I don't understand what problem you're trying to solve.
Nevertheless, we don't have port numbers in MIPv6. We 
use the src, dst and protocol in the SPD. 

Hesham

---

From: Wenxiao He <[email-masked]>
Date: Mon, 14 Oct 2002 17:52:53 -0700

> use the src, dst and protocol in the SPD.

The goal is to negotiate one SA and have one SPD
for MN/HA signaling protection.

Conceptually, MN and HA negotiate a pair of SA for
( MN Ho@, HA, MIPv6_MN_HA_SIGNALING protocol ).
The same entry is in SPD. Any MN/HA signal packet,
be it BU/RR/MPD, will match the same SPD after it
goes thru the translating function.

-- 
Wenxiao He