Subject: RE: [mobile-ip] Mobile IPv4 Traversal across IPSEC-based VPNS

From: "Sami Vaarala" <[email-masked]>
Date: Tue, 8 Oct 2002 11:23:52 +0300

Hi,

> -----Original Message-----
> From: Brijesh Kumar [mailto:[email-masked]]
>[snip]
>
> 2. My main question relates to finding out a real and useful
application
> based on scenario discussed in the draft (section 2.1), i.e., the FA
is in
> the public domain and the HA is behind the firewall and the VPN
gateway.
> The
> technically scenario is fine, but I am having difficulty in finding
any
> real
> application that would need any thing other than an IPSEC VPN tunnel
from
> a
> mobile device. Afterall, all of us do use VPNs and corporate
applications
> from hotels and airports, and also, in somecases, do NAT traversal
with
> IPSEC clients. Why does someone need  IPv4 mobility when he has access
to
> the office VPN and can use all applications.  What appplications are
> depenedent on the ability to maintain IP address mobility via home
agent?

To my understanding the scenario is about a person that needs
to maintain sessions while moving from an unprotected intranet
to an external network.

The importance of not using VPN inside that intranet are two-fold:

   1. Performance impact (bottleneck at VPN device / inefficient
      routing)

   2. Usability impact (VPN authentication even when in trusted
      network -- consider e.g. SecurID)

If sessions don't need to be preserved, enabling/disabling VPN
selectively addresses these needs and MIP is not required.

So the question is:  what applications really need session mobility?
Personally I do need session mobility;  I use LAN in the intranet and
go to WLAN in the meeting room.  If I needed to do anything manually
(like restarting some software, clicking a button on the VPN client),
I would rather leave the laptop in its docking station.  (I run into
this trusted LAN intranet vs. untrusted WLAN in meeting room scenario
daily, so for me it matters :-)

Does this sound like a reasonable justification for the requirement?
Or were you thinking about something different?

Best regards,

-Sami

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 8 Oct 2002 15:13:22 -0400

Sami,

I think your usage is a reasonable justification.  Intranet VPN usage
in WLAN environment is I think the best current practice in
organizations that are careful about wireless security.  In addition,
we may need to mention that use of 802.1X authentication and
WEP/TKIP/AES encryption instead of intranet VPN is out of the scope of
this document.

Yoshihiro Ohba