Subject: [mobile-ip] MIP/IPsec protection question

From: Michael Thomas <[email-masked]>
Date: Mon, 14 Oct 2002 13:28:26 -0700 (PDT)

Hi all,

I've finally read through the ipsec draft and it
seems that there is a fairly fundamental design
decision which was made which is to say that for
mobility the home address should be instead of the
care of address for SPD purposes.

This strikes me as odd and it definitely says that
IPsec implementations would need to change. What I
don't understand is what drove that decision. Was
the goal to use IPsec as, essentially, a firewall
such that only those BU's which are authorized for
processing for a particular home address pass
through?

If so, what was the downside of keeping the IPsec
code the same -- which would permit all
*authenticated* BU's through -- and deal with the
authorization in the MIP module itself? That is,
there would need to be a binding between the SA
that the BU arrived on and the home address? Was
this discussed? 

I'm not criticizing the desicion here, just trying
to understand it -- though I am a little worried
about unintended consequences of changing IPsec's
selector mechanism. It would seem that this also
implies that mobility is not the final stage of
processing which strikes me as odd since mobility
is a routing construct, but I'm willing to be
dissuaded of that notion.

This strikes me as a pretty deep question which
needs to be weighed carefully.

	     Mike