Subject: RE: [mobile-ip] 3 pairs of IPSec SA for MN/HA signaling protectio n

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 14 Oct 2002 21:29:43 +0200

> As per current draft of IPSec in MIPv6, 3 pairs of IPSec
  > SAs are needed for MN/HA signaling protection, plus another
  > pair, though optional, for payload packets.
  > 
  > I see that these many SAs are the natural outcome of
  > applying IPSec to MIPv6, but the number of 3 pair of 
  > SAs sounds clumsy.

  > 
  > IMHO, when using IPSec to protect MN/HA signaling, we
  > should tailor aggressively ( instead of fine tune )
  > IPSec to let it work smoothly with MIPv6.

=> Do you have an alternative?

Hesham

---

From: Wenxiao He <[email-masked]>
Date: Mon, 14 Oct 2002 16:13:39 -0700

> => Do you have an alternative?

Literally speaking, IPSec has a SPD entry with 5 tuple
( src, dst, protocal, srcport, dstport ) as selector,
and uses the 5 tuple in IP packet to match the selector
in a SPD entry. IPSec works when everybody follows this
same rule, and it will still work if everybody agrees
to follow a different rule ( specifically for MIPv6,
maybe ).

An alternative could be something like this:
* Have a virtual protocol, say MIPv6_MN_HA_SIGNALING,
  for MIPv6/IPSec SPD entry, and for key nogotiation ( IKE ).
* Instead of using the 5 tuple from IP packet to match
  an SPD entry, first use a translating function to map from
  original 5 tuple ( from IP packet ) to a new 5 tuple,
  and then use the new 5 tuple to match SPD entry.
  This translating function only kicks in when the
  packet is MIPv6 MN/HA signaling packet, and of course
  uses the virtual MIPv6_MN_HA_SIGNALING protocol in the new 5 tuple.

-- 
Wenxiao He