Subject: RE: [mobile-ip] MIPv6: simpler IPSec config

From: "Mohan Parthasarathy" <[email-masked]>
Date: Wed, 26 Mar 2003 09:14:47 -0800

Greg,

You may still want to use transport mode for packets destined to
Home Agent itself. At least to conform to the wire-format described
in the MN-HA Ipsec draft. So, I think you can have just one
rule for transport mode on the MN : <HoA, HA, *, TRAN>

-mohan

> 
> HA-IPSec.txt appears to specify the following SPD states per 
> HoA, where <A,B,C,D> mean <loc-addr, rem-addr, proto, mode>:
> 
> On the MN
> ---------
> <HoA, HA,     MH, TRAN>  // BU-BA ref 2.1, 4.2.1.
> <HoA,  *,     MH, TUNN>  // HoT(i) ref 2.2, 4.2.2
> <HoA, HA, ICMPv6, TRAN>  // Prefix discovery, 2.3, 4.2.3
> <HoA,  *,      *, TUNN>  // Secure (reverse) tunnel, 2.4, 4.2.4
> 
> On the HA
> ---------
> <HA, HoA,     MH, TRAN>  // BU-BA ref 2.1, 4.2.1.
> < *, HoA,     MH, TUNN>  // HoT(i) ref 2.2, 4.2.2
> <HA, HoA, ICMPv6, TRAN>  // Prefix discovery, 2.3, 4.2.3
> < *, HoA,      *, TUNN>  // Secure (reverse) tunnel, 2.4, 4.2.4
> 
> But in each case the last (lowest precedence) rule covers and 
> protects all the traffic of the three rules that precede it, 
> so apparently we can safely delete the first three rules from 
> each set, yielding:
> <HoA,   *, *, TUNN>      // On the MN.
> <  *, HoA, *, TUNN>      // On the HA.
> 
> Why won't that do?
> 
> Greg
> 
> 
>

---

From: "Greg O'Shea" <[email-masked]>
Date: Wed, 26 Mar 2003 17:58:27 -0000

>P.S. One problem in your config setup may be that the 
>hot/payload SPD entries are specifically for the virtual 
>tunnel interface between the home agent and the mobile node, 
>while the BUs are strictly speaking not sent to that tunnel.

Text that assumes a virtual tunnel interface between HA and MN is
suspect; there may not be one.