Subject: [mobile-ip] MIPv6: simpler IPSec config

From: "Greg O'Shea" <[email-masked]>
Date: Wed, 26 Mar 2003 13:14:54 -0000

HA-IPSec.txt appears to specify the following SPD states per HoA, where
<A,B,C,D> mean <loc-addr, rem-addr, proto, mode>:

On the MN
---------
<HoA, HA,     MH, TRAN>  // BU-BA ref 2.1, 4.2.1.
<HoA,  *,     MH, TUNN>  // HoT(i) ref 2.2, 4.2.2
<HoA, HA, ICMPv6, TRAN>  // Prefix discovery, 2.3, 4.2.3
<HoA,  *,      *, TUNN>  // Secure (reverse) tunnel, 2.4, 4.2.4

On the HA
---------
<HA, HoA,     MH, TRAN>  // BU-BA ref 2.1, 4.2.1.
< *, HoA,     MH, TUNN>  // HoT(i) ref 2.2, 4.2.2
<HA, HoA, ICMPv6, TRAN>  // Prefix discovery, 2.3, 4.2.3
< *, HoA,      *, TUNN>  // Secure (reverse) tunnel, 2.4, 4.2.4

But in each case the last (lowest precedence) rule covers and protects
all the traffic of the three rules that precede it, so apparently we can
safely delete the first three rules from each set, yielding:
<HoA,   *, *, TUNN>      // On the MN.
<  *, HoA, *, TUNN>      // On the HA.

Why won't that do?

Greg

---

From: Jari Arkko <[email-masked]>
Date: Wed, 26 Mar 2003 15:36:40 +0200

> Why won't that do?

Maybe it does. Remember that we are not preventing you
from doing this configuration, as long as you support also
the one in the draft.

Jari

P.S. One problem in your config setup may be that the hot/payload
SPD entries are specifically for the virtual tunnel
interface between the home agent and the mobile node,
while the BUs are strictly speaking not sent to that
tunnel.

---

From: "Ed Remmell" <[email-masked]>
Date: Wed, 26 Mar 2003 07:53:52 -0800

Jari -

Could the BUs that the MN sends to the HA be tunneled? I know that both the
inner and outer tunnel headers would have the same destination IP address in
this case (that of the home agent), but I think the protocol should support
it. This could make for a slightly more simplified implementation.

Thanks.
- Ed

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Jari Arkko
> Sent: Wednesday, March 26, 2003 5:37 AM
> To: Greg O'Shea
> Cc: [email-masked]
> Subject: Re: [mobile-ip] MIPv6: simpler IPSec config
>
>
> Greg O'Shea wrote:
>
> > Why won't that do?
>

---

From: Wenxiao He <[email-masked]>
Date: Thu, 27 Mar 2003 14:29:50 -0800

> <  *, HoA, *, TUNN>      // On the HA.

My observation on the effect of the suggestion vs. current draft:
1) BU/BA and ICMPv6 are now tunneled from MN to HA.
   Well, I dont see a problem going with the end-to-end IPSec tunnel.
2) The last (lowest precedence) rule is optinal in the draft.
   The presence of this rule forces payload packets to be
   IPSec tunneled to HA.
3) When MN is back home, the hoti and payload will be IPSec
   tunneled to HA. However, the draft wants them in cleartext
   and send directly to CN.

-- 
Wenxiao He