Subject: RE: [NSIS] NATFW NSLP; attack in Section 5.10.1 is not specific to NATs

From: "Hancock, Robert" <[email-masked]>
Date: Wed, 3 May 2006 09:59:40 +0100

hi,

> -----Original Message-----
> From: Hannes Tschofenig [mailto:[email-masked]] 
> Sent: 30 April 2006 19:45
> To: Ali Fessi
> Cc: Hancock, Robert; nsis
> Subject: Re: [NSIS] NATFW NSLP; attack in Section 5.10.1 is 
> not specific to NATs
> 
> 
> Hi Ali,
> 
> there is no big motivation behind the mentioned scenario. It 
> is just an 
> end host behind a NAT that moves around and uses the NATFW 
> NSLP protocol 
> for NAT and Firewall signaling. This end host needs to update its NAT 
> binding to continue to receive the data traffic at the new 
> care-of-address.
> 
> For some reason you got jumped to mobility protocols.

possibly the use of terms like 'care-of-address' (and the section 
title "Misuse of mobility in NAT handling) provided that hint :-)

there are two issues:

- the description of the scenario in terms of an address change
behind the NAT is confusing

- but in any case, the fact that the address is changing looks like
it is irrelevant. all we care about is that one node should not be
able to signal on behalf of another under these circumstances.

r.

> 
> We, however, need to ensure that the text does not give you a wrong 
> impression.
> 
> Ciao
> Hannes
> 
> 
> Ali Fessi wrote:
> > Hi again,
> > 
> > Ali Fessi wrote:
> > 
> >> Hi Robert,
> >>
> >> Hancock, Robert wrote:
> >>
> >>> hi,
> >>>
> >>> [this is not really a follow up to Ali's question but another
> >>> issue on 5.10:]
> >>>
> >>> I found at least the introduction of the scenario in 5.10 
> a little 
> >>> difficult to follow from a motivational point of view.
> >>> How common is it for IP layer mobility to be used purely on the 
> >>> private side of a NAT? (I'm not saying that it's impossible,
> >>> just that I tend to think of NATs as reducing the need for
> >>> renumbering in small networks, where you wouldn't use IP
> >>> mobility in the first place.)
> >>
> >>
> >>
> >> i'm not an expert in mobility; but i think, if Hierarchical MIP is 
> >> used, then the HMIP anchor point would basically behaves 
> as a NAT. So 
> >> the scenario described in this section would fit well to HMIP.
> >>
> >> Maybe someone else can provide a better explanation?!
> > 
> > 
> > i've just thought about it a bit more.
> > 
> > the setup with HMIP is similar; but with HMIP there is no 
> need for NSIS 
> > NATFW NSLP. Instead, Mobile Nodes send their Mobile IP 
> "Binding Updates" 
> > straightforward to the HMIP anchor point.
> > 
> > So, the motivation for scenario 5.10 is still unclear.
> > 
> > Cheers,
> > Ali
> > 
> > 
> > 
> --------------------------------------------------------------
> ----------
> > 
> > _______________________________________________
> > nsis mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/nsis
> 
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis