Subject: Re: [Pana] Resolution to Issue 161

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 2 May 2005 18:51:47 -0700

Yoshi,

Sorry for the delay..i was a bit hasty in my last response..

> 
> Actually I am not talking about NAT case.  I am talking about the case
> where a non-link-local PRPA is used by the PaC to communicate with an
> off-link PAA.  My basic question is: which address should the PaC be
> used as IPsec-TOA in this case for IPsec SA between the PaC and the EP
> which is on-link, the (non-link-local) PRPA or a link-local address?
> 
Ok, now i understand what you are talking about.

The PRPA has to be non-link-local for IPv6 mhop case. And the same PRPA
will be communicated to the PAA as device-identifier.  The device-identifier
will be communicated to the EP which will be used as outer address of
the tunnel. Hence, IPsec-TOA can't be the link-local address for mhop PANA
case.  This means, we need following clarifications.

1) PRPA address need not be a link-local address always (i don't remember what
    the framework document says today).

2) IPsec-TOA address need not be a link-local address. The ipsec document
    does not restrict the IPsec-TOA to be a link-local address. I can clarify this.

Makes sense ?

-mohan

> Yoshihiro Ohba
> 
> On Mon, Apr 25, 2005 at 06:12:33PM -0700, Mohan Parthasarathy wrote:
> > I don't assume NAT in the ipv6 case :-) 
> > 
> > -mohan
> > 
> > ----- Original Message ----- 
> > From: "Yoshihiro Ohba" <[email-masked]>
> > To: "Mohan Parthasarathy" <[email-masked]>
> > Cc: <[email-masked]>
> > Sent: Friday, April 22, 2005 3:39 PM
> > Subject: Re: [Pana] Resolution to Issue 161
> > 
> > 
> > > Hi Mohan,
> > > 
> > > On Wed, Apr 20, 2005 at 04:07:34PM -0700, Mohan Parthasarathy wrote:
> > > > Issue 161 refers to changes required in Pana-ipsec draft for mhop changes.
> > > > 
> > > > Change section 5 first line FROM:
> > > > 
> > > >    If the network chooses IPsec to secure the link between the PaC and  
> > > >    EP, the PAA should communicate the IKE pre-shared key (Pac-EP Master  
> > > >    Key), Key-Id, PRPA of the PaC, and the session-Id to the EP before  
> > > >    the IKE exchange begins.
> > > > 
> > > > TO:
> > > > 
> > > >    If the network chooses IPsec to secure the link between the PaC and  
> > > >    EP, the PAA should communicate the IKE pre-shared key (Pac-EP Master  
> > > >    Key), Key-Id, the device identifer of the PaC, and the session-Id to the EP before  
> > > >    the IKE exchange begins. 
> > > 
> > > In IPv6 mhop case, the PaC would need to use a non-link-local address
> > > as PRPA (and the device identifier) to communicate with the PAA.  As a
> > > result, the PaC's device identifer installed to the EP will be the
> > > non-local address.  On the other hand, a link-local address is used as
> > > IPsec-TOA for IPv6 according to pana-framework and pana-ipsec drafts.
> > > 
> > > I mean:
> > > 
> > > IPsec-TOA (link-local) != DI (== non-link-local PRPA), for IPv6 mhop PANA.
> > > 
> > > Do you see an issue here?  Should the PaC use non-link-local PRPA as
> > > IPsec-TOA?
> > > 
> > > Yoshihiro Ohba
> > > 
> > > 
> > > 
> > > > 
> > > > Comments ?
> > > > 
> > > > -mohan
> > > > 
> > > > 
> > > > _______________________________________________
> > > > Pana mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/pana
> > > 
> > > _______________________________________________
> > > Pana mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 04 May 2005 00:48:03 -0400

Hi Mohan,

>     the framework document says today).

This is already reflected to the latest pana-framework snapshot.

>     does not restrict the IPsec-TOA to be a link-local address. I can clarify this.

Good.

> Makes sense ?

Yes, it makes sense to me.

Yoshihiro Ohba