Subject: RE: NAT traversal and its relation to IPv6 [RE: Comments on draft -tsirtsis-dsmip-problem-01.txt]

From: Soliman Hesham <[email-masked]>
Date: Mon, 8 Sep 2003 10:58:19 -0400

>    No, I want Mobile IPv6 to not require its MN-HA tunnel to 
 > be v6-in-v6
 >    but to require it to be either v6-in-v6 or v6-in-v4.
 >    
 > => you can't do that with Mobile IPv6 itself but it is still possible
 > to use an alternative, i.e., something which looks like Mobile IPv6
 > but works for both IP versions. If you wouldn't like to get routing
 > optimization (something a bit hard in this case :-), I suggest the
 > "road warrior" IPsec VPN. But, even if RFC 2401 is clearly for any
 > combination of IP versions, I am afraid that the v6-in-v4 is rarely
 > supported...

=> Francis, 

The IPsec VPN "road warrior" scenario is only applicable
to just those "road warriors". You can certainly extend MIPv6
to _allow_ v6 in v4 tunnels, which is what Alex was asking. 
I don't see why someone who wants seamless roaming and already
has MIP is required to have another IPsec anchor somewhere 
on the Internet. It's not what IPsec is used for and it doesn't
need to be. 

Hesham

 > 
 > Regards
 > 
 > [email-masked]
 >

---

From: Francis Dupont <[email-masked]>
Date: Mon, 08 Sep 2003 17:45:05 +0200

=> Francis, 
   
   The IPsec VPN "road warrior" scenario is only applicable
   to just those "road warriors".

=> I disagree, the only missing pieces are the v6-in-v4 support and
a more friendly processing of handoffs.

   You can certainly extend MIPv6
   to _allow_ v6 in v4 tunnels, which is what Alex was asking. 

=> no, this is not easy at all because MIPv6 doesn't use only tunnels.
You have to introduce IPv4 Care-of addresses and this is a major change.

   I don't see why someone who wants seamless roaming and already
   has MIP is required to have another IPsec anchor

=> not another one, just rename the Home Agent into the Security Gateway.
Note you already have some IPsec between the Mobile Node and its Home
Agent.

   somewhere 
   
=> extra security should not be a problem. The IPsec protection of
all packets through the MN-HA tunnel is already an option, and IMHO
this will be a commonly used option because the initial/last wireless
segment of the path is not known for its security.
   
Regards

PS: note that I suggest IPsec as an example of alternatives. There are
many other ways to manage v6-in-v* tunnels, IPsec is just the standard
one when someone'd like extra security.

---

From: Marc Blanchet <[email-masked]>
Date: Mon, 08 Sep 2003 11:52:22 -0400

to add to this conversation, tunnel broker with tsp does manage v*-in-v*
with security (aaa). if the outer v* address change (i.e. v4 address change
for v6 over v4 tunnels), then the tunnel is automatically re-established
with the broker: "mobility feature". the ipsec need can be handled on the
appropriate IP version.

Marc.

-- lundi, septembre 08, 2003 17:45:05 +0200 Francis Dupont
<[email-masked]> wrote/a ecrit:

>     > => you can't do that with Mobile IPv6 itself but it is still
> possible     > to use an alternative, i.e., something which looks like
> Mobile IPv6     > but works for both IP versions. If you wouldn't like to
> get routing     > optimization (something a bit hard in this case :-), I
> suggest the     > "road warrior" IPsec VPN. But, even if RFC 2401 is
> clearly for any     > combination of IP versions, I am afraid that the
> v6-in-v4 is rarely     > supported...
>    
>    => Francis, 
>    

------------------------------------------
Marc Blanchet
Hexago
tel: +1-418-266-5533x225
------------------------------------------
http://www.freenet6.net: IPv6 connectivity
------------------------------------------

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 09 Sep 2003 14:49:11 +0200

Marc Blanchet wrote:
> to add to this conversation, tunnel broker with tsp does manage 
> v*-in-v* with security (aaa). if the outer v* address change (i.e. v4
>  address change for v6 over v4 tunnels), then the tunnel is 
> automatically re-established with the broker: "mobility feature". the
>  ipsec need can be handled on the appropriate IP version.

The idea to join the Security Gateway into the HA, or the tunnel broker
into the HA can not stand, because the HA performs proxy ND for HoA of
MH when MH is not at home.

The Security Gateway/tunnel brokers is something that lies in the
perimeter buffer secure zone ('DMZ'), while an HA is most of the time
the router towards a link, most often a leaf link.

Alex
GBU

---

From: Francis Dupont <[email-masked]>
Date: Tue, 09 Sep 2003 14:53:41 +0200

=> this is 100% contrary to actual experience: your objection is wrong.

=> in both cases (SG and TB) in fact the mobile node is never at home
so the position of the SG or TB is not a problem at all.

Regards

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 09 Sep 2003 16:15:11 +0200

> => this is 100% contrary to actual experience: your objection is wrong.

Right, and knowing what's wrong is good.

> so the position of the SG or TB is not a problem at all.

Ok.

I think all I wanted to say is, as already known, that if one tries to
use Mobile IPv6 on a mobile terminal on a typical commercial wireless
access network, one often ends up with several levels of encapsulation
which are obviously redundant. Having available several building blocks
(NAT traversal, IPsec tunneling, tunnel broker) that help achieve this
is a good thing. Eliminating some of the encapsulations by touching only
the ends could also be advantageous.

Alex
GBU