Subject: Re: [MOBILE-IP] Private addressing reference in rfc2002-bis ?

From: Samita Chakrabarti <[email-masked]>
Date: Thu, 10 Feb 2000 11:22:53 -0800

Gabriel,
Sorry for the delayed reply.

> by the way, i've submitted the rfc2344-bis draft. if you want
> to get it before the announcement comes out, you can get it
> at:
>
>   http://playground.sun.com/~gab/papers/tunnel.txt
>
> (the only changes are new section 6.3 and an appendix).

Thanks, it has clarified several issues of private address
support associated with reverse tunnel. Especially the simple
case when we have global HA address and global FA addresses
and private MN address space.

> > It seems logical to me that 'P' bit with agent advertisement
> > can let the privately addressed mobile node choose the right FA
> > -- but it may have other implications--any particular reasons
> > against it ?
>
> but the 'P' bit (or overloaded 'T' bit) does not answer this question:
>
>       what COA should the MN used for registration?
>
> notice that the COA may very well be a function of the MN's home
> address: for MN's within the FA's domain the COA is probably
> an 'inside' address of the FA. for MN's with home addresses outside
> the FA's domain, perhaps an 'external' COA makes more sense.

If FA advertises two different COA's for private address support,
then it seems the MN implementation will also need to change to
take into account when to use which COA. Perhaps MNs needs to know
that it's using a private address space and then process the agent
advertisement accordingly.

>
> how are these two different coa's advertised and kept apart? perhaps
> a new  private addr extension could carry
> pairs along these lines:
>
>       nai, coa
>
>       or
>
>       dns authority, coa
>
> given the first element of the pair, an mn would be in a position to select
> the right coa it needs to use.
>

Folks seem to like the nai extension idea.

> the private addr extension need not be included in all advertisements. upon hearing a 'P' bit,
> the mn could solicit with a special code, say in order to obtain the priv
> addr extension.
>

I like this idea. Although I am not quite clear on the idea about the home agent
advertisement. If a HA has one side public net and private net on the other side,
then what address would it advertise on the private side ? Do we assume that
the private addressed MNs never come back home and they are pre-configured to
use HA's global address ? On the other hand if HA advertises private address on
it's private net, then we assume that MNs are intelligent enough  to figure out
which home agent address to use when they are away from home.

Thanks,
-Samita

---

From: Gabriel Montenegro <[email-masked]>
Date: Thu, 24 Feb 2000 14:26:54 -0800

[kind words about rfc2344bis appendix elided (thanks!)...]

> advertisement accordingly.

in general, this is very hard to do, because the problem is not
whether one device is using a "private" address space, but if two
address spaces are incongruent
in any way such that communication between their address spaces
is not transparent as per rfc2775:

   ..."transparency" refers to the original
   Internet concept of a single universal logical addressing scheme, and
   the mechanisms by which packets may flow from source to destination
   essentially unaltered.

there are too many ways transparency breaks (see 2775), it would be extremely
hard or impossible for the mobile node to look at the fa's address
and know if that belongs to another address space. sometimes you
cannot know other than looking at routing tables. sometimes, you'll
have to examine the dns (split dns), etc.

> Folks seem to like the nai extension idea.

i've been thinking about this in the context of rsip and of
rfc2344bis and i am more and more convinced that what we need
is almost there but not quite. what we don't need is the nai.
the nai (rfc2486) was designed for and is suitable to identify users
and roaming devices to the network (e.g. "user@realm").

what we need is for the network to qualify itself to the users
or roaming devices (e.g. by providing a "realm identifier").
at first thought, it
would seem like this is nothing but the "realm" as defined
in rfc2486 (nai).  whereas mn's and users
may use nai's to identify themselves, network elements like
fa's, routers, network access servers could conceivably
use "realm indicators" to indicate what address space
or realm they provide access to.

so a "realm" as in the nai is almost it, but we still need
a human readable ascii label (or do we?) for the root realm
(sometimes referred to as the public internet).

this root domain has several representations in section 3.1
of rfc1034:

   binary: null label
        'null (i.e., zero length) label used for the root'

   ascii: " "
        'For example, A.B.C.D is a subdomain of B.C.D, C.D, D, and " "'

   ascii: "."
        'The most common interpretation uses the root "." '

given that an absolute or rooted fqdn (from which the "realm" in the
nai derives) terminates with a "." (e.g. "domain.com."), then
perhaps that could be used as the ascii representation of
the root realm, specially given the precedent shown above.
the ABNF for a "realm indicator" (ri) could simply be:

   realm-indicator  = realm / "."

   realm            = <from network access identifier (rfc2486)>

a general "private address" extension might need to indicate
what ri an agent address belongs to (home agent or care-of
address):

        coa, ri

> I like this idea. Although I am not quite clear on the idea about the home
> agent advertisement. If a HA has one side public net and private net on the
> other side, then what address would it advertise on the private side ? Do we
> assume that  the private addressed MNs never come back home and they are
> pre-configured to use HA's global address ? On the other hand if HA
> advertises private address on it's private net, then we assume that MNs are
> intelligent enough  to figure out which home agent address to use when they
> are away from home.

a multihomed device with one interface on the "public internet"
could advertise more than one coa/ri pair, for example:

        ipaddr1, "domain.com."
        ipaddr2, "."

a cursory glance might indicate that the above is similar to the
use of point code and network indicator in section 3.2.2 of:

http://search.ietf.org/internet-drafts/draft-coene-ss7-over-ip-00.txt

but i really don't understand ss7.
just some random thoughts...

-gabriel