Subject: Re: [MOBILE-IP] draft-ietf-mobileip-ipv6-09

From: Vipul Gupta <[email-masked]>
Date: Mon, 7 Feb 2000 10:28:07 -0800

> >1> Draft mention that while transmitting packet if corresponding node's
> >Binding cache has valid care_of_address entry for mobile node's home
> >address then it replaces later by former and append routing header with
> >later as last hop. Do the firewall entertain source routing ??
> >2> Also encapsulated packets from home agent can invade foreign network's
> >firewall. Is that acceptable ??
>
>         mobile-ip6 spec talks almost nothing about firewalls so I assumed that
>         there's no firewall in the picture.
>         I myself am not sure about it.

  Correct, and neither does MIPv4 for that matter. All of them assume
  direct reachability between the home network and foreign networks.
  When there are firewalls present, packets may need to carry
  additional authentication to pass the firewall's checks. The
  paper "Secure Mobile Networking" at

    http://playground.sun.com/pub/mobile-ip/

  talks about enabling MIPv4 through firewalls. You'll notice that
  the same technique is applicable to IPv6 as well.

> >3> While registering primary care_of_address with its home agent mobile
> >node sends either an AH [9] or ESP [10] header providing sender
> >authentication, data integrity protection, and replay protection, via
> >Foreign Agent. Isn't that surrendering your secured data to foreign n/w ??
>
>         I believe there's no foreign agent in mobile-ip6 (page 4 first
>         paragraph).

   True. This is actually a boon. As explained in the above paper,
   not having a foreign agent makes it easier to address security.
   The technique described in the paper requires the use of a
   co-located care-of address. Fortunately, in MIPv6, this is the
   only type of care-of address.

> itojun

  vipul