Subject: Re: [MOBILE-IP] Private addressing reference in rfc2002-bis ?

From: Petri Bernhard <[email-masked]>
Date: Thu, 2 Mar 2000 11:02:05 +0100

Hi Gabriel,

my proposal wasn't to take oui's as another name space. Instead, I think,
the basic question is whether to solve the handling of private IP addresses
in Mobile IP by a kind of dns/nai-like solution or by something more
directly related to the IP level itself. NAIs are currently used for
authentication and identification purposes, and  by using them, you can
benefit from the existing DNS infrastructure. However,  I currently don't
see yet, how they could efficiently be inserted into every IP packet, e.g.
between FA and HA (the HA somehow has to find the realm, a private IP
address received in an IP packet belongs to). I would be very interested in
your ideas about this.

With regard to your questions on OUIs and realms, please note that not the
OUI, but the whole VPN-ID (= OUI + index value, see RFC 2685) would be used
to identify an IP address realm. This allows for various possibile uses or
allocation algorithms, e.g.:

- a big company runs its own corporate network, and uses one or more private
address realms. In this case, the company may use its own OUI, and may
allocate various identifiers for the particular realms
- small companies may use the services of a network operator or service
provider. If they use a private addressing realm, they may retrieve an index
value from their operator or service provider
- there's also the possibility that IANA acts as a neutral source for the
allocation realm-IDs based on IANA's own OUI (0x00-00-5E). Although this is
just a single OUI, it would allow IANA to allocate as much realm-IDs as we
currently have IP addresses (4 byte value).

Your suggestion to use AS numbers for the VPN-ID, and its implication of
having one VPN-ID / realm ID per AS domain, was also discussed in the ION
group at that time. The agreed format of the VPN-ID somehow reflects a
compromise on this. While most people want to have their VPN-IDs / realm-IDs
to be independent from the specific BGP-4 protocol domains, some in fact
wanted to have 1 realm-ID per BGP-4 domain. The latter was the reason for
the extension of the initial 3-octet index value (as in current MAC
addresses) to 4-octets; this allows to sub-structure the index-values for a
particular OUI into: 2-octet ASN + 2 octet ASN-specific index value.

Looking forward to some more talks on this in Adelaide

Kind regards
- Bernhard

Bernhard Petri, Siemens
Tel: +49 89 722-34578
Fax: +49 89 722-29098
[email-masked]
______________________________

> -----Original Message-----
> From: Gabriel Montenegro [SMTP:[email-masked]]
> Sent: Saturday, February 26, 2000 1:59 AM
> To:   Petri Bernhard
> Cc:   'Gabriel Montenegro'; [email-masked];
> [email-masked]'
> Subject:      RE: [MOBILE-IP] Private addressing reference in rfc2002-bis
> ?
>
> interesting, thanks for the pointer to the vpn-id stuff.
> hmmm... oui's are another name space...
>
> what i like about realm names is that there is no extra
> administration overhead and they are already used within the
> nai. from rfc2486 (nai):
>
>    This document defines a new namespace that will need to be
>    administered, namely the NAI realm namespace. In order to to avoid
>    creating any new administrative procedures, administration of the NAI
>    realm namespace will piggyback on the administration of the DNS
>    namespace.
>
>    NAI realm names are required to be unique and the rights to use a
>    given NAI realm for roaming purposes are obtained coincident with
>    acquiring the rights to use a particular fully qualified domain name
>    (FQDN).  Those wishing to use an NAI realm name should first acquire
>    the rights to use the corresponding FQDN. Using an NAI realm without
>    ownership of the corresponding FQDN creates the possibility of
>    conflict and therefore is to be discouraged.
>
> also, what is the oui for the root realm?
>
> not all realms will map to a unique oui. in order to specify different
> realms (for example for small/informal/impromptu/soho), owners of oui's
> might
> have to get in the business of further administering the subsequent
> 4 byte octet index value in the vpn-id, to avoid collisions. it gets
> messy, specially because the small network operators (driving forces
> behind nats and rsip applications) now have to ask a much larger
> corporation (large enough to own an oui) to allocate some vpn-id
> space for them. perhaps oui's work best at the high-end, with large
> corporations and ISP's. not sure they're a good easy thing to use
> for smaller networks, where a DNS domain name may be simpler.
>
> by the way, if the idea is to use a fixed size binary representation
> for a "vpn-id", did the ion working group consider
>
> in addition to this:
>
>       3 octet oui + 4 octet index value
>
> this?:
>
>       2 octet ASN (autonomous system number) + 4 octet index value
>
> saves you one byte, but most importantly, it reuses stuff that's
> already needed as a precondition to getting on the internet.
> seems like both oui and asn variations could be useful.
>
> regards,
>
> -gabriel