Subject: Re: [MOBILE-IP] IPv6 Mobility Last Call Question

From: Patrik Flykt <[email-masked]>
Date: Mon, 8 May 2000 13:18:38 +0300

Hello,

> I would like, at the protocol level, to
> force the traffic to be tunneled back to the
> corporation, concurrently with disabling sending BUs
> to CNs.

Actually, since there has been a lot of interest in adding optimized routing
to MIPv4, why would you try to remove it from MIPv6 ??

> In addition, would the WG like to add the
> option to let the CoR do reverse tunneling, just
> to save radio resources? That is good for V4,
> I think that would be even better for V6, as the header
> size is quite bigger.

The radio resource saving is a general concern, not a MIP specific thing.
Therefore it should be attacked by using header compression. The FA in MIPv4
is there mainly as an care-of address distributor, which is not needed in
MIPv6 anymore since we have address autoconfiguration.

> Another item for discussion is:
> How much is acceptable for a corporation
> that a mobile node uses an IP address topologically
> not belonging to the corporate net when sending packets as it is
> away from home but still logically part of the corporate
> network? Does it make corporate security policies enforcement
> more complex? do we have any V6 firewall expert to provide help?

I'm neither a firewall nor a security gateway expert, but IMHO I think this
is solved by having the Mobile Node apply the corporate security policies
for every sent and received datagram. I also thing this is an IPsec issue
irrelevant if MIP is used or not. I agree that MNs tend to move somewhat
more than hosts leasing addresses with DHCP, which is why this issue pops up
when MIP is discussed.

> I also think that mobile IP could require its own special
> things, since I'm not sure that granting network access
> would automatically be associated to granting mobility support

Why not? There is nothing in the visited network that needs to be involved
in MIPv6. Besides, the MN could be protecting its Binding Updates to the HA
also with ESP, meaning that there is no way for the visited network to know
what the MN is sending anyway.

I think most of your concerns could be addressed by proper configuration of
Binding Update sending, VPN, header compression, etc. after/prior to the
MIPv6 stack has been activated.

> services. The allocation of HA may be subject to
> authorization? Opinions?

It's true that HA leasing needs authorization. Perhaps there is some input
to both of the IPv6+AAA drafts here ?

Regards,

        Patrik

---

From: "[email-masked]" <[email-masked]>
Date: Mon, 8 May 2000 05:26:48 -0700

> more than hosts leasing addresses with DHCP, which is why this issue pops up

I would argue that it is impossible for a corporate network for remotely
enforce their policies on a mobile node. This is especially true if I own the
mobile node :).

Seriously corporate networks will expect that their "road warrior" are
subjected to the same policies as their fixed terminals. This is sad, but
true, and has nothing to do with IPsec, per say, unless you are stating that
they could simply tunnel to the corporate network. However, I would like to
add that there are MANY corporate networks that would prefer NOT to let the
Mobile decide that it must initiate a tunnel in order to be subjected to
policies. I could easily envision someone, myself as an example, simply
ignoring the IPsec portion, and start using the 'net. Of course, getting
access to internal resources may be very difficult :)

So, I guess what I am saying is that network/IS managers will expect to have
*some* over the Mobile Nodes that THEY authorize access for. This is REALLY
sad, and certainly is against everything I believe in, but unfortunately true.

PatC