Subject: Re: [MOBILE-IP] Comment Please: Placement for Home Address option header

From: Richard Draves <[email-masked]>
Date: Thu, 9 Nov 2000 22:49:36 -0800

> > - Putting the information after ESP will make things substantially
> >    more complicated for possible firewall management.
>
> ESP might make firewall management more complicated, I won't
> dispute that. But my point is that users & admins should have
> a choice of using AH or ESP. In some environments, the
> appropriate choice might be ESP. In other environments, AH
> might be an appropriate choice.
>
> If the Home Address option follows an AH header, a firewall
> can still find it easily. So if you want to be friendly to
> firewalls, have a policy of using AH. But please don't
> prevent others from using ESP.

Aha, I just got why you want the Home Address before a Fragment header for
firewalls: so they can see the Home Address in every packet even fragments.
Duh. And the Fragment header has to be before the IPsec headers. Since ESP
isn't friendly to firewalls anyway, firewall-friendliness is only a concern
for AH. This means two header orders make sense:
a) IPv6, Home Address, possible Fragment, AH, Binding Update, Transport
b) IPv6, possible Fragment, ESP (auth and/or encryption), Home Address &
Binding Update with CoA suboption, Transport

Rich

---

From: AIme Le-Rouzic <[email-masked]>
Date: Fri, 10 Nov 2000 09:22:50 +0100

> Binding Update with CoA suboption, Transport

 I don't think so, it needs to be friendly with firewalls  having a
policy AH (for BU and BA) and having a policy ESP (for datas).For that
the Home Address header has to be before the security header ESP to
allow firewalls let
the packet goes out or enter.

Home address header has to be seen like an extension of the IPheader.

What's the matter with that because on the other way the routing header
carrying the home address is always before the security header even
using ESP in transport mode.

We need to remember MobileIPv6 will be successful if it allows the user
to protect its datas. The solution has to work when we have the two
security headers in the packet AH +ESP. We need to offer the firewall to
control them at least by the ip address.

Best regards

PS:
Other things , only BU and BA are required to be authenticated. A better
security would be if also RH, HA, BR were recommanded to be
authenticated.

---

From: Francis Dupont <[email-masked]>
Date: Tue, 14 Nov 2000 12:03:20 +0100

In your previous mail you wrote:

=> yes, for IPsec the Home Address MUST only be before the IPsec header(s).
The "before Fragment" is an unexpensive improvement for firewalls.

   for AH.

=> don't joke: this is not an argument! Mobile IPv6 is enough firewall
unfriend (because of its more than two addresses, for instance it makes
ingress filtering hairy) as it is.

 This means two header orders make sense:
   a) IPv6, Home Address, possible Fragment, AH, Binding Update, Transport
   b) IPv6, possible Fragment, ESP (auth and/or encryption), Home Address &
   Binding Update with CoA suboption, Transport

=> b) will fail with many IPsec implementations because the source address
will be wrong (ie. not the home address) at the SA selector check phase.
The easiest way to fix this is simply to mandate a).

Regards

[email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Tue, 14 Nov 2000 12:07:43 +0100

I don't think so, it needs to be friendly with firewalls  having a
   policy AH (for BU and BA) and having a policy ESP (for datas).For that
   the Home Address header has to be before the security header ESP to
   allow firewalls let the packet goes out or enter.

=> in this context (ESP for data protection) the firewall will do
SPI filtering in place of ports filtering (with the suitable policy
both are equivalent, of course this supposes some firewall and IPsec
colaboration but this is the way to make ESP firewall-friendly).

Thanks