Subject: Re: [MOBILE-IP] IPv6 user with Foreign Agent CoA!?

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Wed, 29 Nov 2000 02:50:51 +1100

> > > The question is:
> > > Is that a problem, if I receive already decapsulated datagrams, even
> > > if usually I decapsulate them by myself?!
> > >
> > > Clarifications are welcome.
> > >
> >         => Your scenario is supported in draft-ietf-mobileip-hmipv6-02
> >         which will be on the web very soon. I think you'll get the
> answer
> >         you're looking for there.
> >         But as a short answer, no there is no problem because the MN
> >         doesn't think that it moved since it is still sending and
> receiving
> >         packets using its Home address.
>
> The problem is just this:
> I would like the MN to know it moved, so it can update its CNs and its
> Home
> Agent by itself.
>
        => I realise that. That's exactly what the draft allows you to do.
        The MAP option is sent by the Mobile Router (MR), so the MN
        knows that it moved and that the MAP acts as a COA for it.
        The MN will update the HA and the CNs accordingly with an
        alternate-COA as specified in MIPv6. So route optimised
        packets will be received by the MAP (MR) and forwarded
        to the MN. Every thing happens end to end.
        Does that solve your problem ?
        Please see the draft for more info.

        Regards,
        Hesham

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 28 Nov 2000 09:55:02 -0800

Hello,

I think there's another way to look at this problem of
mobile routers that offers a "better" solution.  It isn't
the same problem as has been discussed in connection with
hiearchical mobility agents.  It should not be solved by
techniques associated with hierarchical mobility agents.
Nor anchor points, if I may use that terminology.  A mobile
router should not necessarily be considered an anchor point
or a regional mobility agent.

The reason it is not the same is as follows:

- With hierarchical mobility agents, the mobile node's home
  agent can be shielded from having to know about local
  care-of addresses, as long as it can supply a regional
  care-of address to the home agent and supply local care-of
  addresses to the regional mobility agent.

- With mobile routers, the mobile node "should" be using
  the prefix of a home address of the mobile router as the
  prefix by which it forms its own care-of address.  This
  could be done independently of any sort of hierarchical
  mobility agent architecture.  In other words, there doesn't
  have to be any regional mobility agent at all to make
  a mobile router work.

To see this in another way, suppose that the mobile router
has a fixed Ethernet attached to it.  The nodes on the
"mobile network" do not run Mobile IPv6.  Why should they
deal with any advertised care-of addresses from the mobile
router?

However, this business about mobile routers does bring up
interesting points.  Suppose the mobile node hooks up to
a mobile router, and gets a prefix from the advertisement,
and forms its care-of address.  Packets routed towards that
care-of address are likely to go through the home agent
for the mobile router.  The router's home agent will
encapsulate them.  The mobile router will decapsulate them.
At this point, the packet should be as issued originally
by the correspondent node (with a routing header) or
by the mobile node's home agent (i.e., encapsulated).

Now suppose some corrspondent node is sending megabytes of
data, with each packet having a routing header containing
the mobile node's care-of address.

We would like for that data not to have to go through the
home agent for the mobile router.  That means that the
correspondent node should get information about the care-of
address for the _mobile router_.  Then, the correspondent node
could put in a routing header with _two_ care-of addresses.
The first one would be the care-of address for the mobile
router, and the second one would be the care-of address
for the mobile node.

In order to do this directly, the mobile router would need
some security association with the correspondent node.
This is one area where this problem shows itself to be much
different than the hierarchical mobility agent problem.
For hierarchical mobility agents, there is a natural way
to set up the security associations.  For the mobile router,
the same security setup seems unlikely to work.  I didn't
"map" it out yet, but I reckon some sort of redirect is
the most likely candidate.  The mobile node can authentically
"relay" a redirect from the mobile router to the correspondent
node.  We would have to make some rules about this, but I
think that what the correspondent node would see would be
a Binding Update for the care-of address.  This has already
been specified in another context for smooth handovers.

I sure hope we don't have to do this before Mobile IPv6
completes its Last Call.

Regards,
Charlie P.

---

From: Francis Dupont <[email-masked]>
Date: Tue, 28 Nov 2000 22:07:32 +0100

In your previous mail you wrote:

   I think there's another way to look at this problem of
   mobile routers that offers a "better" solution.

=> mobile routers are an interesting problem (there are many
examples of them, for instance modern planes are LANs with
mobile border routers). After some (private) mail exchanges
with Thierry Ernst (the author of a mobile IPv6 draft) I
believe this will be a place where mobility will interact
with IPsec tunnels, for instance if you use a bidirectional
ESP tunnel between the mobile router and the home agent.

   A mobile router should not necessarily be considered an anchor
   point or a regional mobility agent.

=> I agree, in many cases the nodes behind the mobile router don't
know something is moving. This is both a nice thing and a source
of problems...

=> exactly!

=> there are false ideas about what is the security issue.
In fact for an ordinary correspondent node there is nothing really
different than for mobile IPv6. You can consider that in place
of a request for a binding for a prefix the mobile router can
send on demand a request per nodes behind him...
 This is a bit different for the home agent because you would not
like to deal with mobile nodes and mobile routers the same way,
but this is not an IPsec issue, only an authorization issue
(don't forget that IPsec gives a strong authentication then
the question is do you or don't you permit this router to register
a whole prefix?)

=> when will be able to use Mobile IPv6 as a signaling protocol
for moving an end of a IPsec tunnel the mobile router problem
will have a very simple solution. The only things we need are:
 - a Mobile IPv6 published as an RFC
 - same * <very large prime number>
 - a real status for IPsec tunnels
 - a fix for the outer source address check issue
 - a standard and secure way to update the (outer) address of
   a IPsec tunnel end-point (new PF_KEY message?)

Thanks

[email-masked]

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 29 Nov 2000 11:14:24 +0100

Hello Charlie,

The draft "Mobile Networks Support in Mobile IPv6"
(draft-ernst-mobileip-v6-network-01.txt)
that was just submitted to the IETF actually considers the issues that you
mention in your email...

We would really appreciated your comments on the draft if you have some time to
read it....

regards,
Claude.

PS: you can get the draft at
http://www.inrialpes.fr/planete/people/ernst/Documents/draft-ernst-mobileip-v6-network.txt

--

----------------------------------------
Claude CASTELLUCCIA, INRIA Rhone-Alpes
ph:  +33 4.76.61.52.15 (fax: 52.52)
http://www.inrialpes.fr/planete/