Subject: [MOBILE-IP] [Fwd: [MOBILE-IP] Comment Please: Placement for Home Address option header]

From: AIme Le-Rouzic <[email-masked]>
Date: Thu, 9 Nov 2000 14:49:04 +0100

Subject: Re: [MOBILE-IP] Comment Please: Placement for Home Address option header
From: AIme Le-Rouzic <[email-masked]>
To: Charlie Perkins <[email-masked]>
Cc: [email-masked]
Date: Thu, 09 Nov 2000 14:48:02 +0100

Hi,

We are experimenting  MobileIPv6 plus IPSec on AIX with a firewall able
to process MobileIPv6 users.

Our conclusion is that the Home Address Option  MUST stay in front of
the ESP header to allow firewall to control those packets and so allow
users, securizing their datas with ESP, to keep their access when they
are outside as though they are at home by allowing the firewall
to do control on the home address.

By not allowing that to the users will kill MobileIPv6 .

Charlie Perkins wrote:
>
> Hello,
>
> I'm trying to follow up on some discussion a few days ago
> about this point.  The last indication I received was that a
> node receiving a packet with an ESP header should be
> able to decrypt the payload using only the SPI and the
> destination IPv6 address.  I had always thought that the
> receiving node would want to use the mobile node's home
> address to select the correct security association.  Recent
> messages indicate that other implementations do not use
> that information; then they presumably do not use the
> IPv6 source address at all when identifying the correct
> security association.
>
> This is a crucial point, and a decision should be made ASAP.
>
> There seem to be two additional relevant points:
>
> - We should pick a placement for the Home Address option,
>    and make it mandatory.  Doing so will simplify the implementation
>    for all the billions of correspondent nodes of the future.  We want
>    that implementation to be as simple as possible.  The two
>    candidate placements are either after ESP, possibly in the
>    same options header as the Binding Update, or else before
>    the Fragment Header.
>
> - Putting the information after ESP will make things substantially
>    more complicated for possible firewall management.
>
> Based on this evidence, I am leaning towards a mandatory placement
> before the Fragment Header.  As soon as I can determine consensus
> on this point, I am ready to issue a revised (and hopefully last)
> Internet Draft for Mobile IPv6.
>
> Thanks for your comments!
>
> Regards,
> Charlie P.