Subject: Re: [MOBILE-IP] comment on IKE in Mobile IPv6

From: Richard Draves <[email-masked]>
Date: Fri, 15 Dec 2000 14:31:15 -0800

> However, consider the case in which a mobile node is performing IKE
> with a correspondent node which is also a mobile node.
>
> If care-of address is used as the Source Address for packets carrying
> IKE messages without using Mobile IP, the packets may not be delivered
> if both nodes change their care-of addresses at the same time.
>
> So I think at least Mobile IP should be used for IKE between a mobile
> node and a correspondent node (and the mobile node and correspondent
> node should not perform IKE before the mobile node is successfully
> registered to its Home Agent.)

I don't understand how your scenario would arise. Typically when mobile node
A tries to contact mobile node B, it would do a lookup of some kind (say
DNS) that would return mobile node B's home address. So the first IKE packet
would be sent from A's care-of address to B's home address.

Rich

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 18 Dec 2000 12:48:57 -0500

From: Richard Draves <[email-masked]>
Subject: RE: [MOBILE-IP] comment on IKE in Mobile IPv6
Date: Fri, 15 Dec 2000 14:31:15 -0800

> would be sent from A's care-of address to B's home address.

It seems that there is no problem with first IKE packet sent from A.
But how about other IKE packets?

When A receives an IKE response packet from B in response to the first
packet, the source address of the received packet is B's care-of
address, according to the current MIPv6 specification.

Then, there are two choices on the destination address of the second
or thereafter IKE packets sent from A to B: B's care-of address and
B's home address.

In the first choice, there is the double movement issue that I
mentioned.

In the second choice, there is no double movement issue, however, I
don't think the use of B's care-of address (as the source address of
the IKE response packet from B) makes sence, bacause A never uses it.
This also makes me wonder why not using the home address as the source
address (seen by the application level) of IKE packets between a
mobile node and a correspondent node.

Yoshihiro Ohba

---

From: Francis Dupont <[email-masked]>
Date: Tue, 19 Dec 2000 17:55:10 +0100

In your previous mail you wrote:

=> there is no difference for other packets.

=> no, B uses the same address than in A first packet. Only the initiator
can use its care-of address, the responder will use its home address.

[email-masked]

---

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 19 Dec 2000 14:43:01 -0500

From: Francis Dupont <[email-masked]>
Subject: Re: [MOBILE-IP] comment on IKE in Mobile IPv6
Date: Tue, 19 Dec 2000 17:55:10 +0100

> [email-masked]

How about if the responder is also a mobile node?

I could not read the section 10.2 as allowing the use of home address
for IKE packets sent from the mobile responder.

    -  The mobile node MUST use its care-of address as the Source
       Address of all packets it sends as part of the key management
       protocol (without use of Mobile IP for these packets, as
       suggested in Section 10.1).

Yoshihiro Ohba

---

From: Francis Dupont <[email-masked]>
Date: Wed, 20 Dec 2000 09:45:17 +0100

=> this is for the case the mobile node has the choice of its source address,
ie. when it is the initiator. When you are the responder, you must use
the same address than the destination of the first packet. IKE is not
different from other applications...

---

From: Mohan Parthasarathy <[email-masked]>
Date: Wed, 20 Dec 2000 10:13:16 -0800

> different from other applications...
Yes, it is no different. But what mandates the destination address to
be the Home address always ? For example, MN's SA expire, bindings
are valid and while neogotiating the SA, it could be the Care of
address of the CN if it is mobile.

-mohan

---

From: Francis Dupont <[email-masked]>
Date: Thu, 21 Dec 2000 10:22:29 +0100

In your previous mail you wrote:

   > IKE is not different from other applications...

   Yes, it is no different. But what mandates the destination address to
   be the Home address always ?

=> nothing but the binding cache is transparent for any common applications
so the home address will always be used.

   For example, MN's SA expire, bindings are valid and while
   neogotiating the SA, it could be the Care of address of the CN if it
   is mobile.

=> it will be the home address from the IKE point of view (and the packet
will be sent with a routing header via the care-of address).

Regards