Subject: Re: [MOBILE-IP] comment on IKE in Mobile IPv6

From: Richard Draves <[email-masked]>
Date: Mon, 18 Dec 2000 11:09:56 -0800

> > I don't understand how your scenario would arise. Typically
> when mobile node
> > A tries to contact mobile node B, it would do a lookup of
> some kind (say
> > DNS) that would return mobile node B's home address. So the
> first IKE packet
> > would be sent from A's care-of address to B's home address.
>
> It seems that there is no problem with first IKE packet sent from A.
> But how about other IKE packets?
>
> When A receives an IKE response packet from B in response to the first
> packet, the source address of the received packet is B's care-of
> address, according to the current MIPv6 specification.

I don't read section 10.2 of the specification that way. The spec talks
about mobile node and correspondent node. In this scenario, B is the
correspondent node and so the requirement to use a care-of source address
does not apply to B. Once an IKE negotiation is started with a
source/destination address pair, I think it would continue to completion
using the same source/destination.

> Then, there are two choices on the destination address of the second
> or thereafter IKE packets sent from A to B: B's care-of address and
> B's home address.
>
> In the first choice, there is the double movement issue that I
> mentioned.
>
> In the second choice, there is no double movement issue, however, I
> don't think the use of B's care-of address (as the source address of
> the IKE response packet from B) makes sence, bacause A never uses it.
> This also makes me wonder why not using the home address as the source
> address (seen by the application level) of IKE packets between a
> mobile node and a correspondent node.

There is a strong desire for a mobile node to contact a correspondent node
and communicate using the mobile's home address, without ever involving the
home agent, if the correspondent node can accept a Binding Update.

Once nodes A & B have established communication and sent each other Binding
Updates, then there is a possibility that future IKE negotiations (for
example when an SA times out and a new SA must be created) between the two
could use their respective care-of addresses. To avoid the double movement
problem, the node initiating the negotiation (eg, node A) should fall back
to using a home address instead of a care-of address for the other party
(eg, node B), if the negotation times out.

Rich

---

From: Mohan Parthasarathy <[email-masked]>
Date: Mon, 18 Dec 2000 12:37:48 -0800

> >
> > > However, consider the case in which a mobile node is performing IKE
> > > with a correspondent node which is also a mobile node.
> > >
> > > If care-of address is used as the Source Address for packets carrying
> > > IKE messages without using Mobile IP, the packets may not be delivered
> > > if both nodes change their care-of addresses at the same time.
> > >
> > > So I think at least Mobile IP should be used for IKE between a mobile
> > > node and a correspondent node (and the mobile node and correspondent
> > > node should not perform IKE before the mobile node is successfully
> > > registered to its Home Agent.)
> >
> > I don't understand how your scenario would arise. Typically when mobile node
> > A tries to contact mobile node B, it would do a lookup of some kind (say
> > DNS) that would return mobile node B's home address. So the first IKE packet
Section 10.2 does not talk about what you use for the destination address
in the IKE packets. So, it could be the Care of address of the CN.
Thus, the first packets also have the same problem.

-mohan

> Yoshihiro Ohba