Subject: RE: [mobile-ip] Comment on ha-ipsec-02.txt

From: "Greg O'Shea" <[email-masked]>
Date: Thu, 23 Jan 2003 17:36:39 -0000

In which case the BA in sect 2.1 and 5.3+ will look like this:
  IP(HA,CoA),ESP,IP(HA,HoA),MH

>-----Original Message-----
>From: Greg O'Shea [mailto:[email-masked]] 
>Sent: 23 January 2003 17:23
>To: [email-masked]
>Subject: [mobile-ip] Comment on ha-ipsec-02.txt
>
>
>I note that sections 2.1 and 5.1 still do not allow tunnel 
>mode IPSec between MN and HA. I thought we had agreed that 
>tunnel mode was okay, given that you need it elsewhere anyway.
>
>-----Original Message-----
>From: Vijay Devarapalli [mailto:[email-masked]] 
>Sent: 31 October 2002 18:44
>To: Greg O'Shea
>Cc: [email-masked]
>Subject: Re: [mobile-ip] Mipv6-ha-ipsec
>
>
>hi Greg,
>
>thanks for the comments.
>
>> Greg O'Shea wrote:
>> 
>> 
>> 1) Sect 5.1 shows ESP after HAO. This would appear to be incorrect if
>> MN and HA are using tunnel mode to protect their BU/BA - or that 
>> configuration not allowed for some reason?
>
>tunnel mode SA results in a 40 byte IPv6 hdr, which is 16 
>bytes more than the 24 bytes for destination options header 
>containing HAO.
>
>but you are right. somebody could still use tunnel mode ESP SA 
>to send MN - HA BUs. we shouldnt prohibit that.
>
>
>

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 23 Jan 2003 11:07:23 -0800

> >tunnel mode was okay, given that you need it elsewhere anyway.

this was dicussed between some of us. it was felt that
specifying too many different options is very confusing.
even now the ha-mn-ipsec draft is already 45 pages.

but there is nothing in the spec which prohibits tunnel
mode IPsec between MN and HA. it is still possible to
use tunnel mode IPsec. the spec only says that packet 
formats in section 2 MUST be supported.

Vijay