Subject: RE: [mobile-ip] MIPv6 IPSEc and s=0

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 13 Jan 2003 16:36:45 -0800

Jari,

Though i am really in favor of (d), i am okay with (b) also. But i had
one question below.

> 
> Jari Arkko wrote:
> 
> > (b) Warn the administrators of this issue in the document,
> >     require an administrative procedure to prevent this.
> >     + Easy to do
> >     - Admins might be missing this check
> >     - Makes the configuration task a bit harder (and it already is
> >       hard)
> 
> Here's some potential text for this alternative. Comments
> appreciated. Which alternative do folks want to pick? I'm
> leaning on (b) myself at this hour, given that if interface
> identifier collisions are allowed to develop, we have more
> serious problems that just security: its hard for the colliding
> mobile nodes to get any service due to link-local DAD checks.
> 
> The text is expected to be added after the second paragraph
> in Section 5.2 [1]:
> 
>     "Note that when the Single Address Only (S) bit has been
>      set to zero, bindings for several home addresses may be
>      affected, all with the same interface identifier. Only one
>      of these addresses appears in the packet, however, and the
>      IPsec policy checks are based on that address. Such checks
>      are therefore unable to verify that the correct security
>      association was used, had the address been one of the other
>      ones. For this reason (and in order to avoid Duplicate Address
>      Detection conflicts), home agents SHOULD NOT be
>      configured to serve different mobile nodes with the
>      same interface identifier.
Ok.
>      Instead, it is recommended
>      that the for each mobile node, security associations
>      are configured to the same node for all combinations of
>      available home subnet prefixes and the node's interface
>      identifier(s).
I am not sure i understand this statement. You recommendation was to
check for IID collisions. You still have one SA per MN bound to just one
home address. This seems to suggest have more than one SA assuming i am
reading it correctly. Could you clarify ?

>Home agent implementations MAY provide
>      automated support for ensuring the consistency of
>      the configuration setup."
> 
> Jari
> ----
> 
-mohan

> [1] 
> http://www.piuha.net/~jarkko/publications/mipv6/drafts/mobilev
6.html#securing-regs-with-home-agents

---

From: Jari Arkko <[email-masked]>
Date: Tue, 14 Jan 2003 09:09:09 +0200

> reading it correctly. Could you clarify ?

Looking at the text now, I should change "Instead" to "Additionally",
since the check and the creation of multiple SAs are not alternatives.
The intention was just to say that when you configure a new
mobile node, you should set up all the possible SAs for it at
the same time. If there are no IID collisions, these SAs will be
unique.

Jari