Subject: [mobile-ip] Comment on ha-ipsec-02.txt

From: "Greg O'Shea" <[email-masked]>
Date: Thu, 23 Jan 2003 17:22:50 -0000

I note that sections 2.1 and 5.1 still do not allow tunnel mode IPSec
between MN and HA. I thought we had agreed that tunnel mode was okay,
given that you need it elsewhere anyway.

-----Original Message-----
From: Vijay Devarapalli [mailto:[email-masked]] 
Sent: 31 October 2002 18:44
To: Greg O'Shea
Cc: [email-masked]
Subject: Re: [mobile-ip] Mipv6-ha-ipsec

hi Greg,

thanks for the comments.

> Greg O'Shea wrote:
> 
> 
> 1) Sect 5.1 shows ESP after HAO. This would appear to be incorrect if 
> MN and HA are using tunnel mode to protect their BU/BA - or that 
> configuration not allowed for some reason?

tunnel mode SA results in a 40 byte IPv6 hdr, which is 16 bytes more
than the 24 bytes for destination options header containing HAO.

but you are right. somebody could still use tunnel mode ESP SA to send
MN - HA BUs. we shouldnt prohibit that.

---

From: "Greg O'Shea" <[email-masked]>
Date: Fri, 31 Jan 2003 09:20:30 -0000

Section 2.1 uses "MUST have at least" which is not the same as the "MUST
support at least" used at end of Section 1. It would be better if "MUST
support at least" were used throughout.

Tunnel mode is necessary for 2.2 and could be used for protecting the
MN-HA BU if 2.1 didn't require transport instead. My personal experience
has been that IPSec is not easy to configure (manually) for MIPv6 even
on very small scale so I am worried about making the IPSec config any
more complex than necessary.

Greg
>From: Francis Dupont [mailto:[email-masked]] 
>Sent: 30 January 2003 09:32
>To: Greg O'Shea
>Cc: Vijay Devarapalli; [email-masked]
>Subject: Re: [mobile-ip] Comment on ha-ipsec-02.txt 
>
>
> In your previous mail you wrote:
>
>   I would like to agree but colleagues keep pointing out that 
>the words
>   say:
>   "...the BUs sent by it to the home agent MUST have at least the
>   following headers in the following order:" [2.1]
>   
>   The order is wrong for tunnel mode, so some additional text 
>is needed in
>   order to permit tunnel mode e.g. using the packet format already
>   described in 2.2.
>   
>=> the tunnel mode has not to be permitted because it is not 
>forbidden... I interpret your concern as the context where the 
>MUST applies should be clearer (i.e., as usual the wording is 
>not clear enough)?
>
>Regards
>
>[email-masked]
>
>PS: there is an explicit agrement between the authors to 
>restrict the main text to the options which "MUST be supported".
>