Subject: [mobile-ip] MIPv6 IPSec database entries

From: "Greg O'Shea" <[email-masked]>
Date: Wed, 8 Jan 2003 09:21:38 -0000

"As described earlier, the Binding Update and Binding Acknowledgement
   messages require protection between the home agent and the mobile
   node.  These messages and the return routability messages employ the
   same protocol from the point of view of the security policy database,
   the Mobility Header." [10.4.4]
Mobility Header is not an IPSec protocol.

"The security policy database entries MUST be
   defined as if they were specifically for the tunnel interface between
   the mobile node and the home agent.  That is, the policy entries are
   not generally applied on all traffic on the physical interface(s) of
   the nodes, but rather only on traffic that enters the tunnel.  This
   makes use of per-interface security policy database entries [4],
   specific to the tunnel interface (the node's attachment to the
   tunnel [11])." [10.4.4]

Disagree. For example if you look at the IPSec implementation in Windows
XP you'll see that its ESP tunnel do not explicitly go via a tunnel
interface, in which case the existing text doesn't make any sense.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 08 Jan 2003 17:02:38 +0200

> Mobility Header is not an IPSec protocol.

Right. s/same protocol/same payload protocol/.

> interface, in which case the existing text doesn't make any sense.

I believe the text refers to the plain IPv6 encapsulation tunnel
(RFC 2473), not the ESP tunnel. So your IPsec policies apply to
this tunnel interface, but if they actually say 'use ipsec' for
a particular packet then this packet may have to go the ESP tunnel.

Were you concerned due to the above being unclear, or are you
concerned about the reliance on tunnel-specific SPD entries?

Jari