Subject: RE: [mobile-ip] single IPSec tunnel for HA/MN singling (RE: ha-ipsec-03.txt)

From: "Greg O'Shea" <[email-masked]>
Date: Wed, 26 Feb 2003 16:36:32 -0000

We have touched on this before, more than once in fact, and have
consistently agreed that the draft permits use of tunnel mode for the BU
SA, in which case with the current spec the BU SA *does* move and the
HAO/RH are *inside* the tunnel. I'm happy so long as it stays that way.

Greg O'Shea wrote:
> 
> >
> >I note that sections 2.1 and 5.1 still do not allow tunnel mode IPSec

> >between MN and HA. I thought we had agreed that tunnel mode was okay,

> >given that you need it elsewhere anyway.

this was dicussed between some of us. it was felt that specifying too
many different options is very confusing. even now the ha-mn-ipsec draft
is already 45 pages.

but there is nothing in the spec which prohibits tunnel
mode IPsec between MN and HA. it is still possible to
use tunnel mode IPsec. the spec only says that packet 
formats in section 2 MUST be supported.

Vijay

>-----Original Message-----
>From: Jari Arkko [mailto:[email-masked]] 
>Sent: 26 February 2003 13:25
>To: Wenxiao He
>Cc: Mobile IPv6 mailling list; Francis Dupont
>Subject: Re: [mobile-ip] single IPSec tunnel for HA/MN 
>singling (RE: ha-ipsec-03.txt)
>
>
>Wenxiao He wrote:
>
>> My intention is to merge SAD entries into one, not SPD entries. All 
>> SPD entries are still the same as in ha-ipsec-03.txt, with one 
>> difference that they all point to the same SAD entry.
>
>Ah, I see now better what you are suggesting. It looks
>pretty attractive, the minimization of the number of SAs
>is always useful, even if you use IKE. There may be a
>limited amount of places for SAs in the hardware, for
>instance.
>
>However, I have a few question marks and doubts:
>
>* Movements and care-of address change. In the current
>  spec, the BU SAs are not moved, because the RHs and HAOs
>  are added outside the IPsec encapsulation. Only
>  the RR/payload protection SAs have to be moved.
>
>  With the proposed change the following happens
>  after the first movement from coa1 to coa2. In the
>  initial state, the gateway of the outbound SA in
>  the home agent is coa1. Now, a BU arrives from coa2
>  (which is fine). If the BU is successful, this SA
>  is changed to use coa2, and this is used to carry the
>  BA back to the mobile node.
>
>  However, what if the BU fails for some reason?
>  Currently, the IPsec processing of BAs is independent
>  of the care-of addresses. With the proposed scheme
>  we'd be temporarily using a care-of address X for the
>  BU, and then go back to using the right address.
>
>  Perhaps I'm missing something but I don't see a clean
>  way to do this.
>
>* Its pretty new. Any other suprises? Will IKE be able
>  to request these SAs in a way that the peer knows what
>  is needed? I looked at this and the initial answer is
>  yes, but...
>
>Anyway, I still think that we should keep the document
>as is at this stage even if this is an interesting suggestion. 
>Unless someone's actually tried to this and found it working 
>well, I'm scared to trust it. (But there's nothing that 
>prevents the definition of this scheme as an extension or 
>improvement of the current spec later.)
>
>Jari
>
>

---

From: Jari Arkko <[email-masked]>
Date: Wed, 26 Feb 2003 18:51:16 +0200

> HAO/RH are *inside* the tunnel. I'm happy so long as it stays that way.

It does permit that (though it requires support of the transport
mode format, and uses only the four-SA pair case in the examples).
In other words, you can do what you want but you'll have to
figure out yourself what works and what does not.

Jari