Subject: [mobile-ip] RE: Which Router Address to use for FMIP signaling (was:Re: [mobi le-ip] Fast Handover document revision)

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Wed, 19 Feb 2003 17:36:12 +0100

> I think there is an issue regarding interaction of Seamboy 
 > CARD and FMIPv6. If
 > the MN can learn enough about the next access router using 
 > CARD, then it does
 > not need to know the global address of the next router (and, 
 > by extension, its
 > current router). 

=> ok I guess that issue is being discussed now.

If it knows just the subnet prefix, it can, 
 > for example, use
 > the Subnet-Router Anycast Address (see 
 > draft-ietf-ipngwg-addr-arch-v3-11.txt)
 > which is globally routable. Using this address, anycast 
 > routing can select a
 > router on the subnet to deliver the signaling to, which 
 > might have an advantage
 > for load balancing.

=> Hmm. We would need to make sure this is secure right?
I haven't seen yet (apart from using RR) a mechanism
that can secure communication between a host and an anycast
group. 

Hesham

 > 
 >             jak
 > 
 > 
 > 
 > ----- Original Message -----
 > From: "Hesham Soliman (EAB)" <[email-masked]>
 > To: "'Xiaoming Wang'" <[email-masked]>;
 > <[email-masked]>
 > Sent: Tuesday, February 18, 2003 5:03 PM
 > Subject: RE: [mobile-ip] Fast Handover document revision
 > 
 > 
 > >
 > >  > Maybe my comment is not so clear. I'm sorry for that.
 > >  >
 > >  > Actually in alper's email it was said that:
 > >  > "how the global IPv6 address of the home agent
 > >  > can be conveyed using router advertisements.
 > >  > So, the required feature is already there."
 > >  >
 > >  > From my point of view, the required feature is not already
 > >  > for all access
 > >  > routers since this is not a MUST or SHOULD requirement. For
 > >  > FMIP, it's not
 > >  > enough and cannot be depend on.
 > >  > That's why I made the conclusion in 2).
 > >
 > > => If you think it's needed for FMIPv6 then we can
 > > always make it a should or must in that draft. The
 > > draft requires drastic additions to ARs so there is
 > > no reason why this relatively trivial addition cannot be made.
 > >
 > > Hesha,
 > >
 >

---

From: "James Kempf" <[email-masked]>
Date: Wed, 19 Feb 2003 08:59:16 -0800

> that can secure communication between a host and an anycast

Yes, the security problem doesn't go away. But moving it away from handover
decreases the time constraint. One can either use SEND mechanisms (to be
published shortly) to do preauthentication or AAA/CT to push the security
context to the new router. I'm not sure, however, whether IPsec applies to
anycast addresses. Any IPsec experts know?

Of course, there is the same issue here as with reserving a new care of address
in the new subnet in advance of handover: how to control reserving resources on
the new router and when to drop them.

            jak

---

From: Jari Arkko <[email-masked]>
Date: Wed, 19 Feb 2003 19:19:18 +0200

> anycast addresses. Any IPsec experts know?

Its troublesome, I think. At least if we can't count on the selected
router being the same all the time, which I don't think we can. Manually
keyed IPsec would appear to work (as it does for multicast), but replay
protection would not work, and neither would IKE.

Jari

---

From: "James Kempf" <[email-masked]>
Date: Wed, 19 Feb 2003 09:40:30 -0800

> protection would not work, and neither would IKE.

What about if the SA gets spread around using CT? 

            jak

---

From: Jari Arkko <[email-masked]>
Date: Wed, 19 Feb 2003 21:44:53 +0200

> What about if the SA gets spread around using CT? 

I didn't pay enough attention to the beginning of this
thread to know what the context of the discussion was.
But I assumed anycast would be used to target the set
of routers on a given location, right? There may be
multiple such routers, and over time you also visit
multiple locations. (Feel free to jump in and explain
the real situation here...)

It seems that you then have two separate problems:

(1) How to get an SA to a new location?
(2) How to deal with the possibility that on
     a given location you may have multiple routers,
     and the communication toggles between them?

The first point appears to imply IKE or some sort
of AAA help, maybe context transfer could help as
well. The second point is more fundamental to the
operation of IP and IPsec, and may require manually
keyed IPsec in the current state of the art. (Unless
we'd reuse some of the transforms developed for SEND
in this space too.)

Jari