Subject: RE: [mobile-ip] mobile IPv6 BindingUpdate security

From: <[email-masked]>
Date: Mon, 19 May 2003 11:27:43 -0500

> 
> James Kempf wrote:
> > What about if the HA is the VPN gateway? Does the spec insist that the
> > security associations be host mode?
> 
> You have to support host mode, but it does not outlaw other modes.
> SAs have to be unique for a given home address, however. If someone
> wants to develop a scheme where one tunnel mode SA is used 
> for a number of mobile nodes, I suppose that is possible in the future. 

Alternate mechanisms for MN-HA security are contemplated for future
discussions. The base specfication mandate for an IPsec SA for every
HoA between the MN and HA is fine for now.

> I understand that the HA end of the tunnel can be easily arranged, but I'm not sure
> whether it is possible on the other end.
> 
> --Jari

-Basavaraj