Subject: [nemo] Comments on draft-wakikawa-mip6-nemo-haha-00.txt

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 22 Oct 2003 18:22:17 +0200

Hello to authors of draft-wakikawa-mip6-nemo-haha-00.txt available at
http://www.mobilenetworks.org/nemo/drafts/draft-wakikawa-mip6-nemo-haha-00.txt

Here are some comments on the draft.  Please take them as comments only.

The whole idea of having an inter-HA protocol (HAHA) for HA's _not_ on
the same link seems valuable from several standpoints, most importantly
for redundancy.  The presentation of the mechanisms makes sense and
covers a large set of scenarios; thanks for writing it.

However, I have doubts with respect to motivating the use of these
mechanisms in order to help with RO; and also doubting about where to
target these mechanisms: MIP6 or NEMO.

> Sometimes the Mobile Network could be closer to the Correspondent 
> Node than the Home Agent.  If the Mobile Router could pick another 
> Home Agent closer to its current location, the tunneling overhead on
>  every packet could be reduced to a much shorter path in the
> Internet.

In order to have important gains from reducing the path length of the
path on which encapsulation happens, it is implicit that they are
proportional with the distance between HA's.  The farther apart are the
HA's placed, the better gains in terms of having a shorter path over
which encapsulation is needed.  Otherwise, if HA's are close, why bother
for two-three short links.

But the farther distanced the HA's are placed, the more difficult it is
for them to advertise the same Home Address (or MNP) without disturbing
the routing in the overall Internet.

> Multiple Home Agents could be located on different links and still 
> serve the same home prefix.

I think that if they are located on different links (IP subnets) then
they will have difficulty to advertise reachability to a same Home
Address (or same MNP).  If these home links are relatively close to each
other, as to form an IGP area, then adertising reachability towards the
same Home Address (or MNP) is indeed feasible, and OSPF does that.  If
however these home links are in different domains (separated by e.g.
BGP) then I doubt these HA's can effectively advertise reachability of
the same Home Address (or MNP).  No?

> When multiple Home Agents are configured at different links, each 
> home agent is expected to know the other Home Agents beforehand and 
> establishes Security Association with them for a secure path towards 
> the other home agent.

I wonder how this could be done, to have a set of HA's scattered in the
Internet and have SA's among them, do you have a specific tool in mind?

> But each Home Agent can not listen Router Advertisements sent by the 
> other Home Agents configured at different link, because Router 
> Advertisements can not be sent over the link-local scope.
                      ^^^
Maybe "RAs can _only_ be sent over a ll scope"?  YEs, the overall
cause-effect makes sense, just maybe the "not" is wrong.

> The Home Agent Solicitation message MUST NOT be multicasted

Why not?  I understand that RA's can not be multicasted on other scope
than link, but why forbidding HAS being multicasted on a wider scope?
It would be good to multicast the HAS especially if there are many HAs
in this "HA multicast group".

> The Home Agent initiated switching is useful for load-sharing of each
>  Home Agents.  A Home Agent can control the load average by moving 
> some of Mobile Routers to other Home Agents compulsory.

"compulsory"?  Maybe "compulsorily"?, just a thought...

> When a Home Agent receives a Binding Update from a Mobile Router and
>  processes the Binding Update successfully, it enables route 
> distribution for the mobile network prefixes.

So HA receives a completely unknown MNP in a BU and redistributes it to
the Internet?  How is HA confident about MR not attacking the Internet?

> Each Home Agent advertises the same home prefix to the Internet.

How far are the HA's from each other and how far do those home prefixes
propagate to the Internet?

> On the other hand, if the Home Agent does not enable forwarding for 
> the Home Address and the mobile network prefixes, it tunnels 
> intercepted packets to the primary Home Agent (Fig 2) first.

If the HA does not enable forwarding for that Home Address, then how it
obtained packets addressed to that Home Address in first place?  I agree
that if HA obtains those packets, it then forwards them to the primary
HA, and that's a good idea, but how does it "intercept" those packets in
first place if it does not forward for that Home Address?

> One specific advantage of not relying on a Home Link for HAHA 
> communication is that for a large configuration, the Home Agents can
>  be organized hierarchically and distributed geographically, as a set
>  of local clusters linked together to form a global Home Network.

I think this explanation is very important to motivate the need of HAHA
previously described.  I think this picture should be given somewhere at
the beginning of the document, instead of at the appendix.

Still, if we consider a very wide-area network (inter-continental) as
described above, then HAHA can work only if the longest links between
the clusters are L2 links (say ATM or sattelite or fiber, your choice),
and are very short in terms of number of IP hops.  One can not imagine
that two HAs advertising same MNP are separated by BGP-served zones,
because dynamically inducing new routes might pose problems in terms of
routing table size (or so they say).

And, once we assume that those HAs are only a few IP hops apart (even if
over inter-continental lengths) then Mobile IP per se brings in little
advantage.  Just use OSPF  in this small domain (small in terms of IP
hops, but large in terms of physical distance) and suddenly
encapsulation problems and RO problems disappear.

And finally, thank you for providing the concepts in this draft, the
mechanisms of binding synchronization and so on make sense, the messages
are described in bit-detail (few drafts do) and looking forward for your
comments,

Alex
GBU

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 22 Oct 2003 10:26:12 -0700

> target these mechanisms: MIP6 or NEMO.

it is definitely not intended to be a substitute for Route
Optimization. we will add an explicit statement to that
effect in the next version of the draft.

> the same Home Address (or MNP).  No?

this is an open issue. I believe that even if the Home Agents
are on different links serving the same set of home prefixes,
they still have to belong to the same Autonomous System. they
are not in different domains. Pascal might have something
different to say here.

> 
>> When multiple Home Agents are configured at different links, each home 
>> agent is expected to know the other Home Agents beforehand and 

thats easy. they are part of the same domain. they can just
run IKE to negotiate the keys. or some admin can manually
setup IPsec SAs.

> the Internet?  How is HA confident about MR not attacking the Internet?

HA has to verify if the Mobile Router is authorized for a
particular MNP. I prefer doing this check always.

> first place if it does not forward for that Home Address?

it just said "if the Home Agent does not enable forwarding...."
it didnt say "the Home Agent does not advertise reachability
for the MNP...".

> the clusters are L2 links (say ATM or sattelite or fiber, your choice),

what about IP-in-IP tunnels between the HA clusters?

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 22 Oct 2003 10:26:12 -0700

Vijay

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 22 Oct 2003 19:47:00 +0200

Vijay Devarapalli wrote:
>> mechanisms in order to help with RO; and also doubting about where 
>> to target these mechanisms: MIP6 or NEMO.
> 
> Optimization. we will add an explicit statement to that effect in the
>  next version of the draft.

Ok, so I retain as problem only "tunnelling overhead on every packet
could be reduced to a much shorter path in the Internet".

>> I think that if they are located on different links (IP subnets) 
>> then they will have difficulty to advertise reachability to a same
>>  Home Address (or same MNP).  If these home links are relatively 
>> close to each other, as to form an IGP area, then adertising 
>> reachability towards the same Home Address (or MNP) is indeed 
>> feasible, and OSPF does that.  If however these home links are in 
>> different domains (separated by e.g. BGP) then I doubt these HA's 
>> can effectively advertise reachability of the same Home Address (or
>>  MNP).  No?
> 
> 
> this is an open issue.

Well said.

> I believe that even if the Home Agents are on different links serving
>  the same set of home prefixes, they still have to belong to the same
>  Autonomous System. they are not in different domains. Pascal might 
> have something different to say here.

Ok.

>> I wonder how this could be done, to have a set of HA's scattered in
>>  the Internet and have SA's among them, do you have a specific tool
>>  in mind?
> 
> thats easy. they are part of the same domain. they can just run IKE 
> to negotiate the keys. or some admin can manually setup IPsec SAs.

Ok, so again you rely on HA's being in the same domain; and if yes then
IKE could be used.

>>> On the other hand, if the Home Agent does not enable forwarding 
>>> for the Home Address and the mobile network prefixes, it tunnels
>> If the HA does not enable forwarding for that Home Address, then 
>> how it obtained packets addressed to that Home Address in first 
>> place?  I agree that if HA obtains those packets, it then forwards
>>  them to the primary HA, and that's a good idea, but how does it 
>> "intercept" those packets in first place if it does not forward for
>>  that Home Address?
> 
> 
> it just said "if the Home Agent does not enable forwarding...." it 
> didnt say "the Home Agent does not advertise reachability for the 
> MNP...".

It said "it does not enable forwarding for the Home Address", no MNP.
Forwarding for a Home Address can only happen if there is forwarding for
some prefix, or host-based route, but it is still forwarding for a Home
Address.

>>> communication is that for a large configuration, the Home Agents
>>>  can be organized hierarchically and distributed geographically,
>>>  as a set of local clusters linked together to form a global Home
>>>  Network.
>> 
>> 
>> 
>> I think this explanation is very important to motivate the need of
>>  HAHA previously described.  I think this picture should be given 
>> somewhere at the beginning of the document, instead of at the 
>> appendix.
>> 
>> Still, if we consider a very wide-area network (inter-continental)
>>  as described above, then HAHA can work only if the longest links 
>> between the clusters are L2 links (say ATM or sattelite or fiber, 
>> your choice),
> 
> 

Coming back to the first statement, which says that this HAHA is not
about RO, it is implicitely about reducing the length of the path on
which packets travel encapsulated.  What?  There is always a level of
encapsulation between HA clusters with IP-in-IP tunnels?

So, even if there is no tunnel between MH and its primary HA (there is
only encapsulation between MH and its local HA) but then there is a
level of encapsulation between the HA's anyways, so what is it gained?

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 22 Oct 2003 19:47:00 +0200

Well said.

Ok.

Alex
GBU

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 22 Oct 2003 11:01:40 -0700

Alexandru Petrescu wrote:

>>> If the HA does not enable forwarding for that Home Address, then how 
>>> it obtained packets addressed to that Home Address in first place?  I 
>>> agree that if HA obtains those packets, it then forwards

needs to be fixed. but I guess you understood what it intends
to say. each Home Agent can either tunnel the packets directly
to the Mobile Router's current point of attachment or to the
primary HA.

>>> somewhere at the beginning of the document, instead of at the appendix.
>>>

think of a fat pipe between the HA clusters.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 22 Oct 2003 11:01:40 -0700

Vijay

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 22 Oct 2003 20:34:26 +0200

> to the Mobile Router's current point of attachment or to the

Yes I got that.

I reacted on it because it seemed the only point in the text to mention 
a little bit that HA's will not always advertise reachability of same 
HoA.  But now that you say that it is a common thread of the entire HAHA 
draft that all HA's are _inside_ a unique small domain (even if spread 
over a wide geographical area) then I understand it.

> think of a fat pipe between the HA clusters.

YEs, fat but very distant from the CN.  The HAHA domain being very small 
in terms of IP hops it can not be close to any IP CN of the Internet 
(even if it _could be_ close geographically).  There can surely be no 
big fat pipe close to all CNs of the Internet, because there are so many.

No?

Alex
GBU

---

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 22 Oct 2003 20:34:26 +0200

Yes I got that.

No?

Alex
GBU