Subject: [netext] Security question on anycast mode of draft-ietf-netext-redirect-01

From: "Laganier, Julien" <[email-masked]>
Date: Wed, 28 Apr 2010 16:15:38 -0700

Hello,

I have a security question on the anycast mode described in Section 1 of the draft:

   o  Support for IPv6 anycast addressing [RFC4291]: the current PMIPv6
      specification does not specify how the PMIPv6 protocol should
      treat anycast addresses assigned to mobility agents.  Although
      [RFC4291] now allows using anycast addresses as source addresses,
      it does not make much sense using anycast addresses for the MAG to
      the LMA communication after the initial PBU/PBA exchange.  For
      example, a blade architecture LMA may appear to the routing system
      as multiple LMAs with separate unicast IP addresses and with one
      or more "grouping" anycast addresses.

I understand from the above that a group of LMA would be addressed with a common anycast address, and the first PBU would be sent to this anycast address, and redirection would follow to one of the unicast addresses of a specific LMA.

If that is correct, I am wondering how will the SA between the MAG and the anycast LMA be looked up?

--julien

---

From: jouni korhonen <[email-masked]>
Date: Fri, 30 Apr 2010 07:16:46 +0300

Hi Julien,

> I understand from the above that a group of LMA would be addressed with a common anycast address, and the first PBU would be sent to this anycast address, and redirection would follow to one of the…

Subsequent PBUs would be sent to a unicast address of a specific LMA.

> If that is correct, I am wondering how will the SA between the MAG and the anycast LMA be looked up?

In the same way as SAs for unicast addresses. If SAs are build for anycast addresses, you basically have to fall back to manual keying of SAs (i.e. multiple LMAs share the same keys etc) and in most cases give up with replay protection (unless LMAs are somehow able to share sequence number state). Other than those, there is no difference to SA configuration or usage compared to the unicast case.

- Jouni

---

From: jouni korhonen <[email-masked]>
Date: Fri, 30 Apr 2010 07:25:57 +0300

Hi Julien,

- Jouni