Re: does mobike support end-to-end use of tunnel mode?

[email protected] wrote:

>In host-to-host IPsec use, either your addresses are static 
>(so you don't have that big need for MOBIKE), or your PAD is not 
>configured appropriately -- or you're doing something like BTNS.
>
>To take a concrete example: suppose my laptop wants to establish 
>an IPsec SA with my local mail server.  Assuming some kind of 
>corporate PKI, the laptop could create an IKE_SA, authenticate the 
>mail server, and authenticate itself as "pasi-dot-eronen-at-
>nokia-dot-com" (or "laptop-123456-at-nokia-dot-com").
>
>But there's practically no way the mail server's PAD would contain
>child SA authorization data saying that "pasi-dot-..  is allowed to
>create IPsec SAs with traffic selectors matching address
>192.0.2.123", since the address came from DHCP...
>
>So either creating the IPsec SA fails, or the PAD contains data
>saying "pasi-dot-... (and all other employees) are allowed to create
>SAs for practically any address" (or at least addresses they can
>spoof).  The latter is not exactly very secure... but that's what 
>some people are using anyway (sort of like BTNS).
>
>The "Experiences with Host-to-Host IPsec" paper by Tuomas Aura,
>Michael Roe, and Anish Mohammed (try Google for PDF) describes
>this and many other issues with host-to-host IPsec in detail.
>  
>
Right. Thanks for the reference, I hadn't seen that before.

--Jari