Re: does mobike support end-to-end use of tunnel mode?

Erik Nordmark wrote:

>The configuration payload allows the client to suggest an IP address as 
>well as just getting one assigned by the SG. I don't know if that 
>introduces any new issues. But in any case, that isn't a problem 
>introduced by the MOBIKE WG.
>  
>
Right.

>But is there or is there not an issue introduced by the combination of 
>dynamic SG assignment of inner addresses, and MOBIKE changing the outer 
>addresses?
>
>Here is an example:
>
>Alice visits the IETF, get X as the IP address, connects to 
>sg.example.net. The SG allocates A as the inner IP address for Alice.
>
>Alice moves to another network. Gets Y as the IP address and uses MOBIKE 
>to move the SAs from X to Y.
>
>An hour later Bob, who also works at example.net, walks into the IETF 
>and is allocated X as its IP address. Bob connects to sg.example.net and 
>is allocated B as the inner address.
>I assume there is no conflict between Alice's and Bob's SAs on 
>sg.example.net, even though they started with the same outer IP address. 
>Is that assumption correct?
>  
>
I think so. SA identification needs to happen via SPIs, not
addresses. And for the internal addresses, the policies
for accepting inner address proposals have to be so that A != B,
even without MOBIKE.

>---
>
>What happens if it takes a while for Alice to walk to the other network 
>so that things happen in this order:
>1. Alice DHCP lease for the outer address (X) expires
>2. Bob shows up at IETF and is allocated IP address X.
>3. Bob contacts sg.example.net, and the SG still has the SAs for Alice 
>at outer address X. Can Bob setup its SAs? What happens to Alice's SAs 
>at the SG?
>  
>
All of this is fine. Remember that already today we have
to allow a situation where a number of VPN connections
come from the same IP addresses, due to NATs. The SPIs
will be different and the UDP port numbers will be different.
(And when they aren't -- see the appendix in mobike protocol
spec for a warning on how to do your implementation.)

>4. Alice finally arrives at the second network, is allocated IP address 
>Y, and contacts the SG and uses MOBIKE to move its SAs from X to Y. Does 
>this work as well as if Bob hadn't been around?
>  
>
Yes.

>There are variants on the above when Alice is walking even slower so 
>that one or more of these happen before Bob arrives:
>  - The IPsec SAs for Alice on the SG expires
>  
>
This is fine.

>  - The IKE SAs for Alice on the SG expires
>  
>
There's nothing special about this. Alice just has to re-establish
her IKE SA, and then this is already from the new address. Nothing
in this entire process affects the inner addresses.

>  - The "lease" for the dynamically allocated inner address A expires on 
>the SG, thus Bob might accidentally end up reusing both the inner and 
>the outer IP addresses that Alice had.
>  
>
This might be possible, but again, this is an IKEv2 problem. The
lease might expire even if Alice didn't move, and didn't
implement MOBIKE.

--Jari