Re: MOBIKE and MIP6 (was RE: Preliminary minutes from the WG last week)

Hi Vidya,

I think you should continue on the thread on
the MIP6 mailing list. I don't think we should
repeat arguments on two lists.

Vijay 

> -----Original Message-----
> From: Narayanan, Vidya [mailto:[email protected]] 
> Sent: Monday, April 03, 2006 9:00 PM
> To: James Kempf; Vijay Devarapalli; gabriel montenegro; Yaron 
> Sheffer; Paul Hoffman
> Cc: [email protected]
> Subject: MOBIKE and MIP6 (was RE: [Mobike] Preliminary 
> minutes from the WG last week)
> 
> All,
> Just catching up with this discussion - I do think that the 
> MOBIKE-MIP6
> interactions need more detail. I recap a gist of what I posted on the
> MIP6 list on this topic (for those of you on both lists, I 
> apologize for
> the repeat): 
> 
> There are two cases with respect to MOBIKE and MIP6: 
> 
> 1. MOBIKE (or IKEv2) and MIP6 have different endpoints - i.e., MOBIKE
> between MN and VPN GW, MIP6 between MN and HA
> 
> This is a valid model and has applicability in some markets 
> (where data
> needs to be protected using IPsec in a VPN-over-MIP model). This would
> be a reason to write a draft similar to the MIP4-MOBIKE one. I'm not
> sure if there is a need to do the draft on this yet though (let the
> users of those markets ask for it?). 
> 
> 2. MOBIKE (or IKEv2) and MIP6 endpoints are the same - i.e., both run
> between the MN and HA 
> 
> In this model, the scope of the IKEv2 SA is important to 
> decide whether
> MOBIKE or the 'K' bit in MIP6 is used to update the IP address of the
> SA. A few different cases to look at here: 
> 
> a. The IKEv2 SA is used to create IPsec SAs solely for MIP6 signaling
> protection
> 
> b. The IKEv2 SA is used to create child SAs for applications 
> other than
> MIP6 (e.g., SIP, data traffic protection, etc.)
> 
> C. The IPsec SA created from the IKEv2 SA protects more than just MIP6
> signaling (i.e., the same IPsec SA protects SIP, etc.)
> 
> In the case of a, it might be acceptable to let the 'K' bit do the
> address update for IKEv2. For b and c, the fact that the 
> IKEv2 and IPsec
> SAs have an applicability that is broader than MIP6 says that MIP6
> should not be updating those SAs. I think we would be 
> shortsighted to go
> the route of using MIP6 in place of MOBIKE there - meshing MIP6 and
> IKEv2 in those cases seems an architectural limitation waiting to be
> unraveled. 
> 
> Vidya
> 
> 
> > -----Original Message-----
> > From: [email protected] 
> > [mailto:[email protected]] On Behalf Of James Kempf
> > Sent: Monday, April 03, 2006 1:52 PM
> > To: Vijay Devarapalli; gabriel montenegro; Yaron Sheffer; 
> Paul Hoffman
> > Cc: [email protected]
> > Subject: Re: [Mobike] Preliminary minutes from the WG last week
> > 
> > OK, Vijay, I get the point. You don't think there is an 
> > issue. I do. We disagree.
> > 
> >             jak
> > 
> > ----- Original Message -----
> > From: "Vijay Devarapalli" <[email protected]>
> > To: "James Kempf" <[email protected]>; "gabriel montenegro" 
> > <[email protected]>; "Yaron Sheffer" 
> > <[email protected]>; "Paul Hoffman" <[email protected]>
> > Cc: <[email protected]>
> > Sent: Monday, April 03, 2006 1:41 PM
> > Subject: RE: [Mobike] Preliminary minutes from the WG last week
> > 
> > 
> > 
> > 
> > > -----Original Message-----
> > > From: James Kempf [mailto:[email protected]]
> > > Sent: Monday, April 03, 2006 1:34 PM
> > > To: Vijay Devarapalli; gabriel montenegro; Yaron Sheffer; 
> > Paul Hoffman
> > > Cc: [email protected]
> > > Subject: Re: [Mobike] Preliminary minutes from the WG last week
> > >
> > > For example, listing cases where MOBIKE works with MIP
> > 
> > Jim, let me know if you have a specific
> > scenario in mind and if you see an issue.
> > 
> > also please lookup RFC 4093. it is a
> > problem statement for VPN traversal with
> > MIPv4.
> > 
> > > and
> > > where not. And
> > > what to do with route optimization.
> > 
> > what about route optimization?
> > 
> > Vijay
> > 
> > >
> > >             jak
> > >
> > > ----- Original Message ----- 
> > > From: "Vijay Devarapalli" <[email protected]>
> > > To: "James Kempf" <[email protected]>; "gabriel montenegro"
> > > <[email protected]>; "Yaron Sheffer"
> > > <[email protected]>; "Paul Hoffman" <[email protected]>
> > > Cc: <[email protected]>
> > > Sent: Monday, April 03, 2006 1:14 PM
> > > Subject: RE: [Mobike] Preliminary minutes from the WG last week
> > >
> > >
> > > > I really think this needs further investigation, particularly
> > > > in light of
> > > > the MIP6 transition work.
> > >
> > > sure. but I don't see an issue. what are we
> > > going to investigate?
> > >
> > > Vijay
> > >
> > > >
> > > >                 jak
> > > >
> > > >
> > > > ----- Original Message ----- 
> > > > From: "Vijay Devarapalli" <[email protected]>
> > > > To: "gabriel montenegro" <[email protected]>;
> > > > "James Kempf"
> > > > <[email protected]>; "Yaron Sheffer"
> > > > <[email protected]>; "Paul
> > > > Hoffman" <[email protected]>
> > > > Cc: <[email protected]>
> > > > Sent: Monday, April 03, 2006 12:23 PM
> > > > Subject: RE: [Mobike] Preliminary minutes from the WG last week
> > > >
> > > >
> > > >
> > > > > I'm confused. In the 3GPP2 solution
> > > > > (draft-ietf-mip4-mobike-connectivity-00)
> > > > > MOBIKE is not used between MN-HA, right? The separation is:
> > > > >
> > > > > between MN-HA: mipv4 tunnel
> > > > > between MN and VPN gateway: mobike+IPsec
> > > >
> > > > right.
> > > >
> > > > > Are you folks saying that the above is wrong/discouraged?
> > > >
> > > > nope. thats *a* solution for a network where
> > > > there is a trusted network and an untrusted
> > > > network with a MIPv4 HA inside the trusted
> > > > network and a VPN GW in the DMZ.
> > > >
> > > > > Or are you saying that it is wrong/discouraged *only* if the
> > > > > MN-HA is a MIP6/IPsec
> > > > > tunnel?
> > > >
> > > > whats discourage is running MOBIKE and
> > > > MIP6/IPsec tunnel to the same box. thats my
> > > > personal opinion anyway.
> > > >
> > > > Vijay
> > > >
> > > > >
> > > > >
> > > > > -gabriel
> > > > >
> > > > > --- Vijay Devarapalli <[email protected]> wrote:
> > > > >
> > > > > > hi Jim,
> > > > > >
> > > > > > with Mobile IPv6, one can create an IPsec
> > > > > > protected Mobile IP tunnel between the mobile
> > > > > > node and the home agent. further, the binding
> > > > > > update is used as a trigger to update the IKE
> > > > > > SA too. so Mobile IPv6 provides a solution
> > > > > > similar to MOBIKE already. so that's why I don't
> > > > > > expect someone to use the two together between
> > > > > > the mobile node and the home agent.
> > > > > >
> > > > > > Mobile IPv4 does not use IPsec and is a very
> > > > > > different protocol.
> > > > > >
> > > > > > Vijay
> > > > > >
> > > > > > ps: FYI, the solution described in
> > > > > > draft-ietf-mip4-mobike-connectivity-00 has
> > > > > > been adopted by 3GPP2 for their 3GPP2-WLAN
> > > > > > interworking solution.
> > > > > >
> > > > > > > -----Original Message-----
> > > > > > > From: [email protected]
> > > > > > > [mailto:[email protected]] On Behalf Of 
> > James Kempf
> > > > > > > Sent: Monday, April 03, 2006 9:41 AM
> > > > > > > To: Yaron Sheffer; 'Paul Hoffman'; [email protected]
> > > > > > > Subject: Re: [Mobike] Preliminary minutes from the WG
> > > last week
> > > > > > >
> > > > > > > Yaron,
> > > > > > >
> > > > > > > Thanx for sending out pointers to these.
> > > > > > >
> > > > > > > In the MIP6 group, there was some discussion 
> about this, and
> > > > > > > the message
> > > > > > > that came up was, in fact, "don't do it". I'll post
> > > > > > > references to these
> > > > > > > drafts to the MIP6 list.
> > > > > > >
> > > > > > >             jak
> > > > > > >
> > > > > > > ----- Original Message ----- 
> > > > > > > From: "Yaron Sheffer" <[email protected]>
> > > > > > > To: "'Paul Hoffman'" <[email protected]>;
> > > > > <[email protected]>
> > > > > > > Sent: Sunday, April 02, 2006 3:38 AM
> > > > > > > Subject: Re: [Mobike] Preliminary minutes from the WG
> > > last week
> > > > > > >
> > > > > > >
> > > > > > > > Regarding the combination of MOBIKE and Mobile IP, there
> > > > > > > are 3 current
> > > > > > > > drafts in MIP4 that deal with this:
> > > > > > > >
> > > > > > > > - draft-ietf-mip4-vpn-problem-solution-02 (this one is
> > > > > pre-MOBIKE)
> > > > > > > > - draft-ietf-mip4-mobike-connectivity-00
> > > > > > > > - draft-meghana-mip4-mobike-optimizations-00
> > > > > > > >
> > > > > > > > So it's a stretch to say "don't do" MOBIKE and Mobile
> > > > > IP together.
> > > > > > > >
> > > > > > > > Yaron
> > > > > > > >
> > > > > > > > -----Original Message-----
> > > > > > > > From: Paul Hoffman [mailto:[email protected]]
> > > > > > > > Sent: Wednesday, March 29, 2006 5:49
> > > > > > > > To: [email protected]
> > > > > > > > Subject: [Mobike] Preliminary minutes from the WG 
> > last week
> > > > > > > >
> > > > > > > > Please let me know if you have any changes.
> > > > > > > >
> > > > > > > > MOBIKE WG minutes
> > > > > > > > IETF 65
> > > > > > > >
> > > > > > > > [deleted]
> > > > > > > >
> > > > > > > > James Kempf - discussion in Mobile IP group - 
> what happens
> > > > > > > if you try to
> > > > > > > > use Mobile IP and MOBIKE together? Some people believe
> > > > > the answer is
> > > > > > > > "don't do that". May need an informational 
> draft (as a new
> > > > > > > work item) to
> > > > > > > > address that.
> > > > > > > >
> > > > > > > > [deleted]
> > > > > > > >
> > > > > > > >
> > > > > > > > _______________________________________________
> > > > > > > > Mobike mailing list
> > > > > > > > [email protected]
> > > > > > > > https://www.machshav.com/mailman/listinfo.cgi/mobike
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > _______________________________________________
> > > > > > > Mobike mailing list
> > > > > > > [email protected]
> > > > > > > https://www.machshav.com/mailman/listinfo.cgi/mobike
> > > > > > >
> > > > > > _______________________________________________
> > > > > > Mobike mailing list
> > > > > > [email protected]
> > > > > > https://www.machshav.com/mailman/listinfo.cgi/mobike
> > > > > >
> > > > >
> > > > >
> > > > > __________________________________________________
> > > > > Do You Yahoo!?
> > > > > Tired of spam?  Yahoo! Mail has the best spam 
> protection around
> > > > > http://mail.yahoo.com
> > > > >
> > > >
> > > >
> > > > _______________________________________________
> > > > Mobike mailing list
> > > > [email protected]
> > > > https://www.machshav.com/mailman/listinfo.cgi/mobike
> > > >
> > >
> > >
> > >
> > 
> > 
> > _______________________________________________
> > Mobike mailing list
> > [email protected]
> > https://www.machshav.com/mailman/listinfo.cgi/mobike
> > 
>