Re: Mobile IP and Mobike

James Kempf writes:
> > The mobike is targeted to the environments where the other end of the
> > connection is stable, i.e the VPN sgw or similar. The mobile ip both
> > ends can move, and the connection is not necessarely from the mobile
> > node to the sgw to the www-server (for example), but can also go
> > directly between mobile node and www-server.
> >
> 
> I'm not sure I understand. In both cases, presumably the mobile node is
> communicating with a correspondent that is not the intermediate node. In
> both cases, the intermediate node typically isn't moving. The mobile node
> can be moving, but I believe what you are saying is that in the Mobike case,
> the correspondent can't be move, is that it?

In the mobike case the other end of the security association (i.e.
other end of MOBIKE protocol) will typically be corporate SGW. The SGW
will not move (ok, it might have multiple interfaces for
high-availibility use, but it will not be mobile). All the traffic
from using the MOBIKE will go through that tunnel from mobile host to
the SGW, and normally then continues from the SGW to the the host
INSIDE the coporate network. If mobile node wants to connect the some
other host in the internet (like www.cnn.com) it will either not use
MOBIKE and connect to that directly using his normal address (==i.e.
the connection will be broken if the IP address changes unless mobile
ip is used), or it will connect to the corporate firewall through the
SGW and make all packets be routed in both directions through the
tunnel. 

> Actually, I'm not sure I agree. Mobile IP sends a Binding Update through an
> ESP Auth tunnel, and could optionally also use encryption on the tunnel. If
> both are used, and if in addition the Mobile Node uses an ESP Auth + Enc
> tunnel for data traffic, it seems to me that it would be exactly the same as
> for Mobike. Therefore, the Mobike "binding update" message to the home agent
> would conflict with the Mobile IP message.

Before the mobile IP can send his AH/ESP protected binding update
packet to the home agent, he needs to make have that IPsec SA up and
working. If he tries to send them AFTER the previous IP address has
disappeared (i.e tries to use the new IP address), then the SA does
not work properly because reply packets go still back to the old
address (IPsec SA is tied to the previous IP address).

So what mobile IP needs to do it needs to recreate the IPsec and IKE
SAs. MOBIKE can make that recreation unnecessary, because it allows
mobile IP to inform MOBIKE that IP address change has occurred (or the
generic mobility policy module in the device informs both MOBIKE and
Mobile IP about this change) and the MOBIKE can fix the tunnel
endpoint addresses of the IPsec and IKE SAs so mobile IP can use the
IPsec SA tunnel to send his binding update packet to the home agent.
-- 
[email protected]