Re: Mobile IP and Mobike

Tero Kivinen wrote:
> James Kempf writes:
> 
>>>The mobike is targeted to the environments where the other end of the
>>>connection is stable, i.e the VPN sgw or similar. The mobile ip both
>>>ends can move, and the connection is not necessarely from the mobile
>>>node to the sgw to the www-server (for example), but can also go
>>>directly between mobile node and www-server.
>>>
>>
>>I'm not sure I understand. In both cases, presumably the mobile node is
>>communicating with a correspondent that is not the intermediate node. In
>>both cases, the intermediate node typically isn't moving. The mobile node
>>can be moving, but I believe what you are saying is that in the Mobike case,
>>the correspondent can't be move, is that it?
> 
> 
> In the mobike case the other end of the security association (i.e.
> other end of MOBIKE protocol) will typically be corporate SGW. The SGW
> will not move (ok, it might have multiple interfaces for
> high-availibility use, but it will not be mobile). All the traffic
> from using the MOBIKE will go through that tunnel from mobile host to
> the SGW, and normally then continues from the SGW to the the host
> INSIDE the coporate network. If mobile node wants to connect the some
> other host in the internet (like www.cnn.com) it will either not use
> MOBIKE and connect to that directly using his normal address (==i.e.
> the connection will be broken if the IP address changes unless mobile
> ip is used), or it will connect to the corporate firewall through the
> SGW and make all packets be routed in both directions through the
> tunnel. 
> 
> 
>>Actually, I'm not sure I agree. Mobile IP sends a Binding Update through an
>>ESP Auth tunnel, and could optionally also use encryption on the tunnel. If
>>both are used, and if in addition the Mobile Node uses an ESP Auth + Enc
>>tunnel for data traffic, it seems to me that it would be exactly the same as
>>for Mobike. Therefore, the Mobike "binding update" message to the home agent
>>would conflict with the Mobile IP message.
> 
> 
> Before the mobile IP can send his AH/ESP protected binding update
> packet to the home agent, he needs to make have that IPsec SA up and
> working. If he tries to send them AFTER the previous IP address has
> disappeared (i.e tries to use the new IP address), then the SA does
> not work properly because reply packets go still back to the old
> address (IPsec SA is tied to the previous IP address).

IPsec SA is tied to the Home Address. IKE SA is tied to the CoA.
so a Binding Update can be sent right away.

Vijay

> 
> So what mobile IP needs to do it needs to recreate the IPsec and IKE
> SAs. MOBIKE can make that recreation unnecessary, because it allows
> mobile IP to inform MOBIKE that IP address change has occurred (or the
> generic mobility policy module in the device informs both MOBIKE and
> Mobile IP about this change) and the MOBIKE can fix the tunnel
> endpoint addresses of the IPsec and IKE SAs so mobile IP can use the
> IPsec SA tunnel to send his binding update packet to the home agent.