Re: Mobile IP and Mobike

Vijay Devarapalli writes:
> > That is not following the IKEv1/IKEv2 RFCs nor the architecture draft.
> > There tunnel mode SAs are tied to the IP addresses which are used to
> > when it is negotiated in the IKE. It is not very clean solution that
> > Mobile IP goes and modifies the internal databases of the IPsec module
> > (SAD). If you want to use standard IPsec then you need to renegotiate
> > the IPsec and IKE SAs before sending the binding update. 
> 
> 
> you gotta be kidding me. :) the selectors are applied to
> the inner IP header, not the outer one. and the selectors are
> what are negotiated.

Yes, but tunnel endpoint addresses are not selectors, and they are not
negotiated at all, they are taken from the IKE SA endpoint addresses.
IKE SA endpoint addresses are also not negotiated, they are taken from
the IP-addresses of the IKE packets. If no NAT traversal is used, then
the IP-addresses will be the ones used in the initial exchange. If NAT
traversal (NAT-T) is used then they SHOULD be from last authenticated
packet from the other end (Note, that the IP-addresses are not
negotiated).

This means that the when the SGW wants to send packets to the other
end it will use the exactly same OUTER IP addresses all the time, and
there is no standard method in the IPsec to change that anyway. The
MOBIKE is trying to define a method to do that.

> we got the Mobile IPv6 + IPsec documents reviewed by numerous
> folks from the security area.

At least I did comment to the drafts that they require the combined
mobile IP and IPsec stacks, as the Mobile IP needs to modify the data
structures of the IPsec, and that kind of methods are not normally
implemented in the IPsec. 

> we have interoperable implementations (infact many
> implementations). so, have to strongly disagree with you.

Of course you can combine Mobile IP and IPsec and make them to work
together, there is no question about that. It just means that you
cannot take IPsec from vendor A and Mobile IP from vendor B and assume
that they can work together at all. With MOBIKE changes to the IPsec,
you should be able to take IPsec from vendor A, MOBIKE from vendor C
and Mobile IP from vendor B, and assume that they will work together
(as long as IPsec and MOBIKE support the PFKEY extensions defined by
the MOBIKE later). 
-- 
[email protected]