Re: Comments to draft-ietf-mobike-protocol-00.txt

> If the initiator is behind the NAT, the DPD can also be used to do to
> simulate the dynamic updates of the non MOBIKE NAT-T, by so that we
> send the INFORMATIONAL exchange with COOKIE2 and CHANGE_PATH message
> as a DPD message, when we suspect that something is wrong. This is
> really like using the operational address pair update messages as a DPD
> just to make sure the operational address pair matches the NAT mapping
> in the NAT box.
> 
> I.e. if host A is behind NAT, and host B is the gateway, and host A
> and B has MOBIKE IPsec connection established between them. Then the
> NAT box is rebooted. The host B will detect that host A starts using
> new IP-address, but because this is MOBIKE NAT-T he does not do
> anything, simply continues using the old address pair (his packets
> will be dropped by NAT).
> 
> The Host A notices that he is not getting any messages (IKE or IPsec)
> back, and starts DPD to verify that everything is ok. He sends DPD (or
> actually operationl address pair update packet is used as DPD) with
> COOKIE2 and CHANGE_PATH to the host B. Host B receives that, and
> replies to it, and in the same time also updates the operational
> address pair to this new one. After that host A can see reply and the
> packets start flowing again, and situation is fixed.
> 
If the operational pair is not working and the intiator is behind NAT,
it could be multiple reasons : NAT reboot, some router crashed etc.
You assumed that NAT rebooted above. If the NAT did not reboot,
then the PATH did not really change. In this case, the initiator would
still not see any response and hence try a new PATH later. Does this
mean that the initiator behind NAT always have to try sending
DPD with CHANGE_PATH and then try new PATH ? If we think
this is a corner case, i am not sure whether it is worth it.

-mohan