Re: FW: Marcelo's review of mobike protocol

El 17/10/2005, a las 12:37, Tero Kivinen escribió:

> marcelo bagnulo braun writes:
>>> There should not be problems with the ingress filters, as we always
>>> use the source address associated to the given interface when sending
>>> packets out. I.e. if we have two interfaces A and B, having IPa and
>>> IPb,  when we send packets out using IPa we always select interface 
>>> A.
>>> The network connected to the interface should allow IPa to pass
>>> through it as it is IP address given by the network to the host for
>>> that interface. Implementations might need to do specific things to
>>> bypass routing of those packets (using default route or similar) to
>>> make use they are really sent out from the host using proper
>>> interface.
>>>
>>
>> yes in this case there shouldn't be problems with ingress filters.
>> However, as i understand it, it is expected that a common multihoming
>> scenario is that multiple PA address blocks are assigned to a
>> multihomed site (one per isp serving the site), so that there will be
>> multiple global addresses assigned to each interface connected to the
>> multihomed site.
>
> I do not think that will be the case of the roaming laptop case, i.e.
> the GPRS, WLAN and fixed ethernet links all give out exctly one
> IP-address to the connected interface, and you are only supposed to
> use that IP-address through that interface to which it was given to.
>
>> In this case, selecting the egress interface doesn't help you 
>> selecting
>> among the multiple addresses assigned to that interface.
>> However, you still may have problem with ingress filters because each
>> address has been assigned by a different ISP, implying that if ingress
>> filters are in place, each isp will only route those packets that
>> contain the prefix delegated by the particular isp in the source
>> address of the packet. hence, we may have ingress filters
>> incompatibility issues, so unidirectional paths may be quite frequent
>> if no ingress filters compatibility mechanisms are in place (for more
>> about this check draft-huitema-shim6-ingress-filtering-00.txt
>
> This could be the case in the multihomed VPN case. Note, that MOBIKE
> should still work perfect, if that unidirectional path does not work
> (i.e. packets does not get back when IP-addresses are reversed), then
> that address pair is not used, and we finally end up selecting address
> pair which does not have that problem with ingress filters.
>

right, if such path exists
It maybe the case, that only disjunct unidirectional paths exists, 
because of ingress filters.
In this case, mobike protocol wouldn't achieve to communicate, even if 
a path exists, and it would be possible to communicate if the mobike 
protocol supported different addresses in the different peers of the 
communication

>> i guess that this at least needs to be specified i.e. that mobike will
>> try with different addresses.... question: is mobike going to retry
>> using only different destination addresses or it will also try with
>> different source addresses? i guess it makes sense to try with
>> different source addresses as well, in particular, with all the
>> possible combinations src and dst addresses available.
>
> If it has multiple IP addresses associated to the IKE SA (even before
> it is created) then it should try all combinations of them through the
> normal IKE SA retransmission policy.

does the IKE SA retransmission policy tries different source addresses?

regards, marcelo