(usagi-users 03816) Re: Force use of IPsec for MNs

Hi Benoit,

MIPL takes care of the IPsec SP, so you have to specify all the HoA you 
plan to use in the HA's config file. With the current MIPL design, what 
you propose is not possible.

Several solutions:
- size correctly your HA from the beginning: think about how many MNs 
you want to support, their HoA etc.
- if you do not know how to size your HA service, you can authorize all 
the bindings in the MIPL config file, and then dynamically add/remove 
some netfilter rules to drop the non-IPsec'd BU (ip6tables can do that).
- or write some extra code in MIPL, to be able from an outside program 
to add/remove some HoA in the IPsec policy set.

regards,

-- 
Romain KUNTZ
[email protected]


Benoit LE TEXIER wrote:
>   Hello everyone,
> 
>   I have a question about IPsec and MNs: is it possible to force using 
> IPsec for MNs registration?
> 
>   Because for the moment I have defined a list of nodes that are able to 
> register (filtrated by ACL rules) and another list of nodes that needs 
> to use IPsec. Here is a sample of the config file of my HA:
> 
> DefaultBindingAclPolicy deny;
> BindingAclPolicy xxx:yyy:zzz:ttt::2 allow;
> BindingAclPolicy xxx:yyy:zzz:ttt::3 allow;
> BindingAclPolicy xxx:yyy:zzz:ttt::4 allow;
> 
> UseMnHaIPsec enabled;
> 
> IPsecPolicySet {
>      HomeAgentAddress xxx:yyy:zzz:ttt::1;
>      HomeAddress xxx:yyy:zzz:ttt::2/64;
>      HomeAddress xxx:yyy:zzz:ttt::3/64;
>      HomeAddress xxx:yyy:zzz:ttt::4/64;
> 
>      IPsecPolicy HomeRegBinding UseESP;
>      IPsecPolicy TunnelMh UseESP;
> }
> 
>   But here, i am more interested in a sort of possibility to say "If a 
> MN want to register, he MUST uses IPSec". In fact, it is a sort of flag 
> "DefaultBindingAclPolicy IPsec;". The idea behind this is to add new MNs 
> without restarting the HA's daemon or anticipating a list of nodes.
> 
>   Does anyone have an idea about this point?
> 
> 
> Best regards,
> Benoit LE TEXIER.
> 
>