Re: [Dime] Fwd: New Version Notification for draft-korhonen-dime-mip6-feature-bits-01

[Vijay Devarapalli <dvijay at gmail.com>]

Hi Jouni,

On Wed, Jun 10, 2009 at 11:03 PM, jouni korhonen<jouni.nospam at gmail.com> wrote:
> Hi Vijay,
>
>
> On Jun 11, 2009, at 12:49 AM, Vijay Devarapalli wrote:
>
>> Hi Jouni,
>>
>> I have a comment on the "VPN Gateway feature". There is no document
>> that describes what it means for a Mobile IPv6 home agent to act as a
>> VPN gateway. The IKEv2 exchange between the MN and the HA [RFC 4877
>> and 5026] already supports mutual authentication, address assignment
>> and setting up of tunnel mode ESP SAs. Are you referring to this as
>> VPN mode? But isn't this regular Home agent functionality?
>
> The "VPN mode" is when you use HA IKEv2/IPsec functionality purely for
> conventional VPN remote access purposes without any mobility.

Again, what does this mean? When you run IKEv2 as described in RFC
4877 and 5026, you are creating tunnel mode security associations for
a *Mobile IPv6 tunnel*. In the "VPN" mode, does the mobile node switch
of the Mobile IPv6 stack?

Or does the Home Agent behave an IPsec VPN gateway for pure IPsec
clients, i.e., there is no Mobile IPv6 stack on these clients.

> That type of
> deployment is shortly referenced in draft-ietf-dime-mip6-split Section 4.1.
> I recall this functionality was originally requested by Gerardo.

It doesn't make sense to me. :) This looks more like co-locating a
Mbile IPv6 home agent and an IPsec VPN gateway and supporting both
Mobile IPv6 mobile nodes and plain IPsec clients at the same time.

There has to be more to this scenario than just the short paragraph in
draft-ietf-dime-mip6-split.

>> Or is there a separate IPsec VPN that is first setup and then Mobile
>> IPv6 is run on top of the IPsec tunnels?
>
> As shortly described in split document:
>
>   In some deployment scenarios, the HA may also act as an IKEv2
>   Responder for a conventional IPsec VPN access.  The challenge in this
>   case is that the IKEv2 responder may not know if IKEv2 is used for
>   Mobile IPv6 service or for IPsec VPN access service.  A network
>   operator needs to be aware of this limitation.  One solution already
>   supported by IKEv2 is to use different responder identities when
>   operating as a conventional IPsec VPN gateway or as a HA.  The MN can
>   then indicate the preferred responder type using the appropriate IDr
>   payload in the IKE_AUTH message.
>
> But yeah, now that feature bits are taken into a separate document, the
> connection between the above and the new feature bit is rather weak. Either
> we need more text and/or reference in the draft-korhonen-dime-feature-bits
> or just remove the bit all together. Since the difference between
> conventional IKEv2 IPsec VPN gateway part and HA's IKEv2 IPsec functionality
> is rather small, I would keep the feature bit and enhance the text instead.

It is not "rather small" in my opinion. I don't understand how
supporting plain IPsec clients can be a feature on a Mobile IPv6 home
agent. :)

Vijay

>
> Jouni
>
>
>>
>>
>> Vijay
>>
>> On Wed, Jun 10, 2009 at 2:55 AM, jouni korhonen<jouni.nospam at gmail.com>
>> wrote:
>>>
>>> Hi all,
>>>
>>> I have updated the additional feature bits draft. I did remove some stuff
>>> so
>>> that the draft now only reserves MIP6-Feature-Vector flag bits and
>>> nothing
>>> more. I'll forward the draft soon to RFC editor so if anyone has
>>> comments,
>>> please be quick :)
>>>
>>> Cheers,
>>>       Jouni
>>>
>>> Begin forwarded message:
>>>
>>>> From: IETF I-D Submission Tool <idsubmission at ietf.org>
>>>> Date: June 10, 2009 12:26:53 PM GMT+03:00
>>>> To: jouni.nospam at gmail.com
>>>> Subject: New Version Notification for
>>>>  draft-korhonen-dime-mip6-feature-bits-01
>>>>
>>>>
>>>> A new version of I-D, draft-korhonen-dime-mip6-feature-bits-01.txt has
>>>> been successfuly submitted by Jouni Korhonen and posted to the IETF
>>>> repository.
>>>>
>>>> Filename:        draft-korhonen-dime-mip6-feature-bits
>>>> Revision:        01
>>>> Title:           Diameter MIP6 Feature Vector Additional Bit Allocations
>>>> Creation_date:   2009-06-10
>>>> WG ID:           Independent Submission
>>>> Number_of_pages: 5
>>>>
>>>> Abstract:
>>>> During the Mobile IPv6 Split Scenario bootstrapping the Mobile IPv6
>>>> Home Agent and the Authentication, Authorization, and Accounting
>>>> server may exchange a set of authorized mobility capabilities.  This
>>>> document defines new mobility capability flags that are used to
>>>> authorize per Mobile Node route optimization, Multiple Care-of
>>>> Address and user plane traffic encryption support.  Furthermore, this
>>>> document also defines a capability flag of indicating whether the
>>>> Home Agent is authorized to act as a stand alone Virtual Private
>>>> Network gateway.
>>>>
>>>>
>>>>
>>>> The IETF Secretariat.
>>>>
>>>>
>>>
>>> _______________________________________________
>>> DiME mailing list
>>> DiME at ietf.org
>>> https://www.ietf.org/mailman/listinfo/dime
>>>
>
>