Subject: (IPng 7303) mobility and IPsec tunnel mode

From: Francis Dupont <[email-masked]>
Date: Thu, 11 Mar 1999 09:11:12 +0100

The interaction between IPv6 mobility and IPsec in tunnel mode is
both interesting and not (yet) described in I-Ds. Usually your get:

from correspondent to mobile:

IPv6 header
 destination=care-of address
Routing header
 final destination=home address
IPSec header
 authentication and replay prevention
Higher level data

from mobile to correspondent:

IPv6 header
 source=care-of address
IPSec header
 authentication and replay prevention
Destination Options
 home address=home address
Higher level data

If you use tunnel mode in place of transport mode for common
packets (ie without binding options) you can use:

from correspondent to mobile:

Outer IPv6 header
 destination=care-of address
IPSec header
 authentication and replay prevention
Inner IPv6 header
 destination=home address
Higher level data

from mobile to correspondent:

Outer IPv6 header
 source=care-of address
IPSec header
 authentication and replay prevention
Inner IPv6 header
 source=home address
Higher level data

The two ways are in fact independent.

The interesting thing is you don't need special things like routing
headers or home address destination options which is not a real
surprise because the key point is to get *two* addresses for the
mobile which is provided by encapsulation...
Then when IPsec tunnel mode is used, mobility has *no* extra cost
for common packets (if my remark is applied). This should be written
down in the specs?

[email-masked]
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------