Subject: RE: [Mip4] Firewall traveral problem

From: "Sami Vaarala" <[email-masked]>
Date: Tue, 23 Sep 2003 12:38:06 +0300

Hi Niko,

> we are testing the performance of MIP and NOMAD with UMTS. Using PPP
our
> mobile node is allocated a globally routable IP address from the UMTS
IP
> subnet. In turn the MN registers the CCOA issuing a RegReq with source
> IP address that of the MN. However, a Firewall at the UMTS IP subnet
> will not let any packets out unless the source address belongs withing
> its administered subnet. This was resolved with the help of a reverse
> IPIP tunnel. However, the Firewall will also not let any packets in,
> unless the mobile node has first initiated the flow. For this, the
> reverse IPIP tunnel was replaced with an IP+UDP tunnel which was
> constructed with the help of the OpenVPN software
> (http://openvpn.sourceforge.net/). We have been coming across several
> problems with OpenVPN and would like to know whether anyone has any
> implementation experience that might be willing to share with us.

I'm not sure if this is a realistic alternative for
you, but your scenario can also be solved using the
MIP NAT traversal specification (RFC 3519).  It allows
a MN to force UDP encapsulation even when no NAT devices
are detected (the 'F'-bit in the RRQ extension is
used for this and was originally added for precisely
this purpose).

When the MN uses the F-bit, the flow is MN initiated,
and uses the RRQ/RRP UDP ports for the data traffic
flow that follows registration.

Hope this helps,

-Sami

> 
> Best Regards
> niko
> 
> 
> _______________________________________________
> Mip4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mip4

_______________________________________________
Mip4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip4

---

From: Henrik Levkowetz <[email-masked]>
Date: Tue, 23 Sep 2003 06:00:11 -0400

Hi Sami,

> Hi Niko,

[snip]

> flow that follows registration.

I see we're on the same page here. Your response dropped
into my inbox while I was writing mine ..  :-)

	Regards,	
		Henrik