Subject: [Mip6] question: SA update in dynamic keying scenario

From: "Shinta Sugimoto (TO/NRJ)" <[email-masked]>
Date: Thu, 25 Nov 2004 21:09:57 +0800

Dear all,

I need clarification on how MIPv6 and IPsec/IKE should interwork
in dynamic keying scenario.

According to RFC 3775 and 3776, there are two cases in dynamic
keying scenario depending on availability of K-bit support negotiated
between the MN and HA in home registration.  When K-bit is ON,
both MN and HA have capability to update IKE endpoints whenever
the MN changes its primary CoA.  When K-bit is OFF, MN and HA
should re-establish phase 1 connection each other.  It is clearly noted
in the specification the difference between the outcome of the two
scenarios is necessity of re-establishing phase 1 connection.

However, I could not find clear description of how IPsec SAs (particularly
tunnel mode SA pairs required to protect RR signals and user traffic)
should be managed.  My question is, "*who* is responsible for updating
/re-establishing IPsec SA in dynamic keying scenarios upon MN's
movement ?"  Should MIPv6 always be responsible for updating the
endpoint address of the tunnel mode SA (as it does in manual keying
scenario) ?  Or IKE daemon should run phase 2 negotiation to establish
new IPsec SA ?

When we discussed this issue with MIPv6 implementators from
Linux and BSD community, we saw disparity of interpretation.
(Some people say that MIPv6 should always be the one who updates
tunnel endpoint, and some people say IKE daemon should re-establish
IPsec SA in dynamic keying scenario)  So, I just would like to clarify
this issue on the list.

Any comments are appreciated.

Regards,
Shinta

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Thu, 25 Nov 2004 17:46:58 +0100

In your previous mail you wrote:

=> MIPv6 is responsible of the update of the SAD and the SPD. If you'd
like to make this by IKE you should go to the Mobike WG, not the Mip6 one.

   IPsec SA in dynamic keying scenario)

=> IKE cannot know what to do if the SPD is not updated.

Regards

[email-masked]