Subject: [Mip6] Re: Questions on draft-qiu-mip6-mobile-firewall-00.txt

From: QIU Ying <[email-masked]>
Date: Tue, 01 Mar 2005 16:40:04 +0800

Hi, Franck

Thanks for your comments.

In original, our draft focuses on the scenario described in section 5.1 of 
your draft (draft-ietf-mip6-firewalls-01.txt).

Your questions are regarding to the scenario described in section 5.2 of 
your draft. We thought it could be solved in our protocol by assigning a bit 
more job to MAP.

In HMIPv6, every packet to MN1 from outside uses the RCoA1 as the 
destination address and is interrupted by MAP, then MAP forward the packet 
to MN1's LCoA1. Actually, the RCoA1 could be considered as one of addresses 
of MAP.

Here, we let MAP as the mobile agent as well as the firewall. In the 
extended protocol, MN2 will not negotiate the RR process with MN1 directly; 
MN2 will do the RR process with MAP instead. In MN2 point, it always 
communicates with a fixed node, MAP, which address is RCoA1. So MAP gets the 
HoTI and CoTI messages from MN2 and replies HoT and CoT messages to MN2. 
After getting the BU message from MN2, MAP forward MN2's new address CoA2 to 
MN1 and then MN1 updates MN2's address to CoA2. Meanwhile, MAP update its 
entries regarding to MN2 to the new address CoA2.

Since RR is a simple process, it should not bring much overhead to MAP.

Is it acceptable?

Regards
Qiu Ying

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>; 
<[email-masked]>; <[email-masked]>
Sent: Tuesday, March 01, 2005 4:53 AM
Subject: Questions on draft-qiu-mip6-mobile-firewall-00.txt

Hello,

I read the draft-qiu-mip6-mobile-firewall-00.txt, and would have few 
questions. I hope that the authors can clarify me on the following.

The proposed approach is interesting and even though not always applicable, 
it could be a solution when the visited network deploy MAPs. Section 5 
analyzes how the proposed solution solves many of the common issues that 
firewall can present to the MIPv6 protocol. However it does not seem to 
describe the procedures when the CN is also a MN. Let's call MN1 the MN in 
the network where MAPs are deployed, and MN2, its CN.

- Does the MAP allow RRT messages (e.g. HoTI, CoTI) from MN2 to reach MN1? 
If yes, malicious may use that to flood MN1. MN1 may be in a network where 
the access link is a scarce and expensive resource (e.g. cellular network) 
and has to pay for its utilization. Fowarding these RRT messages may cause 
the MN1 to pay for undesired packets sent by malicious nodes generating RRT 
packets.

- How does the MAP update the entries when the MN2 uses Route Optimization?

Thank you.

Franck 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6