Subject: [Mip6] RE: Questions on draft-qiu-mip6-mobile-firewall-00.txt

From: [email-masked]
Date: Tue, 1 Mar 2005 09:26:44 -0600

Hello Qiu Ying,

Thank you for the clarification. It could be useful to include a description of it in the internet draft.

Franck

> -----Original Message-----
> From: ext QIU Ying [mailto:[email-masked]]
> Sent: 01 March, 2005 02:40 AM
> To: Le Franck (Nokia-NRC/Dallas); [email-masked];
> [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: Questions on draft-qiu-mip6-mobile-firewall-00.txt
> 
> 
> Hi, Franck
> 
> Thanks for your comments.
> 
> In original, our draft focuses on the scenario described in 
> section 5.1 of 
> your draft (draft-ietf-mip6-firewalls-01.txt).
> 
> Your questions are regarding to the scenario described in 
> section 5.2 of 
> your draft. We thought it could be solved in our protocol by 
> assigning a bit 
> more job to MAP.
> 
> In HMIPv6, every packet to MN1 from outside uses the RCoA1 as the 
> destination address and is interrupted by MAP, then MAP 
> forward the packet 
> to MN1's LCoA1. Actually, the RCoA1 could be considered as 
> one of addresses 
> of MAP.
> 
> Here, we let MAP as the mobile agent as well as the firewall. In the 
> extended protocol, MN2 will not negotiate the RR process with 
> MN1 directly; 
> MN2 will do the RR process with MAP instead. In MN2 point, it always 
> communicates with a fixed node, MAP, which address is RCoA1. 
> So MAP gets the 
> HoTI and CoTI messages from MN2 and replies HoT and CoT 
> messages to MN2. 
> After getting the BU message from MN2, MAP forward MN2's new 
> address CoA2 to 
> MN1 and then MN1 updates MN2's address to CoA2. Meanwhile, 
> MAP update its 
> entries regarding to MN2 to the new address CoA2.
> 
> Since RR is a simple process, it should not bring much 
> overhead to MAP.
> 
> Is it acceptable?
> 
> Regards
> Qiu Ying
> 
> 
> ----- Original Message ----- 
> From: <[email-masked]>
> To: <[email-masked]>; <[email-masked]>; 
> <[email-masked]>; 
> <[email-masked]>; <[email-masked]>
> Sent: Tuesday, March 01, 2005 4:53 AM
> Subject: Questions on draft-qiu-mip6-mobile-firewall-00.txt
> 
> 
> Hello,
> 
> I read the draft-qiu-mip6-mobile-firewall-00.txt, and would have few 
> questions. I hope that the authors can clarify me on the following.
> 
> The proposed approach is interesting and even though not 
> always applicable, 
> it could be a solution when the visited network deploy MAPs. 
> Section 5 
> analyzes how the proposed solution solves many of the common 
> issues that 
> firewall can present to the MIPv6 protocol. However it does 
> not seem to 
> describe the procedures when the CN is also a MN. Let's call 
> MN1 the MN in 
> the network where MAPs are deployed, and MN2, its CN.
> 
> - Does the MAP allow RRT messages (e.g. HoTI, CoTI) from MN2 
> to reach MN1? 
> If yes, malicious may use that to flood MN1. MN1 may be in a 
> network where 
> the access link is a scarce and expensive resource (e.g. 
> cellular network) 
> and has to pay for its utilization. Fowarding these RRT 
> messages may cause 
> the MN1 to pay for undesired packets sent by malicious nodes 
> generating RRT 
> packets.
> 
> - How does the MAP update the entries when the MN2 uses Route 
> Optimization?
> 
> Thank you.
> 
> Franck 
> 
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: QIU Ying <[email-masked]>
Date: Thu, 17 Mar 2005 11:49:45 +0800

Hi, Franck,

I have updated the draft according to your comments. The new version 
draft-qiu-mip6-mobile-firewall-01.txt is at the I-D pool already.

Regards
Qiu Ying

----- Original Message ----- 
From: <[email-masked]>
To: <[email-masked]>; <[email-masked]>; 
<[email-masked]>; <[email-masked]>; 
<[email-masked]>
Sent: Tuesday, March 01, 2005 11:26 PM
Subject: RE: Questions on draft-qiu-mip6-mobile-firewall-00.txt

Hello Qiu Ying,

Thank you for the clarification. It could be useful to include a description 
of it in the internet draft.

Franck