Subject: Re: [Mip6] Comments on draft-ietf-mip6-ikev2-ipsec-01

From: Francis Dupont <[email-masked]>
Date: Mon, 02 May 2005 17:23:09 +0200

In your previous mail you wrote:

   >    okay. atleast we agree that the tunnel mode shouldnt be the default.
   >    you want it explicitly mentioned in the draft?
   >    
   > => I don't believe the word default is necessary: IMHO we should just
   > present things in the right order and explain there are two alternatives
   > to the selector = MH protocol.
   > 
   >    > the default mode should be the same than in 3776, i.e.,
   >    > MH protocol as the selector. But the two others (all traffic and only
   >    > the critical MH types) have to be allowed.
   >    
   > => in fact any selector set which provides the right protection should be
   > allowed... The two alternatives need to be detailed because they have
   > some advantages so should become common. Of course both sides should
   > agree before.
   
   so you want the default mode be the same as in RFC 3776, but present
   the "tunnel everything" mode and the "MH type as a selector" as two
   options?
   
=> yes but even without the word default and of course a SHOULD or a MUST
support.

   I disagree with this. IMHO, the "MH type as a selector" should be
   supported atleast by the Home Agent, so that some mobiles can take
   advantage of this.

=> you are trying to enforce a market decision through a standard
specification... This won't work. And don't forget the MN and HA managers
must agree about security policy (and this choice is part of it) before
any operation...

   the "tunnel everything mode" can be specified
   as part of privacy solution documents.
   
=> IMHO we should constraint the options and provide one as the basic one.
Anything more won't help in the real world.

Regards

[email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6