Subject: [Mip6] [issue78] AD Review - Named SPD entries and EAP authentication

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 27 Sep 2006 00:11:41 +0000

New submission from Vijay Devarapalli <[email-masked]>:

Jari Arkko wrote:

>    The home agent should have named SPD entries per mobile node, based
>    on the identity of the mobile node.  The identity of the mobile node
>    is stored in the "Name" selector in the SPD [5].  The home address
>    presented by the mobile node during the IKE negotiation is stored as
>    the remote IP address in the resultant IPsec security associations.

Assuming a likely deployment arrangement is authentication
through EAP and AAA, this seems hard to achieve. Overall, the text
in this section follows the RFC 3776 model which may not be all
that great for a dynamic operation.

----------
category: Technical
draft: draft-ietf-mip6-ikev2-ipsec
messages: 258
nosy: vijay
priority: Must fix
status: No discussion
title: AD Review - Named SPD entries and EAP authentication

_________________________________________________
Mip6 issue tracker <[email-masked]>
<http://www.mip4.org/issues/tracker/mip6/issue78>
_________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 27 Sep 2006 11:27:36 -0700

> that great for a dynamic operation.

the text was added to resolve issue #15
http://www.mip4.org/issues/tracker/mip6/issue15

there are two cases here.

1. the MN is already configured with the HA, only dynamically
configures a HoA

in this case, each HA is configured to serve a set of a mobile
nodes. so the HA will have a "named" SPD entry per mobile node
that gets updated (or a new SPD with higher priority created)
once the MN is assigned a HoA. this is what is explained in
section 7.1.1.

    The home agent should have named SPD entries per mobile node, based
    on the identity of the mobile node.  The identity of the mobile node
    is stored in the "Name" selector in the SPD [5].

2. the MN dynamically configures the HA and the HoA.

in this case, the HA cannot have any SPD entries per mobile
node, since it does not which mobile nodes it will be
serving. instead, the HA will have a generic SPD entry that
says all binding updates received and binding acks sent must
be protected with ESP. otherwise they are dropped. this is
explained by the following terse sentence in section 7.1.1

    The home agent MAY also have generic SPD entries to prevent mobility
    header traffic that requires IPsec protection from bypassing the
    IPsec filters.

we need to expand on this a bit. here is some text we can
add.

    If the mobile node dynamically configures a home agent and the home
    address, the home agent may not know which mobile nodes it is
    supposed to be serving.  Therefore the home agent cannot have SPD
    entries configured per mobile node.  Instead the home agent should
    have have generic SPD entries to prevent mobility header traffic that
    requires IPsec protection from bypassing the IPsec filters.  Once a
    mobile node authenticates to the home agent and configures a home
    address, appropriate SPD entries are created for the mobile node.

please comment.

Vijay