Subject: [Mip6] Re: Gen-ART review of draft-ietf-mip6-ikev2-ipsec-07.txt

From: Vijay Devarapalli <[email-masked]>
Date: Sat, 25 Nov 2006 12:37:43 -0800

hi,

thanks for the review. responses inline.

Vijay K. Gurbani wrote:
> 1) In S4, the authors state that "Many of the requirements are repeated
>  from RFC3776 to make this document self-contained and complete."
>  There are a fair number of requirements in subsequent sub-sections.
>  It may help if the authors tag each requirement that was already
>  present in RFC3776, so the reader can see which new requirement was
>  generated by this draft.

we would like to keep this document self-contained,
basically one needn't refer to RFC 3776 at all to
implement this spec. the very initial versions of
the document were written with only the new
requirements listed, but folks didn't like it.

> 2) Nit: S6.1, under heading "mobile node SPD-S:"
>    s/=BU/= BU/

fixed.

> 3) In S9, first full paragraph of Page 22: "In case the home agent ...
>  an INTERNAL_ADDRESS_FAILURE message."  If a mobile node gets an
>  INTERNAL_ADDRESS_FAILURE message, does it make sense to specify
>  what should it do, if anything?

good catch. the mobile node has the following
options.

1. it can attempt to auto-configure a home address
as described in section 5.3.2 of
draft-ietf-mip6-bootstrapping-split-03.txt. the
sequence is a bit complicated though. it has to
terminate the current IKE exchange and initiate a
new one. in the new IKE_AUTH exchange, the MN
should try to auto-configure a home address.
2. switch to another home agent (most home agent
discovery mechanisms return more than one home
agent).
3. throw an exception and report and error to the
user.

2) seems to be simplest option.

comments?

Vijay

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 27 Nov 2006 08:04:55 -0800

folks,

any comments on the options below?

Vijay

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 27 Nov 2006 17:24:07 +0100

> any comments on the options below?

Maybe cast a insecure DHAAD Request followed by a MPD Sol and then IKE 
again?

Alex

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 27 Nov 2006 09:40:05 -0800

Alexandru Petrescu wrote:
> Maybe cast a insecure DHAAD Request 

it does not matter which HA discovery is used. the
question is more about whether we should start using
another HA or try again with the current HA but this
time with auto-configuration for the home address.

> followed by a MPD Sol 

MPD cannot be run until the Mobile IP tunnel is up.

Vijay

and then IKE

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 27 Nov 2006 18:54:07 +0100

> time with auto-configuration for the home address.

If the question is so, I'd say start using another HA (not try same HA 
but with auto-config).  Just one oppinion.

> MPD cannot be run until the Mobile IP tunnel is up.

(Not sure about that.  3775 says MPD should be ESPed.  If we relax
  that and run IKE afterwards I don't see an inconvenient.  You may
  disagree.)

Alex

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 27 Nov 2006 09:54:54 -0800

> but with auto-config).  Just one oppinion.

thats option 2 in my mail below.

> (Not sure about that.  3775 says MPD should be ESPed.  

right. but without running IKE an IPsec SA is not
available for protecting the MPD messages. IKE_AUTH
has already failed because the HA cannot give out a
home address to the mobile node.

Vijay

If we relax

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 27 Nov 2006 19:06:34 +0100

> thats option 2 in my mail below.

SO we agree.

> available for protecting the MPD messages.

(not true I run shared keys).

Alex

---

From: "Kilian Weniger" <[email-masked]>
Date: Tue, 28 Nov 2006 10:47:31 +0100

Hi Vijay,

what are reasons for the INTERNAL_ADDRESS_FAILURE? Two reasons that come
to my mind are that the home agent consults a DHCP server on the home
link but the DHCP server is down or that the address pool of the DHCP
server (or a pool internal in the home agent) is empty, i.e., all
addresses are allocated. Any other reasons?

If the new home agent uses the same DHCP server/address pool, option 2
wouldn't help, since the allocation would fail again. In contrast,
option 1 should always work (unless the auto-configured address is
duplicate). So depending on the deployment scenario, option 1 may have
higher chances to succeed, in which case it would be better to go for
option 1.

Option 3 should be done if the allocation fails after multiple retries
IMHO.

My two cents.

-Kilian

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]] 
> Sent: Montag, 27. November 2006 17:05
> To: [email-masked]
> Subject: Dealing with INTERNAL_ADDRESS_FAILURE (was Re: 
> [Mip6] Re: Gen-ARTreview of draft-ietf-mip6-ikev2-ipsec-07.txt)
> 
> folks,
>

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 27 Nov 2006 09:28:20 -0600

> requirements listed, but folks didn't like it.

OK.  More inline.

>mbia.edu/~smb

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Mon, 27 Nov 2006 09:28:20 -0600

OK.  More inline.

> 2) seems to be simplest option.

I am viewing this from a generalist angle; so please filter
what I write through your subject matter expert lens.
It appears to me that (2) sounds reasonable, and if all the
subsequent home agents should return an INTERNAL_ADDRESS_FAILURE
(for whatever reason), then (3) should kick in.

Thanks,

- vijay
-- 
Vijay K. Gurbani  vkg@{lucent.com,research.bell-labs.com,acm.org}
Bell Laboratories, Lucent Technologies, Inc.
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6