Subject: Re: [MOBILE-IP] I-D ACTION:draft-ietf-mobileip-reg-tunnel-01.txt

From: Annika Jonsson <[email-masked]>
Date: Thu, 26 Aug 1999 13:07:56 +0200

Hello Pete,

At 10:59 1999-08-24 -0500, Pete McCann wrote:
>[email-masked] (I) writes:
>
>I> http://www.ietf.org/internet-drafts/draft-ietf-mobileip-reg-tunnel-01.txt
>
>I read through this draft and I have a couple of problems with it.
>
>1) I do not believe it can correctly handle MNs with private IP addresses.
>

You are right, this draft does not address the problem of private IP
addresses. But hopefully it will work well toghether with whatever solution
comes out of the discussions about private addresses.

>
>2) Complexity
>
>Do we really need to expose all of this machinery to MNs?  It seems to
>me that a greater degree of transparency (like that provided by THEMA)
>would provide a cleaner architecture.
>
>In this draft, the MN must explicitly realize that it is on a
>regionalized network by looking at the 'I' bit, and must be capable of
>using the new GFA extension.
>

Yes, if it wants to use regional tunnels. RFC2002 MN:s are also supported,
but without regional tunnels.

THEMA handles the case when the MN and the FA are not on the same link. In
the regional tunnel mgmt. draft we assume that they are, and that regional
tunnels are managed by Mobile IP messages. In that case the MN must be
aware of the regional tunnel mgmt. since the replay protection is not
synchronised with the HA in that case.

>3) Security
>
>While most of the regional registration request is protected by a
>mobile-foreign authentication extension, one key piece (the Hierarchical
>Foreign Agent Extension) is not.  Is a denial of service attack possible
>by a MN at a different FA?  Maybe the replay protection between MN and
>GFA will help here but I can imagine cases where that would not be
>sufficient.
>

The Hierarchical Foreign Agent Extension can not be protected by a
mobile-foreign authentication extension, since it is added by a FA.  But
the Hierarchical Foreign Agent Extension can not be changed on the way to
the GFA since we assume that there exist established security associations
among a GFA and the foreign agents beneath it. We have not specified how
this is used, it could be IPSec, or maybe a FA-FA authentication extension
should be defined?

A MN2 at a different FA can not pretend to be MN1 since the GFA will detect
that the mobile-foreign authentication extension is not correct even if it
does not cover the Hierarchical Foreign Agent Extension.

>This draft seems incapable of leveraging any link-layer security that
>may exist, such as in a cellular network.
>

It doesn't assume it, but it doesn't prevent the use of such link-layer
security.

Thanks for your comments,
Annika

>-Pete

---

From: "Casati, Alessio (Alessio)" <[email-masked]>
Date: Thu, 26 Aug 1999 13:53:14 +0100

> but without regional tunnels.
For an operator it may be important to make
regional tunnels work independent of the
MIP stack used. Transparent and Compulsory solutions
(like Thema) are not prone to MN dependencies, i.e.
the operator decides what the behaviour of the network
is. In addition, there's the potential in Thema (and TEP it
borrows from)to support non MIP stack equipped terminals
in accessing networks the operator itself can provide
access to (e.g. internet access). If these two things
I mentioned look good from
an operator point of view, this may make the case
for reaching an understanding of what is the problem we
are trying to solve via regionalized tunnels and
which are the requirements the solution to the
problem should satisfy. Opinions?

Alessio

---

From: "Casati, Alessio (Alessio)" <[email-masked]>
Date: Thu, 26 Aug 1999 23:50:25 +0100

Gerald,

> While this was perhaps true in 2G, it need not be true for all
> 3G. Especially if basestations are connected via IP (such as in the
> case of ICEBERG) - why should you carry all this traffic up to a few
> choke points - rather than route it as directly as possible.
>
On the contrary TDMA systems (GSM/EDGE/ANSI136) may be
more amenable than
UMTS and CDMA2000 (CDMA based 3G) in handling IP close to the
BTS.

This is due to the 3G RAN architectures
that foresee the need of a frame selector/distributor
to handle soft handover.

Economical (and performance) reasons suggest the
frame selector/distributor not to cover a very limited area.

Hence IP will 'emerge' from the lower layers at points
among which it's safe to state handoffs cannot occur very
frequently.

[...]

> In an environment where there is a mix of WLAN and 2G (or 3G) overlays
> - the mobility will have to be handled at the IP layer - since the
> link layers can't talk to each other directly.
>
It's a fair one.
Anyway it's quite a common understanding
that intersystem HO should be possibly
"rate limited", not to mention
interdomain&system HO.

> So I am not convinced that the rate of handoffs will be all that
> low. Considering that I walk through at least 3 different DECT
> environments when I walk 150m to the nearest hot dog vendor - I would
> expect that in the future there will be at least this number of Mobile
> IP networks that I will walk through.
>
I don't expect one to experience too frequent
HO in going to a Hot dogs
vendor, unless one is really hungry
(in which case HO disruptions may not be what
one would really most care about :).

Alessio