Subject: Re: [mobile-ip] Mobile Routers support without optimization

From: James Kempf <[email-masked]>
Date: Mon, 20 Aug 2001 09:19:58 -0700 (PDT)

Erik,

>I think the design space is quite large.
>One case is when the MNNs are statitionary with respect to the MR
>and don't observe that the MR is moving. In those cases I suspect
>that there are limits to the amount of route optimization possible
>since, depending on the actual model for securing BUs, it might be hard
>or impossible for a 3rd party like the MR to send BUs for its MNNs.
>

Alex and I had an email exchange last week where I think we worked
out how it would be possible to do it. The MR exchanges a BU
with the CNs. The BU contains the MR's CoA and a prefix for the 
subnet that the MR is routing. The CNs set up a tunnel to the MR
in which they send packets routed to the MNNs behind the MR. Similarly,
the MR needs to set up a tunnel to the CNs for outgoing packets, because
the mobile network prefix will not be in the routing tables of the
wired network.

There is still triangle (actually quadralateral) routing but
the advantage over doing the routing through the HA is that the leg
from the CNs to the MR goes more or less through the "natural"
path it would take if there were no tunnel. If all traffic
is tunnelled through the HA, the off leg is much longer.

The security properties in this case seem, on first glance, to
be similar to regular MIP. The only issue is whether the MR
is allowed to route the prefix it claims it is allowed to
route. Even though the CN can authenticate the BU and CoA, it
does not necessarily mean that the node claiming to be a MR
is allowed to route the prefix. Perhaps something could be
set up through the HA when the CN first makes contact
with the MNN so that the HA could inform the CN that the MR
is allowed to route that prefix (or not, as the case may be).

Is there any thing missing in this solution?

>But if the MNNs are made aware that the MR is moving then they can use
>the regular BU mechanism for route optimization.
>This would more complex than MIPv6 today. For example, such MNNs would need
>3 different addresses as  far as I can tell:
> - Home Address
> - Long-term stable CoA associated with the MR's home prefix
>   This only changes when the MNN moves between MRs.
>   Traffic sent to this address will go through the MR's home agent.
> - Temporary CoA associated with the MR's CoA prefix (which the MR acquires as
>   it moves).
>
>Depending on movement rate and traffic patterns the MNN can then choose
>which correspondents to update with the temporary CoA, the stable CoA,
>or not update at all.
>

It seems somewhat impractical to require that nodes behind a
mobile router be mobile aware. What if I buy a laser printer for
my cruise ship network? Or bring one along on a cruise? It probably isn't mobile 
aware. 

I agree that there are cases where the MNNs will be mobile aware, in
particular, when they are capable of being stand-alone MNs in the standard
MIP sense. In those cases, your scheme of three addresses might
work, though it seems somewhat complex to me. And it would require
additional mechanism over and above standard MIP.

In the case where a standard MIP capable MN attaches to a mobile
network, it would  seem simpler if the MR acted as a standard AR
in the MIP sense. The MN would get a CoA using either stateful
or stateless address autoconfig, reporting it to its HA. The
CoA is on the mobile network, and the MR uses the procedure outlined
above to route optimize (or a NAT, yuk!), or perhaps it doesn't route optimize
and routes everything through the HA. The only change needed would be some way 
for the MR to tell the MN to supress sending BUs, since the MR will be taking 
care of that. 

>IMHO the current 3G model for devices connected through a cell phone
>are quite limited - makes the cell phone into some form
>of PPP relay.
>A router is the IETF model for devices that connect between dissimilar L2
>technologies (and also in many cases between the same L2 technologies).
>
>So let's not get distracted my the limits of what folks might be currently
>building while trying to understand the size and shape of the design space.
>

While I certainly agree that the 3G model is limited, I think much
of the emphasis to come up with a solution to the MR problem is
driven by that model. My feeling is that if we can come up with
a solution that solves the short term problem based on some simple
extensions of MIP, perhaps we can then move to a more comprehensive solution for 
mobile routers that has wider applicability. If we try to solve
the long term problem by casting everything into the MIP framework,
I'm  afraid we may be ruling out solutions that would handle complex
cases far more easily and may also provide better solutions to
the simple cases (in the long run). Contrawise, if we ignore the short
term solution, we may end up with people doing suboptimal or
architecturally questionable things (like NATs?).

		jak

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 20 Aug 2001 18:54:44 +0200 (CEST)

> with the CNs.

And how do you propose solve the authorization issue for the BU?

To the WG:

I'm seriously starting to feel like a broken record - do people still feel
like security can be added as an afterthought?
Unless security (authentication and authorization) is thought of up front
I don't see how the WG can make progress.

> is allowed to route that prefix (or not, as the case may be).

And when the HA and MR conspire to fool a random CN?

> my cruise ship network? Or bring one along on a cruise? It probably isn't
> mobile  aware. 

But you might not need to optimize for random CN's accessing your printer :-)

Seriously, there might be some relationship between devices being globally
accessible and wanting to be MNs in their own right, which might feed
into thinking about where optimizations make sense.

> additional mechanism over and above standard MIP.

It isn't clear to me that it requires additional e2e protocols.
It would definitely require different behavior on such an MNN.
(But I'm thing about the requirements space more than the solution space
at the moment.)

   Erik

---

From: Michael Thomas <[email-masked]>
Date: Mon, 20 Aug 2001 12:51:19 -0700 (PDT)

> I don't see how the WG can make progress.

It's probably useful to go back to first
principles here. That is, who in the triangular
path between MN, HA and CN actually knows whether
MN should be allowed to assert the prefix it is
trying to bind (assuming no global prefix PKI, of
course)? One thing is for certain, it's not
necessarily the HA. In fact, I'm going to guess
that it's probably at the edge of the CN's BGP AS
that you really have concrete knowledge. Ie does
the HA's AS advertise this (summarized) prefix or
not?

Indeed, it's not entirely clear that the CN is
really the one that should be the target of the
BU.

		Mike