Subject: RE: Piggybacking: final thoughts ? Was RE: [mobile-ip] MIPv6 - Fo cus of the security discussion

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Thu, 25 Oct 2001 13:58:38 +1000

>  
> this is continuing to be a long discussion. Anyway, I think we are
> probably converging on some issues. Let me make a (bold) try in
> summarizing the discussion.
>  
> - "tight channel" is the main focus. 
> - I say on such a channel, HC is likely used. You have concurred. My claim
> is HC will work with piggybacking. You seem to agree. However, there is
> something below to iron out.
> - My position is that if a link supports IPv6, destination option is a
> given. You seem to agree. I say this means it is supporting piggybacking.
> You say if it does, it has performance issues. I say we don't design based
> on a link's performance..
> - Service disruption is moot to me. See comments below.
> 
	=> OK great, I'm glad you went to the bottom of it. Minimising
service
	disruption is definitely not moot to some of us. I have customers
	that are interested in minimising service disruption, but 
	that's out of the list's scope. 
>  
> Finally, my position is that removing piggybacking is not an option. 
> 
	=> That's fine, but it was good to know
	the motives. Anyway, I attempted to provide alternatives
	so let's see what others tink.

> However, including some text in the draft stating that some links MAY have
> performance issues to consider when piggybacking is fine with me. I think
> this may be the way forward.
> 
	=> I don't think this is enough. We have seen that it is 
	an e2e problem. Without providing a concrete fix I think
	the problem still stands. I think we've discussed this 
	just about enough and I'll get out before the circle 
	starts again, but I have one comment below.
>   
> 
> 
> => I didn't refer to piggybacking ! They violate MIPv6 which clearly 
> states that forwarding to a new CoA must be done based on 
> the reception of an authenticated BU. They don't violate 
> the base IPv6, but MIPv6. Is that allowed ? If so then I 
> don't understand the "violation" argument. 
> 
> 
> [Rajeev]  This is a good argument to discuss. In FMIPv6 at least, if you
> keep the old CoA, there is no requirement for BU. If the network does host
> routing, it is not violating anything either. So, I am not sure what they
> are violating..
> 
	=> We're talking about MIPv6, right ? As I'm sure you're aware, 
	the decision of the oAR (acting like a HA) to forward packets
	to another address is only allowed when an authenticated BU is 
	received. Now if you're saying host routes are used in the 
	domain, what is propagating these host routes ?
	As far as I can see, in FMIPv6 the oAR either tunnels
	to the new CoA, or to the nAR (BETH). There was no 
	protocol designed to propagate host routes, unless
	you're assuming the MN is running a routing protocol, 
	which is certainly not the case in FMIPv6. 

	Regards,
	Hesham