Subject: [mobile-ip] regarding ICMP destination unreachable message

From: [email-masked]
Date: Sat, 7 Dec 2002 15:25:11 +0530

hello all,
    consider a scenario that HA is doing a proxy for a MN. HA intercepts
the packet from a CN for that MN.
It encapsulates(encrypts) the packet  and tunnels it to MN and at that
instance MN is down.  Hence HA will receive ICMP destination unreachable
message which it has to send it back to CN. But the problem is that the
payload of the ICMP packet received by HA is the encryped one.(which only
MN can decrypt).
   So HA wont be able to know the destination address of CN. hence it cant
send  the ICMP packet to CN.

how to handle this scenario???

regards
  gaurav

---

From: Greg Daley <[email-masked]>
Date: Mon, 09 Dec 2002 11:45:59 +1100

Hi Gaurav,

This is a generic IPSec tunnelling issue,
and is partially covered by RFC 2401.

The issue is analogous to the PMTU issue,
although the danger of handling unauthenticated
ICMPv6 Destination unreachable messages is greater.

If the unreachable message is processed (trusted),
then the HA can use the same mechanisms prescribed
in 2401:

Pass the message back to the IPSec processing system,
and try to match the packet source based on SPI
reported in the ESP Header (from the error message).
This will not work for generic MIPv6 tunnelling, but a
fallback which allows the SA/SPD to be marked with the
received error state (used in PMTU processing to report
the new tunnel MTU) could be used to indicate tunnel
unreachability (for some period).

This could be used to set unreachability before the
next packet for that SA is encapsulated, so subsequent
packets can receive the unreachable message from the HA.

Whether this is a good idea with unreachables, depends
on the security of the routing infrastructure.

Greg Daley