Re: [Dime] Fwd: New Version Notification for draft-korhonen-dime-mip6-feature-bits-01

Hi Vijay,

On Jun 11, 2009, at 12:49 AM, Vijay Devarapalli wrote:

> Hi Jouni,
>
> I have a comment on the "VPN Gateway feature". There is no document
> that describes what it means for a Mobile IPv6 home agent to act as a
> VPN gateway. The IKEv2 exchange between the MN and the HA [RFC 4877
> and 5026] already supports mutual authentication, address assignment
> and setting up of tunnel mode ESP SAs. Are you referring to this as
> VPN mode? But isn't this regular Home agent functionality?

The "VPN mode" is when you use HA IKEv2/IPsec functionality purely for  
conventional VPN remote access purposes without any mobility. That  
type of deployment is shortly referenced in draft-ietf-dime-mip6-split  
Section 4.1. I recall this functionality was originally requested by  
Gerardo.

>
>
> Or is there a separate IPsec VPN that is first setup and then Mobile
> IPv6 is run on top of the IPsec tunnels?

As shortly described in split document:

    In some deployment scenarios, the HA may also act as an IKEv2
    Responder for a conventional IPsec VPN access.  The challenge in  
this
    case is that the IKEv2 responder may not know if IKEv2 is used for
    Mobile IPv6 service or for IPsec VPN access service.  A network
    operator needs to be aware of this limitation.  One solution already
    supported by IKEv2 is to use different responder identities when
    operating as a conventional IPsec VPN gateway or as a HA.  The MN  
can
    then indicate the preferred responder type using the appropriate IDr
    payload in the IKE_AUTH message.

But yeah, now that feature bits are taken into a separate document,  
the connection between the above and the new feature bit is rather  
weak. Either we need more text and/or reference in the draft-korhonen- 
dime-feature-bits or just remove the bit all together. Since the  
difference between conventional IKEv2 IPsec VPN gateway part and HA's  
IKEv2 IPsec functionality is rather small, I would keep the feature  
bit and enhance the text instead.

Jouni

>
>
> Vijay
>
> On Wed, Jun 10, 2009 at 2:55 AM, jouni  
> korhonen<jouni.nospam@gmail.com> wrote:
>> Hi all,
>>
>> I have updated the additional feature bits draft. I did remove some  
>> stuff so
>> that the draft now only reserves MIP6-Feature-Vector flag bits and  
>> nothing
>> more. I'll forward the draft soon to RFC editor so if anyone has  
>> comments,
>> please be quick :)
>>
>> Cheers,
>>        Jouni
>>
>> Begin forwarded message:
>>
>>> From: IETF I-D Submission Tool <idsubmission@ietf.org>
>>> Date: June 10, 2009 12:26:53 PM GMT+03:00
>>> To: jouni.nospam@gmail.com
>>> Subject: New Version Notification for
>>>  draft-korhonen-dime-mip6-feature-bits-01
>>>
>>>
>>> A new version of I-D, draft-korhonen-dime-mip6-feature-bits-01.txt  
>>> has
>>> been successfuly submitted by Jouni Korhonen and posted to the IETF
>>> repository.
>>>
>>> Filename:        draft-korhonen-dime-mip6-feature-bits
>>> Revision:        01
>>> Title:           Diameter MIP6 Feature Vector Additional Bit  
>>> Allocations
>>> Creation_date:   2009-06-10
>>> WG ID:           Independent Submission
>>> Number_of_pages: 5
>>>
>>> Abstract:
>>> During the Mobile IPv6 Split Scenario bootstrapping the Mobile IPv6
>>> Home Agent and the Authentication, Authorization, and Accounting
>>> server may exchange a set of authorized mobility capabilities.  This
>>> document defines new mobility capability flags that are used to
>>> authorize per Mobile Node route optimization, Multiple Care-of
>>> Address and user plane traffic encryption support.  Furthermore,  
>>> this
>>> document also defines a capability flag of indicating whether the
>>> Home Agent is authorized to act as a stand alone Virtual Private
>>> Network gateway.
>>>
>>>
>>>
>>> The IETF Secretariat.
>>>
>>>
>>
>> _______________________________________________
>> DiME mailing list
>> DiME@ietf.org
>> https://www.ietf.org/mailman/listinfo/dime
>>