Re: [Dime] Fwd: New Version Notification for draft-korhonen-dime-mip6-feature-bits-01

[Behcet Sarikaya <[e-mail]>]

Hi Jouni,
  I have no comment on your points below except this one:
Well.. feature in a sense that you have both functionalities in the same box anyway. Stretching my memory on the requirements, this came from the cases where an I-WLAN PDG and a HA were to be bundled together.

I don't think ePDG and HA can be bundled together in 3GPP architecture. HA is at the PDN Gateway an entity above PDG.

Regards,

Behcet



----- Original Message ----
From: jouni korhonen <[e-mail]>
To: Vijay Devarapalli <[e-mail]>
Cc: [e-mail]
Sent: Tuesday, June 16, 2009 5:27:44 AM
Subject: Re: [Dime] Fwd: New Version Notification for draft-korhonen-dime-mip6-feature-bits-01

Hi Vijay,

On Jun 16, 2009, at 3:32 AM, Vijay Devarapalli wrote:

> Hi Jouni,
> 
> On Wed, Jun 10, 2009 at 11:03 PM, jouni korhonen<[e-mail]> wrote:
>> Hi Vijay,
>> 
>> 
>> On Jun 11, 2009, at 12:49 AM, Vijay Devarapalli wrote:
>> 
>>> Hi Jouni,
>>> 
>>> I have a comment on the "VPN Gateway feature". There is no document
>>> that describes what it means for a Mobile IPv6 home agent to act as a
>>> VPN gateway. The IKEv2 exchange between the MN and the HA [RFC 4877
>>> and 5026] already supports mutual authentication, address assignment
>>> and setting up of tunnel mode ESP SAs. Are you referring to this as
>>> VPN mode? But isn't this regular Home agent functionality?
>> 
>> The "VPN mode" is when you use HA IKEv2/IPsec functionality purely for
>> conventional VPN remote access purposes without any mobility.
> 
> Again, what does this mean? When you run IKEv2 as described in RFC
> 4877 and 5026, you are creating tunnel mode security associations for
> a *Mobile IPv6 tunnel*. In the "VPN" mode, does the mobile node switch
> of the Mobile IPv6 stack?

VPN mode is plain RFC4306 + 4303 etc. You end up implementing that machinery there in any case, so why not allow using a HA as a VPN gateway as well. In this case, there is no mobility involved.

> 
> Or does the Home Agent behave an IPsec VPN gateway for pure IPsec
> clients, i.e., there is no Mobile IPv6 stack on these clients.

Yes.


> 
> 
>> That type of
>> deployment is shortly referenced in draft-ietf-dime-mip6-split Section 4.1.
>> I recall this functionality was originally requested by Gerardo..
> 
> It doesn't make sense to me. :) This looks more like co-locating a
> Mbile IPv6 home agent and an IPsec VPN gateway and supporting both
> Mobile IPv6 mobile nodes and plain IPsec clients at the same time.

Yes, it is about co-location. To me it makes sense as much as IKEv2+IPsec with MIP6 ;)


> 
> 
> There has to be more to this scenario than just the short paragraph in
> draft-ietf-dime-mip6-split.

Yes, agree.


> 
> 
>>> Or is there a separate IPsec VPN that is first setup and then Mobile
>>> IPv6 is run on top of the IPsec tunnels?
>> 
>> As shortly described in split document:
>> 
>>  In some deployment scenarios, the HA may also act as an IKEv2
>>  Responder for a conventional IPsec VPN access.  The challenge in this
>>  case is that the IKEv2 responder may not know if IKEv2 is used for
>>  Mobile IPv6 service or for IPsec VPN access service.  A network
>>  operator needs to be aware of this limitation.  One solution already
>>  supported by IKEv2 is to use different responder identities when
>>  operating as a conventional IPsec VPN gateway or as a HA.  The MN can
>>  then indicate the preferred responder type using the appropriate IDr
>>  payload in the IKE_AUTH message.
>> 
>> But yeah, now that feature bits are taken into a separate document, the
>> connection between the above and the new feature bit is rather weak. Either
>> we need more text and/or reference in the draft-korhonen-dime-feature-bits
>> or just remove the bit all together. Since the difference between
>> conventional IKEv2 IPsec VPN gateway part and HA's IKEv2 IPsec functionality
>> is rather small, I would keep the feature bit and enhance the text instead.
> 
> It is not "rather small" in my opinion. I don't understand how
> supporting plain IPsec clients can be a feature on a Mobile IPv6 home
> agent. :)

Well.. feature in a sense that you have both functionalities in the same box anyway. Stretching my memory on the requirements, this came from the cases where an I-WLAN PDG and a HA were to be bundled together.

Jouni


> 
> 
> Vijay
> 
>> 
>> Jouni
>> 
>> 
>>> 
>>> 
>>> Vijay
>>> 
>>> On Wed, Jun 10, 2009 at 2:55 AM, jouni korhonen<[e-mail]>
>>> wrote:
>>>> 
>>>> Hi all,
>>>> 
>>>> I have updated the additional feature bits draft. I did remove some stuff
>>>> so
>>>> that the draft now only reserves MIP6-Feature-Vector flag bits and
>>>> nothing
>>>> more. I'll forward the draft soon to RFC editor so if anyone has
>>>> comments,
>>>> please be quick :)
>>>> 
>>>> Cheers,
>>>>      Jouni
>>>> 
>>>> Begin forwarded message:
>>>> 
>>>>> From: IETF I-D Submission Tool <[e-mail]>
>>>>> Date: June 10, 2009 12:26:53 PM GMT+03:00
>>>>> To: [e-mail]
>>>>> Subject: New Version Notification for
>>>>>  draft-korhonen-dime-mip6-feature-bits-01
>>>>> 
>>>>> 
>>>>> A new version of I-D, draft-korhonen-dime-mip6-feature-bits-01.txt has
>>>>> been successfuly submitted by Jouni Korhonen and posted to the IETF
>>>>> repository.
>>>>> 
>>>>> Filename:        draft-korhonen-dime-mip6-feature-bits
>>>>> Revision:        01
>>>>> Title:          Diameter MIP6 Feature Vector Additional Bit Allocations
>>>>> Creation_date:  2009-06-10
>>>>> WG ID:          Independent Submission
>>>>> Number_of_pages: 5
>>>>> 
>>>>> Abstract:
>>>>> During the Mobile IPv6 Split Scenario bootstrapping the Mobile IPv6
>>>>> Home Agent and the Authentication, Authorization, and Accounting
>>>>> server may exchange a set of authorized mobility capabilities.  This
>>>>> document defines new mobility capability flags that are used to
>>>>> authorize per Mobile Node route optimization, Multiple Care-of
>>>>> Address and user plane traffic encryption support.  Furthermore, this
>>>>> document also defines a capability flag of indicating whether the
>>>>> Home Agent is authorized to act as a stand alone Virtual Private
>>>>> Network gateway.
>>>>> 
>>>>> 
>>>>> 
>>>>> The IETF Secretariat.
>>>>> 
>>>>> 
>>>> 
>>>> _______________________________________________
>>>> DiME mailing list
>>>> [e-mail]
>>>> https://www.ietf.org/mailman/listinfo/dime
>>>> 
>> 
>> 

_______________________________________________
DiME mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dime