Re: [Dime] Fwd: New Version Notification for draft-korhonen-dime-mip6-feature-bits-01

[jouni <[e-mail]>]

Hi Behcet,

I-WLAN PDG is not exactly the same as ePDG. And one can implement  
boxes that are not entirely the same as drawn is some SDO architecture.

Cheers,
	Jouni


On Jun 17, 2009, at 10:39 PM, Behcet Sarikaya wrote:

>
> Hi Jouni,
>   I have no comment on your points below except this one:
> Well.. feature in a sense that you have both functionalities in the  
> same box anyway. Stretching my memory on the requirements, this came  
> from the cases where an I-WLAN PDG and a HA were to be bundled  
> together.
>
> I don't think ePDG and HA can be bundled together in 3GPP  
> architecture. HA is at the PDN Gateway an entity above PDG.
>
> Regards,
>
> Behcet
>
>
>
> ----- Original Message ----
> From: jouni korhonen <[e-mail]>
> To: Vijay Devarapalli <[e-mail]>
> Cc: [e-mail]
> Sent: Tuesday, June 16, 2009 5:27:44 AM
> Subject: Re: [Dime] Fwd: New Version Notification for draft-korhonen- 
> dime-mip6-feature-bits-01
>
> Hi Vijay,
>
> On Jun 16, 2009, at 3:32 AM, Vijay Devarapalli wrote:
>
>> Hi Jouni,
>>
>> On Wed, Jun 10, 2009 at 11:03 PM, jouni korhonen<[e-mail] 
>> > wrote:
>>> Hi Vijay,
>>>
>>>
>>> On Jun 11, 2009, at 12:49 AM, Vijay Devarapalli wrote:
>>>
>>>> Hi Jouni,
>>>>
>>>> I have a comment on the "VPN Gateway feature". There is no document
>>>> that describes what it means for a Mobile IPv6 home agent to act  
>>>> as a
>>>> VPN gateway. The IKEv2 exchange between the MN and the HA [RFC 4877
>>>> and 5026] already supports mutual authentication, address  
>>>> assignment
>>>> and setting up of tunnel mode ESP SAs. Are you referring to this as
>>>> VPN mode? But isn't this regular Home agent functionality?
>>>
>>> The "VPN mode" is when you use HA IKEv2/IPsec functionality purely  
>>> for
>>> conventional VPN remote access purposes without any mobility.
>>
>> Again, what does this mean? When you run IKEv2 as described in RFC
>> 4877 and 5026, you are creating tunnel mode security associations for
>> a *Mobile IPv6 tunnel*. In the "VPN" mode, does the mobile node  
>> switch
>> of the Mobile IPv6 stack?
>
> VPN mode is plain RFC4306 + 4303 etc. You end up implementing that  
> machinery there in any case, so why not allow using a HA as a VPN  
> gateway as well. In this case, there is no mobility involved.
>
>>
>> Or does the Home Agent behave an IPsec VPN gateway for pure IPsec
>> clients, i.e., there is no Mobile IPv6 stack on these clients.
>
> Yes.
>
>
>>
>>
>>> That type of
>>> deployment is shortly referenced in draft-ietf-dime-mip6-split  
>>> Section 4.1.
>>> I recall this functionality was originally requested by Gerardo..
>>
>> It doesn't make sense to me. :) This looks more like co-locating a
>> Mbile IPv6 home agent and an IPsec VPN gateway and supporting both
>> Mobile IPv6 mobile nodes and plain IPsec clients at the same time.
>
> Yes, it is about co-location. To me it makes sense as much as  
> IKEv2+IPsec with MIP6 ;)
>
>
>>
>>
>> There has to be more to this scenario than just the short paragraph  
>> in
>> draft-ietf-dime-mip6-split.
>
> Yes, agree.
>
>
>>
>>
>>>> Or is there a separate IPsec VPN that is first setup and then  
>>>> Mobile
>>>> IPv6 is run on top of the IPsec tunnels?
>>>
>>> As shortly described in split document:
>>>
>>>   In some deployment scenarios, the HA may also act as an IKEv2
>>>   Responder for a conventional IPsec VPN access.  The challenge in  
>>> this
>>>   case is that the IKEv2 responder may not know if IKEv2 is used for
>>>   Mobile IPv6 service or for IPsec VPN access service.  A network
>>>   operator needs to be aware of this limitation.  One solution  
>>> already
>>>   supported by IKEv2 is to use different responder identities when
>>>   operating as a conventional IPsec VPN gateway or as a HA.  The  
>>> MN can
>>>   then indicate the preferred responder type using the appropriate  
>>> IDr
>>>   payload in the IKE_AUTH message.
>>>
>>> But yeah, now that feature bits are taken into a separate  
>>> document, the
>>> connection between the above and the new feature bit is rather  
>>> weak. Either
>>> we need more text and/or reference in the draft-korhonen-dime- 
>>> feature-bits
>>> or just remove the bit all together. Since the difference between
>>> conventional IKEv2 IPsec VPN gateway part and HA's IKEv2 IPsec  
>>> functionality
>>> is rather small, I would keep the feature bit and enhance the text  
>>> instead.
>>
>> It is not "rather small" in my opinion. I don't understand how
>> supporting plain IPsec clients can be a feature on a Mobile IPv6 home
>> agent. :)
>
> Well.. feature in a sense that you have both functionalities in the  
> same box anyway. Stretching my memory on the requirements, this came  
> from the cases where an I-WLAN PDG and a HA were to be bundled  
> together.
>
> Jouni
>
>
>>
>>
>> Vijay
>>
>>>
>>> Jouni
>>>
>>>
>>>>
>>>>
>>>> Vijay
>>>>
>>>> On Wed, Jun 10, 2009 at 2:55 AM, jouni korhonen<[e-mail] 
>>>> >
>>>> wrote:
>>>>>
>>>>> Hi all,
>>>>>
>>>>> I have updated the additional feature bits draft. I did remove  
>>>>> some stuff
>>>>> so
>>>>> that the draft now only reserves MIP6-Feature-Vector flag bits and
>>>>> nothing
>>>>> more. I'll forward the draft soon to RFC editor so if anyone has
>>>>> comments,
>>>>> please be quick :)
>>>>>
>>>>> Cheers,
>>>>>       Jouni
>>>>>
>>>>> Begin forwarded message:
>>>>>
>>>>>> From: IETF I-D Submission Tool <[e-mail]>
>>>>>> Date: June 10, 2009 12:26:53 PM GMT+03:00
>>>>>> To: [e-mail]
>>>>>> Subject: New Version Notification for
>>>>>>   draft-korhonen-dime-mip6-feature-bits-01
>>>>>>
>>>>>>
>>>>>> A new version of I-D, draft-korhonen-dime-mip6-feature- 
>>>>>> bits-01.txt has
>>>>>> been successfuly submitted by Jouni Korhonen and posted to the  
>>>>>> IETF
>>>>>> repository.
>>>>>>
>>>>>> Filename:        draft-korhonen-dime-mip6-feature-bits
>>>>>> Revision:        01
>>>>>> Title:          Diameter MIP6 Feature Vector Additional Bit  
>>>>>> Allocations
>>>>>> Creation_date:  2009-06-10
>>>>>> WG ID:          Independent Submission
>>>>>> Number_of_pages: 5
>>>>>>
>>>>>> Abstract:
>>>>>> During the Mobile IPv6 Split Scenario bootstrapping the Mobile  
>>>>>> IPv6
>>>>>> Home Agent and the Authentication, Authorization, and Accounting
>>>>>> server may exchange a set of authorized mobility capabilities.   
>>>>>> This
>>>>>> document defines new mobility capability flags that are used to
>>>>>> authorize per Mobile Node route optimization, Multiple Care-of
>>>>>> Address and user plane traffic encryption support.   
>>>>>> Furthermore, this
>>>>>> document also defines a capability flag of indicating whether the
>>>>>> Home Agent is authorized to act as a stand alone Virtual Private
>>>>>> Network gateway.
>>>>>>
>>>>>>
>>>>>>
>>>>>> The IETF Secretariat.
>>>>>>
>>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> DiME mailing list
>>>>> [e-mail]
>>>>> https://www.ietf.org/mailman/listinfo/dime
>>>>>
>>>
>>>
>
> _______________________________________________
> DiME mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/dime
>
>
>
>
>