Re: [EME] Traversing HIP-aware NATs and Firewalls: Problem Statement andRequirements

Hi Paul,

Paul Francis wrote:
> Hi Hannes,
>
> I'm responding to your emails out of order...
>
> This draft certainly is relevant.  I would not claim to have been intimately
> familiar with it when we wrote the EME drafts, but speaking for myself I was
> vaguely aware of it.  (As you can see, we were quite lazy about citing much
> of anything.  Especially the design draft is meant to trigger getting
> feedback...it is certainly our intent to do a better job with citations once
> we think we are on the right track.)
>   
Hmmm.

> As far as the HIP nat traversal stuff relates to NUTSS, Am I right in saying
> that it suffers from the problem of assymetric paths (i.e. with multihomed
> sites)?  If this is the case, then NUTSS seems very complimentary to HIP (as
> Tom and others are suggesting).
>   
It depends what you call "suffer". There are various ways to solve these 
problems. It is just not beautiful when NAT/Firewall traversal is dumped 
into HIP. It works nicely when you use other protocols that are designed 
for this purpose.

On the other hand, stateful packet filtering firewalls just don't work 
nicely with asymmetric paths. It's just the way how they work; it's 
their purpose.

> Sorry if this is a stupid question, but am I right in assuming that with hip
> nat/fw traversal, the middleboxes can authenticate the HIP setup, but not
> data packets themselves (which after all are vanilla IPSec packets)
>   
That's true unless you use
* digitally sign each packet
* Establish IPsec tunnels recursively, or
* use something similar to the stuff suggested in 
http://www.ambient-networks.org/docs/Advanced_HIP_based_Firewall_Traversal.pdf 

But again, there is the question why you actually need this functionality.

Ciao
Hannes

> PF
>
>  
>
>   
>> -----Original Message-----
>> From: Hannes Tschofenig [mailto:Hannes.Tschofenig@gmx.net] 
>> Sent: Monday, June 18, 2007 4:09 PM
>> To: eme@irtf.org
>> Subject: [EME] Traversing HIP-aware NATs and Firewalls: 
>> Problem Statement andRequirements
>>
>> This document might be related and relevant:
>> http://www.tschofenig.com/drafts/draft-tschofenig-hiprg-hip-na
>> tfw-traversal-04.txt
>>
>> I wonder whether someone ever looked at it.
>>
>>
>>
>> _______________________________________________
>> EME mailing list
>> EME@irtf.org
>> https://www1.ietf.org/mailman/listinfo/eme
>>
>>     

_______________________________________________
EME mailing list
EME@irtf.org
https://www1.ietf.org/mailman/listinfo/eme