Re: [Int-area] Rethink on Mobile IPv6

Raj:

I agree with your point that IPsec support is one of the complex areas of
the Mobile IPv6 protocol definition. Lack of standardized interfaces to
IPsec module, the needed interactions between Mobile IPv6 and Ipsec modules,
never made the protocol an easy implementation. And the recent new
extension, Dual-stack Mobile IPv6 support, surely took the complexity to a
new level. Not to trivialize the efforts, the solution under the given
constraints is probably the best chosen approach. We can blame NAT Traversal
support, or may be its the nature of the requirement, but the resulting
protocol is an implementation nightmare and we cannot deny that.

However, I'm not sure if this is the sole reason for the lack of protocol
adoption. As I see it the issues are multifold.

1. We have not realized that the protocols we develop at IETF have zero
value, if the approaches are not aligned with the SDO interests and if there
is no adoption of those protocols.

2. We do not respond to the SDO needs in a time bound manner. We are taking
years to standardize and deliver a feature, and in the process we are
hurting the protocol adoption. Looking at NETEXT WG, after two years of
debate, we barely made any progress, leaving the 3GPP group confused, as
when the IETF will provide the needed solutions.

Bottom line, I agree with your argument principle, that if the SDO groups
have a true need for alternative security approaches, we need to realize
that and provide the needed solutions, and in a time bound manner. And if
that is indeed the issue. I do realize that there are some elements in the
protocol that are surely adding to the protocol complexity and we should
make efforts to simplify it. And above all, we need to make sure the design
approaches are aligned with the SDO interests, IMO, that is probably the
bigger issue.

Regards
Sri

On 3/3/10 7:55 AM, "Basavaraj.Patil@nokia.com" <Basavaraj.Patil@nokia.com>
wrote:

> 
> Mobile IPv6 (RFC3775) has been an RFC since 2004, and Dual-stack
> Mobile IPv6 (RFC5555) since 2009. Implementations of the protocol has
> been lacklustre to say the least. Several SDOs have considered MIP6
> and DSMIP6 as a solution for interworking and mobility between
> different access technologies and only 3GPP has adopted it in a very
> limited manner for Rel 8 (for use on the S2c interface) with the
> likelihood of it being actually deployed quite low (IMO).
> 
> While there are many reasons that can be attributed to the lack of
> implementations and use, one that I would like to raise is the the
> concern with the overly complex security model that MIP6/DSMIP6 relies
> on today. MIP6/DSMIP6 requires IPsec and IKE/IKEv2 (RFC3776/4877) to
> secure the signaling between the MN and HA. The fundamental purpose of
> MIP6/DSMIP6 is to provide mobility to hosts. At a very high level the
> MIP6/DSMIP6 protocol boils down to the ability to setup a tunnel
> between the MN and HA and update the MN tunnel end-point whenever
> there is a change in the associated IP address (CoA). The signaling to
> establish the tunnel needs to be secure. But using a protocol like
> IKEv2 and IPsec to achieve this security is just an overkill. It
> increases the complexity of the implementation as a result of many
> factors that have been captured in I-D:
> draft-patil-mext-mip6issueswithipsec and discussed in the MEXT WG
> meetings. 
> 
> Given the objective of the protocol is to enable IP mobility for hosts,
> it should focus on doing that well in a manner that makes it easy to
> implement/adopt/deploy/scale. My opinion as a result of implementation
> experience is that MIP6/DSMIP6 can be significantly simplified,
> especially the security architecture. The protocol as specified
> currently in RFC3775/RFC5555 is a kitchensink of features. Getting back
> to basics of simply establishing a tunnel between the MN and HA and
> managing that tunnel is all that is needed and would potentially see
> the light of day in the real world.
> 
> You may want to call it as Mobile IPv6-lite if you wish. But I do
> believe that a simplification of the protocol is needed without which
> I fear it will remain an academic exercise with many years spent in
> developing a spec. I hope the working group and people who are
> involved in mobility related work would consider undertaking such an
> effort in the IETF.
> 
> -Basavaraj
> 
> _______________________________________________
> Int-area mailing list
> Int-area@ietf.org
> https://www.ietf.org/mailman/listinfo/int-area