Re: [Mip4] 3344bis clarification on identifying the FA's SA

Hi Kent,

On 2005-01-20 12:25 am Kent Leung said the following:
> Hi.  I realized during our Deregistration/FHAE discussions that
> we assumed that the FA's SA is indexed by the source IP address of the
> RRQ on the HA.  But it's not explicitly clear in RFC 3344 (going back to
> RFC 2002) that source IP address is the method to identify the FA since
> CoA may also be used.
> 
> So this leaves ambiguity in implementation and also introduces deployment
> issues where the SA is configured based on CoA.
> 
> I think we should clearly state some text to avoid ambiguity?  Something like
> "The FA or HA is identified by the source IP address of the registration
> message.  This IP address and the SPI is used to index the security
> association to authenticate the message."
> 
> Thoughts?

I suspect that the reason this has not been raised before is that before
we introduced NAT traversal into the equation, it was an unstated
assumption that the source IP address and the CoA address would be the same.

Indeed, it is this assumption which is the base for detection of NATs in
3519 - if src address and CoA address differ, then you say "Ah, this
packet has gone through a NAT".

So one way of clearing up the ambiguity could be the text you propose;
another could be to clearly state that the FA sends the reply with the
source address equal to the Care-of Address, typically through the
interface having this address.

There may be other ones too, and I'm not sure which is the best way to go
here.

One question which pops into my head, though, is why base this on the src
address, in preference to the CoA?  It would be interesting to hear your
reasoning here.  Which one we pick may impact a 3519bis (NAT traversal)
document more or less...

	Henrik

Re: [Mip4] 3344bis clarification on identifying the FA's SA

Attachment: signature.asc