RE: [Mip6] Review of draft-ietf-mip6-firewalls-00.txt (with referenceto draft-chen-mip6-gprs-02.txt)

Hello James,

Thank you for the clarifications.

> If you want to make it clearer, would you have any suggestion?
> 
> jak>> Draft-chen takes each individual case and examines it 
> in detail. For
> example, Section 4.1.1.1:
[...] 
> I think it would be more helpful for readers to understand 
> the problem if
> each case (MN inside behind firewall and HA outside, MN outside and HA
> inside, etc.) were analyzed individually to the same level of 
> detail as in
> draft-chen and Section 3.1.1.
> jak>>>(end)

Ok. In the next version of the draft, we will try to follow your suggestion to make the description of the problem clearer.

> For the other scenarios you pointed out, I agree with you. 
> They are not in
> the scope of the document. We described some of the issues, 
> and specifically
> focused on the basic ones. I will add an explicit statement 
> in the document
> to explain that the scenarios you mentioned are not included.
> 
> jak>>> I'm not clear what you mean. Is this document intended to be a
> comprehensive exploration of the problems involved in 
> firewall interaction
> with MIPv6 or not? If not, then we clearly need another document that
> explores the problems this one doesn't.

The initial intent of the document was not to list all the possible problems between the Mobile IPv6 protocol and firewalls, but to describe the main ones. However we could include the scenarios you just described in the next version of the draft.

> > Section 3.2.2, Paragraph 10: The discussion doesn't consider
> > the distinction
> > between a TCP and UDP session. Earlier in the text, the
> > description of the
> > state maintained in the firewall implies a distinction. But
> > if a MIPv6 host
> > is receiving TCP packets tunneled from the HA, then the
> > firewall state will
> > be for UDP (presuming it is set up at all). The firewall
> > timers for UDP may
> > interact negatively with the MN's TCP timeouts, and there 
> may be other
> > problems.
> 
> Can you please clarify what you mean?
> 
> jak>>> Sorry, I wasn't thinking clearly here. Obviously, the 
> firewall will
> step over the IP packet header and set up the proper state 
> for TCP. There's
> only an issue if a UDP tunnel is used, such as would be the 
> case for IPsec,
> and even in that case, it's not clear how serious the problem 
> would be.
> jak>>>(end)
> 
> jak>> Hope that helps.

Yes, thank you.

Franck

_______________________________________________
Mip6 mailing list
Mip6@ietf.org
https://www1.ietf.org/mailman/listinfo/mip6