Re: [Mip6] WG Last call: draft-ietf-mip6-ikev2-ipsec-06.txt

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

    > => I consider the HAO as a degenerated tunnel so you have double
    > tunneling (one tunnel for IPsec, one for MIPv6) when obviously only
    > one is needed.
   
   => Understood. I do think this is a matter of taste though not
   architecture.
   
=> yes, it is a matter of taste about an architectural view of things...

    >    I think
    >    it's a more "correct" use of IPsec to not use tunnel mode
    >    between two end nodes.
    > 
    > => but is the right end the HA or the CN (:-)?
   
   => It's always the HA as far as IPsec is concernced. In some
   cases the messages are processed by the HA (BU, MPD), in others
   the HA is treated like a security GW (HOTI, payload). So as far as
   IPsec is concerned the end node is always the HA. The fact that 
   the packet is then forwarded somewhere else is irrelevant to IPsec. 
   
=> for IPsec the transport mode is strictly end-to-end so either
the real end node is the CN and tunnel mode is required, or the
tunnel between MN-HA and the forwarding to/from CN is part of the
"MIPv6 application" and my concern about double tunneling is more
important. BTW the term SG (security gateway) implies tunnel mode.
   
Regards

[e-mail]

_______________________________________________
Mip6 mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mip6