[Mip6] [issue44] Review by Steve Bellovin: Section 5.3

New submission from Hannes Tschofenig <hannes.tschofenig@siemens.com>:

Steve wrote: 
> >
> >5.3:
> >	It's generally safe to permit ESP traffic to a known-locked down
> >	host.  If there's a generic HA, it can be a valid recipient of
> >	IPsec without compromising network security.  The same applies
> >	to Issue 2.  Issue 3 is the same situation described earlier.

Hannes: 

i agree that some network administrators might allow IPsec protected data 
traffic to known hosts inside their network to bypass. they, however, need to 
be told that this is an issue with mobile ip. 

to reflect your comment let me make a proposal to change section 5.3 from: 

"
5.3  Scenario where the HA is in a network protected by firewall(s)

   Let's consider a MN moving into a network protected by firewall(s).
   The following issues may exist:

   Issue 1: If the firewall(s) block ESP traffic, many of the MIPv6
      signaling (e.g.  Binding Update, HoT) may be dropped at the
      firewall(s) preventing MN(s) from updating their binding cache and
      performing Route Optimization, since Binding Update, HoT and other
      MIPv6 signaling must be protected by IPsec ESP.

   Issue 2: If the firewall(s) protecting the Home Agent block
      unsolicited incoming traffic (e.g. as stateful inspection packet
      filters do), the firewall(s) may drop connection set up requests
      from CN, and packets from MN.

   Issue 3: If the Home Agent is in a network protected by several
      firewalls, a MN/CN's change of IP address may result in the
      traffic to and from the Home Agent passing through a different
      firewall that may not have the states corresponding to the flows.
      As a consequence, packets may be dropped at the firewall.
"

to:

"
5.3  Scenario where the HA is in a network protected by firewall(s)

   Let's consider a MN moving into a network protected by firewall(s).
   The following issues may exist:

   Issue 1: If the firewall(s) block ESP traffic, many of the MIPv6
      signaling (e.g.  Binding Update, HoT) may be dropped at the
      firewall(s) preventing MN(s) from updating their binding cache and
      performing Route Optimization, since Binding Update, HoT and other
      MIPv6 signaling must be protected by IPsec ESP.

      Network administrators may allow to bypass IPsec ESP protected traffic to 
a predefined host within their network. 

   Issue 2: If the firewall(s) protecting the Home Agent block
      unsolicited incoming traffic (e.g. as stateful inspection packet
      filters do), the firewall(s) may drop connection set up requests
      from CN, and packets from MN.

      Network administrators may allow to bypass Mobile IP signaling messages 
to a predefined host within their network.

   Issue 3: If the Home Agent is in a network protected by several
      firewalls, a MN/CN's change of IP address may result in the
      traffic to and from the Home Agent passing through a different
      firewall that may not have the states corresponding to the flows.
      As a consequence, packets may be dropped at the firewall.

      Network administrators may deploy state synchronization mechanisms 
between firewalls to deal with this problem prior to the introduction of 
mobility protocols. 
"

----------
category: Technical
draft: draft-ietf-mip6-firewalls
messages: 164
nosy: bpatil, franckle, hannes, mip6, sfaccin
priority: Should fix
status: Pending
title: Review by Steve Bellovin: Section 5.3

_________________________________________________
Mip6 issue tracker <tracker-mip6@mip4.org>
<http://www.mip4.org/issues/tracker/mip6/issue44>
_________________________________________________

_______________________________________________
Mip6 mailing list
Mip6@ietf.org
https://www1.ietf.org/mailman/listinfo/mip6