Re: [Mip6] Review of draft-ietf-mip6-firewalls-00.txt (with referenceto draft-chen-mip6-gprs-02.txt)

["James Kempf" <[e-mail]>]

Franck,

Some responses.

For the description of the problem (e.g. mismatch between the firewall
states and incoming packets), we tried to explicitely describe them. As an
example, to quote section 3.1.1: "The state created by the stateful
inspection packet filter protecting A is therefore initially based on the IP
address of A(IP A) and the home address of the node B (IP HoA B)." then "The
Care of Test Init message is sent using the new CoA of B as the source
address. Such a packet does not match any entry in the firewall protecting A
and as described in Section 2, the CoTi message will thus be dropped by the
firewall."

If you want to make it clearer, would you have any suggestion?

jak>> Draft-chen takes each individual case and examines it in detail. For
example, Section 4.1.1.1:

           The IP datagrams sent from A to B use the (reverse) tunnel from
A's
           current CoA to its HA. IP datagrams exit the tunnel at A's home
agent
           and transmit to B using  A's home address as the source address.
Upon
           arriving at the GGSN, the IP datagrams' source address matches
the
           IPv6 source address (A's home address) recorded in one of the TFT
           filters and, if other filtering parameters are matched as well,
the
           IP datagrams will be delivered to B through the PDP Context
           corresponding to the TFT. No specific issues are identified for
this
           case.

This only applies to the Home Agent tunneling case when the MN is under the
GGSN and the HA and CN are outside. Draft-ietf-mip6-firewalls segues from
the text you've cited above from Section 3.1.1 which is a relatively precise
description of a single case into a more vaguely worded description of the
problem involving route optimization.

I think it would be more helpful for readers to understand the problem if
each case (MN inside behind firewall and HA outside, MN outside and HA
inside, etc.) were analyzed individually to the same level of detail as in
draft-chen and Section 3.1.1.
jak>>>(end)


For the other scenarios you pointed out, I agree with you. They are not in
the scope of the document. We described some of the issues, and specifically
focused on the basic ones. I will add an explicit statement in the document
to explain that the scenarios you mentioned are not included.

jak>>> I'm not clear what you mean. Is this document intended to be a
comprehensive exploration of the problems involved in firewall interaction
with MIPv6 or not? If not, then we clearly need another document that
explores the problems this one doesn't.

> Section 3.2.2, Paragraph 10: The discussion doesn't consider
> the distinction
> between a TCP and UDP session. Earlier in the text, the
> description of the
> state maintained in the firewall implies a distinction. But
> if a MIPv6 host
> is receiving TCP packets tunneled from the HA, then the
> firewall state will
> be for UDP (presuming it is set up at all). The firewall
> timers for UDP may
> interact negatively with the MN's TCP timeouts, and there may be other
> problems.

Can you please clarify what you mean?

jak>>> Sorry, I wasn't thinking clearly here. Obviously, the firewall will
step over the IP packet header and set up the proper state for TCP. There's
only an issue if a UDP tunnel is used, such as would be the case for IPsec,
and even in that case, it's not clear how serious the problem would be.
jak>>>(end)

jak>> Hope that helps.

            jak



_______________________________________________
Mip6 mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mip6