Re: [netext] Stephen Farrell's Discuss on draft-ietf-netext-pmip-cp-up-separation-05: (with DISCUSS and COMMENT)

["Sri Gundavelli (sgundave)" <[e-mail]>]

Hi Stephen,

Thanks for the review. Please see inline.



On 8/7/14 5:50 AM, "Stephen Farrell" <[e-mail]> wrote:

>
>I have two questions. They could be easy or hard, I'm not
>sure:-) Apologies in advance if I've forgotten what little I
>ever knew about PMIPv6 and gotten stuff wrong here.

Not at all. Thanks for the discussion.

>
>(1) PMIPv6 traffic between MAG and LMA is generally assumed to
>be protected via IPsec, right? Assuming that's actually done,
>does figure 1 here indicate a weakening of security since it
>shows that IP encapsulation is used between MAG-UP and LMA-UP
>without any mention of IPsec. Is that downgrading security? I
>get that the binding messages are the most important and will
>presumably continue on the control plane but what else changes?

Yes. PMIPv6 allows the use of IPsec security (Tunnel Mode ESP) protection
for the user-plane traffic. This is optional and is based on standard
IPsec security. It requires no special interaction between IPsec and the
Proxy Mobile IPv6 entities.

In the split mode (LMA ==> LMA-CP & LMA-DP), the MAG (or MAG-DP) and the
LMA-DP can optionally enable IPsec security on the user-plane traffic.
MAG-DP establishes a layer-3 p2p tunnel to LMA-DP and both these peers can
be configured to apply IPsec security on the tunneled traffic. So, there
is no loss of functionality here and the CP/DP split approach is not
resulting in weakened security.



>
>(2) How does the rest of the Internet know to use the LMA-UP
>for the MN and not the LMA-CP? Sorry for being dense but I
>don't see how packets from a random Internet node for the MN
>end up going down the user plane.

The IP address of the mobile node is topologically anchored on the LMA-DP.
>From the point of view of Routing, the LMA-DP owns that larger IP prefix
block from which it allocates to IP prefixes/address to individual
mobility sessions. The LMA-DP is in the path for the user-plane traffic
and is the entry point into the mobile network.  However, the LMA-CP is
only terminating the control signaling from the MAG and is not in the path
for the user-plane traffic.


 

>
>
>----------------------------------------------------------------------
>COMMENT:
>----------------------------------------------------------------------
>
>
>Did you need to say somewhere which PMIPv6 messages are to be
>sent in the control plane and which in the user plane? That
>might be obvious to some, but its not to me and I guess there
>are a bunch of PMIPv6 extensions so I could imagine that
>someone somewhere might get it wrong.
>


The signaling messages {IPv6 with Mobility Header, or IPv4 UDP Port 5436)
traffic is exchanged between MAG-CP and LMA-CP. There is no implication on
the use/non-use of other mobility options.

The tunneled traffic with L3 encapsulation is between MAG-DP and LMA-DP.


Regards
Sri







>
>_______________________________________________
>netext mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/netext