Re: [netext] Stephen Farrell's Discuss on draft-ietf-netext-pmip-cp-up-separation-05: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

Hiya,

A few follow ups...

On 09/08/14 17:54, Sri Gundavelli (sgundave) wrote:
> Hi Stephen,
> 
> Thanks for the review. Please see inline.
> 
> 
> 
> On 8/7/14 5:50 AM, "Stephen Farrell" <[e-mail]> wrote:
> 
>>
>> I have two questions. They could be easy or hard, I'm not
>> sure:-) Apologies in advance if I've forgotten what little I
>> ever knew about PMIPv6 and gotten stuff wrong here.
> 
> Not at all. Thanks for the discussion.
> 
>>
>> (1) PMIPv6 traffic between MAG and LMA is generally assumed to
>> be protected via IPsec, right? Assuming that's actually done,
>> does figure 1 here indicate a weakening of security since it
>> shows that IP encapsulation is used between MAG-UP and LMA-UP
>> without any mention of IPsec. Is that downgrading security? I
>> get that the binding messages are the most important and will
>> presumably continue on the control plane but what else changes?
> 
> Yes. PMIPv6 allows the use of IPsec security (Tunnel Mode ESP) protection

"allows"? Do you happen to know if that's really used or not
in practice? (That's not a DISCUSS point, but I do wonder.)

> for the user-plane traffic. This is optional and is based on standard
> IPsec security. It requires no special interaction between IPsec and the
> Proxy Mobile IPv6 entities.
> 
> In the split mode (LMA ==> LMA-CP & LMA-DP), 

What's LMA-DP? That's not mentioned in the draft? I assume you
mean what the draft calls LMA-UP? (I.e. DP = data plane being
the same as UP = user plane?)

> the MAG (or MAG-DP) and the
> LMA-DP can optionally enable IPsec security on the user-plane traffic.

Hmm. So you're saying IPsec can be on for the control plane and
off for the user plane independently? Is that a good plan? I
guess it'd be a bad plan if it were the other way around?

> MAG-DP establishes a layer-3 p2p tunnel to LMA-DP and both these peers can
> be configured to apply IPsec security on the tunneled traffic. So, there
> is no loss of functionality here and the CP/DP split approach is not
> resulting in weakened security.

Well, it might if IPsec is on for one and off for the other.

Or, if say MAG-CP and MAG-UP are from different vendors, then
I don't know how they signal to one another to turn on/off
IPsec if what we want is for IPsec to be on for both or off
for both.

>> (2) How does the rest of the Internet know to use the LMA-UP
>> for the MN and not the LMA-CP? Sorry for being dense but I
>> don't see how packets from a random Internet node for the MN
>> end up going down the user plane.
> 
> The IP address of the mobile node is topologically anchored on the LMA-DP.

You mean LMA-UP there right?

> From the point of view of Routing, the LMA-DP owns that larger IP prefix
> block from which it allocates to IP prefixes/address to individual
> mobility sessions. The LMA-DP is in the path for the user-plane traffic
> and is the entry point into the mobile network.  However, the LMA-CP is
> only terminating the control signaling from the MAG and is not in the path
> for the user-plane traffic.

Is that written down somewhere? If say the LMA-UP and LMA-CP had
utterly different addresses then it couldn't work could it?

>> ----------------------------------------------------------------------
>> COMMENT:
>> ----------------------------------------------------------------------
>>
>>
>> Did you need to say somewhere which PMIPv6 messages are to be
>> sent in the control plane and which in the user plane? That
>> might be obvious to some, but its not to me and I guess there
>> are a bunch of PMIPv6 extensions so I could imagine that
>> someone somewhere might get it wrong.
>>
> 
> 
> The signaling messages {IPv6 with Mobility Header, or IPv4 UDP Port 5436)
> traffic is exchanged between MAG-CP and LMA-CP. There is no implication on
> the use/non-use of other mobility options.

Sure. My question is: where is it written down which are
signalling messages and which are not?

Ta,
S.

> 
> The tunneled traffic with L3 encapsulation is between MAG-DP and LMA-DP.
> 
> 
> Regards
> Sri
> 
> 
> 
> 
> 
> 
> 
>>
>> _______________________________________________
>> netext mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/netext
>