Francis,
I wrote:
> Thus, making your system to help at all, it would require that
> EVERYBODY ELSE FORBIDS Home Address Option altogether.
Francis Dupont wrote:
> => everybody else is better than everybody (:-).
I think the main reason for our disagreement is that you mostly seem to
think that MIPv6 will be employed by operators. I don't. If MIPv6
will ever become common, I certainly want to run my own MIPv6 Home
Agent, in the same way I am running my own DNS server, my own SMTP
server, etc. That is, the only service that I buy is IP connectivity,
and I really really really want to have an Internet that allows you
to buy IP connectivity, and provide all of the rest of the
infrastructure yourself. I don't want to be part of a global AAA.
[Personally, I would consider such a requirement fascist.]
Now, returning to the real issue. I just want to second Jari Arkko's
statement:
A. We seem to agree that HAO may be dangerous since it potentially
makes IP traceback more difficult.
B. There seems to be two possible solutions:
B.1 Make the Binding Cache hard state instead of a cache.
That is, mandate that CN accepts HAO if and only if there
is a corresponding binding in the binding cache. (Or,
at minimum, that it keeps trace of received HAOs for
traceback purposes.)
B.2 Mandate that every ingress router everywhere in the Internet
either checks that the HAO is legitimate, or drops it.
That is, my (possibly flawed) understanding of your ingress filtering
draft requires B.2. If B.2 was mandated, the CN could accept HAO
and rely that it is authentic. On the B.1 case, on the other hand,
it is the CN's responsibility to decide whether to rely on HAO or not.
As far as I can see, that is the difference. As a practical result,
B.1 allows anybody to use MIPv6 security protocols (whatever it will be),
establish bindings, and use HAOs. B.2, on the other hand, would restrict
where you can use BUs, and that your home agent must be part of the
still-not-existing global AAA infrastructure so that you could use HAO.
As a result, all the work that we have done with RR and CGA would be
unnecessary, since you would mandate AAA, and while you are mandating
it, you just could use it for basic MIPv6 security as well.
Francis, if you insist to keep your opinion that B.2 with all its
consequences is better, there is nothing I can do. On the other hand,
if I have really misunderstood the practical consequences of your draft,
please enlighten me, and explain in detail how you expect it to work
so that MIPv6 route optimization could still be used by private persons
and small organizations that are not part of the alledged global AAA
infrastructure.
--Pekka Nikander
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page: http://playground.sun.com/ipng
FTP archive: ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [EMAIL PROTECTED]
--------------------------------------------------------------------
