Subject: Re: [Mip6] GRE key

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 03 May 2007 17:57:06 +0200

Chowdhury, Kuntal wrote:
> 
>> -----Original Message----- From: Alexandru Petrescu 
>> [mailto:[email-masked]] Sent: Thursday, May 03, 2007 
>> 9:37 AM To: Ahmad Muhanna Cc: [email-masked]; Alexandru Petrescu; 
>> Casati, Alessio (Alessio) Subject: Re: [Mip6] GRE key
>> 
>> Ahmad Muhanna wrote:
>>> Hi Alex,
>>> 
>>> We are talking about the home address here for different VPNs, 
>>> for example, that the HA supports and it is possible for two MNs 
>>> from
> two
>>> different VPNs roam at the same time in the area of a single MAG
> with
>>> the same home private IP address.
>>> 
>>> I hope this would help.
>> It helps clarifying some parts, in that it may so happen that two 
>> MNs have the same private IPv4 Home Address.  I will not go as far 
>> as
> saying
>> that I find this problem little worth exploring.
>> 
>> [HEre's why: Private IPv4 Home Addresses aren't reachable from the 
>> Internet,
> hence
>> no need to give them continuous access with Mobile IP.
>> 
> [KC>] Nobody is talking about internet routing here.

We're completely out of synch :-)  I wouldn't call Mobile IP "Internet
routing", but maybe BGP I would (?)

> Private IPv4 addressing is widely used in enterprises and campus 
> networks.

Certainly.

> These networks are often hosted by operators.

Who often care little about the address plan of other operators, because
the mobiles of one operator never need to talk to the mobile of another
operator.

> FYI....scenarios using private IPv4 HoA usefully has VPN links back 
> to the respective enterprise/campus networks.

I think two things mixed here.  A VPN user never gets the same IPv4
"Home" Address (although it is private).  So the collision probabilty
between two mobiles of different Enterprises is low.  The second is that
two mobiles using VPNs and wanting to talk to each other always have the
possibliity to use their CoAs instead of potentially overlapping HoAs.

So I really am not sure how the risk of overlapping private IPv4
addresses translates into a case when Mobile IPv6 is used and/or Proxy
Mobile IPv6.

>> MIPv6 doesn't deal with IPv4 Home Addresses.
>> 
> [KC>] DS-MIP6 does.

YEs, but not private IPv4 home addresses.

>> DS-MIPv6 doesn't deal with HA behind NAT, hence doesn't deal with 
>> private IPv4 Home Addresses.]
>> 
> [KC>] To support private IPv4 address pools, the HA won't have to be
>  necessarily behind a NAT from MN/MAGs PoV.

If HA won't have to _be_ behind a NAT then will it be a NAT itself?

>> -it is thought that GRE is needed for some SDO.  Then it should be
>>  stated first and foremost.
> 
> [KC>] I do not think we have to bring SDOs into this discussion.

Thanks for confirming GRE for Proxy Mobile IPv6 is _not_ a SDO matter.

Then what is the deployment need for it?

>> -it is thought that GRE has something to do with PMIPv6 (not with 
>> MIPv6).  Then the use of GRE tunnel instead of IPv6-in-IPv6 tunnel
>>  should be proposed to PMIPv6.
> [KC>] overlapping IPv4 address pool use case applies to both PMIP6 
> and DS-MIP6.

It's too early for such statements.  Or you may know better where PMIPv6
IPv4 support is going to.

>> -it is thought that private IPv4 Addresses have something to do 
>> with DS-MIPv6.  Then the use of one IPv4 private home address 
>> should be suggested to DS-MIPv6.
> [KC>] Not sure that is necessary.

But it is said that PMIPv6 uses DS-MIPv6 to support IPv4, right?

Alex

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: <[email-masked]>
Date: Fri, 4 May 2007 13:42:29 +0200

Hi Alex,

See some comments inline.

> >>> We are talking about the home address here for different 
> VPNs, for 
> >>> example, that the HA supports and it is possible for two MNs from
> > two
> >> It helps clarifying some parts, in that it may so happen 
> that two MNs 
> >> have the same private IPv4 Home Address.  I will not go as far as
> > saying
> We're completely out of synch :-)  I wouldn't call Mobile IP 
> "Internet routing", but maybe BGP I would (?)
> 
> Who often care little about the address plan of other 
> operators, because the mobiles of one operator never need to 
> talk to the mobile of another operator.

That's why there are magic proxy boxes mobiles register to
reach the other mobiles. Not the cleanest solution but in
certain service deployments it does not really matter if
terminals cannot contact each other directly.

Other thing is that a mobile operator most probably would not
allow direct connectivity between terminals anyway. Either
because of security reasons or for some other artificial
reasons.
 
> > FYI....scenarios using private IPv4 HoA usefully has VPN 
> links back to 
> > the respective enterprise/campus networks.
> 
> I think two things mixed here.  A VPN user never gets the 
> same IPv4 "Home" Address (although it is private).  So the 
> collision probabilty between two mobiles of different 
> Enterprises is low.  The second is that two mobiles using 
> VPNs and wanting to talk to each other always have the 
> So I really am not sure how the risk of overlapping private 
> IPv4 addresses translates into a case when Mobile IPv6 is 
> used and/or Proxy Mobile IPv6.
> 

DSMIP6 spec mentions that IPv4-HoA can be a private address.

> If HA won't have to _be_ behind a NAT then will it be a NAT itself?

Not necessarily.. there can be deployments where the HA has public
IP, mobiles have their (virtual) private addressed network and somewhere
behing the HA there is NAT box before reaching the Internet. I would say
rather common deployment.

> > [KC>] overlapping IPv4 address pool use case applies to 
> both PMIP6 and 
> > DS-MIP6.
> 
> >> -it is thought that private IPv4 Addresses have something 
> to do with 
> >> DS-MIPv6.  Then the use of one IPv4 private home address should be 
> >> suggested to DS-MIPv6.

/JOuni

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 04 May 2007 14:16:49 +0200

Hi Jouni, some comments...

> DSMIP6 spec mentions that IPv4-HoA can be a private address.

It does.  But that doesn't mean it makes sense [it claims HA to be
reachable behind NAT but we need MN to be reachable behind NAT].  We can
discuss it separately.

>>>> DS-MIPv6 doesn't deal with HA behind NAT, hence doesn't deal
>>>> with private IPv4 Home Addresses.]
>>>> 
> IP, mobiles have their (virtual) private addressed network and
> somewhere behing the HA there is NAT box before reaching the
> Internet. I would say rather common deployment.

I think this potential DS-MIPv6 deployment does not offer reachability
for MN at its private IPv4 Home Address.

In all cases, DS-MIPv6 doesn't use GRE tunnelling but IPv6-in-IPv6
and/or IPv6-in-UDP-or-in-IP.

Alex