Re: [BEHAVE] Re: CPE equipments and stateful filters

[james woodyatt <jhw@apple.com>]

On Jul 30, 2007, at 17:56, james woodyatt wrote:
> On Jul 30, 2007, at 17:28, Dan Wing wrote:
> > <http://tools.ietf.org/html/draft-tschofenig-mip6-ice> describes  
> > how ICE might be useful for Mobile IPv6.
> I'm reading this draft now.
If I understand how this might work, it would involve encapsulating  
IPsec ESP and IKE in UDP, to transit firewalls between MN's and their  
HA's, using conventional UDP state tracking.
We don't currently have any protocol whereby IKE decides to switch  
over to UDP encapsulation, except in the NAT-traversal case, do we?   
With IPv6, we still think we have no NAT, so tests for reflexive  
addresses to match IKE initiations will always succeed.
What triggers the switch to UDP encapsulation?  The mobility layer  
trying to do STUN connectivity tests on the ESP protocol?  Blech, but  
I guess it works most of the time.  If it fails mysteriously, just  
try again-- that seems to be a common failure recovery method in  
human-centered systems.  I can't say I approve of it.  For one thing,  
I really don't like the idea of extending my implementations of IPsec  
and IKE to do STUN over protocol=50 and port=udp/500.
RFC 4487 describes additional issues, e.g. CN's reaching MN's that  
roam behind networks with firewalls.  <http://tools.ietf.org/html/ 
draft-bajko-mip6-rrtfw> proposes a way to work around the RRT issue,  
which looks on its face to be an ugly but workable hack.  It reminds  
me that <draft-ietf-v6ops-cpe-simple-security> needs to be very  
explicit about how to handle the mobility extension header.
Finally, <http://tools.ietf.org/html/draft-tschofenig-mip6-ice> seems  
not to care at all about the problem of home agents behind  
firewalls.  RFC 4487 raises that issue, but I'm not seeing how M-ICE  
is supposed to address it.  Did I miss something?
My head hurts trying to sort out all the questions I have about ways  
these approaches potentially might fail during incremental  
deployment.  On the other hand, all this stuff seems a lot simpler--  
though still pretty soul-killingly fragile-- with ALD in the mix.  I  
still think we'd be better off without any SPF middleboxes.  (Oh, by  
the way, I remember now why I'm not optimistic about firewalls  
helping keep denial-of-service traffic off first mile links.  That's  
a topic for another message, though.)

--
james woodyatt <jhw@apple.com>
member of technical staff, communications engineering