| TOC |
|
By submitting this Internet-Draft, each author represents that any applicable patent or other IPR claims of which he or she is aware have been or will be disclosed, and any of which he or she becomes aware will be disclosed, in accordance with Section 6 of BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF), its areas, and its working groups. Note that other groups may also distribute working documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as “work in progress.”
The list of current Internet-Drafts can be accessed at http://www.ietf.org/ietf/1id-abstracts.txt.
The list of Internet-Draft Shadow Directories can be accessed at http://www.ietf.org/shadow.html.
This Internet-Draft will expire on December 28, 2006.
Copyright © The Internet Society (2006).
Most of the firewalls deployed today are Mobile IPv6 unaware. Widespread Mobile IPv6 deployment is not possible unless Mobile IPv6 messages can pass through these firewalls. One approach is to use a signaling protocol to communicate with these firewalls and instruct them to bypass these Mobile IPv6 messages. The goal of this document is to describe the interaction between NSIS and Mobile IPv6 for enabling Mobile IPv6 traversal.
1.
Introduction
2.
Terminology
3.
Mobile node behind a firewall
3.1.
Binding updates
3.2.
Route optimization
3.3.
Bi-directional tunneling
3.4.
Triangular routing
3.5.
Change of Firewalls
3.6.
Operations when MN is behind a firewall
4.
Correspondent Node behind a firewall
4.1.
Route Optimization
4.2.
Bi-directional Tunneling
4.3.
Triangular routing
4.4.
Change of Firewalls
4.5.
Operations when CN is behind a firewall
5.
Home Agent behind a firewall
5.1.
Route Optimization
5.2.
Bi-directional tunneling
5.3.
Triangular routing
5.4.
Operations when HA is behind a firewall
6.
Additional Discussions
7.
Security Considerations
8.
Acknowledgements
9.
References
9.1.
Normative References
9.2.
Informative References
§
Authors' Addresses
§
Intellectual Property and Copyright Statements
| TOC |
Route optimization, an integral part of Mobile IPv6 specification does not work with state of the art firewalls that employ stateful packet filtering (SPF). This problem is well described in [1] (Le, F., Faccin, S., Patil, B., and H. Tschofenig, “Mobile IPv6 and Firewalls: Problem Statement,” May 2006.). The other modes of communication in Mobile IPv6, namely bi-directional tunneling and triangular routing, also do not work under some firewall placements. Apart from this, the Mobile IPv6 binding updates (encapsulated using IPsec ESP) packets also have problems with firewall traversal. To tackle these issues, one approach is to utilize a signaling protocol to install some firewall rules for allowing these Mobile IPv6 messages to pass through. The NSIS NAT/FW NSLP, as described in [2] (Stiemerling, M., “NAT/Firewall NSIS Signaling Layer Protocol (NSLP),” April 2006.), allows to establish, maintain and delete middlebox state (i.e., NAT bindings and Firewall rules), and allow packets to traverse these boxes. This protocol thus provides a possible way to address the aforementioned problem. This document describe the considerations of NSIS NAT/FW NSLP, especially the involved messages and necessary firewall rules, when firewalls are encountered in a Mobile IPv6 network. More specifically, the following basic scenarios are studied individually.
For every scenario, we will discuss how to apply NSIS signaling for the three routing modes. It has to be noted that a real scenario could include a combination of some set of these cases. In any case, we assume that the MN, the CN, the HA and the Firewalls (FWs) are NSIS aware. Also note that for every NSIS message, the undelying GIST[5] (Schulzrinne, H. and R. Hancock, “GIST: General Internet Signaling Transport,” February 2006.) level provides flow-id information which will be used to install the firewall policies.
| TOC |
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [3] (Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” March 1997.).
Furthermore, we use the same terminology as in [4] (Johnson, D., Perkins, C., and J. Arkko, “Mobility Support in IPv6,” June 2004.), [2] (Stiemerling, M., “NAT/Firewall NSIS Signaling Layer Protocol (NSLP),” April 2006.), and [6] (Brunner, M., “Requirements for Signaling Protocols,” April 2004.). Apart from this, we use some abbreviations to describe the flow-id of the NSIS messages: SA-Source Address, DA-Destination Address, SP-Source Port, DP-Destination Port and an asterisk is used as wild-card.
The term 'DS' refers to data sender and the term 'DR' to data receiver.
| TOC |
In Figure 1 (MN behind the firewall), the MN is protected by a firewall that employs
stateful packet filtering (SPF). The external CN and the HA are also
shown in the figure. The MN is in a foreign network and is communicating with the
CN. Here it is assumed that MN has initiated the communication and hence it has
no problems with the SPF.
+----------------+ +----+
| | | HA |
| | +----+
| | Home Agent
| +----+ +----+
| | MN | | FW |
| +----+ +----+
| | +----+
| | | CN |
| | +----+
+----------------+ External CN
Network protected
by a firewall
| Figure 1: MN behind the firewall |
| TOC |
IPsec protected Binding Updates cause problems in some deployment environments, as described in [1] (Le, F., Faccin, S., Patil, B., and H. Tschofenig, “Mobile IPv6 and Firewalls: Problem Statement,” May 2006.). As a solution, NAT/FW NSLP can be used to dynamically configure the firewall(s) to allow the IPsec packets and associated traffic like IKE/IKEv2 packets to traverse, before sending the binding updates. Therefore, IP Protocol ID 50 should be allowed in the filter policies in order to allow IPsec ESP and IP Protocol ID 51 to allow IPsec AH. The firewall should also allow IKE packets (to UDP port 500) to bypass.
- For the BU message from MN to HA, the MN installs rules using CREATE for the flow-id: SA: COA, DA: HA.
| TOC |
In Figure 2 (NSIS signaling for MN behind the firewall), the message flow for MN behind firewall scenario is shown (with CN as data sender). Here, all the messages initiated by the MN will be bypassed. Immediately after moving to a new network, the MN acquires a new CoA and it performs the Binding Update to the HA. The HoT message received by the MN is actually a tunneled message and as it does not belong to the session initiated by the MN, it will be dropped by the FW. Using REA, the MN initiate NSIS signaling to the FW and open pinholes for the HoT message.
- For the HoT message from HA to MN, the MN signaling using REA for the flow-id: SA: HA, DA: CoA.
Once the RRT is successful, the binding update message is sent to the CN. If the MN wants to continue sending data traffic, then no NSIS signaling is needed at all for this scenario. However, if the CN wants to send data traffic, the relevant packet filter rules have to be installed at the firewall. Hence, the CN has to initiate sending datta traffic to the MN but this happens after the RRT. The MN has to perform a Binding Update to the CN, conveying its new CoA. Therefore, the MN open pinholes using REA to let the data traffic traverse the firewalls.
- For the CREATE message for data traffic from CN to MN, the MN signaling using REA for the flow-id: SA: CN, DA: CoA, SP: data application port, DP: data application port.
Network protected
+-------------------------+
| |
| +-----+ +-----+ +----+
| | |Binding Update| | | |
| | |-------->-----+ +--------->----------+ |
| | | | | Binding ACK | |
| | |--------<-----+ +---------<----------+ |
| | MN | REA | FW | | HA |
| | +-------->-----+ | | |
| |(DS) | RESPONSE | | | |
| | +--------<-----+ | | |
| | | | | HoTI | |
| | +-------->-----+ +--------->----------+ |
| | | HoT | | | |
| | +--------<-----+ +---------<----------+ |
| +-----+ +-----+ +----+
| | ^
+-------------------------+ |
v
+----+
| CN |
|(DR)|
+----+
----- = signaling traffic Correspondent node
| Figure 2: NSIS signaling for MN behind the firewall |
| TOC |
Consider the scenario where the MN is protected by a SPF. Even though the MN had earlier initiated a connection for the purpose of binding update, new filter rules have to be installed to allow the tunneled data traffic. The message flow is shown in Figure 3 (NSIS signaling for MN behind the firewall).
If the MN is the DS, no signaling is needed at all. Otherwise, the MN open pinholes to let the data messages traverse, with the help of REA.
- For the CREATE message for data traffic from HA to MN, the MN signaling using REA for the flow-id: SA: HA, DA: CoA. Note these data messages for which we do signaling, are IP-in-IP tunneled messages
Protected network
+-------------------------+
| | Home Agent
| +-----+ +-----+ +----+
| | |Binding update| | | |
| | |-------->-----+ +--------->----------+ |
| | | | | Binding ACK | |
| | |--------<-----+ +---------<----------+ |
| | MN | REA | FW | | HA |
| |(DR) +--------<-----+ | | |
| | | RESPONSE | | | |
| | +-------->-----+ | | |
| | | | | Data traffic | |
| | +*******<******+ +*********<**********+ |
| +-----+ +-----+ +----+
| | *
+-------------------------+ ^
*
+----+
| CN |
|(DS)|
***** = Data traffic +----+
----- = Signaling traffic Correspondent node
| Figure 3: NSIS signaling for MN behind the firewall |
| TOC |
After mobility the MN sends a Binding update message to register its new CoA. If the CN is the DS, it sends the data to MN through HA.
If the MN is the data sender, no further signaling is needed as the session is initiated by the MN. The message flow is shown in Figure 4 (NSIS signaling for MN behind the firewall).
- For the CREATE message for data traffic from HA to MN, the MN signaling using REA for the flow-id: SA: HA, DA: CoA. Note these data messages for which we do signaling, are IP-in-IP tunneled messages.
Network protected
+-------------------------+
| | Home Agent
| +-----+ +-----+ +----+
| | |Binding update| | | |
| | |-------->-----+ +--------->----------+ |
| | | | | Binding ACK | |
| | |--------<-----+ +---------<----------+ |
| | | REA | | | HA |
| | +-------->-----+ | | |
| | | RESPONSE | | | |
| | +--------<-----+ | | |
| | MN | | FW | Tunneled packets | |
| |(DR) +########<#####+ +#########<##########+ |
| | | | | +----+
| | | | | *
| | | | | ^
| | | | | *
| | | | | +----+
| | | | | | CN |
| +-----+ +-----+ |(DS)|
| | +----+
+-------------------------+ Correspondent Node
----- = Signaling traffic
***** = Data traffic
##### = Tunneled data traffic
| Figure 4: NSIS signaling for MN behind the firewall |
| TOC |
If the MN roams and attaches to a different firewall, the above-mentioned routing methods will have problems in traversing the new firewall. In this case the data sender (where it is MN or the CN or the HA) should re-signaling to the firewall using NSIS and establish the policies accordingly (mentioned above according to the routing methods).
Since the NAT/FW NSLP rely on a soft-state approach, established sessions will be automatically be teardown after a specified timeout value. Thus it is not necessary to delete or teardown a session after an MN roams to another network, as the protocol will do this by it own. More discussions about a possible alternative way by tearing down the established state are given in [7] (Lee, S., “Applicability Statement of NSIS Protocols in Mobile Environments,” March 2006.).
| TOC |
MN configure the firewall(s) using CREATE to let following traverse:
MN configures the firewall(s) using REA to let following traverse:
| TOC |
| TOC |
In Figure 5 (CN behind the firewall), the CN is protected by a firewall that employs stateful packet filtering (SPF). The external MN and its associated HA are also shown in the figure. The MN is in its home network and is communicating with the CN. Here it is assumed that CN has initiated the communication and hence it has no problems with the SPF.
+----------------+ +----+
| | | HA |
| | +----+
| | Home Agent
| +----+ +----+
| | CN | | FW |
| +----+ +----+
| | +----+
| | | MN |
| | +----+
+----------------+ External Mobile
Network protected Node
by a firewall
| Figure 5: CN behind the firewall |
The MN moves out of its home network and has to perform the return routability test (RRT) before sending the binding update to the CN. It sends a HoTI message through the HA to the CN and expects a HoT message from the CN along the same path. It also sends a CoTI message directly to the CN and expects CoT message in the same path from the CN. The SPF will only allow packets that belong to an existing session and hence both the packets (HoTI, CoTI) will be dropped as these packets are Mobile IPv6 packets and these packets have different header structure. The existing rules at the firewall might have been installed for some kind of data traffic.
As the RRT can not be executed, the firewalls rules have to be modified to allow these MIPv6 messages to go through. The MN initiates the NSIS session by sending a CREATE message to the CN. When the MN receives both the messages CoT and HoT, it will construct the binding key and perform binding update to the CN. Note, the signaling that was aforementioned was only to allow the Mobile IPv6 messages. The message flow for NSIS signaling (with MN as data sender) is shown in Figure 6 (NSIS signaling for CN behind the firewall). Note, only the message flow between MN and CN is shown in the diagram.
- For the CREATE message for MIPv6 signaling traffic from MN to CN, the flow-id will be: SA: CoA, DA: CN. Note: The policy rules that are to be installed to allow the HoTI and CoTI packets are different and the NI has to perform signaling twice.
If the CN wants to continue sending data traffic (CN is the DS) to the new CoA, it can do so without any additional signaling. This is because the SPF will allow the traffic initiated by the nodes that it protects. But if the MN wants to continue sending data traffic (MN is the DS), it has to install filter rules for data traffic. The prospect of combined signaling (for control and data traffic) could be useful, but currently the NSIS NAT/FW protocol does not support installing multiple rules at the same time.
- For the CREATE message for data traffic from MN to CN, the flow-id will be: SA: CoA, DA: CN.
This solution works with the assumption that the firewalls will allow NSIS messages from external network to bypass with delayed packet filter state establishment and authorization from the CN. However, operators might be reluctant to allow NSIS message from external network as this might lead to DoS attacks. The CN might therefore be required to authorize the traversal of NSIS signaling message implicitly to reduce unwanted traffic.
To avoid this, it is also possible to ask the CN to open pinholes in the firewall on behalf of the MN. But this solution will not work in some scenarios due to routing asymmetry as explained in [2] (Stiemerling, M., “NAT/Firewall NSIS Signaling Layer Protocol (NSLP),” April 2006.).
+-----------------------+ Home Agent
| | +----+
| +-----+ | HA |
| | | +----+
|+----+ | |
|| | | | CREATE +----+
|| +--------<-----+ +---------<----------+ |
|| | RESPONSE | | | |
|| +-------->-----+ FW +--------->----------+ |
|| | | | CoTI | |
|| CN +--------<-----+ +---------<----------+ MN |
|| | CoT | | | |
||(DR)+-------->-----+ +--------->----------+(DS)|
|| | | | Binding update | |
|| +--------<-----+ +---------<----------+ |
|+----+ +-----+ +----+
| | Mobile
+-----------------------+ Node
Network protected
by a firewall
| Figure 6: NSIS signaling for CN behind the firewall |
| TOC |
If the CN is protected by a SPF-firewall, there is no need for any signaling if the CN starts sending data traffic. The CN sends the data traffic and hence the SPF will store relevant state information and accepts packets from the reverse direction.
If MN is the DS, then the CN has to initiate the signaling using REA, in order to configure the firewall to allow the data traffic traverse from the HA to CN. The message flow is shown in Figure 7 (NSIS signaling for CN behind the firewall).
- For the CREATE message for data traffic from HA to CN, the CN signaling using REA for the flow-id will be: SA: HA, DA: CN.
Protected network
+-------------------------+
| | Home Agent
| +-----+ +-----+ +----+
| | | | | | |
| | CN | REA | FW | | HA |
| | +-------->-----+ | | |
| |(DR) | RESPONSE | | | |
| | +--------<-----+ | | |
| | | | | Data traffic | |
| | +**************+ +********************+ |
| +-----+ +-----+ +----+
| | #
+-------------------------+ #
+----+
| MN |
|(DS)|
***** = Data traffic (both direction) +----+
----- = signaling traffic Correspondent node
##### = tunneled traffic
| Figure 7: NSIS signaling for CN behind the firewall |
| TOC |
This section considers the scenario shown in Figure 8 (NSIS signaling for CN behind the firewall) where the CN is protected by a FW that has SPF functionality. If the CN is the DS, then the data traffic will be bypassed by the firewall. But if the MN is the DS, the firewall will not allow the data packets from the MN (packets in the reverse direction) as it does not belong to any connection that exists already.
Hence, the MN has to initiate signaling by sending the CREATE message to the CN and the FW will install the policies when it receives the a sucessful response. Now, the MN is allowed to communicate in the reverse direction.
- For the CREATE message for data traffic from MN to CN, the flow-id will be: SA: MN, DA: CN, SP: Data application port, DP: Data application port.
+-------------------------+
| | Home Agent
| +-----+ +-----+ +----+
| | | | | | HA |
| | | | | +----+
| | CN | | FW |
| |(DR) | | | CREATE +----+
| | +--------<-----+ +---------<----------+ |
| | | RESPONSE | | | MN |
| | +-------->-----+ +--------->----------+(DS)|
| | | | | Data traffic | |
| | +********<*****+ +*********<**********+ |
| +-----+ +-----+ +----+
| | External Mobile
+-------------------------+ Node
Network protected
----- = signaling traffic
***** = Data traffic
| Figure 8: NSIS signaling for CN behind the firewall |
| TOC |
If the MN roams and attaches to a network with a different firewall then the above-mentioned routing methods will have problems in traversing the new firewall. In this case the data sender (where it is MN or the CN or the HA) should re-signaling to the firewall using NSIS and establish the policies accordingly (mentioned above according to the routing methods).
| TOC |
MN configure the firewall(s) using CREATE to let following traverse:
CN configure the firewall(s) to let following traverse:
| TOC |
| TOC |
The MN, after entering a new network, sends a Binding Update to the HA. But as it is initiated by the MN, it first has to install some filter rules in the FW before sending the Binding Update.
The MN-HA Binding Update message is assumed to be IPsec protected. This might cause problems, as some primitive firewalls do not recognize IPsec traffic and hence drop the packets because of the absence of any transport header. Hence UDP encapsulation of IPsec traffic might be needed to alleviate this problem.
The MN initiates the NSIS signaling to create rules that will allow the Binding Update messages to bypass. The MN then performs the Binding Update to the HA.
- For the CREATE message for the MIPv6 signaling traffic from MN to the HA, the flow-id will be: SA: MN, DA: HA, SPIx. (if not UDP encapsulated).
Note that this section does not consider the usage of the 'Authentication Protocol for Mobile IPv6' protocol [8] (Leung, K., “Authentication Protocol for Mobile IPv6,” September 2005.).
The firewall rules previously installed will not allow the HoTI message to bypass. Hence, the MN has to install a different set of rules for these signaling messages, by initiating another signaling exchange and then it sends the HOTI message to the HA. The HA will then send the HoTI to CN and obviously this message is allowed as it is initiated by the HA. The HoT message from the CN to the HA is also allowed by the SPF as it belongs to the session previously initiated by the HA. The HoT message from the HA to the MN is also allowed as it is initiated by the HA. The RRT completes successfully.
- For the CREATE message for the from the MIPv6 signaling traffic MN to the HA, the flow-id will be: SA: MN, DA: HA.
Detailed message flow (with MN as data sender) is shown in Figure 9 (NSIS signaling for HA behind the firewall). Note, only the interaction between the HA and the MN is shown in the figure.
+------------------------+ +----+
| | | CN |
| | |(DR)|
| | +----+
| |
| +----+ +-----+ +------------------+
| | | | | CREATE | +----+ |
| | +--------<-----+ +---------<------|---<---+ | |
| | | RESPONSE | | | | | |
| | +-------->-----+ +--------->------|--->---+ | |
| | | | | Binding update | | | |
| | +--------<-----+ +---------<------|---<---+ | |
| | HA | | FW | Binding ACK | | MN | |
| | +-------->-----+ +--------->------|--->---+ | |
| | | | | | |(DS)| |
| | | | | CREATE | | | |
| | +--------<-----+ +---------<------|---<---+ | |
| | | RESPONSE | | | | | |
| | +-------->-----+ +--------->------|--->---+ | |
| | | | | HoTI | | | |
| | +--------<-----+ +---------<------|---<---+ | |
| | | | | HoT | | | |
| | +-------->-----+ +--------->------|--->---+ | |
| +----+ +-----+ | +----+ |
| | | |
+------------------------+ +------------------+
HA protected by firewall Visited Network
(Home Network)
| Figure 9: NSIS signaling for HA behind the firewall |
For the data traffic, there is no additional signaling as the MN sends data directly to CN and none of these networks (CN network and MN network) are protected by firewalls. This is applicable for both, MN and CN, as data senders.
| TOC |
Here, it is necessary that the HA open pinholes for the data traffic from the CN using REA. The CN is then allowed to send the data traffic through the FW. After intercepting the packets, the HA tunnels the packet to the MN. Figure 10 (NSIS signaling for HA behind the firewall ) shows the message flow.
- For the CREATE message for data traffic from CN to HA, the flow-id initiated by the HA using REA will be: SA: CN, DA: HoA, SP: Data application port, DP: Data application port.
HA Network protected
+-------------------------+
| |
| +-----+ +-----+ +----+
| | | REA | | | |
| | |-------->-----+ | | CN |
| | | RESPONSE | | |(DS)|
| | |--------<-----+ | | |
| | | | | | |
| | HA |********<*****+ FW +*********<**********+ |
| | | | | +----+
| | | | |
| | | | | +----+
| | +########>#####+ +#########>##########+ MN |
| | | | | |(DR)|
| +-----+ +-----+ +----+
| |
+-------------------------+
----- = Signaling traffic
***** = Data traffic
##### = Tunneled data packet
| Figure 10: NSIS signaling for HA behind the firewall |
| TOC |
The HA initiates NSIS signaling to open pinholes in the FW for the traffic from CN using REA. Then the CN can send the data traffic to HoA. The message flow is the same as shown in Figure 10 (NSIS signaling for HA behind the firewall ).
For the CREATE message for data traffic from CN to HA, the flow-id initiated by the HA using REA will be: SA: CN, DA: HoA, SP: Data application port, DP: Data application port.
| TOC |
MN configure the firewall(s) using CREATE to let following traverse:
HA configure the firewall(s) using REA to let following traverse:
| TOC |
To support the operations described in this draft, it would be desireable if the NSIS NAT/FW NSLP has the ability to discover the presence and the characteristics (e.g., uplink or downlink filter) of firewalls. This will be useful in several cases. For instance, it would be desireable if one could detect whether a firewall exists, if no, then NAT/FW NSLP will be unnecessary. Moreover, it is necessary to determine where (i.e., in which MIPv6 segment/scenario) is the firewall. This will be very useful to provide multiple firewall rules within a single signaling message exchange for multiple traffic modes (e.g., rules to allow BU and HoTI traverse). Current NAT/FW NSLP [2] (Stiemerling, M., “NAT/Firewall NSIS Signaling Layer Protocol (NSLP),” April 2006.) specification does not provide this ability, however, we believe it would be useful to extend it to be able to discover the presence and characteristics of firewalls. This desired feature is already discussed in [9] (Bajko, G., “Requirements for Firewall Configuration Protocol,” January 2006.):
- "A client MUST be able to create pinholes and specify the characteristics of the pinholes to be installed in the firewalls."
To enable the operations defined in this draft, some kind of interface between Mobile IPv6 and the NAT/FW NSLP is required. This interface notifies the NSLP about the MIP6 actions, for example the roaming into a new network and provides the required information (CoA, HoA, ...). This notification triggeres the required operation. The protocol uses a firewall detection approach to determine the current scenario and performs the pinhole creation process necessary for this case. After creation of the pinholes, MIP6 signaling is enabled to traverse possible firewalls.
The operation overview will be explained in more detail in future versions of this draft.
This draft also handles the Triangle Routing case. Further discussion will cover wheter it is needed to consider triangle routing at all.
| TOC |
The NAT/FW NSLP is in itself a very security sensitive service. A detailed description of possible threats and countermeasures are described in [2] (Stiemerling, M., “NAT/Firewall NSIS Signaling Layer Protocol (NSLP),” April 2006.).
More details to authorization and authentication will be provided in the next version of this draft.
| TOC |
Parts of this document are a byproduct of the ENABLE Project, partially funded by the European Commission under its Sixth Framework Programme. It is provided "as is" and without any express or implied warranties, including, without limitation, the implied warranties of fitness for a particular purpose. The views and conclusions contained herein are those of the authors and should not be interpreted as necessarily representing the official policies or endorsements, either expressed or implied, of the ENABLE Project or the European Commission.
The authors would like to thank Martin Stiemerling, Cedric Aoun and Elwyn Davies for the discussions about the NAT/Firewall NSLP. Additionally, we would like to thank Marcus Brunner and Miquel Martin for their feedback.
| TOC |
| TOC |
| [1] | Le, F., Faccin, S., Patil, B., and H. Tschofenig, “Mobile IPv6 and Firewalls: Problem Statement,” RFC 4487, May 2006. |
| [2] | Stiemerling, M., “NAT/Firewall NSIS Signaling Layer Protocol (NSLP),” draft-ietf-nsis-nslp-natfw-11 (work in progress), April 2006. |
| [3] | Bradner, S., “Key words for use in RFCs to Indicate Requirement Levels,” BCP 14, RFC 2119, March 1997 (TXT, HTML, XML). |
| [4] | Johnson, D., Perkins, C., and J. Arkko, “Mobility Support in IPv6,” RFC 3775, June 2004. |
| TOC |
| [5] | Schulzrinne, H. and R. Hancock, “GIST: General Internet Signaling Transport,” draft-ietf-nsis-ntlp-09 (work in progress), February 2006. |
| [6] | Brunner, M., “Requirements for Signaling Protocols,” RFC 3726, April 2004. |
| [7] | Lee, S., “Applicability Statement of NSIS Protocols in Mobile Environments,” draft-ietf-nsis-applicability-mobility-signaling-04 (work in progress), March 2006. |
| [8] | Leung, K., “Authentication Protocol for Mobile IPv6,” draft-ietf-mip6-auth-protocol-07 (work in progress), September 2005. |
| [9] | Bajko, G., “Requirements for Firewall Configuration Protocol,” draft-bajko-nsis-fw-reqs-04 (work in progress), January 2006. |
| TOC |
| Srinath Thiruvengadam | |
| Siemens | |
| Otto-Hahn-Ring 6 | |
| Munich, Bavaria 81739 | |
| Germany | |
| Email: | srinath@mytum.de |
| Hannes Tschofenig | |
| Siemens | |
| Otto-Hahn-Ring 6 | |
| Munich, Bavaria 81739 | |
| Germany | |
| Email: | Hannes.Tschofenig@siemens.com |
| Franck Le | |
| Carnegie Mellon University | |
| 5000 Forbes Avenue | |
| Pittsburgh, PA 15213 | |
| USA | |
| Email: | franckle@cmu.edu |
| Niklas Steinleitner | |
| University of Goettingen | |
| Institute for Informatics | |
| Lotzestr. 16-18 | |
| Goettingen 37083 | |
| Germany | |
| Email: | steinleitner@cs.uni-goettingen.de |
| Xiaoming Fu | |
| University of Goettingen | |
| Institute for Informatics | |
| Lotzestr. 16-18 | |
| Goettingen 37083 | |
| Germany | |
| Email: | fu@cs.uni-goettingen.de |
| TOC |
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
This document and the information contained herein are provided on an “AS IS” basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Copyright © The Internet Society (2006). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
Funding for the RFC Editor function is currently provided by the Internet Society.