TABLE OF CONTENTS Mobile IPv6 uses the IPsec mechanism to protect the Mobile IPv6 signaling messages. The specifications on how to protect messages are defined in [RFC3776].
The messages directly exchanged between a mobile node and a home agent are protected by the IPsec transport mode mechanism. The Binding Update and Binding Acknowledgment messages must be protected by the IPsec ESP or AH header. The Mobile Prefix Solicitation and Advertisement messages should be protected by the IPsec mechanism.
The messages exchanged between a mobile node and a correspondent node, and relayed by the home agent, are protected by the IPsec tunnel mode mechanism. The Home Test Init and Home Test messages must be protected by the IPsec ESP header with the IPsec tunnel mode. As we will show in this section, the tunnel mode policy entries must be able to support the Mobility Header type specific policy rule. More precisely, it must be able to send and receive the Home Test Init and Home Test messages only via the IPsec tunnel. This is necessary when two mobile nodes communicate with route optimization. If a mobile node cannot specify the Home Test Init/Home Test messages as policy specification, a Binding Update message to the other mobile node (this node is actually treated as a correspondent node) is incorrectly tunneled to the home agent of the mobile node that is sending the Binding Update message.
Note that the Dynamic Home Agent Address Discovery Request and Reply messages cannot be protected because...
