Mobile IP in a large-ish IPv4 network

Question

So we are looking into implementing IP mobility in our network.

The use case would be for a laptop to be able to roam between wired and wireless mode of operation while retaining all TCP/UDP based connections (ongoing browser downloads, conferencing sessions, SIP/RTM softphone connections, RDP connections)

Current state

Due to a generous /16 IPv4 network assignment from the olden days, we were hardly pressed to implement IPv6. So we didn't. The basic outline of the environment:

• Windows servers in public IPv4 address space, with a permanently assigned IPv4 address
• Cisco UCM - based phone network
• Windows clients in public IPv4 address space, with a permanently assigned IPv4 address
• countless wireless clients are getting a dynamically assigned address from a private IPv4 address space
• the private address space router is NATting outbound connections to a pool of public IPv4 addresses
• Clients and servers are mainly Windows, basically everything that is still covered under Microsoft's extended support policy (Server 2008-2016, Windows 7 - Windows 10 1607)
• all hosts are members of an AD domain.
• Cisco gear on the network side
• MAC-/VMPS-based VLAN assignment on the wired network
• no 802.1x auth for wired hosts
• Radius-backed 802.1x (EAP-TTLS-PAP) for wireless connections
• Communications between clients and servers are restricted by the Cisco routers' ACLs as well as by server-side Windows Firewall rules

The ancillary conditions fro the use case are that

1. users should not be required to start/connect a separate VPN client
2. we likely do not have the resources to implement Proxy Mobile IPv6 as we would need IPv6 routing and address management working first, which we do not have and are not going to get in the short term

Options considered

We have a Cisco ASA - based VPN in place, so remote and wireless users are capable of connecting into our network. But since we restrict access to our systems on a per-address basis, using this to create an overlay network for all of our users has severe management implications:

• we would permanently need to assign an additional IPv4 address from the public VPN address pool to each employee, which is going to deplete our address pools
• the router ACLs and host firewall rules are often configured with exemptions for ranges and subnets in the wired network which reflect our organization's structure (departments having own subnets). If we simply assign addresses to employees from a contiguous, non-structured pool, this method of access control will be rendered unusable.
• currently, a VPN-connected client is routing all traffic through the ASA gateways. This is not going to scale all that well if we let all users connect to the gateways at all times to support the seamless roaming scenario. Even if only connections to our internal servers would be routed through the tunnel, we are looking into more bandwidth on the tunneling endpoints, than we can possibly handle.

Windows obviously comes with things like Teredo and 6to4 tunneling along with opportunistic encryption for connections over IPSEC, which we might consider using in lieu of the current network-address based access control. But as far as I can see, no current Windows stack is implementing Mobile IPv6 and I am having a hard time finding working implementations altogether.

I have been made aware of LISP but even after reading the overview publications on this topic I am having difficulties embracing the extent of infrastructure changes needed for it to work for us. Also, as most publications are mentioning "datacenter mobility", I cannot yet see if it would fit our use case of roaming clients as well.

So what options would remain?

Answer 1

I don't think there is a way. Both on the client and on the server side, sessions are tied to the client's IP address. This in turn is tied to the client NIC's MAC address which is likely to change when switching hardware (from wireless to wired or vice versa). So, we've got two essential requirements: neither IP address nor MAC address must change.

For the server side this could be worked around with a single LAA MAC that is assigned to both wi-fi and Ethernet NICs. Sending a frame out from the client after switching NICs would update the switches to the new port. (Both wired and wireless connections would need to use the same segment.)

For the client side this is much harder. You'd need to somehow hand over the open sessions from one NIC to the other which most probably isn't possible with any OS.

The only imaginable solution would be a virtual NIC that all sessions run through. Its traffic would need to be bridged to the physical NIC. That way you could work around the IP and MAC address restrictions.

Possibly there's a VPN solution out there that could accomplish this. A VPN (or other) tunnel could additionally solve the problem with needing to bridge the wired and the wireless network - the underlying, physical connection would have little importance.

Answer 2

Things like the Cisco phone system and Windows servers are moot for your question insofar as they are immobile. So the real issue is how to make your mobile laptop clients' sessions persistent as your users move around the building. The best investment you can make here --and also the easiest one to sell to your user base -- would be an upgrade of your Wi-Fi infrastructure to permit seamless roaming on the same SSID. It requires no changes from the users, gives you a control point for policy, and does exactly what you need.