Subject: [BEHAVE] STUN Relay

From: "Kevin Johns" <[email-masked]>
Date: Mon, 15 Jan 2007 09:48:24 -0700

One of the properties of STUN relay is that the STUN relay server
handles both STUN messages and media on the same IP and Port. This makes
policy control a bit difficult as the policy enforcement point has to be
able to identify STUN messages over Media in order to enforce policy.
Has there been any discussion around having a management only IP/Port
and as part of the allocation process allocate a local transport address
(the address and port the UA requesting the allocation sends and
receives from) in addition to the currently allocated relayed transport
address?
 
Such and approach would facilitate policy management as STUN Relay (and
STUN for that matter) can be classified separately from the media
traffic allowing for separate policy enforcement.
 
Regards,
Kevin
_______________________________________________
Behave mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/behave

---

From: "Brian Stucker" <[email-masked]>
Date: Mon, 15 Jan 2007 10:54:05 -0600

What sort of policy management separation are you looking for? I am
assuming that you are talking about gating behavior at the relay?
 
Regards,
Brian

________________________________

	From: Kevin Johns [mailto:[email-masked]] 
	Sent: Monday, January 15, 2007 10:48 AM
	To: [email-masked]
	Subject: [BEHAVE] STUN Relay

	One of the properties of STUN relay is that the STUN relay
server handles both STUN messages and media on the same IP and Port.
This makes policy control a bit difficult as the policy enforcement
point has to be able to identify STUN messages over Media in order to
enforce policy. Has there been any discussion around having a management
only IP/Port and as part of the allocation process allocate a local
transport address (the address and port the UA requesting the allocation
sends and receives from) in addition to the currently allocated relayed
transport address?
	 
	Such and approach would facilitate policy management as STUN
Relay (and STUN for that matter) can be classified separately from the
media traffic allowing for separate policy enforcement.
	 
	Regards,
	Kevin