Subject: RE: [Ietf-behave] TURN Issue #6: port numbers

From: "Kevin Johns" <[email-masked]>
Date: Mon, 5 Dec 2005 14:15:09 -0800 (PST)

Jonathan,
How would approach 1 work if a single box was running both STUn and TURN
services?

Kevin

-----Original Message-----
From: Jonathan Rosenberg [mailto:jdrosen@xxxxxxxxx] 
Sent: Monday, December 05, 2005 1:34 PM
To: Behave
Subject: [Ietf-behave] TURN Issue #6: port numbers

Right now, TURN has no default port. Its marked as XXXX in the spec. 
With the view that TURN would be a stun usage, its not clear that it 
needs a separate port from the STUN port. The only reason to have that 
is if folks think there is a desire from firewall admins to block TURN 
by disabling its port, but allow STUN. There are a few options here:

1. TURN will reuse the STUN default port. DNS procedures also exist to 
detect the udp, tcp, etc. ports for STUN/TURN, but they are always
shared.

2. TURN has a separate default port. DNS procedures also exist to detect

the udp, tcp, etc. ports for STUN, and there is also a procedure to 
detect them for TURN. This would be done by defining a separate NAPTR 
service for Allocate requests.

3. TURN will reuse the STUN default port. DNS procedures also exist to 
detect the udp, tcp, etc. ports for STUN, and there is also a procedure 
to detect them for TURN. This would be done by defining a separate NAPTR

service for Allocate requests.

4. TURN has a separate default port, and there are no DNS procedures 
defined at all for STUN or TURN. This would imply a specific solution to

the TLS problem in Issue #5 (in particular, would imply no DNS-based 
solutions). Why do this? The only reason is to force usage of TURN over 
a specific port since no discovery mechanism would exist. This would 
facilitate firewall port-blocking. Of course, its easily circumvented 
through configuration of the TURN port (which is what is done today), 
but its an option.

I tend to prefer #1 for simplicity. Unless there is a compelling 
argument brought about why the TURN and STUN requests NEED to run on 
different ports, I see no reason for anything else.

-Jonathan R.

-- 
Jonathan D. Rosenberg, Ph.D.                   600 Lanidex Plaza
Cisco Fellow                                   Parsippany, NJ 07054-2711
Cisco Systems
jdrosen@xxxxxxxxx                              FAX:   (973) 952-5050
http://www.jdrosen.net                         PHONE: (973) 952-5000
http://www.cisco.com
_______________________________________________
Ietf-behave mailing list
Ietf-behave@xxxxxxxxxxxxxxxxxxx
https://list.sipfoundry.org/mailman/listinfo/ietf-behave

---

From: Jonathan Rosenberg <[email-masked]>
Date: Fri, 9 Dec 2005 11:54:24 -0800 (PST)

It would work fine because there wouldn't really be a separate STUN and 
TURN server. Rather, there would be a STUN server that supports the 
binding discovery usage (i.e., the BindingRequest) and the relay usage 
(i.e., the Allocate Request).

-Jonathan R.

Kevin Johns wrote:

Jonathan,

-----Original Message-----
From: Jonathan Rosenberg [mailto:jdrosen@xxxxxxxxx] 
Sent: Monday, December 05, 2005 1:34 PM
To: Behave
Subject: [Ietf-behave] TURN Issue #6: port numbers

-Jonathan R.