Subject: Re: Handling of Setup message by Gatekeeper.

From: [email-masked]
Date: Tue, 9 Mar 1999 16:18:48 +0530

Hi Ramesh,
    Thanks for your input. But still things are not clear. It's not only
registration which matters but presence of endpoint in the zone also
affects this case. What if endpoint is in the zone but not registered? An
endpoint just got power on and directly sent Setup message. Therefore three
checks are required at the Gatekeeper.
1. whether or not endpoint is in the zone of this GK.
2. If yes, then whether it's registered or not.
3. If it is registered, whether ARQ was sent or not.

May be GK needs to maintain a static database of all the endpoints in its
zone along with the registration table. But as Anant pointed out, there is
no mandatory field in the Setup message, which provides source information.
So even if both the databases are available with the GK, how to perform the
checks? As getting a setup message without an ARQ is a valid case (as given
in first mail), we can not just discard the message.

Any inputs?

Thanks,
Ritu.

"Ramesh B S" <[email-masked]> on 03/09/99 02:49:44 PM

To:   [email-masked]
cc:
Subject:  Re: Handling of Setup message by Gatekeeper.

>Hi All,
>       Here is a query regarding handling of setup message received by
>Gatekeeper.
>
>In normal case, any endpoint in the zone of a gatekeeper will send ARQ
>message before sending Setup message. On receiving ARQ, Gatekeeper will
>check for registration, allocate bandwidth and also decides the callmodel.
>
>But there are cases when Gatekeeper receives Setup without receiving ARQ
>from an endpoint. Scenarios include:
>1. Called party Gatekeeper decides for GKrouted call model and sends ARJ.
>Called endpoint sends facility message with reason = routeCallToGatekeeper
>to the calling party. In this case, calling party releases the previous
>call and sends a new Setup message to the called endpoint's Gatekeeper.
>2. If calling and called endpoints are registered with different
>gatekeepers and called party's gatekeeper decides for GKrouted call model.
>Calling endpoint, registered with gatekeeper1, will send Setup to
>gatekeeper2 while it has performed ARQ/ACF transaction with gatekeeper1.
>3. GK receives Setup message from another gatekeeper.
>4. GK receives a Setup message from a gateway in preGrantedArq scenario.
>
>In all these cases, gatekeeper will receive Setup message without
receiving
>ARQ message. So how can gatekeeper check whether ARQ is expected from the
>endpoint, which sent the Setup or not? No field in the Setup message seem
>to give this information. If gatekeeper doesn't check for this, that means
>even the endpoints in its own zone can bypass gatekeeper for RAS
>signalling?
>

If there is a gatekeeper in the system, then, according to the spec.
(H.323,
v2, section 7.2.2),
all endpoints shall register with it. It is possible to bypass a gatekeeper
but
that would be a protocol violation.
To answer the question as to how a gatekeeper checks for ARQs:
A gatekeeper will have a database of all endpoints that
have registered with it. A gatekeeper should also maintain states
associated
with such endpoints. So when a Setup message arrives at the GK, it can
tell if the endpoint is from the same zone and if it is, whether it has
sent
an ARQ (if !preGrantedArq) before this request.

---------
This message came from the IETF IPTEL Working Group Mailing List.

---

From: Chris Purvis <[email-masked]>
Date: Tue, 9 Mar 1999 11:28:33 -0000

All,

A few options:

1. Let the endpoint get away with it.
2. Use some other form of security, such as H.235.
3. Do everything Ramesh suggests AND have a proxy on the edge of the zone so
that all calls into the zone come via the proxy (which is registered and
will do ARQ).
4. Within an administrative domain, it is possible to have a restricted
database of entities (such as other gatekeepers) which are permitted to
setup without ARQ.

Maintaining a static database of all endpoints in a GK's zone is not by
itself a good solution to this particular problem: it seems unreasonable to
give MORE rights to things outside of one's zone than things within it.

A few other pointers:

A gatekeeper knows whether it has pregranted an ARQ to a particular entity.
It is up to the entity to fill in the setup message such that the gatekeeper
knows who it is - sourceCallSignalAddress and SourceAddress fields are the
starter for this, if you want security use H.235.

Regards,
Chris

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: 09 March 1999 10:49
> To: Ramesh B S
> Cc: [email-masked]; [email-masked]
> --------------------------------------------------------------
> -----------
> for list subscription instructions,
> send email to [email-masked] with text "info"
> 

---------

---

From: Umesh Mallugari <[email-masked]>
Date: Thu, 11 Mar 1999 23:18:47 -0800

Ritu,

Won' t the fields "sourceAddress" and "sourceInfo" in the Setup UUIE be of any help to the Gatekeeper
to perform checks on the Setup message received?

-Umesh.

-----Original Message-----
From:	[email-masked] [SMTP:[email-masked]]
Sent:	Thursday, March 11, 1999 5:16 PM
To:	Deepak Kumar
Cc:	[email-masked]'; ronald h. davis; [email-masked]; [email-masked]
Subject:	RE: Handling of Setup message by Gatekeeper.

How can Gatekeepers know that there are some endpoints in its zone not
registered? If GKs don't know their existence, then how can those endpoints be
managed?
Thanks for any information

Regards!

Hanlin

Deepak Kumar <[email-masked]> on 03/09/99 10:26:38 PM

To:   "'rtgupta @hss.hns.com'" <[email-masked]>, "ronald h. davis"
      <[email-masked]>
cc:   [email-masked], [email-masked] (Hanlin
      Fang/HQ/3Com)
Subject:  RE: Handling of Setup message by Gatekeeper.

Q.931 could originate at a rogue (ie. in the physical zone, but
unregistered, and doesn't send ARQ) end-point or an end-point/GK outside the
zone. Why is a distinction between these two scenarios meaningful?

An end-point that chooses (illegally) not to register with its Gatekeeper
could be treated exactly like an end-point outside the zone, and be denied
the benefits of Gatekeeper support - such as the ability to recv incoming
calls, QoS reservations, and the ability to place and recv calls using
network resources such as Gateways and proxies.

Deepak Kumar,

Program Manager, IP Telephony,
Windows Networking and Communications,
Microsoft Corp.

> From:   [email-masked] [SMTP:[email-masked]]
> Sent:   Tuesday, March 09, 1999 9:19 PM
> To:     ronald h. davis
> Hi Davis,
>     Thanks for your inputs.
> I agree that GK is responsible only for the endpoints whixh exist in its
> zone. And also that it can not administer endpoints in other zones. But
> the
> scenarios mentioned in the query are all valid scenarios. GK CAN receive
> Setup message without any RAS signalling taking place before that. So it
> can not terminate h225 signalling channel because of absence of RAS
> channel.
>
> In contrast to what you said, I think RAS signalling is must for all the
> endpoints in any GK's zone. RAS signaling is not required for endpoints,
> outside the zone. Now when GK receives a Setup message, it doesn't know
> whether it is from its own zone or from outside. Before doing any further
> checks, it needs to check that. And as I mentioned in my previous mails,
> to
> do that, it needs to maintain a static databse of its zone. But there is
> no
> mandatory field in Setup message,giving source info. So basic question is
> how to perform this check.
>
> regards,
> Ritu.
>
> _____________________________________________________________________
> Ritu Gupta                                   |       email:
> [email-masked]
> Senior Software Engineer,       |                   [email-masked]
> Hughes Software Systems,     |       phone: 91-80-2286390/91/92(W)
> Banglore, Karnataka                  |                    91-80-3374075(H)
> INDIA.                                            |       Fax    :
> 91-80-2286393
> _____________________________________________________________________
> Restlessness and discontent are the first necessities of progress.
>
>
>
>
>
> "ronald h. davis" <[email-masked]> on 03/09/99 11:32:19 PM
>
> To:   [email-masked]
> cc:   [email-masked], [email-masked]
> [email-masked] wrote:
> >
>                [scenarios deleted]
> > Any help/information on this issue will be appreciated.
> >
> the gatekeeper is only responsible for arq/acf/arj with endpoints within
> its zone.  all endpoints within the zone establish a ras channel (over
> which these messages are sent) with their gatekeeper.
> endpoints in other zones don't establish a ras channel with this
> gatekeeper.  thus, when calls are received from outside of the zone
> the recipient (be through the direct or gatekeeper routed call model)
> has no idea how the calling endpoint came upon sending the setup
> message.
> this statement may be controversial but it is my opinion that h.323
> is lan-oriented, so if you think of gatekeepers as administering
> bandwidth allocation, &c for endpoints on different lans it would
> be difficult for a gatekeeper to perform this administration for
> a different lan.  and it would be even harder for a gatekeeper to
> perform such administration over a wide area network consisting of
> a number of zones.
> this fact leads me to believe that the ras channel should be *optional*
> for h.323 gatekeepers.  to abstract your scenarios further it is
> possible that gatekeepers could act as application layer routers, in
> which case they are terminating h.225 signalling and h.245 media control
> channels for endpoints with which they have no ras channel.
> --
>   __  ______  __  / __/ |       lucent technologies, naperville il, usa
> _/ (_(_) / (_(_/_/_(_/  .       [email-masked]
> "if you ain't the lead dog, the scenery never changes"  -- edmund wilson
>
>
>
>
> -------------------------------------------------------------------------

---------

---------

---------

---

From: Umesh Mallugari <[email-masked]>
Date: Thu, 11 Mar 1999 22:50:51 -0800

Hanlin,

There is no way a Gatekeeper can know that an endpoint in its zone has not registered except when
the administrator has statically configured all the endpoint IDs into it.
Simply, out of the zone of a Gatekeeper ( unregistered with Gatekeeper ) means out of management.

-Umesh.

-----Original Message-----
From:	[email-masked] [SMTP:[email-masked]]
Sent:	Thursday, March 11, 1999 5:16 PM
To:	Deepak Kumar
Cc:	[email-masked]'; ronald h. davis; [email-masked]; [email-masked]
Subject:	RE: Handling of Setup message by Gatekeeper.

Regards!

Hanlin

Deepak Kumar,

---------

---------

---------

---

From: [email-masked]
Date: Wed, 10 Mar 1999 12:46:58 +0530

Hi,
   Ok, Gatekeeper might decide that way. But how will a GK check whether
endpoint, sending Setup message belongs to his zone or not? If yes, then
whether it is registered or not? If registered whether it has sent an ARQ
or not? Again the basic fundamental question is how to get
index/information to make all these checks?

Once the results of above checks are avaialbale, GK can decide what to do
in different scenarios like Setup from unregistered endpoint in its own
zone but without sending an ARQ.

Regards,
Ritu.

Deepak Kumar <[email-masked]> on 03/10/99 11:56:38 AM

To:   "[email-masked]'" <[email-masked]>, "ronald h. davis"
      <[email-masked]>
cc:   [email-masked], [email-masked]
Subject:  RE: Handling of Setup message by Gatekeeper.

unregistered, and doesn't send ARQ) end-point or an end-point/GK outside

---------

---

From: [email-masked]
Date: Thu, 11 Mar 1999 12:29:39 +0530

Davis,
     You had mentioned in your previous mail

************
************

All I'm saying is how to perform this check that the endpoint is from
outside the zone and then terminate the h.225 connection? Just because RAS
signaling is not present, we can not terminate the h.225 conection. In this
case we can not assume that h.225 message is coming from outside the zone.
What if it is from an unregistered endpoint within the zone itself?

Regards,
Ritu.

"ronald h. davis" <[email-masked]> on 03/10/99 10:14:21 PM

To:   [email-masked]

the
> can not terminate h225 signalling channel because of absence of RAS
i think that i don't understand what you're trying to say.  the setup
message is an h.225 call signalling message, not a ras message.
--
  __  ______  __  / __/ |       lucent technologies, naperville il, usa
_/ (_(_) / (_(_/_/_(_/  .       [email-masked]
"if you ain't the lead dog, the scenery never changes"  -- edmund wilson

---------

---

From: [email-masked]
Date: Fri, 12 Mar 1999 12:15:37 +0530

Umesh,
      'source Address' is a sequence of alias addresses and is an optional
field. This ight not be present at all. even if it is there, we can not
bank on it. Because alias addresses are not globally unique. Endpoints in
different zones can have same alias address. And 'source Info' is just the
type of endpoint the source is. Values can be GK, GW, MSU or terminal etc.
with some vendr info. So we can not check on basis of thisfield also.

Thansk,
Ritu.

P.S. Check previous mails for a link to a proposal in Setup message.

Umesh Mallugari <[email-masked]> on 03/12/99 12:48:47 PM

Please respond to "[email-masked]" <[email-masked]>

To:   "[email-masked]'"
      <[email-masked]>
cc:   "[email-masked]'" <[email-masked]>,
      "[email-masked]'" <[email-masked]>
Subject:  RE: Handling of Setup message by Gatekeeper.

Ritu,
Won' t the fields "sourceAddress" and "sourceInfo" in the Setup UUIE be of
any help to the Gatekeeper
to perform checks on the Setup message received?
-Umesh.
-----Original Message-----
From:     [email-masked] [SMTP:[email-masked]]
Sent:     Thursday, March 11, 1999 5:16 PM
To:  Deepak Kumar
Cc:  [email-masked]'; ronald h. davis; [email-masked];
[email-masked]
Subject:  RE: Handling of Setup message by Gatekeeper.

How can Gatekeepers know that there are some endpoints in its zone not
registered? If GKs don't know their existence, then how can those endpoints
be
managed?
Thanks for any information
Regards!
Hanlin

---------

---------

---------

---

From: [email-masked]
Date: Thu, 11 Mar 1999 11:19:59 +0530

Hi,
    Thanks for the link. I think adding EndpointId as a mandatory field
will solve the problem of making checks on sender of the message. After
checking the authenticity of the sender, decisions can be made by the
gatekeeper for various scenarios like setup message without RAS signalling
, both in valid and invalid cases. But for version 1 and 2 endpoints, I
think gatekeeper needs to drop this check, if source info is not available.
Again because standards do not say anything so solution will be
proprietary.

I know, registration is mandatory for all the endpoints, in a zone but I
pointed out the scenario from security point of view. There can be
unregitered endpoints, trying the access the network for making calls.

Thanks,
Ritu.

[email-masked] on 03/10/99 07:44:05 PM

To:   [email-masked]
cc:   [email-masked], [email-masked]
Subject:  Re: Handling of Setup message by Gatekeeper.

to
no
>mandatory field in Setup message,giving source info. So basic question is
There is a proposal in SG-16 to include the EndPointIdentifier as a
mandatory field in the Setup message for GK routed calls.
You can get the document from the PictureTel's SG16 site, on
ftp://standard.pictel.com/avc-site/9902_Mon/TD-46.zip
Also note that registration is mandatory before making a call
(in an earlier email you had mentioned a scenario where an
endpoint tries to make a call after powering up. Starting up
after a power down is one of the situations when an endpoint
will send an RRQ to the GK.)
<EOM>

>how to perform this check.
_____________________________________________________________
>Banglore, Karnataka                  |                    91-80-3374075(H)
]

---------

---

From: Deepak Kumar <[email-masked]>
Date: Tue, 9 Mar 1999 22:26:38 -0800

Deepak Kumar,

---------

---

From: Chris Purvis <[email-masked]>
Date: Fri, 12 Mar 1999 11:14:25 -0000

I fail to see what is gained by adding EndpointId as a "mandatory" field
(which will not be filled in by v1 & v2 endpoints anyway) - quite apart from
being impossible (it's gatekeeper-allocated, so in an environment without
gatekeepers you can't fill it in).  It is optional in TD-46, and for good
reasons.

After all, if I'm in the business of wanting to break things I can easily
send an EndpointID I make up in any setup message.  To try to return to the
original problem, if I as an endpoint want to send a setup message without
having sent an ARQ, I can soon make something up to put in any field I
choose.  If I want to obey the spec and there are any gatekeepers around at
all, I will not send a setup without first sending an ARQ to my gatekeeper.

Regards,
Chris

> Sent: 11 March 1999 5:50
> To: [email-masked]

---------