Subject: [Speermint] domain-policy-ddds-00: Why DNS and not SIP

From: Otmar Lendl <[email-masked]>
Date: Fri, 24 Mar 2006 17:44:43 +0100

[This is the third followup to monday's WG discussion on this draft.]

There were two questions (Rohan and Jonathan) concerning why
all this DNS busines is necessary and helpful. After all, there
are mechnisms within SIP to reject calls and the "consent framework"
can be used to establish fine-tuned access control.

The reason we're not basing our solution on SIP is the following:

When looking at the target audience for Speermint we found:

* Some VSPs don't want to have their SIP proxies exposed to
  the public Internet fearing DoS and other attacks.
  They thus use firewalls to allow incoming SIP packets
  only from pre-approved addresses.

* Most of the peering fabrics popping up at Internet
  Exchange Points use a private L2/3 infrastructure which
  is not reachable from the public Internet.

* 3GPP and others (ETSI's NGN, the CableCos) are builing their
  interconnects on a private network seperated from the Internet.

In these cases you can't use SIP to query whether they will
accept calls from you. Sure, you can try but the most likely
response will be a timeout. If you're lucky you'll get an
ICMP error message. Maybe.

Call-setup is a time-critical procedure. Callers don't tolerate 
gratuitous delays. So your choice is to either

* use extremely short timeouts on the SIP try
or
* use an out-of-band (in terms of SIP) procedure.

Furthermore, we have:

* Some peering fabrics operate in a SIP-hub mode: All calls
  between participating VSPs are routed via a central SIP proxy.

* Some peering fabrics require special TLS certs to be used
  to connect to the SIP proxies. 

!! In these cases you have to know the destination's federation
!! affiliation before you can reach them via SIP.

Some of these things could be solved via appropriate SRV records, e.g.
have them point at the central SIP hub in the first example.

This quickly breaks down if a VSP participates in a number of different
peering fabrics. This could be a very realistic scenario in a few years.

What should the SRV records look like for e.g. 3G-example.com which
is reachable via the GRX (using the SIP hubs used therein), the VoIP- 
VLANs at VIX, LINX and DE-CIX (which may very well exist in a few
years), plus from a selected set of IP-addresses over the public Internet?

Comments?

/ol
-- 
< Otmar Lendl ([email-masked]) | nic.at Systems Engineer >

_______________________________________________
Speermint mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speermint