Subject: Re: [AAA-WG]: Message Forwarding and Routing Proposed text

From: [email-masked]
Date: Wed, 21 Feb 2001 12:04:43 -0500 (EST)

On Mon, 12 Feb 2001, Patrice Calhoun wrote:

> > I missed the new Origin-Realm AVP, I guess I only read the first
> > 50 or 60 emails you guys exchanged.  It seems like an Origin-Realm
> > AVP would be just the ticket to complete the routing picture, unless
> > there are more complicated routing situations.
> 
> It is a rather complicated problem, but it looks like we have it
> nailed down. If someone has a more complicated routing situation,
> then I would like to hear about it. Otherwise, I think we have all
> cases handled. I would really hate to have to introduce additional
> complexity :(

What about a host which is running multiple diameter processes?  We
now have lots of routing being performed based upon some form of host
name, but what if a Diameter proxy winds up communicating with a
Diameter server on the same machine?  Does the Diameter server notice
that the Record-Route AVP has it own hostname in it and assume a loop?

How about multiple client processes running on one machine which end
up communicating with the same server?  Can either client process
handle unsolicited requests from the server?  Can a response go back
to either client process?

It also looks to me like a diameter process (either client or server)
will be doing lots of hostname to ip address and ip address to host
name conversions.  Perhaps the Host-Name AVP in the Device-Reboot-Ind
message should be defined to be the value which is used and verified
in the Record-Route and related AVPs.  This issue may have already
been addressed in recent proposed updates.

Stuart
-- 
Stuart A Barkley                        email: [email-masked]

[resend.  previous attempt seemed to go into a blackhole.]

---

From: Pat Calhoun <[email-masked]>
Date: Fri, 23 Feb 2001 05:29:31 -0800 (PST)

Finally coming up for air....

> What about a host which is running multiple diameter processes?  

well, I asked for it...

> We

Currently yes. So the question I have for you is whether multiple aaad
processes on a single box is a requirement.

> to either client process?

yes, via the proxy state. The proxy state can encode pretty much anything you
want, including the source port number.

> been addressed in recent proposed updates.

Correct, the host name is passed in the DRI. In fact, my clients file no
longer contains IP addresses, but fully qualified domains names. This makes
the lookup a hell of alot easier, and eliminates the need to constantly call
DNS for name resolution. 

Of course, you could use IP addresses, and simply store the Host-Name in the
clients entry too.

PatC

---

From: Barney Wolff <[email-masked]>
Date: Fri, 23 Feb 2001 10:31:41 -0500

Were I implementing a DIAMETER proxy, I would not bother checking
for a loop unless the list of Record-Routes was longer than, say,
10 items.  A misconfiguration resulting in a loop should be very
rare, and detecting the loop does not have to be instant at the
millisecond level.  That way, most sane configs that loop a
request to different proxies on the same host will not even notice.
If an apparent loop is detected, it can be disambiguated by
something in Proxy-State.  A really smart proxy would lower
the loop-detect threshold for a while after a loop was detected.

Also, a *server* never has to check record-route if it is not
going to forward the request.  Only a proxy ever has to make
this check.

Finally, with IP aliases widely supported these days, one can
run multiple DIAMETER daemons on a host with separate sets of
IP addresses rather than with separate port numbers.  In the
not-unusual case of a "special" daemon to reprocess the rare
request, listening on 127.0.0.1 might be all that's needed.

Barney