Subject: [NSIS] Re: NATFW Proxy Mode

From: Martin Stiemerling <[email-masked]>
Date: Thu, 28 Sep 2006 10:25:12 +0200

Hi Matthias,

Am 12.08.2006 um 10:50 schrieb Matthias Friedrich:

> Hi,
>
> I've got a question about the NATFW Proxy Mode (Section 3.7.7.1,
> "Proxying for a Data Sender"). It looks like case b) is incomplete:
>
> According to the spec, the NI+ may decide to "teardown the REA-PROXY
> sessions", but there is noting said how it should be done. I think the

It is described how to teardown REA-PROXY sessions, but in a hidden way.
The REA-PROXY section mentions that processing of REA-PROXY and the  
CREATE
message works in the same way as their non-proxy counterparts REA and
CREATE. Therefore, the process of tearing down a REA-PROXY session is
setting the session lifetime to zero. This will also terminate the
corresponding CREATE sent by the edge-device.

I have to admit that the text about this is somewhat short and can be
easily misunderstood. I have added it to my issue list and I will add
it to the issue tracker.

> NI+ can't tear down the REA session because it would loose the  
> reserved
> external address. Starting a new non-proxy REA session afterwards
> doesn't help because a different external address would be reserved.

You are right about loosing the external address if you teardown a REA
or REA-PROXY session. However, the external address is still in use if
there is already a CREATE message coming from outside, i.e., a non-proxy
CREATE.

>
> I'd suggest to add to the spec that the NI+ should keep the old REA
> session alive, but set the proxy bit in the REA messages to zero. The
> NF then tears down the CREATE session in the usual way, by sending
> CREATE(lifetime==0). What remains are two sessions: The old REA  
> session
> and the CREATE session initiated by the DS.

Interesting point of switching between proxy and non-proxy mode within
a single NSLP signaling session. I have to go back and think about it
and the implications.

   Martin

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Martin Stiemerling <[email-masked]>
Date: Thu, 28 Sep 2006 10:25:12 +0200

Hi Matthias,

   Martin