Subject: [NSIS] NATFW Issue 63: Aggregation of NSLP signaling messages (was signaling session wildcarding)

From: Martin Stiemerling <[email-masked]>
Date: Thu, 2 Mar 2006 13:30:41 +0100

Dear all,

The issue 63 (https://kobe.netlab.nec.de/roundup/nsis-natfw-nslp/ 
issue63)
refers to the below section out of the 3GPP2 requirements draft
(http://www.watersprings.org/pub/id/draft-bajko-nsis-fw-reqs-04.txt)

5.1.7 Efficient use of the air interface

    The protocol MUST allow an end point to create, modify or delete
    several firewall states with one protocol instance.

    NOTE: a Firewall Configuration Protocol should provide a solution
    for the above requirement in a single Firewall architecture. In a
    multihomed scenario, with multiple Firewalls on alternative paths,
    there should be a means for the Firewalls to keep themselves
    synchronized.

    This capability is useful in some wireless networks, where the
    access link resources are limited. This would reduce the overhead
    and the delay of the procedures.

    It MUST be possible to open a pinhole with a single protocol
    request/response pair of messages. This is required because:
    a) a wireless link is a scarce and expensive resource
    b) real-time applications are delay sensitive

After further discussions with Gabor we have concluded that basically
a function is needed to teardown multiple session belonging to a single
NATFW NSLP node. For instance, if a mobile terminal is shutting down,
it can send a single NATFW NSLP message and all session concerned
will be terminated.
The solution to this is similar to the NOTIFY storm avoidance. For
NOTIFY the upcoming version of the draft contains:

    To avoid the need of generating per signaling session NOTIFY message
    in such a described or similar scenario, NFs SHOULD follow this
    procedure: The NF uses the NOTIFY message with the session ID in the
    NTLP set to zero, with the MRI completely wildcarded, and the
    'explicit routing' as described in Sections 5.2.1 and 7.1.4. in [1].
    The upstream NF receiving this type of NOTIFY immediately regards  
all
    signaling sessions from that peer matching the MRI as void.

(taken from here: http://www.stiemerling.org/ietf/nsis/snapshot/ 
snapshot.txt)

The teardown of all session for a specific node could be done in this  
way
- Set the MRI to source IP address of the node
- wildcard all other parameter
- Set SID to zero
- Use 'explicit routing' in the NTLP
- NSLP message with lifetime set to zero

Any thoughts, comments, or objections about it?

   Martin

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: <[email-masked]>
Date: Mon, 6 Mar 2006 13:34:32 +0200

This looks good to me. 

>-----Original Message-----
>From: ext Martin Stiemerling [mailto:[email-masked]] 
>Sent: 02 March, 2006 14:31
>To: nsis
>Subject: [NSIS] NATFW Issue 63: Aggregation of NSLP signaling 
>messages (wassignaling session wildcarding)
>
>Dear all,
>
>After further discussions with Gabor we have concluded that 
>basically a function is needed to teardown multiple session 
>belonging to a single NATFW NSLP node. For instance, if a 
>mobile terminal is shutting down, it can send a single NATFW 
>NSLP message and all session concerned will be terminated.
>The solution to this is similar to the NOTIFY storm avoidance. 
>For NOTIFY the upcoming version of the draft contains:
>
>    The upstream NF receiving this type of NOTIFY immediately 
>regards all
>The teardown of all session for a specific node could be done 
>in this way

---

From: Martin Stiemerling <[email-masked]>
Date: Tue, 7 Mar 2006 15:40:41 +0100

Thanks and added to the upcoming -10 draft under 3.8.4  "Deleting  
Sessions"

   Martin