Subject: RE: [AAA-WG]: Issue 204: How to handle CER from unknown peer

From: [email-masked]
Date: Tue, 13 Nov 2001 18:51:51 +0200

One comment: this overlaps with policies that can be imposed by the lower
layers. One can specify which source/destination addresses and ports are
allowed/disallowed, so that, for example, a connection from an undesired
node can be refused already by the router.

Regards,

Adrian

> 
> Looks good to me.
> 
> sjr
> 
> Pat Calhoun writes:
>  > All,
>  > 
>  > Here is my text that covers all cases, and appears to 
> address everyone's
>  > concerns. The last sentence was added stating that some 
> implementations
>  > may want to accept CERs from unknown peers, since this is 
> actually required
>  > to handle redirect servers.
>  > 
>  > PatC
>  > ----
>  > 
>  > 
>  > 5.3  Capabilities Exchange
>  > 
>  > [...]
>  > Receiving CERs from unknown peers MAY be silently 
> discarded, or a CEA MAY
>  > be issued with the Result-Code AVP set to 
> DIAMETER_UNKNOWN_PEER. In both
>  > cases, the transport connection is closed. If the local 
> policy permits
>  > receiving CERs from unknown hosts, a successful CEA MAY be 
> returned.
>  > 
>  > 
>

---

From: Pat Calhoun <[email-masked]>
Date: Tue, 13 Nov 2001 09:50:23 -0800

well, there many be a variety of filtering mechanism that can occur, some even
on an outside firewall. For that reason we decided to not get into that rat hole :)

PatC