Subject: [Dime] Diameter Intercommunication

From: [email-masked]
Date: Wed, 21 May 2008 08:10:14 +0200

Hello All,

I’m contacting you regarding the Diameter AAA protocol . For some days I'm already busy with studying the Diameter Base Protocol ( RFC 3588) and there came up some question regarding this protocol. 

Assume that we have a triple-a server X and a second triple-a server Z. Now a NAS (network access server and working as Diameter client) wants to authenticate an attached client by contacting his default triple-a server X. But the server X doesn’t have any authentication/authorization information regarding this client. Does server X use DIAMETER to contact his ‘next hop’ triple-a server Z to 
request Authentication/Authorization information? 

Which protocol does triple-a servers use to intercommunicate?
If they use Diameter to intercommunicate, will the triple-a server X only forward the Diameter client's (NAS) request to server Z, or must server X modify the whole Diameter request (AA-Request) or create a special request and then forward it to his 'next hop'?

I'm not sure, if a Diameter Relay Agents is involved in the described behavior.

Thanks a lot in advance!!!!

Bernd

-- 
Psssst! Schon vom neuen GMX MultiMessenger gehört?
Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger
_______________________________________________
DiME mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dime

---

From: <[email-masked]>
Date: Wed, 21 May 2008 09:58:16 +0300

Hi Bernd, 

>Hello All,
>
>I'm contacting you regarding the Diameter AAA protocol . For 
>some days I'm already busy with studying the Diameter Base 
>Protocol ( RFC 3588) and there came up some question regarding 
>this protocol. 
>
>Assume that we have a triple-a server X and a second triple-a 
>server Z. Now a NAS (network access server and working as 
>Diameter client) wants to authenticate an attached client by 
>contacting his default triple-a server X. But the server X 
>doesn't have any authentication/authorization information 
>regarding this client. Does server X use DIAMETER to contact 
>his 'next hop' triple-a server Z to request 
>Authentication/Authorization information? 

YES

>Which protocol does triple-a servers use to intercommunicate?

Diameter

>If they use Diameter to intercommunicate, will the triple-a 
>server X only forward the Diameter client's (NAS) request to 
>server Z, or must server X modify the whole Diameter request 
>(AA-Request) or create a special request and then forward it 
>to his 'next hop'?

One option is to just route it to the user's home AAA server. 
It could, however, also do a redirect. 

>I'm not sure, if a Diameter Relay Agents is involved in the 
That's a deployment choice. 

You can read the details in RFC 3588 or in the updated version (still in
progress):
http://www.ietf.org/internet-drafts/draft-ietf-dime-rfc3588bis-10.txt

>Thanks a lot in advance!!!!

Ciao
Hannes

---

From: "Glen Zorn" <[email-masked]>
Date: Thu, 29 May 2008 09:23:23 +0700

> >Authentication/Authorization information?

Hmm.  This seems to imply that a Diameter server blindly forwards all
requests an unknown user to the next hop server, which is certainly not
true.  Server X will forward to server Z iff there is a path to the realm
identified in the user's NAI (this path may, of course be a default).

> >Which protocol does triple-a servers use to intercommunicate?

RADIUS servers are also AAA servers but rarely use Diameter for anything
;-).

...

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 29 May 2008 19:44:24 +0300

Hi Glen,

> identified in the user's NAI (this path may, of course be a default).
I presented the simplified story.

> RADIUS servers are also AAA servers but rarely use Diameter for anything
I almost forgot RADIUS :-)

Ciao
Hannes