Subject: [AAA-WG]: CMS Security TTL questions

From: Don Zick <[email-masked]>
Date: Wed, 02 Jan 2002 14:21:46 -0500

From Section 1.3 of the Diameter CMS Security Application draft 3:

>The PDSA MUST contain the TTL setting
>agreed by the proxy agent for its DSA. This information will
>allow the access device to re-issue a PDSR prior to the proxy's
>DSA if it needs the DSA to remain active.
>

Okay, so the access device can re-issue a PDSR to re-establish a DSA
prior to expiration.

>...
>An optimized approach also allows the PDSR to be sent by the access
>device without the DSAR-Target-Realm AVP. This message is used to
>inform the proxy that it MUST establish a Diameter security
>association for all realms it will be communicating with on behalf of
>the access device. DSAs are typically established once the first
>request for a given realm has been recelived by the proxy agent, but
>it MAY establish certain DSAs with known realm in advance.

What should TTL be set to in the PDSA in this case?

>
>If a DSA for a given realm cannot be established, the proxy agent
>MUST reject the access device's request, and set the Result-Code AVP
>to DIAMETER_NO_DSA_ESTABLISHED. Although the proxy agent MAY receive
>many PDSRs from access devices, only one DSA per realm MUST be
>established. Furthermore, the proxy is responsible for re-
>establishing the DSA prior to expiration without any involvement by
>the access device.

It is the proxy's responsibility to re-establish a DSA prior to
expiration?  Isn't this inconsistent with what was stated in the first
paragraph above?

Thanks,
Don