Subject: RE: [AAA-WG]: Question regarding IP Filter Rule

From: "Christopher Richards" <[email-masked]>
Date: Tue, 16 Dec 2003 13:32:25 -0600

Hi Avi,

The Diameter RFC (And applications) specify where to redirect user traffic -
not how. The "how" is implementation specific.

Best Regards,
Chris.

Shasta Wireless Development
Nortel Networks

Telephone:
+1 972 684 3281
ESN 444 3281

-----Original Message-----
From: Avi Lior [mailto:[email-masked]] 
Sent: Tuesday, December 16, 2003 1:23 PM
To: [email-masked]'; [email-masked]
Subject: [AAA-WG]: Question regarding IP Filter Rule

The Black I-D and PWLAN draft prompted me to check something out.

It seems to me that something is missing in Diameter.  Using the filter
specification in 3588 its not clear how I force a forward.  The only actions
supported are permit or deny whereas ipfw supports a forward mechanism as
well.

The motivation for this is the requirement in (WLAN for example) whereby I
want to force all http traffic to a specific portal and deny all other
traffic until the portal instructs the NAS otherwise.  This needs to be done
either during an Access Accept or mid-session using COA.

---

From: Avi Lior <[email-masked]>
Date: Tue, 16 Dec 2003 15:03:28 -0500

Chris,
 
Okay so forgive me but how do I specify where to redirect user traffic in
diameter.  Which attributes do that.  Note I am not talking about where to
redirect AAA traffic.
 
Avi

-----Original Message-----
From: Christopher Richards [mailto:[email-masked]] 
Sent: Tuesday, December 16, 2003 2:32 PM
To: 'Avi Lior'; [email-masked]'; [email-masked]
Subject: RE: [AAA-WG]: Question regarding IP Filter Rule

Hi Avi, 

Best Regards, 
Chris. 

Telephone: 
+1 972 684 3281 
ESN 444 3281 

-----Original Message----- 
From: Avi Lior [mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Tuesday, December 16, 2003 1:23 PM 
To: [email-masked]'; [email-masked] 
Subject: [AAA-WG]: Question regarding IP Filter Rule

---

From: <[email-masked]>
Date: Wed, 17 Dec 2003 09:19:31 +0200

Avi Lior wrote

> either during an Access Accept or mid-session using COA.

How to redirect user traffic (e.g. http) is implementation specific and
I think is not a Diameter business. If you want to indicate redirect traffic
to a specific address, in Diameter applications you can define a grouped AVP
to realize the functionality. One example could be the Final-Unit-Indication
in the DCC application.

Regards
Marco

---

From: Avi Lior <[email-masked]>
Date: Wed, 17 Dec 2003 11:49:27 -0500

Thanx Marco,

I am familiar with DCC.  My point was/is that IPFilterRules would have been
one way to do this and the IPFW appears to support this capability.  Its too
bad that IPFilterRules don't support this capability because now we have to
build it into our applications.

For RADIUS prepaid and PWLAN etc we will have to define a new AVP to do
redirects.  Alternatively, we could define an IPFilterRule attribute that
has the forwarding capability that went missing in Diameter.  But now we
would have a compatibility issue with Diameter.

> From: [email-masked] [mailto:[email-masked]] 
> Sent: Wednesday, December 17, 2003 2:20 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> How to redirect user traffic (e.g. http) is implementation 
> specific and I think is not a Diameter business. If you want 
> to indicate redirect traffic to a specific address, in 
> Diameter applications you can define a grouped AVP to realize 
> the functionality. One example could be the 
> Final-Unit-Indication in the DCC application.
> 
> Regards
> Marco
>

---

From: Avi Lior <[email-masked]>
Date: Wed, 17 Dec 2003 11:58:05 -0500

Scratch that.  I was mistaken. IPFW does not support redirects.

You have to invent a new attribute or use Framed-IP-Route to do redirects.

---

From: <[email-masked]>
Date: Wed, 17 Dec 2003 19:03:22 +0200

> You have to invent a new attribute or use Framed-IP-Route to 

Are you talking about RADIUS attribute? 

> From: ext Avi Lior [mailto:[email-masked]]
> Sent: 17 December, 2003 18:58
> To: Stura Marco (NET/Helsinki); Avi Lior

---

From: <[email-masked]>
Date: Thu, 18 Dec 2003 08:49:12 +0200

> Yes. But you also need the same in Diameter

Yes, I think you are right.

>Well DCC did right?

I think so. This is one way to do it, but there may be also
other ways. 

> Sent: 17 December, 2003 20:44
> Yes. But you also need the same in Diameter (I think? Well 
> DCC did right?)
> 
> > Sent: Wednesday, December 17, 2003 12:03 PM
> > > > > It seems to me that something is missing in Diameter.  
> > Using the 
> > > > > filter specification in 3588 its not clear how I force 
> > a forward.
> > > > > The only actions