Re: [pntaw] TURN over websockets or just TURN.

Hi Tiru

thanks for the info !

What is your opinion, do we have to add something to the draft to improve
our interoperability with  Secaas systems ?

We are pretty much concentrating on two major aspects:

1) Connectivity
2) Ability for the network managers to set the access policies.

Regards,
Oleg

On Wed, Sep 25, 2013 at 8:26 PM, Tirumaleswar Reddy (tireddy) <
tireddy@cisco.com> wrote:

>  Hi Oleg,****
>
> ** **
>
> Please see inline [TR]****
>
> ** **
>
> *From:* pntaw-bounces@ietf.org [mailto:pntaw-bounces@ietf.org] *On Behalf
> Of *Sergio Garcia Murillo
> *Sent:* Thursday, September 26, 2013 2:10 AM
> *To:* pntaw@ietf.org
>
> *Subject:* Re: [pntaw] TURN over websockets or just TURN.****
>
>  ** **
>
> El 25/09/2013 21:18, Oleg Moskalenko escribió:****
>
>  Andy, see below:****
>
> ** **
>
> On Wed, Sep 25, 2013 at 12:03 PM, Hutton, Andrew <
> andrew.hutton@siemens-enterprise.com> wrote:****
>
>
> [AndyH] True I was considering that as the simple case and of course there
> is no HTTP CONNECT in that scenario. So are you saying that when there is
> no proxy then a websockets connection is more likely to work than a
> TURN/TCP or TURN/TLS connection. I would be interested in whether there is
> evidence of that I am not sure whether it is true or not certainly in the
> encrypted case I don't see how this can be but I am not an expert on this.
> ****
>
> ** **
>
> I cannot say that I am exactly an expert in IT firewall world, too. But I
> personally observed a rather strict corporate environments where a strict
> firewall is used without explicit HTTP proxy. Also, I heard from our TURN
> server users the stories about similar cases. The usual story was that the
> firewall blocks the outgoing TURN TCP connection unless it is destined to
> 80/443 port and it has an HTTP handshake.****
>
> ** **
>
> Exactly the same case here. I have (had) a "potential" customer that is
> using a cloud based network filtering solution, and SIP over secure
> websockets works but TURN over TLS on port 443 doesn't. I yet have to
> double check my TURN TLS settings to see if everything is correctly
> configured and working correctly with chrome.****
>
> ** **
>
> [TR] Various Enterprises in addition to firewalls are also using cloud
> connector which re-directs HTTP/HTTPS traffic to cloud based "Security As A
> Service" (SecaaS) for DPI, reputation based filtering etc
> http://www.gartner.com/technology/reprints.do?id=1-1FVA8PB&ct=130603&st=sb.
> SecaaS can also do HTTPS inspection by acting as HTTPS proxy. ****
>
> ** **
>
> -Tiru.
>
> Best regards
> Sergio****
>
> _______________________________________________
> pntaw mailing list
> pntaw@ietf.org
> https://www.ietf.org/mailman/listinfo/pntaw
>
>