Re: [radext] configuration auto-discovery [was: draft-cullen-radextra-status-realm-00]

Alan DeKok <aland@deployingradius.com> Sun, 13 August 2023 20:38 UTC

Return-Path: <aland@deployingradius.com>
X-Original-To: radext@ietfa.amsl.com
Delivered-To: radext@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6311C14CE25 for <radext@ietfa.amsl.com>; Sun, 13 Aug 2023 13:38:01 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.909
X-Spam-Level:
X-Spam-Status: No, score=-1.909 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5F4Vauco57yL for <radext@ietfa.amsl.com>; Sun, 13 Aug 2023 13:37:57 -0700 (PDT)
Received: from mail.networkradius.com (mail.networkradius.com [62.210.147.122]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3FDEEC14F74A for <radext@ietf.org>; Sun, 13 Aug 2023 13:37:55 -0700 (PDT)
Received: from smtpclient.apple (135-23-95-173.cpe.pppoe.ca [135.23.95.173]) by mail.networkradius.com (Postfix) with ESMTPSA id 377AB20A; Sun, 13 Aug 2023 20:37:53 +0000 (UTC)
Authentication-Results: NetworkRADIUS; dmarc=none (p=none dis=none) header.from=deployingradius.com
Content-Type: text/plain; charset="us-ascii"
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
From: Alan DeKok <aland@deployingradius.com>
In-Reply-To: <5B16D759-758E-4701-8C7E-4A563AC74274@gmail.com>
Date: Sun, 13 Aug 2023 16:37:51 -0400
Cc: radext@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <3CAEA649-7996-4564-B6C9-7B28DD32FDDA@deployingradius.com>
References: <0FCC9942-32CE-4B98-8F71-175F410882E7@deployingradius.com> <5B16D759-758E-4701-8C7E-4A563AC74274@gmail.com>
To: Bernard Aboba <bernard.aboba@gmail.com>
X-Mailer: Apple Mail (2.3696.120.41.1.1)
Archived-At: <https://mailarchive.ietf.org/arch/msg/radext/cBaWBgPtBPTvC-e8PtRitiTYNEg>
Subject: Re: [radext] configuration auto-discovery [was: draft-cullen-radextra-status-realm-00]
X-BeenThere: radext@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: RADIUS EXTensions working group discussion list <radext.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/radext>, <mailto:radext-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/radext/>
List-Post: <mailto:radext@ietf.org>
List-Help: <mailto:radext-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/radext>, <mailto:radext-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 13 Aug 2023 20:38:01 -0000

On Aug 13, 2023, at 2:23 PM, Bernard Aboba <bernard.aboba@gmail.com> wrote:
> [BA] Before embarking on the design of a routing protocol (which is an IPR minefield and could generate lots of route flap traffic) it would first be useful to define use cases not already handled by dynamic discovery or existing failover mechanisms. Personally I have never encountered such a use case and have often disabled routing protocols on NAS devices to avoid route flaps.

  There are a few use-cases which could be solved.  A routing protocol may be the solution, or perhaps something simpler.

  One is that fail-over is just not defined at all in RFC 2865.   RFC 3539 defines a way to tell if a particular connection is alive.  But no specification describes how to fail over between connections, or load-balancing mechanisms, or how to address multi-hop issues.

  This lack means that any fail-over mechanism is largely implementation-defined.  Which means there are often connection / destination flapping, similar to route flaps.

  There is no way for a proxy to say "I'm alive, but I can't route this particular packet.  Please redirect it somewhere else".  Better connection signalling would solve that issue directly.  A routing protocol would solve it indirectly.

  Similarly, there's no way to signal capabilities.  RADEXT had long discussions about this a decade ago, with no conclusion.  The reverse CoA draft would directly benefit from some kind of connection or multi-hop signalling.  A routing protocol would help indirectly.

  The use of 7585 discovery helps here.  It's widely used in WBA OpenRoaming.  Roaming systems like eduroam are often "spoke and hub", but statically configured.  So perhaps a routing protocol is less useful there.

  But both solutions would benefit from clearer and more standardized fail-over, load-balancing, and discovery mechanism.

  Alan DeKok.