Re: [radext] Review of draft-ietf-radext-radiusdtls

[Fabian Mauchle <[e-mail]>]

On 20.03.2024 05:50, Mark Grayson (mgrayson) wrote:
> I think I raised this issue previously, but there may be a conflict 
> between mandating application-layer watchdog and the recommendation of 
> configurable idle timeout connection limits.
> 
> There may be a need to avoid mandating operation of the 
> application-layer watchdog, specifically with RADIUS/TLS connections 
> established dynamically using 7585, to then facilitate the graceful 
> closing of such connections using the idle timeout mechanism when all 
> devices have detached from the NAS.

I think this issue can be solved with a simple provision. The client 
side already specifies this, and it can be applied to the server the 
same way:

6.4.2.  Client Session Management

[...] Clients SHOULD close a session when no traffic other than watchdog 
packet and (possibly) watchdog responses have been sent [...].

 From my experience with eduroam, the watchdog (i.e. Status-Server) has 
been extremely helpful with bad firewall and load-balancer behavior.

-- 
Fabian