Network Working Group R. Ejzak
INTERNET-DRAFT Alcatel-Lucent
Intended status: Informational December 17, 2008
Expires: June 17, 2009
Extension to the Session Description
Protocol (SDP) for Bypass of Border Gateways
<draft-ejzak-mmusic-bg-bypass-00.txt>
Status of this memo
This Internet-Draft is submitted to IETF in full conformance with
the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as
Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other documents
at any time. It is inappropriate to use Internet-Drafts as
reference material or to cite them other than as "work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html
Abstract
This document describes an extension to the Session Description
Protocol (SDP) that can be used by systems of cooperating networks
using Application Level Gateways (ALG) to insert border gateways
performing as Network Address Port Translators (NAPT) between their
IP realms to identify when border gateways can be bypassed for more
efficient media flow. This extension can be used by networks based
on a protocol using the SDP offer/answer model, such as the IP
Multimedia Subsystem (IMS) of the Third Generation Partnership
Project (3GPP), which is based on the Session Initiation Protocol
(SIP). ALGs using this extension can determine within a single SDP
offer/answer transaction when the insertion of a new border gateway
would cause the media path to re-enter an IP realm visited elsewhere
Ejzak [Page 1]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
within the media path, and to bypass one or more border gateways
that would otherwise be included in the media path. This extension
also works with hosted NAPT traversal schemes to establish a direct
media path between endpoints within the same IP realm. Optional
procedures provide additional means to improve media flow.
Table of Contents
1. Introduction....................................................3
2. Applicability Statement.........................................5
3. Conventions and Acronyms........................................6
4. Overview of Operation...........................................6
4.1. Overview of Operation of Base Algorithm....................6
4.2. Overview of Operation of the Active-Bypass Option..........9
5. IP realm considerations........................................12
6. ALG procedures.................................................13
6.1. ALG handling of SDP offer.................................13
6.1.1. SDP offer case 1: bypass controlled BG and prior BGs.14
6.1.2. SDP offer case 2: bypass controlled BG...............15
6.1.3. SDP offer case 3: bypass prior BGs...................15
6.1.4. SDP offer case 4: bypass no BGs......................16
6.2. ALG handling of SDP answer in base algorithm..............17
6.2.1. SDP answer sub-case a: valid connection information..18
6.2.2. SDP answer sub-case b: match on other IP realm.......19
6.2.3. SDP answer sub-case c: match on forwarded SDP offer..20
6.2.4. SDP answer sub-case d: match on received SDP offer...20
6.2.5. SDP answer sub-case e: match on own secondary-realm..21
6.2.6. SDP answer sub-case f: no match......................22
6.3. ALG procedures for Active-Bypass Option...................22
6.3.1. Anchor ALG sends an alternate path request...........22
6.3.2. Target ALG processing of alternate path request......23
6.3.3. Anchor ALG processing of SDP offer from Target ALG...24
6.3.4. Other ALG processing of SDP answer in original dialog 26
6.3.5. Target ALG processing of SDP answers.................26
6.3.6. Release of alternate path dialog.....................27
6.4. Special handling of unspecified address from endpoints....28
6.5. Assumptions about non-compliant ALGs......................28
6.6. Operation in the presence of forking......................30
7. The visited-realm and secondary-realm attributes...............30
8. Security Considerations........................................35
9. IANA Considerations............................................35
9.1. visited-realm Attribute...................................36
9.2. secondary-realm Attribute.................................36
10. References....................................................37
10.1. Normative References.....................................37
10.2. Informative References...................................37
Ejzak [Page 2]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
1.
Introduction
The IP Multimedia Subsystem (IMS) [20] [21] and other SIP networks
have the option to deploy border gateways between the IP realms
defined by each network. Within an IP realm every endpoint is
reachable from any other endpoint using a common address space.
Each border gateway typically provides a firewall or Network Address
Port Translator (NAPT) [13] to limit access to endpoints within a
realm. An Application Layer Gateway (ALG) controls each border
gateway to allocate new IP addresses and ports as necessary for each
SDP media line and updates the SDP connection and port information
in each forwarded SDP offer and answer to effectively insert the
border gateway into each end-to-end multimedia stream.
The media path associated with a multimedia stream may traverse an
arbitrary number of IP realms between endpoints. As long as each
border gateway in the media path has no connection to IP realms on
the media path other than its two directly connected IP realms,
there is no option to optimize the media path using the allocated
border gateway resources. But if either endpoint or any border
gateway on the path has direct access to one of the other IP realms
on the path, then a shorter media path exists. A sequence of ALGs
implementing the procedures herein, where each ALG can determine the
IP address and port information for entities on the media path in
its interconnected IP realms, will be able to establish a media path
with the minimum number of border gateways without compromising any
of the access controls associated with the border gateways on the
path. If one or more ALGs on the signaling path do not implement
the procedures then border gateway bypass can still occur but some
potentially bypassable border gateways may remain in the media path.
The procedures described herein also include an "active-bypass"
option to attempt to find a shorter media path segment between
existing border gateways associated with the path. This option
requires additional SIP signaling to establish a SIP dialog for each
alternate media path segment candidate, whereas the base algorithm
works by adding information to existing SDP offer/answer messages.
Due to this additional signaling overhead, this option should only
be used when it can be determined that dramatic improvement is
possible for a media path segment.
This extension also works with hosted NAPT traversal schemes to
establish a direct media path between endpoints within the same IP
realm. If the endpoints are in different IP realms, this extension
cannot bypass an ALG/BG that is coordinating the traversal of a
Residential Gateway (RG) NAPT, although it is possible that a
combination of NAPT traversal techniques can achieve this. This
document does not analyze combination methods to address this
limitation. Since networks using ALG/BGs typically perform other
Ejzak [Page 3]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
media path functions at the ALG/BG configured to traverse the
RG/NAPT, this is not a significant limitation.
RFC 3264 [3] describes the SDP offer/answer model, which enables SIP
networks to establish end-to-end media paths for the multimedia
streams in each session. This document describes two SDP extension
attributes and some extensions to ALG procedures for forwarding SDP
offers and answers. ALGs on the path manipulate the SDP as
necessary within a single end-to-end SDP offer/answer transaction to
enable establishment of an end-to-end media path with the minimum of
border gateways. The SDP extension attributes describe media
connection and port information for each IP realm on the path that
is a candidate to bypass one or more border gateways on the path.
This document describes an extension and optimization of the ALG
approach to NAPT traversal. Other options for NAPT traversal
include the Middlebox Control Protocol [14], Session Traversal
Utilities for NAT (STUN) [18], the STUN Relay Usage [19], and Realm
Specific IP [11] [12]. The most recent and comprehensive approach
to NAPT traversal is Interactive Connectivity Establishment (ICE)
[17], which uses STUN to identify candidate addresses for NAPT
traversal for media streams established by the offer/answer model.
While an ALG approach may require the insertion of a SIP back to
back user agent (B2BUA) to modify SDP whenever a border gateway is
inserted in the media path, ICE also has several disadvantages. ICE
requires the deployment of STUN servers in each IP realm, a means of
advertising the location of available STUN servers to SIP endpoints,
extra signaling to discover candidate addresses for inclusion in SDP
offers and answers, extra signaling to communicate the selected
connection information, and implementation of the ICE procedures in
the endpoints. With ICE, border gateways must be configured to
allow signaling between endpoints and STUN servers, and do not
receive definitive information on which ones are actually used and
which remote addresses will be used in the RTP [15] stream. This
makes it difficult for border gateways to limit access to known IP
source addresses and to predict bandwidth usage, which are two
important reasons for deploying border gateways.
The border gateway bypass procedures in this document, while
requiring the use of ALGs, avoid the requirement to deploy STUN
servers, require no additional signaling beyond what is needed for a
single end-to-end SDP offer/answer transaction (although an optional
procedure does generate additional signaling), require no new
procedures to be supported by endpoints, allow border gateways to
limit access to known IP source addresses, and allow border gateways
to predictably manage aggregate bandwidth usage for all sessions.
Ejzak [Page 4]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
Since this extension does not incorporate end-to-end connectivity
checks of the media path, it requires accurate provisioning of the
IP realms.
2.
Applicability Statement
The use of this extension is only applicable inside a "Trust Domain"
as defined in RFC 3325 [4]. Nodes in such a Trust Domain are
explicitly trusted by its users and end-systems to inspect and
manipulate SDP messages as necessary to traverse and/or bypass
firewalls and NATS while limiting access from unauthorized sources
to endpoints in IP realms associated with the Trust Domain.
Since the procedures in this document include an option to
cryptographically certify the candidate connection and port
information from each IP realm, they can be used under some
circumstances when the signaling traverses non-trusted networks or
the Internet at large.
This extension requires that ALGs on the signaling path have the
ability to access and manipulate SDP messages, which is inconsistent
with the general recommendation that these messages be encrypted and
integrity protected end-to-end.
In the interest of algorithmic simplicity, this extension finds
improved media paths in most cases according to the available
information, but not under all circumstances.
This document does NOT offer a general model for optimal
configuration of border gateways in the Internet at large.
This extension assumes that there is at most a single set of
connection and port information for each SDP media line, consistent
with existing RFCs. Possible future SDP extensions that allow
description of alternative connection or port capabilities may not
be compatible.
This extension makes some assumptions about the behavior of ALGs not
implementing the extension that may not always be valid. See
section 6.5 for a discussion of the compatibility issues and work-
arounds. The extension also has some limitations when handling an
unspecified address as connection information from an endpoint. See
section 6.4.
Despite these limitations, there are sufficiently useful specialized
deployments that meet the assumptions described above, and can
accept the limitations that result, to warrant publication of this
mechanism. An example deployment would be an IMS network using
Ejzak [Page 5]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
border gateways to interconnect multimedia sessions with other
networks.
3.
Conventions and Acronyms
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [1].
The following acronyms are used in this document:
3GPP - the Third Generation Partnership Project
3pcc - Third Party Call Control [16]
ABNF - Augmented Backus-Naur Form [6]
ALG - Application Layer Gateway [13]
B2BUA - Back to Back User Agent [2]
BG - Border Gateway
FQDN - Fully Qualified Domain Name
GRUU - Globally Reachable UA URI [8]
ICE - Interactive Connectivity Establishment [17]
IMS - Internet Protocol Multimedia Subsystem [20] [21]
IP - Internet Protocol
IPSEC - IP Security
IPv4 - IP Version 4
IPv6 - IP Version 6
LAN - Local Area Network
MD5 - Message-Digest 5 Algorithm [9]
NAT - Network Address Translation [13]
NAPT - Network Address Port Translation [13]
RG - Residential Gateway
RTCP - RTP Control Protocol [15]
RTP - Real-time Transport Protocol [15]
SDP - Session Description Protocol [7]
SIP - Session Initiation Protocol [2]
SP - Space
STUN - Session Traversal Utilities for NAT [18]
TCP - Transport Control Protocol
UA - User Agent [2]
UDP - User Datagram Protocol
URI - Uniform Resource Identifier
WGS - World Geodetic System [24]
4.
Overview of Operation
4.1.
Overview of Operation of Base Algorithm
Ejzak [Page 6]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
Figure 1 shows a typical call configuration between endpoints UA1
and UA2, where the SIP signaling goes between the UAs via at least
one ALG (four are shown) and other SIP servers not shown, and one
RTP multimedia stream goes between the UAs via the BGs and possibly
an RG associated with each UA (only one RG is shown associated with
UA2). Each BG is controlled by its corresponding ALG. R1, R2,
etc., in the figure represent the IP realms associated with each
segment of the media path.
The media path for each multimedia stream between the UAs is
established via an end-to-end SDP offer/answer exchange where each
ALG may choose to modify the connection and port information
associated with each media line in the SDP to insert its BG in the
media path according to normal ALG procedures. Each ALG may also
perform the base algorithm procedures to identify when one or more
BGs and/or RGs can be bypassed and to modify the forwarded SDP
messages to implement the corresponding changes in the media path to
bypass the BGs.
+----+ +----+ +----+ +----+
|ALG1|---|ALG2|---|ALG3|---|ALG4|
/+----+ +----+ +----+ +----+\
/ | | | | \
+---+/ | | | | \+---+ +---+
|UA1| +----+ +----+ +----+ +----+ |RG |---|UA2|
| |---|BG1 |---|BG2 |---|BG3 |---|BG4 |---| |---| |
+---+ +----+ +----+ +----+ +----+ +---+ +---+
|<--R1-->|<--R2-->|<--R3-->|<--R4-->|<--R5-->|<--R6-->|
Figure 1: Example Call Configuration
Figure 2 shows another example call configuration where secondary
BGs are used to establish a media path with fewer BGs. ALG1 through
ALG5 initially allocate BG1a, BG2, BG4, BG4 and BG5a as ALGs forward
the initial SDP offer towards UA2 from UA1. These BGs enable
traversal of unique IP realms R1 through R6 (not labeled in the
figure). Since these BGs do not create any loop in the media path,
there is no possibility to bypass any of them if the algorithm is
limited to finding loops in a fixed media path.
Ejzak [Page 7]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
+----+ +----+ +----+ +----+ +----+
|ALG1|---|ALG2|---|ALG3|---|ALG4|---|ALG5|
/+----+ +----+ +----+ +----+ +----+\
/ | | | | | | | \
+---+/ | | | | | | | \+---+
|UA1| +----+| +----+ +----+ +----+ |+----+ |UA2|
| |-|BG1a|-----|BG2 |---|BG3 |---|BG4 |-----|BG5a|-| |
+---+ +----+| +----+ +----+ +----+ |+----+ +---+
\ | | /
\ +----+ +----+ /
\---|BG1b|----------------------------|BG5b|---/
+----+ +----+
Figure 2: Example Configuration using Secondary BGs
While forwarding the initial SDP, if an ALG along the way, such as
ALG1, controls BG(s) that have access to IP realm(s) other than
those IP realms that it controls on the default media path (i.e.,
not R1 or R2), then the ALG can advertise its ability to access
additional IP realm(s) by including information about them in the
forwarded SDP.
If a subsequent ALG (e.g., ALG5) determines that it controls a BG
(e.g., BG5b) that has a direct connection to an IP realm accessible
from a BG controlled by a previous ALG in the path (e.g., ALG1 and
BG1b), then the ALG may choose to use this alternative media path if
it appears to be an improvement over the initial path. In this
example, the algorithm establishes an alternative media path from
UA1 to UA2 via BG1b and BG5b while significantly reducing the number
of BGs traversed. Note that the IP realm between BG1b and BG5b in
the example (R7) will not match any of the IP realms R1 through R6.
If the connections exist, the algorithm may also generate
alternative paths either via BG1a and BG5b, via BG1b and BG5a, or
via BG1a and BG5a, for example (not shown).
The border gateway bypass base algorithm and active-bypass option
(described in the next section) assume ICE is not used by any entity
in the architecture. Although hybrid procedures are possible, they
are beyond the scope of this document.
It is assumed that the UAs participate in standard SDP offer/answer
negotiation by presenting standard connection and port information
for each media line according to RFC 4566 [7], RFC 3264 [3] and
possibly other extensions. If necessary, the ALGs may use the rtcp
attribute defined in RFC 3605 [5] to identify an RTCP port not using
the expected default value.
Ejzak [Page 8]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
The border gateway bypass base algorithm and the active-bypass
option are may be implemented only within the ALGs. The procedures
have no impact on any aspect of SDP offer/answer negotiation other
than the connection and port information associated with each media
line.
This document defines an SDP extension attribute 'visited-realm'
that provides connection and port information for a prior IP realm
visited on the signaling path. Each instance of visited-realm has
an instance number, realm identifier, connection/port data, and
optional cryptographic signature computed using an algorithm private
to each IP realm so as to ensure the integrity of the visited-realm
data.
This document also defines an SDP extension attribute 'secondary-
realm' that provides connection and port information for secondary
IP realms associated with the signaling path. The secondary-realm
attribute includes the same types of information as the visited-
realm attribute.
Note that the connection and port information in each SDP
offer/answer transaction within a SIP dialog must be handled the
same way, as described in this document, re-allocating and de-
allocating BGs as necessary with each SDP offer/answer transaction
to accommodate any potential changes in the IP realms associated
with the session endpoints.
4.2.
Overview of Operation of the Active-Bypass Option
Figure 3 shows an example of the use of the base algorithm with the
active-bypass option. If the initial BG allocations traversing IP
realms R1 through R6 do not offer an opportunity to bypass any BGs
(as in figure 2), and if no connections exist to offer any of the
alternative options available in the base algorithm, then the
active-bypass option can discover additional alternative(s). Note
that in this case BG1b and BG5b do not share a common IP realm (in
fact, all of the IP realms are different in this example), so the
active-bypass option creates a new signaling path via ALG6 to
establish a new media path segment via BG6.
Ejzak [Page 9]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
+----+
/--------|ALG6|----------------\
/ +----+ \
/ | \
+----+ +----+ | +----+ +----+ +----+
|ALG1|---|ALG2|---|ALG3|---|ALG4|---|ALG5|
/+----+ +----+ | +----+ +----+ +----+\
/ | | | | | | | | \
+---+/ | | | | | | | | \+---+
|UA1| +----+| +----+ | +----+ +----+ |+----+ |UA2|
| |-|BG1a|-----|BG2 |---|BG3 |---|BG4 |-----|BG5a|-| |
+---+ +----+| +----+ | +----+ +----+ |+----+ +---+
\ | | | /
\ +----+ +----+ +----+ /
\---|BG1b|-------|BG6 |---------------|BG5b|---/
+----+ +----+ +----+
Figure 3: Example Configuration with Active-Bypass Option
When implementing the active-bypass option, the following additional
information may be included in each visited-realm and secondary-
realm attribute generated by the base algorithm for an SDP offer, if
available: the approximate geo-location of the corresponding BG; the
approximate delay of IP packets on the previous media path segment
between this BG and the immediately preceding BG or endpoint; the
approximate packet loss rate on the same media path segment; and if
the ALG is reachable via a globally unique host name, then a
globally reachable address of the ALG with a unique instance id for
the corresponding SIP dialog and media line, in the form of a
temporary GRUU [8].
Each ALG should include the geo-location, delay and loss information
in the first visited-realm attribute generated for an SDP offer, and
may include them for other visited-realm or secondary-realm
attributes if the information differs significantly from the first.
Each ALG may include the GRUU in the first visited-realm attribute
generated for a media line in an SDP offer. There is no need to
repeat the GRUU in subsequent visited-realm or secondary-realm
attributes for the same media line.
When processing the SDP answer in the second phase of the base
algorithm, after determining which BGs (if any) are to be bypassed
as a result of the base algorithm, each ALG that still controls a BG
determines if there is the possibility that a significantly shorter
media path segment can be established via another ALG reachable via
a GRUU. Each ALG makes this determination based on the available
geo-location, delay and packet loss information associated with each
BG and media path segment.
Ejzak [Page 10]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
If an ALG determines that it may be able to establish a shorter
media path segment, the ALG (e.g., ALG5) sends a SIP INVITE request
to the "best" ALG reachable via a GRUU (e.g., ALG1) to establish a
separate dialog and corresponding alternate media path segment
(e.g., via ALG6 and BG6). If the ALG is successful in establishing
the alternate media path segment and it appears to be significantly
better than the corresponding one determined by the base algorithm,
then the ALGs instruct the BGs to insert the shorter path segment
into the overall media path.
Figure 4 shows a call flow that corresponds to the configuration in
figure 3.
UA1 ALG1 ALG2 ALG6 ALG3 ALG4 ALG5 UA2
| | | | | | | |
|(1a)SDP| | | | | |
| Offer|(1b) |(1c) | |(1d) |(1e) |(1f) |
|------>|------>|-------------->|------>|------>|------>|
| | | | | |(3a) |(2a)SDP|
| | | | | | empty | Answer|
| | |(3b) | | | Invite|<------|
| |<--------------|<----------------------| |
| |(4a) | | | | | |
| | 200 OK| | | | | |
| | w/ SDP| | | | | |
| | Offer| |(4b) | | | |
| |-------------->|---------------------->| |
| | | | | |(5a) | |
| | | | | | ACK | |
| | | | | | w/ SDP| |
| | |(5b) | | | Answer| |
| |<--------------|<----------------------| |
| | | | | | | |
|(2f) |(2e) | |(2d) |(2c) |(2b) | |
|<------|<------|<--------------|<------|<------| |
| | | | | | | |
Figure 4: Example Flow with Active-Bypass Option
Steps 1a to 1f describe the progression of SDP offers via the ALGs
from UA1 to UA2 and steps 2a to 2f describe the corresponding
progression of SDP answers according to the base algorithm. After
step 2a, ALG5 determines that it may be able to establish a shorter
media path segment via ALG1 and sends an empty SIP INVITE request to
ALG1 via ALG6 in steps 3a and 3b. Steps 4a, 4b, 5a and 5b describe
a new SDP offer/answer transaction between ALG1 and ALG5 via ALG6
which attempts to establish an alternate media path segment. If an
alternate media path segment is successfully established and is a
Ejzak [Page 11]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
significant improvement, ALG5 signals the selection of the alternate
media path segment to ALG1 in steps 2b through 2e. ALG1
incorporates the alternate media path segment into the media path
for the primary dialog before forwarding the final SDP answer to UA1
in step 2f.
5.
IP realm considerations
For the procedures in this specification, the term "IP realm" has a
specific meaning beyond the use of the term "realm" for digest
authentication [10]. An IP realm has two purposes: 1) to identify a
private means by which network entities sharing private information
can verify that data communicated via intermediaries remains
unchanged; and 2) to identify when one network entity is reachable
from another via a fully interconnected common IP address space.
The syntax for the visited-realm and secondary-realm extension
attributes in section 7 clearly describes means of accomplishing
purpose 1) using security credentials.
There are many network configurations for which 2) is applicable, as
described below.
For example, all hosts in a residence on a private LAN behind an
RG/NAPT can be considered to be in their own IP realm. An operator
providing hosted NAPT traversal from an ALG in the network can
identify a separate IP realm for each such residence and provide the
security framework to ensure, for example, that it is possible to
provide a media path directly between hosts in the same residence
when they are involved in an end-to-end session established via SIP
servers in an external network, thus bypassing a potentially
significant number of BGs that would otherwise have been allocated
using normal ALG procedures.
A very similar example is when there is a private enterprise network
using a private IP address space with one or more NAPTs to external
networks. The same principles apply as in the residential case. An
ALG providing hosted NAPT traversal creates an IP realm for the
enterprise, associates the appropriate IP addresses from the
enterprise IP realm with a selected identifier and looks for
opportunities to bypass BGs in the network.
Session endpoints not associated with NAPTs may also be directly
connected to an ALG in the network. Those mutually reachable
endpoints connected to an ALG may be assigned an IP realm.
Once a media path enters a network isolated with ALGs from access
and peer networks, all addresses associated with media connections
Ejzak [Page 12]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
to BGs that are mutually reachable within the network can be
considered part of another IP realm. Whenever an ALG forwards an
SDP offer back into such an IP realm after visiting it on a prior
hop, there is an opportunity to bypass all BGs visited on the "loop"
back into the IP realm.
Two interconnected networks may have ALG/BGs directly connected via
IPSEC associations over the Internet. There may be one or more IP
realms created just to identify these limited connectivity options.
Since there will be limited opportunities to bypass BGs via these IP
realms, a network MAY choose to leave these IP realms unidentified
and MAY choose not to forward visited-realm or secondary-realm
information for these IP realms.
IP addresses reachable from the open internet are associated with
the pre-defined IP realm "IN".
These are just a few examples of IP realms. Since no connectivity
checks are used to verify reachability, IP realms MUST be
provisioned to correctly identify mutually reachable IP addresses.
It is RECOMMENDED that networks provide other means to verify
reachability between endpoints in their defined IP realms.
6.
ALG procedures
The ALG procedures apply in this section SHALL apply separately to
each media line with non-zero port value in each SDP message, and
SHALL apply separately to each SDP offer/answer transaction.
6.1.
ALG handling of SDP offer
When an ALG receives an SDP offer from a UA or another ALG, it first
determines the IP realm for the outgoing segment of the media path
associated with the outgoing signaling. For example, in Figure 1,
if UA1 initiates an SDP offer towards UA2, then the outgoing IP
realm for ALG1 is R2, the outgoing IP realm for ALG2 is R3, and the
outgoing IP realm for ALG4 is R6 (rather than R5). Since ALG4 is
managing the traversal of the RG to R6, BG4 and IP realm R5 are not
eligible for bypass, unless both media path IP endpoints are in the
same IP realm R6, so that all BGs and RGs in the media path are
bypassed.
The ALG examines all previously visited IP realms represented by the
visited-realm and secondary-realm instances for the media line in
the received SDP offer. If the outgoing IP realm matches any of the
visited-realm or secondary-realm instances, then the ALG can bypass
one or more BGs, including the one it controls. The ALG SHOULD
select the earliest matching IP realm and determine the number of
Ejzak [Page 13]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
BGs that can be bypassed by substituting the connection and port
information from this earliest IP realm into the forwarded SDP
offer.
The ALG then determines if a BG under its control has access both to
the outgoing IP realm and to an IP realm associated with a prior
visited-realm or secondary-realm instance in the received SDP offer.
In this case the ALG may be able to bypass one or more BGs, but not
the one it controls. The ALG SHOULD select the earliest IP realm
accessible from a BG under its control and determine the number of
BGs that can be bypassed by connecting the prior IP realm directly
to the BG. Note that in this case use of a visited-realm instance
associated with the immediately prior ALG is pointless since no BGs
are bypassed. Also note that in this case use of a secondary-realm
instance associated with the immediately prior ALG will not reduce
the number of BGs in the path, but may still result in a superior
media path if, for example, it can be determined that there is less
IP layer congestion using this path.
The ALG SHALL then select one of the following four cases depending
on applicability and local policy.
1. Bypass the controlled BG and one or more prior BGs.
2. Bypass the controlled BG.
3. Bypass prior BGs.
4. Bypass no BGs.
The most common local policy will be to select the case that
bypasses the largest number of BGs. In cases 3 and 4, the ALG MAY
signal that it is not to be bypassed by removing all visited-realm
and secondary-realm instances associated with incoming and prior IP
realms from the forwarded SDP offer. The ALG SHOULD signal that it
is not to be bypassed if it performs any necessary media function
other than address translation, e.g., transcoding.
6.1.1.
SDP offer case 1: bypass controlled BG and prior BGs
In case 1, the ALG determines that there exists a visited-realm or
secondary-realm instance for the media line in the received SDP
offer that does not match the incoming IP realm for that media line
but does match the IP realm to be used for the media line in the
forwarded SDP offer.
The ALG
1. SHALL replace the connection and port information for the media
line in the SDP offer with the connection and port information
from the earliest visited-realm or secondary-realm instance
associated with the outgoing IP realm;
Ejzak [Page 14]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
2. SHALL delete every visited-realm or secondary-realm instance
with realm-number value higher than the one used to populate
the outgoing connection and port data, and
3. SHALL forward the modified SDP offer.
An example of case 1, using Figure 1 as reference, is that upon
receiving an SDP offer from the direction of UA1, ALG3 determines
that R4 and R1 are instances of the same IP realm. ALG3 substitutes
the connection and port information from UA1 into the outgoing SDP
offer and deletes the visited-realm instances for R2 and R3 from the
SDP before forwarding. After the end-to-end SDP offer/answer
transaction is completed, the media path will bypass BG1, BG2 and
BG3.
6.1.2.
SDP offer case 2: bypass controlled BG
In case 2 (bypass only the controlled BG), the ALG determines that
the outgoing IP realm is accessible from the incoming IP realm
represented by the IP connection and port information for the media
line in the received SDP offer. If there is a visited-realm or
secondary-realm instance for the incoming IP realm that matches the
media line in the received SDP offer (not necessarily matching the
incoming connection information), the ALG SHALL forward the received
SDP offer without change. Otherwise the ALG SHALL construct a new
visited-realm instance from the connection and port information for
the media line in the incoming SDP offer and SHALL add this visited-
realm instance to the SDP offer before forwarding.
For case 2, the received SDP offer will normally include a visited-
realm or secondary-realm instance that matches the incoming IP realm
unless the previous ALG does not support the BG bypass procedures.
Adding this missing information provides for more opportunities to
perform BG bypass.
6.1.3.
SDP offer case 3: bypass prior BGs
In case 3, the ALG determines that a BG under its control has access
both to the outgoing IP realm and to an IP realm other than the
incoming IP realm that matches a prior visited-realm or secondary-
realm instance for the media line in the received SDP offer.
The ALG:
1. SHALL use the connection and port information from the earliest
visited-realm or secondary-realm instance accessible from the
BG as the remote connection and port information for the side
of the BG directed towards the offerer;
2. SHALL replace the connection and port information for the media
line in the SDP offer with the connection and port information
from the side of its BG directed toward the answerer;
Ejzak [Page 15]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
3. SHALL delete from the SDP answer every visited-realm and
secondary-realm instance with realm-number higher than the
realm-number for the earliest visited-realm or secondary-realm
instance accessible from the BG;
4. MAY, if the ALG requires that its BG remain in the media path,
remove all visited-realm and secondary-realm instances from the
SDP offer;
5. SHOULD, if the outgoing IP realm does not match any of the
visited-realm or secondary-realm instances in the SDP offer,
add to the SDP offer a visited-realm instance for the IP realm
associated with the connection and port information for the
media line in the modified SDP offer;
6. MAY add to the SDP offer a secondary-realm instance for each IP
realm that does not match any other visited-realm or secondary-
realm instance for the media line but for which there is a BG
controlled by the ALG that has access both to this IP realm and
to the incoming IP realm associated with the BG previously
allocated by this ALG and
7. SHALL forward the modified SDP offer.
An example of case 3, using Figure 1 as reference, is that upon
receiving an SDP offer from the direction of UA1, ALG4 determines
that BG4 has access to R2. ALG4 substitutes its BG connection and
port information into the SDP offer, uses the connection and port
information from the visited-realm instance for R2 as the remote
connection and port information for the UA1 side of BG4, deletes the
visited-realm instances for R3 and R4 from the SDP offer, and adds
the visited-realm instance for R5 before forwarding. After the end-
to-end SDP offer/answer transaction is completed, the media path
will bypass BG2 and BG3.
6.1.4.
SDP offer case 4: bypass no BGs
In case 4, the ALG bypasses no BGs.
The ALG:
1. SHOULD, if there is no visited-realm or secondary-realm
instance that matches the IP realm associated with the media
line in the received SDP offer and the ALG allows bypass of its
BG, construct a new visited-realm instance from the connection
and port information for the media line in the incoming SDP
offer and add this visited-realm instance to the SDP offer to
be forwarded;
2. SHALL replace the connection and port information for the media
line in the SDP offer with the connection and port information
from the side of its BG directed toward the answerer;
3. MAY, if the ALG requires that its BG remain in the media path,
remove all visited-realm and secondary-realm instances from the
SDP offer;
Ejzak [Page 16]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
4. SHOULD, if the outgoing IP realm does not match any of the
visited-realm or secondary-realm instances in the SDP offer,
add a visited-realm instance for the IP realm associated with
the connection and port information for the media line in the
forwarded SDP offer;
5. MAY add to the SDP offer a secondary-realm instance for each IP
realm that does not match any other visited-realm or secondary-
realm instance for the media line but for which there is a BG
controlled by the ALG that has access both to this IP realm and
to the IP realm associated with the received SDP offer and
6. SHALL forward the modified SDP offer.
If the ALG is not performing hosted NAPT traversal on the side
towards the SDP offerer, the ALG SHALL use the connection and port
information from the incoming SDP offer as the remote connection and
port information for the side of the BG directed towards the
offerer. If the ALG is performing hosted NAPT traversal on the side
towards the SDP offerer, the ALG/BG MUST discover the address of the
RG via latching or other unspecified technique. Except for the
insertion of the visited-realm and secondary-realm instance(s) in
the outgoing SDP offer, case 4 corresponds to standard ALG behavior.
6.2.
ALG handling of SDP answer in base algorithm
After forwarding an SDP offer, the ALG SHALL keep information about
which of the four cases it selected for handling of BG bypass and
which visited-realm and secondary-realm instances it received and
added to the forwarded SDP offer. The ALG uses this information in
the processing of the corresponding SDP answer, but there are
additional sub-cases to be considered since downstream ALGs can also
bypass BGs already visited, and other ALGs in the path may or may
not support the BG bypass procedures. Note that there is at most
one identified instance of each IP realm (as represented by a
visited-realm or secondary-realm instance) in the SDP offer that
reaches its final destination. The ALG uses this fact to correctly
process the SDP answer. Unidentified IP realms represent lost
opportunities for BG bypass.
To help distinguish the additional sub-cases when processing the SDP
answer, the ALG SHALL insert into the connection information for the
media line in the forwarded SDP answer either: 1) a valid IP address
for the corresponding IP realm or 2) an unspecified address. For
this purpose the unspecified address for IPv4 is '0.0.0.0' and for
IPv6 is a domain name within the .invalid DNS top level domain
(rather than the IPv6 unspecified address '0::0'). When signaling
the unspecified address for the connection information, the port
information MUST have a non-zero value.
Ejzak [Page 17]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
The ALG must consider the following sub-cases when receiving an SDP
answer:
a. The connection and port information for the media line in the
SDP answer received by the ALG is *valid* for its IP realm.
This IP realm matches the IP realm associated with the
connection and port information for the corresponding media
line in the SDP offer forwarded by the ALG.
b. The connection information for the media line in the SDP answer
received by the ALG is the *unspecified address*. The visited-
realm instance in the SDP answer matches a visited-realm or
secondary-realm instance previously *received* in the SDP
offer.
c. The connection information for the media line in the SDP answer
received by the ALG is the *unspecified address*. The visited-
realm instance in the SDP answer matches the IP realm
associated with the connection and port information for the
corresponding media line in the SDP offer *forwarded* by the
ALG, and sub-case b does not apply.
d. The connection information for the media line in the SDP answer
received by the ALG is the *unspecified address*. The visited-
realm instance in the SDP answer matches the IP realm
associated with the connection and port information for the
corresponding media line in the SDP offer *received* by the
ALG, and sub-cases b and c do not apply.
e. The connection information for the media line in the SDP answer
received by the ALG is the *unspecified address*. The visited-
realm instance in the SDP answer matches the IP realm
associated with a secondary-realm instance previously inserted
by the ALG in the forwarded SDP offer, and sub-cases b, c and d
do not apply.
f. The connection information for the media line in the SDP answer
received by the ALG is the *unspecified address*. Sub-cases b,
c, d and e do not apply.
Note that after completing the processing for the appropriate sub-
case, the ALG MAY release any BG resources no longer used by the
resulting media path.
6.2.1.
SDP answer sub-case a: valid connection information
In sub-case a, the ALG receives connection information for the media
line in the SDP answer that corresponds to a valid IP address in its
IP realm. The ALG behavior depends on which SDP offer case it
selected when forwarding the SDP offer:
. In case 1, since the ALG bypassed its BG and at least one prior
BG when forwarding the SDP offer, the ALG must forward an SDP
Ejzak [Page 18]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
answer containing the unspecified address to signal that the
ALG receiving the forwarded SDP answer controls a BG that is to
be bypassed. The ALG SHALL construct a new visited-realm
instance from the connection and port information for the media
line in the incoming SDP answer, SHALL add this visited-realm
instance to the SDP answer, replacing any other visited-realm
instances that may appear in the SDP answer, SHALL replace the
connection information for the media line in the SDP answer
with the unspecified address, and SHALL forward the modified
SDP answer.
. In case 2, since the ALG already bypassed its BG and no others
in the SDP offer, it SHALL forward the received SDP answer with
no changes.
. In case 3, since the ALG already bypassed at least one prior BG
in the SDP offer, but did not bypass its own BG, the forwarded
SDP answer must contain the unspecified address to signal that
the ALG receiving the forwarded SDP answer controls a BG that
is to be bypassed. The ALG SHALL construct a new visited-realm
instance from the local connection and port information for the
side of the BG directed towards the offerer, SHALL add this
visited-realm instance to the SDP answer, SHALL replace the
connection information for the media line in the SDP answer
with the unspecified address, and SHALL forward the modified
SDP answer.
. In case 4, since the ALG does not bypass any BGs, the ALG SHALL
replace the connection and port information for the media line
in the SDP answer with the local connection and port
information for the side of its BG directed toward the offerer,
and SHALL forward the modified SDP answer.
In addition, when the controlled BG remains allocated, as in cases 3
and 4 with sub-case a, if the ALG is not performing hosted NAPT
traversal on the side towards the SDP answerer, the ALG SHALL use
the connection and port information from the incoming SDP answer as
the remote connection and port information for the side of the BG
directed towards the answerer. If the ALG is performing hosted NAPT
traversal on the side towards the SDP answerer, the ALG/BG MUST
discover the IP address of the RG via latching or other unspecified
technique.
6.2.2.
SDP answer sub-case b: match on other IP realm
In sub-case b, the ALG receives an unspecified address in the
connection information for the media line in the SDP answer. The
visited-realm instance in the SDP answer matches a visited-realm or
secondary-realm instance previously *received* by the ALG in the SDP
offer. Regardless which case 1-4 the ALG previously applied to the
SDP offer, the ALG is not required to provide a BG for the media
path. The ALG SHALL forward the SDP answer with no changes.
Ejzak [Page 19]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
6.2.3.
SDP answer sub-case c: match on forwarded SDP offer
In sub-case c, the ALG receives an unspecified address in the
connection information for the media line in the SDP answer. The
visited-realm instance in the SDP answer matches the IP realm
associated with the connection and port information for the
corresponding media line in the SDP offer *forwarded* by the ALG,
and sub-case b does not apply. The ALG behavior depends on which
SDP offer case it selected when forwarding the SDP offer:
. Sub-case b applies exclusively to case 1.
. In case 2, since the ALG already bypassed its BG and no others
in the SDP offer, the visited-realm instance in the received
SDP answer also matches the IP realm associated with the
connection and port information for the corresponding media
line in the SDP offer *received* by the ALG. The ALG SHALL
replace the connection and port information for the media line
in the SDP answer with the connection and port information from
the visited-realm instance in the received SDP answer, SHALL
delete the visited-realm instance from the SDP answer, and
SHALL forward the modified SDP answer.
. In case 3, since the ALG already bypassed at least one prior BG
in the SDP offer, but did not bypass its own BG, the forwarded
SDP answer must contain the unspecified address to signal that
the ALG receiving the forwarded SDP answer controls a BG that
is to be bypassed. The ALG SHALL replace the visited-realm
instance for the media line in the SDP answer with a new
visited-realm instance constructed from the local connection
and port information for the side of the BG directed towards
the offerer, SHALL retain the unspecified address in the
connection information for the media line in the SDP answer,
and SHALL forward the modified SDP answer.
. In case 4, since the ALG does not bypass any BGs, the ALG SHALL
replace the connection and port information for the media line
in the SDP answer with the local connection and port
information for the side of its BG directed toward the offerer,
SHALL delete the visited-realm instance from the SDP answer,
and SHALL forward the modified SDP answer.
In addition, when the controlled BG remains allocated, as in cases 3
and 4 with sub-case c, the ALG SHALL use the connection and port
information from the visited-realm instance in the received SDP
answer as the remote connection and port information for the side of
the BG directed towards the answerer.
6.2.4.
SDP answer sub-case d: match on received SDP offer
Ejzak [Page 20]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
In sub-case d, the ALG receives an unspecified address in the
connection information for the media line in the SDP answer. The
visited-realm instance in the SDP answer matches the IP realm
associated with the connection and port information for the
corresponding media line in the SDP offer *received* by the ALG, and
sub-cases b and c do not apply. The ALG bypasses its BG in all
cases. The ALG behavior depends on which SDP offer case it selected
when forwarding the SDP offer:
. Sub-case b applies exclusively to case 1.
. Either sub-case b or c applies to case 2.
. Sub-case b applies exclusively to case 3.
. In case 4, since the ALG did not bypass any BGs when processing
the SDP offer, it must now signal the forwarded SDP answer to
bypass its own BG. The ALG SHALL replace the connection and
port information for the media line in the SDP answer with the
connection and port information from the visited-realm instance
for the media line in the received SDP answer, SHALL delete the
visited-realm instance from the SDP answer, and SHALL forward
the modified SDP answer.
6.2.5.
SDP answer sub-case e: match on own secondary-realm
In sub-case e, the ALG receives the unspecified address in the
connection information for the media line in the SDP answer. The
visited-realm instance in the SDP answer matches a secondary-realm
instance previously inserted by the ALG in the SDP offer, and sub-
cases b, c and d do not apply. The ALG behavior depends on which
SDP offer case it selected when forwarding the SDP offer:
. SDP offer cases 1 and 2 do not apply since the ALG does not
insert secondary-realm instances into the SDP offer in these
cases.
. In case 3, since the ALG already bypassed at least one prior BG
in the SDP offer, but did not bypass its own BG, the forwarded
SDP answer must contain the unspecified address to signal that
the ALG receiving the forwarded SDP answer controls a BG that
is to be bypassed. The ALG uses the BG associated with the
secondary-realm instance rather than the original BG allocated
for the forwarded SDP offer. The ALG SHALL construct a new
visited-realm instance from the local connection and port
information for the side of the secondary BG directed towards
the offerer, SHALL add this visited-realm instance to the SDP
answer, SHALL replace the connection information for the media
line in the SDP answer with the unspecified address, and SHALL
forward the modified SDP answer.
. In case 4, since the ALG does not bypass any BGs, the ALG SHALL
replace the connection and port information for the media line
in the SDP answer with the local connection and port
Ejzak [Page 21]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
information for the side of its secondary BG directed toward
the offerer, and SHALL forward the modified SDP answer.
In addition, since the secondary BG remains allocated for this sub-
case, if the ALG is not performing hosted NAPT traversal on the side
towards the SDP answerer, the ALG SHALL use the connection and port
information from the incoming SDP answer as the remote connection
and port information for the side of the BG directed towards the
answerer. If the ALG is performing hosted NAPT traversal on the
side towards the SDP answerer, the ALG/BG MUST discover the address
of the RG via latching or other unspecified technique.
6.2.6.
SDP answer sub-case f: no match
In sub-case f, the ALG receives an unspecified address in the
connection information for the media line in the SDP answer, and
sub-cases b, c, d and e do not apply. Since either there is no
visited-realm instance or the instance does not match any of the
listed cases, then either the unspecified address comes from the SDP
answerer or the active-bypass option has been invoked by another
ALG. In all cases 1-4, the ALG SHALL forward the SDP answer with no
changes.
6.3.
ALG procedures for Active-Bypass Option
During the processing of the SDP answer in the base algorithm, any
ALG that still retains a BG in the media path (i.e., SDP answer sub-
cases a, c or e with SDP offer cases 3 or 4) MAY choose to perform
the active-bypass option as a candidate anchor ALG for an alternate
media path segment. The candidate anchor ALG contacts the best
candidate target ALG to mutually determine if a superior media path
segment is available.
6.3.1.
Anchor ALG sends an alternate path request
Each ALG handling one of SDP answer sub-cases a, c or e with SDP
offer case 3 or 4 MAY examine the information within visited-realm
and secondary-realm instances previously received in the SDP offer
to determine if there is a possibility that a significantly "better"
remaining path can be constructed than the one already determined by
the base algorithm. In particular, the ALG examines the geo-
location, delay and loss data from its BG back to the earliest ALG
reachable via a GRUU to make this determination. The method of
using the information to identify better paths and the threshold of
improvement required (given the extra signaling needed for the
active-bypass option) is a matter of local policy.
Ejzak [Page 22]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
For example, if the earliest ALG reachable via a GRUU controls a BG
that is geographically close to the BG controlled by the determining
ALG, yet there are other visited-realm or secondary-realm instances
on the path between them that are geographically distant from them,
then there is good reason to expect that a better media path segment
exists.
If a possible "better" path exists for one or more SDP media lines
to the same earlier ALG, the determining ALG (now called the anchor
ALG) SHALL send a SIP INVITE request without SDP to the earlier ALG
(now called the target ALG). This INVITE request is called an
alternate path request. This alternate path request will, if
successful, result in an alternate path dialog and one or more
alternate media path segments, if they have not already been
established by earlier alternate path requests. This is in contrast
to the original dialog, for which the anchor ALG is still processing
the SDP answer.
If an alternate path dialog associated with the original dialog
already exists between the anchor and target ALGs, the alternate
path request SHALL comprise a re-INVITE request within the existing
alternate path dialog. This may occur, for example, if a previous
SDP offer/answer transaction has already completed within the
original dialog. Otherwise the alternate path request SHALL
comprise a new INVITE request, placing the GRUU of the target ALG in
the Request-URI and the GRUU of the anchor ALG in the From and P-
Asserted-Identity headers.
According to normal IMS routing procedures, the alternate path
request may traverse one or more ALGs on its path to the target ALG.
If the alternate path request fails prematurely with any non-success
final response, the anchor ALG SHOULD abort the active-bypass option
and continue handling of the SDP answer within the original dialog
according to the base algorithm.
6.3.2.
Target ALG processing of alternate path request
Upon receipt of an alternate path request in a new INVITE request,
the target ALG SHALL identify the corresponding original dialog via
the unique value of the GRUU in the Request-URI. Upon receipt of an
alternate path request in a re-INVITE request, the target ALG SHALL
identify the associated alternate path dialog and its corresponding
original dialog. The target ALG uniquely identifies either request
as an alternate path request associated with the original dialog
since the assigned GRUU is the only address for which the target ALG
will establish a corresponding alternate path dialog.
Ejzak [Page 23]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
For each SDP media line in the previously forwarded SDP offer within
the original dialog for which SDP offer case 3 or 4 has been applied
(i.e., the target ALG has allocated a BG for the media line), the
target ALG SHALL determine the IP realm associated with the
alternate path request. Then for each applicable media line, the
target ALG SHALL determine whether the BG resource(s) allocated
during the processing of the SDP offer for the original dialog has
access to the IP realm associated with the alternate path request.
If so, then the BG resource can be re-used, else the target ALG MUST
allocate a new BG resource.
Then the target ALG SHALL construct a new SDP offer from the SDP
offer forwarded within the original dialog by:
1. copying the original SDP offer;
2. modifying the o line as appropriate;
3. deleting all visited-realm and secondary-realm instances;
4. constructing the visited-realm information for each applicable
media line;
5. inserting the corresponding connection and visited-realm
instance information for each applicable media line and
6. setting port value to zero for all other media lines.
For each applicable media line in the new SDP offer, if BG resources
are available with access to additional IP realms as well as access
to the IP realm previously selected for the portion of the bearer
path towards the original SDP offerer, the target ALG MAY construct
the corresponding secondary-realm instances and add them to the
media line.
Then the target ALG SHALL send the constructed SDP offer to the
anchor ALG in the SIP 200 OK response message according to normal
SIP procedures. If the alternate path request received by the
target ALG traversed one or more ALGs on its path from the anchor
ALG, this new SDP offer will also traverse the same ALGs, which will
recursively apply the base algorithm and optionally the active-
bypass option to the SDP offer.
If an error such as any of the following occurs during the
processing of the alternate path request, the target ALG responds
with an appropriate SIP final error response:
. The target ALG does not recognize the GRUU.
. There are no BG resources allocated for any media line in the
original SDP offer.
. The INVITE request included SDP.
6.3.3.
Anchor ALG processing of SDP offer from Target ALG
Ejzak [Page 24]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
When the anchor ALG receives the SDP offer from the target ALG in
the 200 OK response, the anchor ALG SHALL apply the following
procedure independently to each media line in the received SDP offer
before returning the corresponding SDP offer in the ACK request
towards the target ALG.
If the port value is set to zero in the media line, the anchor ALG
SHALL set the port value to zero in the corresponding media line in
the SDP answer to be sent towards the target ALG and SHALL proceed
with the base algorithm (i.e., the active-bypass option has no
impact on the base algorithm for this media line).
If the media line has a non-zero port value, then the anchor ALG
SHALL attempt to identify the corresponding media line in the
original SDP answer. There is a possibility that the order of the
media lines in the received SDP offer is different from the order of
the media lines in the original SDP answer due to intermediate
applications performing 3rd party call control procedures to
split/merge SDP media lines. If there is a visited-realm or
secondary-realm instance in the received SDP offer with a GRUU for
the target ALG, then this can be matched against the GRUU received
for the target ALG in the original SDP offer to identify the
corresponding media line. If no GRUU is present to assist in
matching media lines, the anchor ALG may be able to uniquely match
the media lines based on other information, e.g., only one
applicable media line is common to both the original and alternate
path dialogs.
If the anchor ALG cannot identify the corresponding original media
line for a received media line with a non-zero port value, the
anchor ALG SHALL set the port value to zero in the corresponding
media line in the SDP answer to be sent towards the target ALG.
If the anchor ALG can identify the corresponding original media line
for a received media line with a non-zero port value, the anchor ALG
SHOULD use available visited-realm and secondary-realm instance
information in the received SDP offer and MAY use other unspecified
data to determine if the alternate media path segment is
significantly "better" than the corresponding portion of the
original media path. The algorithm used to assess the quality of
each media path segment and to determine the minimum threshold of
significance is a matter of local policy.
If the anchor ALG determines that the alternate media path segment
is not significantly better than the corresponding portion of the
original media path, the anchor ALG SHALL set the port value to zero
in the corresponding media line in the SDP answer to be sent towards
the target ALG and SHALL proceed with the base algorithm.
Ejzak [Page 25]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
If the anchor ALG determines that the alternate media path segment
is significantly better than the corresponding portion of the
original media path, the anchor ALG:
1. SHALL allocate BG resources for the IP realm associated with
the alternate media path segment, if not already available;
2. SHALL set the connection information and/or visited-realm
attribute for the corresponding media line in the SDP answer
in the alternate path dialog according to the recursive
application of the base algorithm by choosing SDP offer case
3 or 4 according to the processing of the received media line
from the alternate path dialog and by applying SDP answer
sub-case a, c or e from the processing of the original SDP
answer; and
3. SHALL modify the processing of the original SDP answer in the
base algorithm as follows.
For the corresponding media line of the SDP answer received during
the course of the base algorithm, the anchor ALG:
1. SHALL select the remote connection and port information for the
side of the BG directed towards the answerer according to the
SDP offer case applied to the media line in the alternate path
dialog and the applicable original SDP answer sub-case;
2. SHALL delete any visited-realm instance for the media line in
the SDP answer;
3. SHALL construct a new visited-realm instance for the special IP
realm "NOMATCH" including the GRUU of the media line received
from the target ALG, if available;
4. SHALL add this visited-realm instance to the SDP answer;
5. SHALL replace the connection information for the media line in
the SDP answer with the unspecified address; and
6. SHALL forward the modified SDP answer within the original
dialog.
6.3.4.
Other ALG processing of SDP answer in original dialog
After the anchor ALG forwards the original SDP answer, every other
conformant ALG on the signaling path prior to the target ALG will
forward the SDP answer without change according to SDP answer sub-
case f of the base algorithm.
6.3.5.
Target ALG processing of SDP answers
Upon receipt of the SDP answer within the original dialog,
recognizing that it has recently received and responded to an
alternate path request for this media line (and possibly others),
the target ALG:
Ejzak [Page 26]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
1. SHALL determine if SDP answer sub-case f applies with special
IP realm "NOMATCH" in the corresponding visited-realm
attribute (if one is present);
2. SHALL verify that the corresponding media line for the
alternate path dialog is to be associated with this original
media line, using either the GRUU in the received visited-
realm attribute or other unspecified means;
3. SHALL determine if the SDP answer for the alternate path
dialog is received (in the ACK request) in a reasonable
amount of time;
4. SHALL determine if the port for the corresponding media line
for the alternate path dialog has non-zero value and
5. SHALL determine that SDP answer sub-case a, c or e applies to
the corresponding media line for the alternate path dialog.
If any of the above conditions do not apply, then the target ALG
SHOULD continue with the normal processing of the base algorithm
and mark the media line for the alternate path request as
"unused". Note that some combinations of conditions (representing
error cases) will fail to establish an end-to-end media path. If
this occurs, the target ALG SHOULD reject subsequent alternate
path requests within the original dialog and MAY apply other
unspecified recovery actions.
If all of the above conditions apply, the target ALG SHALL apply the
applicable SDP offer case 3 or 4 and the applicable SDP answer sub-
case a, c or e for the corresponding media line for the alternate
path dialog to configure the BG and modify the received SDP answer
for the original dialog before forwarding the SDP answer.
The net result of the successful application of the procedure in
sections 6.3.1 through 6.3.5 is to replace the portion of the end-
to-end media path generated by the base algorithm between the target
and anchor ALGs with the alternate media path segment generated by
the alternate path request.
6.3.6.
Release of alternate path dialog
The target ALG and anchor ALG SHOULD release the alternate path
dialog and associated resources not otherwise needed using standard
SIP procedures when either the original dialog is released or when
all of the media lines for the alternate path dialog either have
port value zero or are marked "unused".
If the alternate path dialog is released while in use to maintain an
alternate media path segment, the anchor ALG and target ALG MAY
release the corresponding original dialog or perform other
unspecified recovery actions.
Ejzak [Page 27]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
6.4.
Special handling of unspecified address from endpoints
If the UA initiating an SDP offer includes an unspecified address in
the connection information, the unspecified address SHALL be
associated with the IP realm of the UA. The ALG SHALL follow case 1
when forwarding an SDP offer with an unspecified address, where it
is understood that the SDP offer contains an implicit visited-realm
instance with the unspecified address for every IP realm. The net
result of this procedure is that if there is an unspecified address
in the initial SDP offer, every ALG will forward an unspecified
address. If the received SDP answer includes a valid IP address, it
will be transformed into an unspecified address by the first ALG
using sub-case a, and subsequent ALGs will include the unspecified
address in the forwarded SDP answer using a sub-case b through f.
Since this procedure does not support the use of a "black hole"
address [16] to discover the connection information for the
answering UA, there are some limitations to the applicability of
these procedures, although none of the recommended 3pcc procedures
[16] depend on the use of the "black hole" address.
If the UA initiating an SDP answer includes an unspecified address
in the connection information, the ALG procedures for handling of
SDP answers remain unchanged, with the result that if any BGs were
allocated when forwarding SDP offers, they will all be released.
Each ALG SHALL treat an SDP answer with an unspecified address but
without an explicit visited-realm instance as if it contains a
single implicit visited-realm instance for an unknown IP realm.
Thus sub-case f always applies.
Note that if the initial SDP offer or initial SDP answer includes an
unspecified address in the connection information, there can be no
media flow until a subsequent SDP offer/answer transaction is
performed using actual IP addresses from the endpoint IP realms.
6.5.
Assumptions about non-compliant ALGs
A non-compliant ALG will usually delete unknown SDP attributes
before forwarding SDP offers or answers. Such an ALG will delete
any visited-realm or secondary-realm instances from the SDP offer
before allocating a BG and forwarding the SDP offer, making it
impossible for subsequent ALGs to bypass the allocated BG.
Optimizations can still be applied independently to the portions of
the end-to-end media path before and after the non-compliant ALG to
successfully establish the end-to-end media path via the BG
allocated by the non-compliant ALG.
If a non-compliant ALG in a session signaling path does forward
visited-realm and secondary-realm attributes after BG allocation,
Ejzak [Page 28]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
compliant ALGs retain most opportunities for BG bypass while
establishing the end-to-end media path if the non-compliant ALG
exhibits the following behaviors:
. When receiving an SDP message with an unspecified address in
the connection information, the non-compliant ALG retains the
unspecified address in the forwarded SDP message. If the ALG
both converts an unspecified address into a valid address and
forwards visited-realm attributes, then the procedures may fail
to establish a media path. The ALGs bordering a non-compliant
ALG known to do this MAY implement a work-around by
manipulating the signaling to keep the non-compliant ALG in the
media path, although this forfeits significant opportunities
for BG bypass.
To keep a neighbor ALG in the path, a compliant ALG selects an
applicable case or sub-case from the detailed procedures that
ensures that real connection information is provided in all SDP
messages destined to the neighbor ALG and to delete all
visited-realm attributes in SDP messages destined to or coming
from the neighbor ALG.
. A non-compliant ALG will not terminate a session for which
there is no media flow in its BG. The ALG must implicitly
accept that its BG may be bypassed.
The ALGs bordering a non-compliant ALG that is known to violate
this assumption MAY implement a work-around by manipulating the
signaling to keep the non-compliant ALG in the media path,
although this forfeits significant opportunities for BG bypass.
Ejzak [Page 29]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
6.6.
Operation in the presence of forking
Forking has no impact on the processing of SDP offers according to
either the base algorithm or the active-bypass option.
When an ALG forwards an INVITE request including an SDP offer that
is subsequently forked, an ALG may receive multiple SDP answers
associated with the SDP offer in the early dialog state, where each
SDP answer is within a separate early dialog. The ALG SHALL apply
the base algorithm and the active-bypass option separately to each
SDP answer associated with a forked branch. The ALG MUST retain any
resources reserved during the handling of the SDP offer until a
dialog is fully established or until it can receive no other forked
SDP answers. If the ALG allocates a BG resource that is shared by
multiple media paths created for parallel-forked dialogs, the ALG
MAY apply local policy to selectively filter the media streams
associated with the forked endpoints according to the gateway model
of RFC 3960 [22] or RFC 5009 [23].
7.
The visited-realm and secondary-realm attributes
The visited-realm and secondary-realm SDP attributes are media-level
attributes only.
The visited-realm attribute contains an IP realm identifier and
transport address for a previously visited realm that can
potentially be used to bypass allocated BGs.
The secondary-realm attribute contains an IP realm identifier and
transport address for a secondary realm that can potentially be used
to bypass allocated BGs.
The syntax of these attributes is defined using Augmented BNF as
defined in RFC 4234 [6]:
Ejzak [Page 30]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
visited-realm = "visited-realm" ":" realm-number SP
realm SP
nettype SP ;from RFC 4566
addrtype SP ;from RFC 4566
connection-address SP ;from RFC 4566
port ;from RFC 4566
[SP rtcp-port [SP rtcp-address]]
[SP coordinates]
[SP delay]
[SP loss]
[SP temp-gruu]
[SP credentials]
*(SP extension-att-name SP
extension-att-value)
secondary-realm = "secondary-realm" ":" realm-number SP
realm SP
nettype SP ;from RFC 4566
addrtype SP ;from RFC 4566
connection-address SP ;from RFC 4566
port ;from RFC 4566
[SP rtcp-port [SP rtcp-address]]
[SP coordinates]
[SP delay]
[SP loss]
[SP temp-gruu]
[SP credentials]
*(SP extension-att-name SP
extension-att-value)
realm-number = 1*DIGIT
realm = non-ws-string ;from RFC 4566
rtcp-port = "rtcp-port" SP port
rtcp-address = "rtcp-address" SP connection-address
coordinates = "coordinates" SP latitude "," longitude
latitude = [ "-" ] 1*2DIGIT [ "." *DIGIT ]
longitude = [ "-" ] 1*3DIGIT [ "." *DIGIT ]
delay = "delay" SP delay-value
delay-value = 1*DIGIT
loss = "loss" SP loss-value
loss-value = "-" 1*DIGIT ["." 1*DIGIT]
temp-gruu = "temp-gruu" SP SIP-URI ;from RFC 3261
credentials = "credentials" SP credentials-value
credentials-value = non-ws-string
extension-att-name = token
extension-att-value = non-ws-string
Ejzak [Page 31]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
This grammar encodes the primary information about each visited-
realm and secondary-realm instance: the sequence in which the realm
was visited, the realm identity, its IP address and port, and
optional geo-location, IP packet delay, IP packet loss, temporary-
GRUU and security credentials:
<realm-number>: For a visited-realm instance, realm-number is a
positive decimal integer between 1 and 256 which identifies
the sequence in which this visited-realm instance was
visited during the forwarding of an SDP offer, compared to
other visited-realm instances for the media line in the same
SDP offer. It MUST start at 1 and MUST increment by 1
compared to the highest existing realm-number for the media
line when inserting a new visited-realm instance into an SDP
offer. The realm-number can be ignored in an SDP answer
since there should only be one visited-realm instance and no
secondary-realm instance in an SDP answer. It is
RECOMMENDED that the realm-number have value 1 in an SDP
answer. For a secondary-realm instance in a forwarded SDP
offer, realm-number MUST have the same value as the realm-
number for the visited-realm instance created for the same
media line by the same ALG for the connection information in
the forwarded SDP offer.
<realm>: identifies a set of mutually reachable IP endpoints
that share a common IP addressing scheme. Each realm also
defines a protection domain for all hosts using visited-
realm or secondary-realm attribute instances for the realm,
to help ensure the integrity of the remaining information in
each attribute instance. A public address reachable from
the open internet MAY be associated with the special realm
"IN", for which no credentials are required. The special
realm "NOMATCH" is used to signify a realm only reachable
via an alternate media path segment created by the active-
bypass option. Operators of ALGs that wish to ensure the
integrity of the visited-realm instance information for
their realm(s) MUST adhere to the following guidelines for
creation of a realm string for their servers: 1) Realm
strings MUST be globally unique. It is RECOMMENDED that a
realm string contain a hostname or domain name, following
the recommendation in Section 3.2.1 of RFC 2617 [10]. 2)
Realm strings SHOULD present a human-readable identifier
that can be rendered to a user.
<nettype>, <addrtype> and <connection-address>: are taken from
the connection-field (c= line) of RFC 4566 [7]. They
describe the IP address associated with the visited-realm
instance, allowing for IPv4 addresses, IPv6 addresses and
FQDNs. An IP address SHOULD be used, but an FQDN MAY be
Ejzak [Page 32]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
used in place of an IP address. When receiving an offer or
answer containing an FQDN in an a=visited-realm attribute,
if there is a match on the realm according to the procedures
herein, the FQDN is looked up in the DNS using an A or AAAA
record, and the resulting IP address is used for the
remainder of the procedure.
<port>: is also taken from RFC 4566 [7]. It is the port
associated with the visited-realm instance. Its meaning
depends on the network being used for the connection-
address, and on the transport protocol selected for the
corresponding media line, e.g., UDP or TCP.
<rtcp-port> and <rtcp-address>: taken together are semantically
equivalent to the rtcp attribute defined in RFC 3605 [5].
They optionally encode the RTCP port and address information
when the visited-realm instance is for an RTP stream and the
RTCP port number is not exactly one greater than the port
for the RTP stream at the same address.
<coordinates>: provides the approximate geographic coordinates
(geo-location) of the BG or endpoint associated with the
connection information in the visited-realm or secondary-
realm attribute. The "latitude" component MUST contain the
decimal latitude of the identified location in the reference
system WGS 84 [24]. The "longitude" component MUST contain
the decimal longitude of the identified location in the
reference system WGS 84 [24]. The number of decimal places
indicates the precision of the value. The coordinates need
only be accurate enough to estimate the minimum IP packet
propogation delay between successive BGs/endpoints based on
distance. The ALG SHOULD include known coordinates for each
visited-realm or secondary-realm attribute in a forwarded
SDP offer. The procedures in this document do not require
the use of coordinates in SDP answers.
<delay-value>: is an estimate of the delay in transporting IP
packets between the controlled BG and the next BG or
endpoint towards the SDP offerer (through the previous IP
realm). delay-value is a positive decimal integer
representing the delay in milliseconds. The ALG SHOULD
include delay-value for each visited-realm or secondary-
realm attribute in a forwarded SDP offer if the information
is available and is significantly different from an
estimated minimum value based on the coordinates of the
respective BGs/endpoints. The procedures in this document
do not require the use of delay-value in SDP answers.
Ejzak [Page 33]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
<loss-value>: is an estimate of the rate of IP packet loss on
the link between the controlled BG and the next BG or
endpoint towards the SDP offerer. loss-value is equal to
log(packet-loss-rate) in negative decimal format, where
packet-loss-rate is the average ratio of lost IP packets to
all IP packets sent on the link. The packet-loss-rate can
be reconstructed as 10**(loss-value). The ALG SHOULD
include loss-value for each visited-realm or secondary-realm
attribute in a forwarded SDP offer if the information is
available. The procedures in this document do not require
the use of loss-value in SDP answers.
<temp-gruu>: is a temporary GRUU assigned uniquely by each ALG
for a specific dialog and media line. Draft-ietf-sip-gruu
[8] defines the format of the temporary GRUU. For each
media line in a forwarded SDP offer, if the ALG supports the
target ALG procedures of the active-bypass option, is
reachable via a globally unique host name, and controls the
BG associated with the connection information for the media
line in the forwarded SDP offer, the ALG SHOULD include a
temp-gruu in the corresponding visited-realm attribute
generated by the ALG. See the active-bypass option
procedures for use of the temp-gruu in an SDP answer. The
procedures in this document do not require the use of temp-
gruu in the secondary-realm attribute.
<credentials-value>: is a digital signature computed on the other
contents of the attribute and other secret data. The
authority for the protection domain associated with the
realm MAY choose MD5 [9] or other algorithm to compute the
credentials. For additional security, extension attributes
(such as nonce and opaque used for digest [10]) MAY be used
to link the credentials calculated on the attribute in one
SDP message to prior SDP offers or answers used within a SIP
dialog. Only servers within the protection domain need to
verify the integrity of the attribute contents.
The candidate attribute can itself be extended. The grammar allows
for new name/value pairs to be added at the end of the attribute.
An implementation MUST ignore any name/value pairs it does not
understand.
Since the connection and port information in an instance of the
visited-realm attribute can only be used by a trusted node within
the corresponding IP realm, the realm MAY choose to put encrypted
versions of the connection-address and port information into the
extension parameters while putting dummy values into the connection-
address and port fields.
Ejzak [Page 34]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
8.
Security Considerations
The use of this extension is only applicable inside a "Trust Domain"
as defined in RFC 3325 [4]. Nodes in such a Trust Domain are
explicitly trusted by its users and end-systems to inspect and
manipulate SDP messages as necessary to traverse and/or bypass
firewalls and NATS while limiting access from unauthorized sources
to endpoints in IP realms associated with the Trust Domain.
Since the procedures in this document include an option to
cryptographically certify the candidate connection and port
information from each IP realm, they can be used under some
circumstances when the signaling traverses non-trusted networks or
the Internet at large.
Since the base algorithm in this extension requires no additional
signaling outside of an end-to-end SDP offer/answer exchange, it is
likely to be impacted by any attack that can modify or disrupt an
SDP offer/answer exchange. Such an attack could direct media to a
target of a DoS attack, insert a third party into the media stream,
and so on. These are similar to the general security considerations
for offer/answer exchanges, and the security considerations in RFC
3264 [3] apply. These require techniques for message integrity and
encryption for offers and answers, which can be satisfied by the
SIPS mechanism [2] or IMS security mechanisms when SIP is used. As
such, the usage of hop-by-hop message integrity and encryption with
this extension is RECOMMENDED.
In addition to the above considerations, the active-bypass option in
this extension establishes alternate path dialogs and alternate
media path segments using GRUUs with values that cannot always be
certified. Thus the active-bypass option is NOT RECOMMENDED for
signaling that traverses non-trusted networks or the Internet at
large.
This extension is not consistent with end-to-end security procedures
that are otherwise recommended for SDP messages.
9.
IANA Considerations
This specification registers two new SDP attributes per the
procedures of Section 8.2.4 of [7]. The required information for
the registration is included here.
Ejzak [Page 35]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
9.1.
visited-realm Attribute
Contact Name: Richard Ejzak, ejzak@alcatel-lucent.com
Attribute Name: visited-realm
Long Form: visited-realm
Type of Attribute: media level
Charset Considerations: The attribute is not subject to the
charset attribute.
Purpose: This attribute is used in private networks employing
border gateways to identify configurations in which IP
realms are re-entered when establishing an end-to-end
multimedia session, so that border gateways can be bypassed
without compromising their role in securing access to the
networks. The attribute provides a means to identify
connection information for visited IP realms to help select
the most optimal available path.
Appropriate Values: See Section 7 of RFC XXXX [Note to RFC-ed:
please replace XXXX with the RFC number of this
specification].
9.2.
secondary-realm Attribute
Contact Name: Richard Ejzak, ejzak@alcatel-lucent.com
Attribute Name: secondary-realm
Long Form: secondary-realm
Type of Attribute: media level
Charset Considerations: The attribute is not subject to the
charset attribute.
Purpose: This attribute is used in private networks employing
border gateways to identify configurations in which
secondary IP realms are available to establish an end-to-end
multimedia session, so that border gateways can be bypassed
without compromising their role in securing access to the
networks. The attribute provides a means to identify
connection information for secondary IP realms to help
select the most optimal available path.
Ejzak [Page 36]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
Appropriate Values: See Section 7 of RFC XXXX [Note to RFC-ed:
please replace XXXX with the RFC number of this
specification].
10.
References
10.1.
Normative References
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[2] Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A.,
Peterson, J., Sparks, R., Handley, M. and E. Schooler, "SIP:
Session Initiation Protocol", RFC 3261, June 2002.
[3] Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model with
Session Description Protocol (SDP)", RFC 3264, June 2002.
[4] Jennings, C., Peterson, J. and Watson, M., "Private Extensions
to the Session Initiation Protocol (SIP) for Asserted Identity
within Trusted Network", RFC 3325, November 2002.
[5] Huitema, C., "Real Time Control Protocol (RTCP) attribute in
Session Description Protocol (SDP)", RFC 3605, October 2003.
[6] Crocker, D. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", RFC 5234, January 2008.
[7] Handley, M., Jacobson, V. and Perkins, C., "SDP: Session
Description Protocol", RFC 4566, July 2006.
[8] Rosenberg, J., "Obtaining and Using Globally Routable User
Agent (UA) URIs (GRUU) in the Session Initiation Protocol
(SIP)", draft-ietf-sip-gruu-15 (RFC editor's queue), October
2007.
10.2.
Informative References
[9] Rivest, R., "The MD5 Message-Digest Algorithm", RFC 1321, April
1992.
[10] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S.,
Leach, P., Luotonen, A. and L. Stewart, "HTTP authentication:
Basic and Digest Access Authentication", RFC 2617, June 1999.
[11] Borella, M., Lo, J., Grabelsky, D., and G. Montenegro, "Realm
Specific IP: Framework", RFC 3102, October 2001.
[12] Borella, M., Grabelsky, D., Lo, J., and K. Taniguchi, "Realm
Specific IP: Protocol Specification", RFC 3103, October 2001.
[13] Senie, D., "Network Address Translator (NAT)-Friendly
Application Design Guidelines", RFC 3235, January 2002.
[14] Srisuresh, P., Kuthan, J., Rosenberg, J., Molitor, A., and A.
Rayhan, "Middlebox communication architecture and framework",
RFC 3303, August 2002.
[15] Schulzrinne, H., Casner, S., Frederick, R., and V. Jacobson,
"RTP: A Transport Protocol for Real-Time Applications", RFC
3550, July 2003.
Ejzak [Page 37]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
[16] Rosenberg, J., Peterson, J., Schulzrinne, H., and G. Camarillo,
"Best Current Practices for Third Party Call Control (3pcc) in
the Session Initiation Protocol (SIP)", BCP 85, RFC 3725, April
2004.
[17] Rosenberg, J., "Interactive Connectivity Establishment (ICE): A
Protocol for Network Address Translator (NAT) Traversal for
Offer/Answer Protocols", draft-ietf-mmusic-ice-19 (RFC editor's
queue), October 2007.
[18] Rosenberg, J., Mahy, R., Matthews, P. and D. Wing, "Session
Traversal Utilities for NAT (STUN)", RFC 5389, October 2008.
[19] Rosenberg, J., Mahy, R., and P. Matthews, "Traversal Using
Relays around NAT (TURN): Relay Extensions to Session Traversal
Utilities for NAT (STUN)", draft-ietf-behave-turn-12 (work in
progress), November 2008.
[20] 3GPP "TS 23.228: IP Multimedia Subsystem (IMS); Stage 2
(Release 8)", 3GPP 23.228, September 2008,
ftp://ftp.3gpp.org/specs/archive/23_series/23.228/.
[21] 3GPP "TS 24.229: IP Multimedia Call Control Protocol based on
SIP and SDP; Stage 3 (Release 8)", 3GPP 24.229, September 2008,
ftp://ftp.3gpp.org/specs/archive/24_series/24.229/.
[22] Camarillo, G. and H. Schulzrinne, "Early Media and Ringing Tone
Generation in the Session Initiation Protocol (SIP)", RFC 3960,
December 2004.
[23] Ejzak, R., "Private Header (P-Header) Extension to the Session
Initiation Protocol (SIP) for Authorization of Early Media",
RFC 5009, September 2007.
[24] National Imagery and Mapping Agency, "Department of Defense
World Geodetic System 1984, Third Edition", NIMA TR8350.2,
January 2000.
Any 3GPP document can be downloaded from the 3GPP webserver,
http://www.3gpp.org/. See specifications.
Author's Address
Richard Ejzak
Alcatel-Lucent
1960 Lucent Lane
Naperville, IL 60566, USA
Phone: +1 630 979 7036
EMail: ejzak@alcatel-lucent.com
Copyright Notice
Copyright (c) 2008 IETF Trust and the persons identified as the
document authors. All rights reserved.
Ejzak [Page 38]
INTERNET-DRAFT Border Gateway Bypass December 17, 2008
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with
respect to this document.
This Internet-Draft expires June 17, 2009.
Ejzak [Page 39]