Re: call for discussion on draft-heinanen-radius-pe-discovery-03.txt

> if using radius accounting messages as pe keepalive messages is
> something that people don't like in the draft then we can easily get rid
> of the whole pe keepalive business by requiring that each pe must
> re-authenticate each of its vpn sites every N hours.

Re-authentication can be accomplished by sending a Session-Time attribute
with Termination-Action=1.  However, there is also work underway (for
prepaid) to support re-authorization via the "Authorize Only" Service-Type
supported in draft-chiba.

> if i remember
> correctly, this is how it was in the first version of the draft, but
> then introduced the pe keepalive concept in order to improve
> scalability.

Not sure why using Interim Accounting would improve scalability as
compared with re-authorization.

> if a provider has 3,600 vpn sites in its network and N=1, radius server
> would get on the average one authentication message per second from the
> pes.  that may still be acceptable.  but if the number of vpn sites
> grows to, say, 36,000, then most likely N would need to be made bigger,
> e.g., 10 or 24.

With this many sites you will definitely need to require some improvements
in RADIUS client retransmission behavior.  I've seen situations
with 3K+ RADIUS clients where the network could not come up again after a
power failure, due to overload on the RADIUS server.  Exponential backoff
+ jittering would have helped, and we'll be putting together a document to
provide guidelines on how RADIUS client should behave.

> to me even N=24 would be acceptable, since in vpn application getting
> rid of a pe that no longer contains any sites of a vpn is not usually
> that urgent matter.  if it in some case is an urgent matter, then the
> network management application could be used to trigger valid pes to
> immediately re-authenticate the sites of a vpn and thus learn the
> currently valid pe list.

You can use draft-chiba to send a CoA-Request with Service-Type="Authorize
Only" in order to make this happen.