Authentication, Authorization and Accounting (AAA) Transport Profile
Extracted elements (31)
A single persistent connection per peer pair is recommended rather than multiple connections because multiple connections multiply the effective TCP slow-start initial window. For example, ten connections with initial window 2 would create an effective initial window of 20, permitting an inappropriate large burst.
AAA transport is typically application-driven rather than network-driven: inter-packet spacing commonly exceeds the RTT by orders of magnitude (e.g., 25 seconds for a 48-port NAS). This invalidates TCP congestion window estimates and renders fast re-transmit largely inapplicable, driving nearly all of the protocol-specific guidance in this document.
Back-pressure via receive buffer sizing (where the agent's receive buffer equals its send buffer) is impractical for enabling per-conversation self-clocking because closing the receive window affects all traffic from the AAA client, not just conversations destined for the congested downstream server.
SCTP stream IDs do not need to be preserved by relay agents when forwarding messages between associations with different numbers of streams. This simplifies relay implementation and the distribution across streams acts like a hash table — unlikely that two messages end up in the same stream causing blocking.
The application layer watchdog is designed to detect failures of the immediate peer only, and not to be affected by failures of downstream proxies or servers. This prevents instability in downstream AAA components from propagating upstream: lack of an AAA Response may be due to downstream problems, so only failure to respond to the watchdog itself confirms peer failure.
The default Twinit of 30 seconds was selected because it minimizes the probability that failover will be initiated due to a routing flap, as noted in Paxson's empirical research on end-to-end Internet dynamics. Setting Twinit as low as 6 seconds significantly increases the probability of spurious failover and duplicate generation.
AAA protocols running over reliable transport (TCP or SCTP) experience nearly double the packet traffic compared to UDP because AAA traffic is application-driven, leaving insufficient reverse traffic to enable ACK piggybacking, causing delayed ACKs to comprise nearly half the traffic.
The SCTP transport-layer heartbeat probes alternate paths to reach the same server, while the AAA application layer watchdog detects failures of the server application itself. Both mechanisms MAY be used together; if AAA implementations have access to SCTP heartbeat parameters, they MAY ensure the SCTP heartbeat interval is longer than Tw.
AAA agents and servers MUST be prepared to handle duplicates, and MUST assume that duplicates can arrive on any connection. This is necessary because failover can cause the same transaction to be sent to multiple agents or servers before expiration of the time-wait interval.
AAA implementations running over TCP MUST enable the Nagle algorithm (RFC 896). The Nagle algorithm is not used with SCTP.
AAA implementations SHOULD support selective acknowledgement as described in RFC 2018 and RFC 2883, and SHOULD implement Limited Transmit for TCP as described in RFC 3042, to improve loss recovery when congestion window validation keeps the window small.
AAA protocols MUST support an application layer watchdog message to enable more quickly detecting transport and application-layer failures. The watchdog operates on all open connections and is used to suspend and eventually close failing connections, and to re-open and validate connections that have returned to health.
AAA protocols SHOULD use only a single persistent connection between a AAA client and a given AAA agent or server, and SHOULD provide for pipelining of requests. A connection MUST NOT be brought down before BRINGDOWN_INTERVAL (5 minutes) of inactivity.
AAA Servers MUST support TCP and SCTP. AAA clients SHOULD support SCTP, but MUST support TCP if SCTP is not available. AAA agents inherit all the obligations of Servers with respect to transport support.
Each AAA node SHOULD distribute its messages evenly across the range of SCTP streams agreed upon with its peer. AAA peers MUST be able to accept messages on any stream; streams are used solely to prevent head-of-line blocking.
Implementations SHOULD implement the watchdog algorithm specified in Section 3.4.1. The default value of Twinit is 30 seconds and MUST NOT be set lower than 6 seconds (not including jitter).
Once three watchdog messages (DWAs) have been received in the REOPEN state, the connection is returned to service. Connection validation via receipt of multiple watchdogs is not required when a connection is initially brought up.
Store and forward proxies SHOULD NOT be used, because they send a reply to the NAS before receiving confirmation from the accounting server, causing the NAS to prematurely delete accounting records from non-volatile storage.
The AAA client MUST NOT close the primary connection until the primary's watchdog timer has expired at least twice without a response. Once the primary connection has failed, subsequent requests are sent to the alternate server until the watchdog timer on the primary connection is reset.
To address RTO invalidation for SCTP, AAA implementations SHOULD use SCTP heartbeats with the default 30-second interval; if needed, implementations MAY reduce the heartbeat interval. Where available, transport parameters SHOULD be used to improve upon default timer values.
Watchdog timer jitter MUST be pseudo-random, generated by a PRNG seeded as per RFC 1750, with a value randomly drawn between -2 and 2 seconds added to Twinit. Alternative calculations to create jitter MAY be used.
When failover is initiated, the combination of an end-to-end identifier and the origin host MUST be used to identify duplicate messages. Hop-by-hop identifiers alone are insufficient since the same message can arrive from multiple agents with different hop-by-hop IDs.
While the connection is in the DOWN state, the AAA client MUST NOT attempt to send further watchdog messages on the connection. However, after the connection is closed, the AAA client continues to periodically attempt to reopen the connection.
In load-balanced configurations, Pearson's hash (RFC 3074) applied to the NAI (RFC 2486) is recommended to assign transactions to connections, providing granular load distribution while ensuring all traffic for a given conversation goes to the same agent or server.
The BRINGDOWN_INTERVAL constant is defined as 5 minutes; a connection that has been unutilized (excluding watchdog traffic) for less than this interval MUST NOT be brought down. Functioning connections should remain open for a minimum of 5 minutes to prevent periodic closing and reopening of secondary connections.
The Peer Control Block (PCB) tracks: Status (OKAY/SUSPECT/DOWN/REOPEN/INITIAL), Pending (boolean — outstanding unanswered watchdog request), Tw (watchdog timer in seconds), and NumDWA (count of DWAs received during REOPEN state, must reach 3 before returning to service).
The watchdog timer Tw is initialized to Twinit (default 30 seconds) plus a jitter drawn randomly from [-2, +2] seconds. Tw is reset whenever any AAA message is received. On expiry with no pending watchdog, a Device-Watchdog-Request (DWR) is sent and Pending is set TRUE.
The failover algorithm is vulnerable to denial-of-service attack: an attacker can swamp the network, causing watchdog packets to be dropped, triggering the AAA client to cycle between AAA agents, denying service to legitimate users seeking network access.
Where IPsec is used to provide AAA security, IPsec policy MUST require IPsec on incoming packets. Initiating a connection in the clear and having the AAA agent respond with IKE minimizes client configuration but increases DoS attack surface because a connection request can then exhaust both transport and IKE resources.
Where TLS (RFC 2246) is used for AAA security, the protocol is vulnerable to spoofed TCP reset packets and other transport-layer DoS attacks such as SYN flooding. SCTP offers improved DoS resilience compared to TCP and can mitigate this to some extent.
The watchdog Peer Control Block (PCB) defines five states: INITIAL (never opened), OKAY (connection up), SUSPECT (failover initiated), DOWN (connection closed), and REOPEN (attempting to reopen). Transitions are triggered by events: receiving a message, timer expiration (Tw reaches zero), connection up, and connection down.