Docs / dflux EdgeGuard
ContactGet started

Diameter peering

Diameter (RFC 6733) has no client/server concept — every node is a peer, and every connection has an Initiator (sent CER) and a Responder (sent CEA). dflux EdgeGuard exposes this directly with a per-peer connection_mode field that says whether the proxy dials, accepts, or both.

Connection modes

Listening is implied by the presence of diameter.listen_addr. Per-peer behaviour is controlled by connection_mode on each entry in peers[]:

connection_modeDials this peerAccepts inbound from this peerUse case
initiator (default)yesonly via the listener (if listen_addr set)The proxy dials a producer HSS or PCRF
respondernoyes (requires listen_addr)Other peers connect to the proxy
bothyesyesSymmetric peering with election per RFC 6733 §5.6.4
responder / both require listen_addr
A responder or both peer without listen_addr is rejected at startup. The legacy top-level diameter.mode field (client / server / both) is no longer accepted; configs that set it fail with a migration error.

Examples

Initiator-only — outbound to an HSS

JSON

Responder-only — accept inbound on :3868

JSON

Both — listen and dial the same peer

JSON

Origin-Host and Origin-Realms

origin_host is the Origin-Host AVP advertised in CER/CEA. Realms can be configured two ways:

  • Single realm: origin_realm: "example.com". Legacy form.
  • Multiple realms: origin_realms: ["epc.…", "ims.…"]. The first entry is the primary realm used in the Origin-Realm AVP of every base-protocol message (RFC 6733 §6.3 requires exactly one per message). Other realms are still authoritative — useful when one proxy serves S6a in one realm and Rx in another.

Timers and watchdog

The proxy carries an explicit set of timers:

  • timers.cea_timeout — CER/CEA capabilities-exchange timeout (default 10s).
  • timers.dwa_timeout — DWR/DWA device-watchdog answer timeout (default 10s).
  • timers.dpa_timeout — DPR/DPA disconnect answer timeout (default 5s).
  • watchdog_interval — DWR send cadence.
  • reconnect_interval — delay before reconnecting a dropped peer.
  • max_missed_watchdogs — close the peer after this many missed DWA answers.
  • request_timeout — upper bound on how long the relay waits for a producer answer (default 10s).

Duplicate protection

RFC 6733 §6.3.4 specifies handling of duplicate messages identified by the (Origin-Host, End-to-End-Id) tuple. When duplicate_protection: true, the relay caches the answer sent for each tuple for duplicate_timer (default 240s) and short-circuits retransmitted duplicates without re-invoking the handler or re-forwarding upstream.

Memory usage scales with offered request rate × duplicate_timer. Off by default; zero cost when off.

Applications

Each entry in applications[] declares an application id, vendor id, and type (auth or acct). Common 3GPP applications:

  • S6a / S6d — app id 16777251, vendor id 10415, auth.
  • Gx — app id 16777238, vendor id 10415, auth.
  • Rx — app id 16777236, vendor id 10415, auth.