Docs / dflux EdgeGuard
ContactGet started

Bring up a Diameter S6a relay

Bring up dflux EdgeGuard as an S6a relay between an MME and an HSS. Walks through enabling the Diameter listener, declaring the application, configuring two peers, and verifying CER/CEA exchange and routing on a live message.

Before you start

  • dflux EdgeGuard installed.
  • An MME or test peer that can speak S6a to a configured peer (any RFC 6733 implementation that knows the S6a app id will do).
  • An HSS or HSS simulator reachable on a known address and port. For lab work an open-source HSS simulator is fine.
  • Either TCP or SCTP available between the proxy and the HSS. This tutorial uses SCTP because that is the typical 3GPP choice; TCP works with a one-line change.

Topology

Code

The proxy listens for inbound from the MME on its listen_addr, and dials the HSS for the outbound side. We model the HSS peer as connection_mode: initiator (the proxy dials it). The MME side is implicit — anything that connects in on the listen address is accepted when accept_undefined_peer: true, or you can list MMEs explicitly with connection_mode: responder.

Write the config

Start from examples/edge-minimal.yaml and add a diameter block. The minimum that brings up an S6a relay:

YAML

Save as d3x-edge-s6a.yaml.

default_action: allow is for the lab only
We set default_action: allow here to focus on Diameter wiring. In production, leave it deny and add explicit allow rules — see the policy tutorial and Securing the admin API.

Run

Bash

On startup you should see CER/CEA exchange with the HSS:

text

If the HSS is offline, the dial fails and the proxy retries on reconnect_interval.

Verify peer state

Bash

Each entry carries the peer uri and its current state. Expect at least one peer in Open (the healthy FSM string):

JSON

Point the MME at the proxy

Configure the MME's S6a peer to point at the proxy's listen_addr instead of the HSS directly. The exact mechanism depends on your MME; the key fact is that the MME opens an SCTP association to the proxy, exchanges CER/CEA, and starts sending S6a requests.

Exercise with a UE attach

Trigger an attach on the MME. The S6a flow is:

  1. MME sends AIR (Authentication-Information-Request) to the proxy.
  2. The proxy runs the request through the filter chain, then forwards via the route for realm epc.example.com to the HSS.
  3. HSS replies with AIA.
  4. The proxy runs the response stage and returns the AIA to the MME.
  5. MME proceeds with ULR/ULA for location update.

Check the relay summary while the flow runs:

Bash

This returns the relay's identity and live peer count — confirm peer_count reflects the HSS (and any MMEs) that have come up:

JSON

Per-message counters and latencies are exposed as Prometheus metrics on observability.metrics_listen (:9100 in the config above) — Diameter-only mode does not start the SBI listener. Look for these while the flow runs:

  • edge_diameter_requests_total incrementing per AIR / ULR.
  • edge_diameter_forward_total incrementing with result=success.
  • edge_diameter_forward_duration_seconds histogram updated.

Watch the watchdog

Periodically (default 30s) the proxy sends DWR to each peer. The peer answers DWA. If max_missed_watchdogs DWAs are missed, the proxy closes the peer and reconnects. Watch it happen by temporarily killing the HSS process — the proxy detects the missed DWAs, marks the peer down, and reconnects automatically when the HSS returns.

Hardening before production

  • Turn accept_undefined_peer off and list MMEs explicitly with connection_mode: responder.
  • Turn default_action back to deny and add policy rules. The same rule set covers both protocol planes — see Policy engine.
  • Enable TLS on the TCP transport (or rely on SCTP path security + network-level isolation for SCTP).
  • Configure realm-scoped routes if you proxy more than one application. Use origin_realms[] if the proxy is authoritative for multiple realms.
  • Decide whether to enable duplicate_protection — needed when peers retransmit aggressively; off by default to save memory.