Daniel Nashed's Blog

Domino pass-through connections - Anyone using it still large scale and why?

Domino pass-through (PT) connections are coming from another century where Domino servers had one or more modems to let a user or another server to connect to one server instead of having a need to dial into every server separately.

The connection type was never designed for todays large scale deployments with many concurrent users and a lot of traffic.
It's still used by companies having a PT server in their DMZ allowing users to connect to distinct servers in their intranet.


You can tightly control PT connections by specifying who can

• Route through a server via PT
• Access a server via PT

Using this type of connection the user (or server) session is established with the PT server first.
The PT server opens a new NRPC session to the destination server on the user's behalf.

So the PT server is actively involved in the communication not just passing network packages around.

This also means you need an authenticated session first on the PT server before the server establishes a session on the user's behalf on the destination server.

In result the PT server has some extra load and processing of the NRPC transaction data.
A PT server connection will be always slower than a direct connection. And in earlier releases I have seem some scalability limitations due to high load on the PT server.


Unauthenticated light transactions not supported via PT


But there also so called "light transactions" for new mail notifications, getting server statistics, configuring a client and a couple more, which are unauthenticated and not creating a full Notes session.

Those type of transactions are not supported via PT. Luckily some of those transactions like getting server statistics and polling the mail delivery sequence number for new mail notification have a full and light transaction.
This means that once you have a PT session those transactions will work -- But they can't be the initial transaction to a PT server.


Can' setup a new user via PT connection

In turn setting up a new user will not work over a PT connection, because this transaction is not authenticated or a full session yet.
Also downloading a Notes.ID via PT will not work!
So you would need to setup your user while they are in intranet and can connect directly to the server.


Different location and connection profiles needed

To make PT work on the road you also need a different set of connection to your server while you are on the road.
This usually means you need to manage separate connection documents.
Relying on the PT server setting in your location document isn't sufficient. The client would try to connect directly, time out and will eventually use the PT connection.


Known issues with encrypted sessions with Domino 11 and Domino 12 (including 12.0.2)

We had a customer case recently where where customer is using PT servers in their DMZ to let their whole sales team replicate their CRM over PT.

PT in Domino 11/12 can have an issue with encrypted connections replicating larger databases.
HCL has reproduced the case and there isn't a solution yet.

We had to downgrade the PT server to the latest Domino 10.0.1 FP to get the connection stable again.

User sessions dropped during replication of larger databases.

The error shown on the replicator is:  Network error: buffer was too small


Modern way to connect external users to internal servers

PT users used to be a very good way to connect to internal resources just for Notes and Domino.
In today's environments users usually need to have access to more than just Notes resources.

In modern IT environments customers usually leverage VPNs to connect their external users to intranet resources.

HCL SafeLinx for example would be a solution terminating the network connection in your DMZ and allows to route this traffic to the right servers in your intranet.
And it also offers reverse proxy functionality for other applications in parallel where VPN is required.

Of course there a many other VPN solutions on the market, which are all working on the same principle providing a tunneled connection to explicitly allowed internal resources.

Most of the time the connection is authenticated with strong authentication like certificate based and two factor authentication.


PT is still a valid approach for some special requirements

For a smaller environment PT connections could still be a valid approach to just use Notes connections in a secure way.
When you enable password checking on your PT server, the Notes.ID in combination with the password is a kind of two factor authentication as well.


Why are you using PT connections today?

I would be interested to hear from you if you are still using PT connections today.

• Is this for securing your connection to the Domino server via DMZ?
• Or are you a MSP or hosting provider saving public IP addresses and letting customers connect via a single PT to multiple servers?
  
  The latter one isn't what you should do today, based on what I explained in this article.

• Comments [8]