Domino pass-through connections - Anyone using it still large scale and why?
Daniel Nashed – 25 January 2023 07:32:11
Domino pass-through (PT) connections are coming from another century where Domino servers had one or more modems to let a user or another server to connect to one server instead of having a need to dial into every server separately.
The connection type was never designed for todays large scale deployments with many concurrent users and a lot of traffic.
It's still used by companies having a PT server in their DMZ allowing users to connect to distinct servers in their intranet.
You can tightly control PT connections by specifying who can
- Route through a server via PT
- Access a server via PT
Using this type of connection the user (or server) session is established with the PT server first.
The PT server opens a new NRPC session to the destination server on the user's behalf.
So the PT server is actively involved in the communication not just passing network packages around.
This also means you need an authenticated session first on the PT server before the server establishes a session on the user's behalf on the destination server.
In result the PT server has some extra load and processing of the NRPC transaction data.
A PT server connection will be always slower than a direct connection. And in earlier releases I have seem some scalability limitations due to high load on the PT server.
Unauthenticated light transactions not supported via PT
But there also so called "light transactions" for new mail notifications, getting server statistics, configuring a client and a couple more, which are unauthenticated and not creating a full Notes session.
Those type of transactions are not supported via PT. Luckily some of those transactions like getting server statistics and polling the mail delivery sequence number for new mail notification have a full and light transaction.
This means that once you have a PT session those transactions will work -- But they can't be the initial transaction to a PT server.
Can' setup a new user via PT connection
In turn setting up a new user will not work over a PT connection, because this transaction is not authenticated or a full session yet.
Also downloading a Notes.ID via PT will not work!
So you would need to setup your user while they are in intranet and can connect directly to the server.
Different location and connection profiles needed
To make PT work on the road you also need a different set of connection to your server while you are on the road.
This usually means you need to manage separate connection documents.
Relying on the PT server setting in your location document isn't sufficient. The client would try to connect directly, time out and will eventually use the PT connection.
Known issues with encrypted sessions with Domino 11 and Domino 12 (including 12.0.2)
We had a customer case recently where where customer is using PT servers in their DMZ to let their whole sales team replicate their CRM over PT.
PT in Domino 11/12 can have an issue with encrypted connections replicating larger databases.
HCL has reproduced the case and there isn't a solution yet.
We had to downgrade the PT server to the latest Domino 10.0.1 FP to get the connection stable again.
User sessions dropped during replication of larger databases.
The error shown on the replicator is: Network error: buffer was too small
Modern way to connect external users to internal servers
PT users used to be a very good way to connect to internal resources just for Notes and Domino.
In today's environments users usually need to have access to more than just Notes resources.
In modern IT environments customers usually leverage VPNs to connect their external users to intranet resources.
HCL SafeLinx for example would be a solution terminating the network connection in your DMZ and allows to route this traffic to the right servers in your intranet.
And it also offers reverse proxy functionality for other applications in parallel where VPN is required.
Of course there a many other VPN solutions on the market, which are all working on the same principle providing a tunneled connection to explicitly allowed internal resources.
Most of the time the connection is authenticated with strong authentication like certificate based and two factor authentication.
PT is still a valid approach for some special requirements
For a smaller environment PT connections could still be a valid approach to just use Notes connections in a secure way.
When you enable password checking on your PT server, the Notes.ID in combination with the password is a kind of two factor authentication as well.
Why are you using PT connections today?
I would be interested to hear from you if you are still using PT connections today.
- Is this for securing your connection to the Domino server via DMZ?
- Or are you a MSP or hosting provider saving public IP addresses and letting customers connect via a single PT to multiple servers?
The latter one isn't what you should do today, based on what I explained in this article.
- Comments [8]
1Detlev Poettgen 25.01.2023 8:05:38 Domino pass-through connections - Anyone using it still large scale and why?
Great Blog post.
Thank you Daniel
2Thomas Bahn 25.01.2023 11:24:57 Domino pass-through connections - Anyone using it still large scale and why?
We and some customers of us do. But more for the mentioned "edge cases", not for normal operation.
3Christian Henseler 27.01.2023 15:52:17 Domino pass-through connections - Anyone using it still large scale and why?
We are using PT connections in a very specific/emergency use case.
When FW rule sets for an distinct site/LAN are not fully in place yet, or got lost for whatever reason, but there is still at least one Domino server able to connect to the Domino server protected by this misconfigured FW, we are using PT connections to guarantee mailing and access from outside of the affected LAN to the Domino servers inside.
4Daniel Nashed 27.01.2023 20:11:39 Domino pass-through connections - Anyone using it still large scale and why?
@Christian, I used cascaded PT connections to tick firewall restrictions during a miration ..
The team was still discussing in a big emergency telco, how we can get access to the server now that the firewall port is not open...
while they have been still thinking of the question I had already done the migration steps via cascaed PT connections :-)
5Harald Wolf 28.01.2023 15:30:53 Domino pass-through connections - Anyone using it still large scale and why?
We still use PT-Connection for VPN-Users to access some singular Databases on a Domino-Server on a different location. So only the PT-Server is allowed to connect the other location through FW-Rules.
And we use it to route Mails from the DMZ-SMTP-Server to the Domino Server in other Site/LAN which has no direct connection to the DMZ.
6Craig Wiseman 31.01.2023 19:03:12 Domino pass-through connections - Anyone using it still large scale and why?
We are still using PT connections to allow folks to hit app servers without having to connect to the VPN.
We've also starting working with Nomad on iPad & Android tablets, using PT connections. Users like not having to connect their VPN just to access Notes Dbs.
7Urs Meli 17.02.2023 13:14:41 Domino pass-through connections - Anyone using it still large scale and why?
We used to have PT, it was the only way to get your notesdata while you're connected to a customers VPN
8Rudi 14.03.2023 10:22:17 Domino pass-through connections - Anyone using it still large scale and why?
In Most occasions where this PT is still in Use this ia mainly done to have Firewall rules for NRPC to be allowed, but any other trafic between network segments prevented.
To get to Servers behind such firewalls, the PT is the best option, to keep this secure and allow the needed access to those servers.