Cirrus provides the P2P "rendevous" service that allows 2 peers over UDP to traverse their firewalls restrictions and to connect directly to another peer who also is potentially behind a firewall.
For the Cirrus rendevous to work the 2 peers firewalls need to be compatible.
In this thread http://forums.adobe.com/message/1064983#1064983
it was mentioned that:
If one end is a symmetric NAT with a single IP address, then connections to peers behind other symmetric NATs or behind port-restricted cone NATs (or port-restricted firewalls) are impossible.
If one end is a symmetric NAT with multiple IP addresses, then connections to peers behind other symmetric NATs or behind address-restricted (and likely port-restricted) cone NATs (or address-restricted or port-restricted firewalls) are impossible.
The only guranteed work around to provide service to 100% of users you would need to provide a central server that would act like a relay for the peers that can't establish direct p2p RTMFP connections, I believe you can do this with the commercial Flash media server, or check out the Adobe Live Cycle Collaboration Servce (LCCS or Cocomo). LCCS will allow you to establish P2P connections as well as central server connections and provides is seamlessly as a cloud-based service you pay for what you use (instead of the upfront investment of a Flash media server).
Thanks for the information, I'm trying to leverage Cirrus as much as possible in order to get FMS 4 Enterprise. I'm pretty happy with Cirrus so far, but I can probably be even happier because I think there may some bugs somewhere in my application that would restrict 2 peers to connect together, when they BOTH can connect to Cirrus.
So just to confirm : If 2 peers can both connect to Cirrus, then I should be able to connect them together for sure?
If 2 peers can connect to Cirrus that does not mean they can connect to each other because of incompatible network devices.
Connecting to Cirrus is just a normal outgoing UDP message, the "magic" happens when Cirrus tries to connect 2 hosts as if one or both of them was listening on an open port, this requires Cirrus service to traverse the NAT and connect the 2 (basically their router/firewall is a NAT device). If the 2 users have incompatible NAT devices then a connection may not be established.
If you are working with a network larger than 2 users it may be possible to "route" traffic through a common node that they both can connect to. I'm not sure all the technical details as to which NAT devices will not work together, or might even not work at all with Cirrus, maybe an Adobe developer can help with that.
Thanks that is very useful information. Will check out about routing traffic through common node when needed.