Imported from previous forum
[ original email was from sebnem arseven - bim-sw1@imkb.gov.tr ]
If I want to login to any FIX system and send messages to them what should I do? In other ways , how do we control the users who will connect to our FIX system ?
If “SenderCompID” is checked for it, is it enough to check and control?
[ original email was from Ryan Pierce - rpierce@taltrade.com ]
> If I want to login to any FIX system and send messages to them what should I do? In other ways , how do we control the users who will connect to our FIX system ?
> If “SenderCompID” is checked for it, is it enough to check and control?
The first thing you do is contact the operators of that FIX system and arrange for such a connection. In general practice, FIX is a B2B protocol, not one where individual customers initiate sessions to their brokers. Hence FIX sessions are mutually agreed upon, by both parties, in advance. They decide, among other things, what CompIDs to use, what IP addresses and port, and who should initiate the connection. Once this agreement is done, the parties generally automate it so the connection is established each trading day.
In terms of identifying the other party, many firms key off their SenderCompID to determine who is connecting. Some firms take an approach where each FIX session gets their own TCP port, which can also help identify the client; others have a common port where everyone connects.
Authentication security is something of an issue. If using FIX without the software-based security DES, PGP/DES/MD5, SSL or TLS provides, people generally use firewalls or some IP access list to control which FIX clients can connect, thus attempting to prevent someone from guessing the CompID and port of another client and placing orders on their behalf. (Yes, IP forging is possible, but steps can be done to minimize the risk.)