Subject: Issue: NAS identity

From: "Joseph Salowey (jsalowey)" <[email-masked]>
Date: Thu, 26 Mar 2009 11:40:29 -0700

Description of issue
Submitter name: Joseph Salowey
Submitter email address: [email-masked]
Date first submitted: 3/26/2009
Reference: URL to e-mail describing problem, if available
Document: draft-ietf-radext-radsec-04.txt
Comment type: T
Priority: S
Section: 
Rationale/Explanation of issue:
Current RADIUS specs the NAS identity is tightly coupled with IP address
because this is how the shared secret is referenced.  With new modes of
authentication it seems that the  identity need not be tied to IP
address anymore.   This could help with dynamic addressing and NATS.  

Requested change:
Discuss in the document that the NAS can be identified by something
other than source IP address.  

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>

---

From: Stefan Winter <[email-masked]>
Date: Thu, 26 Mar 2009 20:37:04 +0100

Hi,

> other than source IP address.  

Sure, that's possible. FOr X.509 cert operation, I guess this is a 
non-issue, since there are numerous ways to identify a peer without 
using its IP address.
For PSK, the PSK Identifier Field can be used to identify the peer. This 
can be used to create arbitrary identifiers, independent of the IP 
address of the NAS.

This works both ways: if one has configured many tuples of (IP,sh-sec), 
it might be desirable to keep that configuration - in which case the 
Identifier field can be set to the IP address.

In none of these cases it is necessary to use layer 3 packet inspection 
to identify the peer - the Identifier field is always sufficient. Is 
that what you menat? Then I'll update the text accordingly.

Greetings,

Stefan Winter