Subject: Re: [radext] rfc3579- Doubt regarding Access challenge packet

From: Bernard Aboba <[email-masked]>
Date: Wed, 30 Jan 2013 23:18:29 -0800

Putting an EAP-Failure in an Access-Accept or an EAP-Success in an Access-Reject is NOT RECOMMENDED in RFC 3579. Also, the NAS is an EAP pass through and modifying EAP packets as you state is a DoS attack on the supplicant.

siva kumar <[email-masked]> wrote:

Hi All,

I have one more question:

In case of 802.1x authentication (EAP and radius), if the radius server
sends a access-accept with a service type that
is not supported by NAS, it is recommended that the NAS assumes it to be a
access-reject, but is it OK for the NAS(which
acts as passthru) to decode the EAP success message sent in radius
access-accept message and modify it as a EAP failure
and send it to the supplicant.

Thanks & Regards,
Sivakumar.S

On Fri, Jan 25, 2013 at 12:29 PM, siva kumar <[email-masked]>wrote:

> Hi Dave/Alan/Bernard/Others,
>
> Thanks all for the valuable inputs. It is evident that our NAS
> implementation is not acceptable as per your views. And Our NAS
> is not interoperable with most of the radius servers. We will consider all
> your inputs and re-architect our implementation.
>
> Thanks again.
>
> Regards,
> Sivakumar.S
>
>
> On Fri, Jan 25, 2013 at 12:57 AM, Dave Nelson <[email-masked]> wrote:
>
>> On Thu, Jan 24, 2013 at 2:18 PM, Bernard Aboba
>> <[email-masked]> wrote:
>>
>> > [BA] That text is about Access-Accept, not Access-Challenge.  An
>> > Access-Challenge is not about provisioning services (the decision on
>> whether
>> > to Accept or Reject has not been made yet).  Given that, I believe that
>> > ignoring attributes that aren't understood is probably fine.  Even
>> > attributes that might be considered mandatory in an Accept (e.g.
>> filters)
>> > can probably be safely ignored in an Access-Challenge.
>>
>> Agreed.
>>
>> Regards,
>>
>> Dave
>>
>> David B. Nelson
>> Director of Technology
>> Elbrys Networks, Inc.
>> www.elbrys.com
>> +1.603.570.2636
>>
>
>

---

From: Dave Nelson <[email-masked]>
Date: Thu, 31 Jan 2013 07:54:46 -0500

On Thu, Jan 31, 2013 at 2:23 AM, siva kumar <[email-masked]> wrote:

> If service type is not supported and if NAS consider access-accept as
> access-reject, is it ok to not authenticate/authorize the port
> without sending eap failure. Will this create an unending authentication
> retries.

I think what you're asking is what's the best way for the NAS to
signal to the end user, via the 802.1X supplicant, that the RADIUS
Server is misconfigured.  After all, if EAP authentication succeeds,
but the RADUS Server provisions a service the NAS cannot deliver, the
server is very likely misconfigured.  My answer is anything that gets
the end user to call the Help Desk and open a trouble ticket.  :-)

Regards,

Dave

David B. Nelson
Director of Technology
Elbrys Networks, Inc.
www.elbrys.com
+1.603.570.2636

---

From: siva kumar <[email-masked]>
Date: Thu, 31 Jan 2013 12:53:49 +0530

On Thu, Jan 31, 2013 at 12:48 PM, Bernard Aboba
<[email-masked]>wrote:

>  Putting an EAP-Failure in an Access-Accept or an EAP-Success in an
> Access-Reject is NOT RECOMMENDED in RFC 3579. Also, the NAS is an EAP pass
> through and modifying EAP packets as you state is a DoS attack on the
> supplicant.
>
> > attributes that might be considered mandatory in an Accept (e.g. filters)