Subject: Re: [radext] rfc3579- Doubt regarding Access challenge packet

From: Dave Nelson <[email-masked]>
Date: Fri, 1 Feb 2013 07:40:00 -0500

> If I receive a radius packet with more than one message authenticator,
> should I discard the packet or should I ignore it?.

You SHOULD verify the message authenticator, where it exists.  If
there are two, I think this may be challenging.  If they are identical
in value, I suppose you could assume that the comparison value is to
be calculated over the packet as if there were only one, i.e. over a
shorter that actual length packet.  If one message authenticator is
calculated over the packet with the other message authenticator
already in place, that would be very non-standard.  In any event, you
should , IMHO, file a bug report against any RADIUS product that does
this.  :-)

Regards,

Dave

David B. Nelson
Director of Technology
Elbrys Networks, Inc.
www.elbrys.com
+1.603.570.2636

---

From: siva kumar <[email-masked]>
Date: Fri, 1 Feb 2013 16:35:57 +0530

I am sorry if I am disturbing this forum, with lame questions. But I am new
to this and eager to know more by developing it.

As per the advice from members, I am ignoring the attributes which are
mentioned as 0 as per the
table of attributes in rfc 3579 instead of discarding the packet. But, for
example, message authenticator is
mentioned as 1. which means there should be only one message authenticator
in a radius packet.
If I receive a radius packet with more than one message authenticator,
should I discard the packet or
should I ignore it?.

Thanks & Regards,
Sivakumar.S

On Thu, Jan 31, 2013 at 6:24 PM, Dave Nelson <[email-masked]> wrote:

> On Thu, Jan 31, 2013 at 2:23 AM, siva kumar <[email-masked]>
> wrote:
>
> > If service type is not supported and if NAS consider access-accept as
> > access-reject, is it ok to not authenticate/authorize the port
> > without sending eap failure. Will this create an unending authentication
> > retries.
>
> I think what you're asking is what's the best way for the NAS to
> signal to the end user, via the 802.1X supplicant, that the RADIUS
> Server is misconfigured.  After all, if EAP authentication succeeds,
> but the RADUS Server provisions a service the NAS cannot deliver, the
> server is very likely misconfigured.  My answer is anything that gets
> the end user to call the Help Desk and open a trouble ticket.  :-)
>
> Regards,
>
> Dave
>
> David B. Nelson
> Director of Technology
> Elbrys Networks, Inc.
> www.elbrys.com
> +1.603.570.2636
>