Subject: (radius) Globally unique NAS-Identifier (was: Matching NAS-IP-Address to a ctual real-life NAS IP address)

From: "Beadles, Mark A." <[email-masked]>
Date: Wed, 24 Feb 1999 20:22:01 -0500

(from a thread on the RADIUS list - trim the to: line where appropriate)
From:	Alan DeKok [SMTP:[email-masked]]
>Scenario:
>
>  Sales guy 1 dials into a POP in L.A., NAS-IP-Address = 192.168.1.1
>  Sales guy 2 dials into a POP in N.Y., NAS-IP-Address = 192.168.1.1
>  They both are proxied to your corporate RADIUS server in Chicago.

>  Please convince me that NAS-IP-Address attribute is a unique
>identifier under your control.  You can't.

I'm not sure why your corporate RADIUS server cares about the NAS-IP-Address
in either case.  What useful information does this carry to the corporation?
For that matter, a service provider may wish to deliberately HIDE IP address
information from the corporation in a proxy situation.

>  This is what I would like.  The ONLY way to have such a unique
>identifier in a world of proxies is to have a GLOBALLY unique
>identifier.

Ah, well, this is the RADIUS protocol working group.  In my opinion, issues
relating to global uniqueness and a "world of proxies" would seem to belong
properly to the Roaming Operations working group, where I have cc'ed this
message.

>  All it needs is a globally unique ID.  These are well known, they're
>called Ethernet MAC addresses.  (Not that I'm advocating using MAC
>addresses for NAS-Identifier, though it wouldn't hurt)

Not all IP interfaces have globally unique Ethernet MAC addresses.  And you
may want a NAS-Identifier to remain static even if you change a faulty card
in a NAS, you know?

+ Mark Anthony Beadles + MCI WorldCom Advanced Networks +
+  [email-masked]   +        http://www.wcom.net     +
+  Voice 614.723.1941  +          Fax 614.723.8407      +

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Alan DeKok <[email-masked]>
Date: Wed, 24 Feb 1999 21:13:17 -0500

> in either case.  What useful information does this carry to the corporation?

  It doesn't, but my original problem was that people were advocating
the use of NAS-IP-Address as a (potentially globally) unique NAS ID,
for tracking/database keying purposes.  I think such use is incorrect.

> information from the corporation in a proxy situation.

  Then they should remove all NAS specific information from the
packet, and replace it with information about the proxy server.

  In fact, if they're using private IP addresses for their NASes, this
requirement should probably be mentioned in the RADIUS RFC as a MUST.
Polluting the global information space with private IP's is a Bad
Thing.

>  In my opinion, issues relating to global uniqueness and a "world of
> proxies" would seem to belong properly to the Roaming Operations
> working group, where I have cc'ed this message.

  When in doubt, avoid the issue by redefining the problem. :)

  If RADIUS proxies don't advertise private IP's from the NASes, we
don't need global uniqueness other than public proxy IP address.

> may want a NAS-Identifier to remain static even if you change a faulty card

  I know, which is why I wasn't entirely advocating it.

  Alan DeKok.
-