Subject: Re: (radius) Matching NAS-IP-Address to actual real-life NAS IP address

From: Carl Rigney <[email-masked]>
Date: Thu, 25 Feb 1999 10:38:10 -0800 (PST)

Aydin Edguer <[email-masked]> writes:
>  5.32.  NAS-Identifier
>      The String field is one or more octets, and should be unique to
>      the NAS within the scope of the RADIUS server.
>
>  5.4.  NAS-IP-Address
>      This Attribute indicates the identifying IP Address of the NAS
>      which is requesting authentication of the user.
>
>If the NAS-IP-Address is not unique then it would not be "the identifying
>IP Address".  Explicit text can be added to the NAS-IP-Address to make
>this as clear as it is for NAS-Identifier (if necessary).

Excellent idea.  How about this for NAS-IP-Address:

  This Attribute indicates the identifying IP Address of the NAS which is
  requesting authentication of the user, and should be unique to the NAS
  within the scope of the RADIUS server.  Note that NAS-IP-Address MUST
  NOT be used to select the shared secret used to authenticate the
  request, the source IP address of the access-request MUST be used.

  NAS-IP-Address is only used in
  Access-Request packets.  Either NAS-IP-Address or NAS-Identifier MUST
  be present in an Access-Request packet.  

I'll add a similar disclaimer to NAS-Identifier.  The new draft mentions
this elsewhere as well, but its an extremely important point and thus useful
to spend a couple of extra lines on.

And to people thinking "Isn't this delving into trivia" I would say that this
is exactly the kind of thing we should catch and document before going to
draft standard.

Many thanks to all the respondents so far.

--
Carl Rigney
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Ignacio Goyret <[email-masked]>
Date: Thu, 25 Feb 1999 10:52:33 -0800

>  be present in an Access-Request packet.  

What about Accounting-Request?

-