Subject: Re: (radius) Matching NAS-IP-Address to actual real-life NAS IP address

From: Aydin Edguer <[email-masked]>
Date: Wed, 24 Feb 1999 19:21:56 -0500 (EST)

> Wouldn't that identifier be better handled by using the pre-existing
> NAS-Identifier attribute?

The purpose of the NAS-Identifier and NAS-IP-Address are similar.
The difference is not the purpose but the format of the attribute.

Not all NASes support the NAS-Identifier attribute, but most (?all?)
do support either the NAS-Identifier or the NAS-IP-Address.  Some may
allow the operator to configure which will be used.

> What do you do when you've got 2 NASes, each with a private and a
> public network, with the RADIUS server on the shared public network?
> The server can get requests from each NAS, with the SAME NAS-IP-Address.

No, this would be considered a misconfiguration.

  5.32.  NAS-Identifier

      The String field is one or more octets, and should be unique to
      the NAS within the scope of the RADIUS server.

  -- RFC 2138

  5.4.  NAS-IP-Address

      This Attribute indicates the identifying IP Address of the NAS
      which is requesting authentication of the user.

  -- RFC 2138

If the NAS-IP-Address is not unique then it would not be "the identifying
IP Address".  Explicit text can be added to the NAS-IP-Address to make
this as clear as it is for NAS-Identifier (if necessary).

> So NAS-IP-Address CANNOT be used as a unique NAS identifier.

I am not sure how you reached this conclusion.  The NAS-IP-Address does
not have to be the same as the IP address used by the NAS to originate
the RADIUS Access-Request but it should still be a unique identifier of
the NAS.

Since there is no way for a NAS to know all the NAS-Identifiers or all
the NAS-IP-Addresses that are available, enforcement of this requirement
is left up to the system operator.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Alan DeKok <[email-masked]>
Date: Wed, 24 Feb 1999 19:52:30 -0500

> No, this would be considered a misconfiguration.

  I disagree.  You can't control which NAS-IP-Address is sent by the
NAS, and if you're a server others proxy to, you can't control the IP
addresses chosen by remote administrators.

  Scenario:

  Sales guy 1 dials into a POP in L.A., NAS-IP-Address = 192.168.1.1
  Sales guy 2 dials into a POP in N.Y., NAS-IP-Address = 192.168.1.1
  They both are proxied to your corporate RADIUS server in Chicago.

  Please convince me that NAS-IP-Address attribute is a unique
identifier under your control.  You can't.

>       the NAS within the scope of the RADIUS server.

  This is what I would like.  The ONLY way to have such a unique
identifier in a world of proxies is to have a GLOBALLY unique
identifier.

> this as clear as it is for NAS-Identifier (if necessary).

  It's an "identifying IP Address".  Unlike the NAS-Identifer
definition, the word "unique" does not appear here.  ergo, the RFC
does not require it to be unique.

  In a world of private IP's sent via RADIUS proxies across the
Internet, NAS-IP-Address CANNOT be unique.  (I'll ignore the
horrifying idea of NATs inspecting and translating IP's inside of
RADIUS packets.)

> I am not sure how you reached this conclusion.

  I hope I've better explained my reasoning above.

>   The NAS-IP-Address does not have to be the same as the IP address
> used by the NAS to originate the RADIUS Access-Request but it should
> still be a unique identifier of the NAS.

  Unfortunately, the RFC does not currently state this restriction.  I
believe that the RFC cannot make this restriction, either.

> is left up to the system operator.

  ??? Why would the NAS have to "know all of the NAS-Identifiers"?

  All it needs is a globally unique ID.  These are well known, they're
called Ethernet MAC addresses.  (Not that I'm advocating using MAC
addresses for NAS-Identifier, though it wouldn't hurt)

  Alan DeKok.
-