Subject: Re: (radius) Globally unique NAS-Identifier (was: Matching NAS-IP-Address to a ctual real-life NAS IP address)

From: [email-masked] (Patrice Calhoun)
Date: Thu, 25 Feb 1999 07:23:45 -0800

>(from a thread on the RADIUS list - trim the to: line where appropriate)
>From:	Alan DeKok [SMTP:[email-masked]]
>>Scenario:
>>
>>  Sales guy 1 dials into a POP in L.A., NAS-IP-Address = 192.168.1.1
>>  Sales guy 2 dials into a POP in N.Y., NAS-IP-Address = 192.168.1.1
>>  They both are proxied to your corporate RADIUS server in Chicago.
>
>>  Please convince me that NAS-IP-Address attribute is a unique
>>identifier under your control.  You can't.
>
>I'm not sure why your corporate RADIUS server cares about the NAS-IP-Address
>in either case.  What useful information does this carry to the corporation?
>For that matter, a service provider may wish to deliberately HIDE IP address
>information from the corporation in a proxy situation.
>
>>  This is what I would like.  The ONLY way to have such a unique
>>identifier in a world of proxies is to have a GLOBALLY unique
>>identifier.
>
>Ah, well, this is the RADIUS protocol working group.  In my opinion, issues
>relating to global uniqueness and a "world of proxies" would seem to belong
>properly to the Roaming Operations working group, where I have cc'ed this
>message.
>
>>  All it needs is a globally unique ID.  These are well known, they're
>>called Ethernet MAC addresses.  (Not that I'm advocating using MAC
>>addresses for NAS-Identifier, though it wouldn't hurt)
>
>Not all IP interfaces have globally unique Ethernet MAC addresses.  And you
>may want a NAS-Identifier to remain static even if you change a faulty card
>in a NAS, you know?

Furthermore, some NASes only have Frame Relay or ATM interfaces, and it isn't
clear to me that these boxes have a MAC address. If the language to the NAS
Identifier is changed to insist that it is the NASes FQDN, then it should
be guaranteed to be unique.

PatC
>
>
>
>
>+ Mark Anthony Beadles + MCI WorldCom Advanced Networks +
>+  [email-masked]   +        http://www.wcom.net     +
>+  Voice 614.723.1941  +          Fax 614.723.8407      +
>
>
>-
>To unsubscribe, email [email-masked]' with
>'unsubscribe ietf-radius' in the body of the message.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Carl Rigney <[email-masked]>
Date: Thu, 25 Feb 1999 10:50:10 -0800 (PST)

> If the language to the NAS Identifier is changed to insist that it is
> the NASes FQDN, then it should be guaranteed to be unique.

NAS-Identifier states:
  The String field is one or more octets, and should be unique to the NAS
  within the scope of the RADIUS server.  For example, a fully qualified
  domain name would be suitable as a NAS-Identifier.

  The actual format of the information is site or application specific,
  and a robust implementation SHOULD support the field as undistinguished octets.

So it mentions FQDN as a good choice, but lets people choose other things if
it makes more sense in their situation.

--
Carl
-