Subject: RE: (radius) Matching NAS-IP-Address to actual real-life NAS IP a ddress

From: Carl Rigney <[email-masked]>
Date: Wed, 24 Feb 1999 13:19:32 -0800 (PST)

There's no point in attempting to match the NAS-IP-Address to the IP address of
the client the access-request is received from.  They won't match in proxy,
so I don't see any particular value in requiring that they match for 
multi-homed NASes.  The NAS-IP-Address is just a convenient and unique identifier
for NASes that don't use NAS-Identifier to uniquely identify themselves.

Would people like me to add language to the RADIUS draft pointing this out?

--
Carl Rigney
[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Alan DeKok <[email-masked]>
Date: Wed, 24 Feb 1999 16:52:49 -0500

Carl Rigney <[email-masked]> wrote:

> There's no point in attempting to match the NAS-IP-Address to the IP
> address of the client the access-request is received from.  They
> won't match in proxy, so I don't see any particular value in
> requiring that they match for multi-homed NASes.

  Exactly, which is why I suggested that they 'SHOULD' match.  I'm not
sure what it would mean for a multi-homed NAS if they don't match,
which is why I brought up the question.

  The side effect of the problem in this case, was a firewall leaking
secret information across it's "protected" interfaces.  Not a Good Thing.

>  The NAS-IP-Address is just a convenient and unique identifier for
> NASes that don't use NAS-Identifier to uniquely identify themselves.

  Most radius servers treat the NAS-IP-Address as informational, not
as identifying.  i.e. They ignore it, other than for logging purposes.

> Would people like me to add language to the RADIUS draft pointing this out?

  You've got my vote.

  Alan DeKok.
-