Subject: Re: (radius) Matching NAS-IP-Address to actual real-life NAS IP a ddress

From: Carl Rigney <[email-masked]>
Date: Thu, 25 Feb 1999 10:12:28 -0800 (PST)

[email-masked] says:
> The primary purpose of the NAS-IP-Address attribute (or the NAS-
> Identifier) is so that the RADIUS server may look up the shared secret
> of the NAS.

This is exactly wrong.  The shared secret MUST be looked up based on the
source IP address of the RADIUS packet, not the contents of the packet.
Otherwise proxy wouldn't work.  I think 2138 was ambiguous on that and
we added language to the forthcoming draft to make this (subtle but vital)
point.

The protocol treats client and NAS interchangeably, but once you're doing
proxy then there is a certain special status for the endpoints of the proxy
chain; one being a NAS, the other being the final server.

--
Carl Rigney
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Dave Mitton <[email-masked]>
Date: Fri, 26 Feb 1999 15:26:37 -0500

on this topic:

- I've never understood why not to send a NAS-IP-Address attribute.
It's trivial to include and should be there ALWAYS, and it's value is most
obvious.

- WRT: NAS-Identifier, I had an argument with one of my developers who
claimed that the wording of the RFC indicated that it is not recommended
that you send both.
I'd like to get that "recommendation" struck out.

I brought this up once before:

>Return-Path: <[email-masked]>
>Received: from atlas.xylogics.com by vulcan.xylogics.com
>	  id AA12506 (4.1/UK-doug-951219); Wed, 28 Jan 98 09:43:32 EST
>Received: from smtp-gw.BayNetworks.COM (ext-ns4.baynetworks.com
[192.32.253.7]) by atlas.xylogics.com (8.7.3/8.7.3) with ESMTP id JAA04481
for <[email-masked]>; Wed, 28 Jan 1998 09:43:31 -0500 (EST)
>Received: from bast.livingston.com (bast.livingston.com [149.198.247.2])
>	by smtp-gw.BayNetworks.COM (8.8.6/8.8.6) with ESMTP id JAA16554
>	for <[email-masked]>; Wed, 28 Jan 1998 09:44:06 -0500 (EST)
>Received: from server.livingston.com (server.livingston.com
[149.198.1.70]) by bast.livingston.com (8.8.5/8.6.9) with ESMTP id
GAA04517; Wed, 28 Jan 1998 06:36:05 -0800 (PST)
>Received: (from majordom@localhost) by server.livingston.com (8.8.5/8.6.9)
id GAA13569 for ietf-radius-outgoing; Wed, 28 Jan 1998 06:38:13 -0800 (PST)
>Message-Id: <[email-masked]>
>X-Sender: [email-masked]
>X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
>Date: Wed, 28 Jan 1998 09:38:08 -0500
>To: [email-masked]
>From: Dave Mitton <[email-masked]>
>Subject: (radius) NAS-IP-Address,or NAS-Identifier, but not both.  Why?
>Mime-Version: 1.0
>Content-Type: text/enriched; charset="us-ascii"
>Sender: [email-masked]
>Precedence: bulk
>Reply-To: Dave Mitton <[email-masked]>
>
><x-rich>RADIUS, RFC 2138, Section 4.1 says:
>
><bigger>      An Access-Request MUST contain a User-Name attribute.  It
>SHOULD
>
>      contain either a NAS-IP-Address attribute or NAS-Identifier
>
>      attribute (or both, although that is not recommended).
>
>
>A similar phrase is more findable in Accounting RFC 2139, Section 5.13,
>
>
>   [5] An Accounting-Request MUST contain either a NAS-IP-Address or a
>
>   NAS-Identifier, and it is permitted (but not recommended) for it to
>
>   contain both.
>
>
>I'm most curious about the _why_ both is not "recommended"?
>
>
>Providing the IP-Address is a no-brainer.
>
>And I thought that providing the system name in text in the
>NAS-Identifier was most user and debug friendly.  
>
>
>But I get push back when I try to include both.
>
>
>	Dave.</bigger>
>-
---------------------------------------------------------------
David Mitton			  		ESN: 248-4570
Consulting Engineer, Nortel Networks	978-916-4570 Direct
Carrier Packet Solutions, I&SP Netwks	978-916-4789 FAX
Billerica, MA 01821				[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.