Subject: (radius) Retransmission hints

From: Carl Rigney <[email-masked]>
Date: Wed, 24 Feb 1999 15:53:08 -0800 (PST)

In going through the archives to find things that have confused people in
the past (and thus are good candidates for discussing in more depth in the
revised RADIUS draft) I came across the issue of retransmissions.  I'd like
to add something along the following lines to the Operations section.
Comments please?

  2.X Retransmission Notes

  If the RADIUS server and alternate RADIUS server share the same shared
  secret, it is OK to retransmit the packet to the backup RADIUS server
  with the same ID and Request Authenticator, because the content of the
  attributes haven't changed.  If you wanted to use a new Request
  Authenticator when sending to the backup server, you could (and would
  then have to use a new ID).

  If you change the contents of the User-Password attribute (or any other
  attribute), you need a new Request Authenticator and therefore a new
  ID.

  If the NAS is retransmitting a RADIUS request to the same server as
  before, and the attributes haven't changed, you MUST use the same same
  Request Authenticator and ID.  If any attributes have changed, you MUST
  use a new Request Authenticator and ID.

  A NAS MAY use the same ID across all servers, or MAY keep track of IDs
  seperately for each server, its up to the implementer.  If a NAS needs
  more than 256 IDs for outstanding requests, it MAY use additional
  source ports to send requests from, and keep track of IDs for each
  source port.  This allows up to 16 million or so outstanding requests
  at one time to a single server.

--
Carl
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Steven P. Crain" <[email-masked]>
Date: Thu, 25 Feb 1999 00:25:52 -0500 (EST)

On Wed, 24 Feb 1999, Carl Rigney wrote:

> If you wanted to use a new Request Authenticator when sending to the
> backup server, you could (and would then have to use a new ID).

Since its sending to a different server, it wouldn't necessarily need a
new ID.

-- 
Steven P. Crain, Development
http://www.shore.net/~scrain
Shore.Net, An ISP with Excellence in the Greater Boston Area.

-