Subject: (radius) Matching NAS-IP-Address to actual real-life NAS IP address

From: Alan DeKok <[email-masked]>
Date: Wed, 24 Feb 1999 15:08:58 -0500

Under what circumstances can a RADIUS client put a NAS-IP-Address
attribute inside of a packet, which is different than the IP address
from which the packet is sent?

  I can understand if there's a proxy server between the NAS and the
end authenticating server.  The NAS-IP-Address *may* match the NAS,
and the sending IP address will be the proxy.  However, one of our
customers ran into the following problem.

  They had a firewall with 3 interfaces, on 3 networks.  Let's call
them DMZ, Public, and Private.  The RADIUS server is on the Private
network, and is seeing the Access-Request packets coming from the
Private network address of the firewall.  These requests are due to
people from the Public network requesting authentication.

  However, the NAS-IP-Address that the firewall is placing inside of
the packet contains the DMZ IP address of the firewall.  So the
firewall is leaking information across networks, and is confusing
to the server about its IP address.

  I'd like to see the draft updated to talk about this issue.  Even
adding a 'SHOULD' would help, as in:

---------------------------------
5.4.  NAS-IP-Address

   Description

      This Attribute indicates the identifying IP Address of the NAS
      which is requesting authentication of the user.  It is only used
      in Access-Request packets.  Either NAS-IP-Address or NAS-
      Identifier SHOULD be present in an Access-Request packet.

      If the NAS is originating the packet, then the value of the
      NAS-IP-Address attribute SHOULD match the IP address of the
      interface from which the packet is sent.
---------------------------------

  (where the last sentence is new.)

  Personally, I'd prefer a MUST, but I'd be satisfied with a SHOULD.

  Not surprisingly, the vendors response was:

    "Our interpretation of the RFC is that the NAS-IP-Address attribute
     does not have to match the IP address of the interface from which
     the packet was sent."

  If this interpreation is correct, then there isn't much point in
having a NAS-IP-Address attribute, as the RADIUS server doesn't know,
and doesn't care about other IP addresses the NAS may have.

  Alan DeKok.
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: MARC DE VRIES WE41/KT <[email-masked]>
Date: Thu, 25 Feb 1999 18:35:07 +0200 (MET-DST)

>from which the packet is sent?
[...]
>and doesn't care about other IP addresses the NAS may have.

for another vendor's response:

we have a radius server that makes a clear distinction between the two:

we consider the source ip address when validating the packet source (radius
secret).

any other functionality (like port reservation per nas, statistics
generation,...) is based on the NAS-Id attributes (4 and/or 32).

I believe this is exactly the purpose of having the two IPs: being able to ID
the NAS independent of where the packet comes from, and being able to validate
that the packet comes from a trusted source.

It is common for NASses to send their 'system IP' in attr 4, but provide the
'interface IP' as source IP address depending on the outgoing interface.

regards,

Marc.

-