Subject: RE: (radius) NAS-Port-Id and Framed-IP-Pool

From: Dave Mitton <[email-masked]>
Date: Wed, 03 Mar 1999 11:33:27 -0500

Okay.  Well in that case, returning the Framed-IP-Addr=255.255.255.254
value should suffice.

I've quickly come to the conclusion, that service provider offering proxy
authentication, wants to "edit" or control the actual return parameters, of
which this is a prime example because of the necessary control of the
network configuration.
The proxy server would have templates for the services being offered to
each proxy target.

Hopefully the service provider has an address allocation scheme that may be
proxy domain dependent, and would insert that in the NAS return message
appropriately.  He may want to use  different pools of addresses for
different customer bases, and could either do a server based assigment or
direct the NAS accordingly.

	Dave.

At 11:08 AM 3/3/99 -0500, Mun, Mike wrote:
>That is in the single domain. What I talk about is in case of roaming users
>and proxy to different domain.
>
>Mike
>
>	----------
>	From:  Dave Mitton [SMTP:[email-masked]]
>	Sent:  Wednesday, March 03, 1999 10:42 AM
>	To:  Mun, Mike; Nelson, David; Steven P. Crain
>	Cc:  [email-masked]'
>	Subject:  RE: (radius) NAS-Port-Id and Framed-IP-Pool
>
>	That's silly.
>
>	From the server's point of view, you should know if you configured
>an IP
>	pool on that NAS and provision the use of it accordingly.  If there
>is no
>	pool, then ignore it.
>
>	If you need some help in remembering such things, your server
>	implementation can certainly organize it's data internally.  Many of
>the
>	leading RADIUS servers now have internal "attributes" which are used
>to
>	trigger appropriate behaviors.  The NAS never sees them on the wire.
>
>	The semantics of Framed-IP-Address already allow for the NAS to
>assign an
>	address given the magic value of 255.255.255.254.  Your proposal is
>redundant.
>
>	Adding another attribute just allows the Server to select from
>multiple
>	potential pools.
>	I would even go so far as to say that it could be used in a DHCP
>request
>	from the NAS, to a DHCP server that uses "Class" arguments for
>address
>	selection.
>
>		Dave.
>
>	At 10:05 AM 3/3/99 -0500, Mun, Mike wrote:
>	>>From AS server's point of view, I think Framed-IP-Pool should be
>an integer
>	>value: 
>	>0	NAS pool available
>	>1	NAS pool only
>	>If this attribute is not present, then NAS pool is not available.
>	>Mike
>	>
>	>
>	>	----------
>	>	From:  Steven P. Crain [SMTP:[email-masked]]
>	>	Sent:  Tuesday, March 02, 1999 3:40 PM
>	>	To:  Nelson, David
>	>	Cc:  'Dave Mitton'; [email-masked]'
>	>	Subject:  RE: (radius) NAS-Port-Id and Framed-IP-Pool
>	>
>	>	On Tue, 2 Mar 1999, Nelson, David wrote:
>	>
>	>	> Of course, I've always been left a little unsatisfied by
>the "some
>	>
>	>	> mechanism outside the scope of RADIUS" business.  It
>doesn't do
>	>much to
>	>	> promote interoperability.  However, since we have already
>cast the
>	>die
>	>	> in terms of the Filter-ID usage, I guess Framed-IP-Pool
>would be
>	>OK on
>	>	> that basis.
>	>
>	>	Maybe we should call it Framed-IP-Pool-ID for consistency.
>	>
>	>	-- 
>	>	Steven P. Crain, Development
>	>	http://www.shore.net/~scrain
>	>	Shore.Net: Local Ties... World Class Connections
>	>
>	>	-
>	>	To unsubscribe, email [email-masked]' with
>	>	'unsubscribe ietf-radius' in the body of the message.
>	>
>	>Attachment Converted: "L:\Eudora\attachments\RE (radius)
>NAS-Port-Id and Fr1"
>	>
>	---------------------------------------------------------------
>	David Mitton			  		ESN: 248-4570
>	Consulting Engineer, Nortel Networks	978-916-4570 Direct
>	Carrier Packet Solutions, I&SP Netwks	978-916-4789 FAX
>	Billerica, MA 01821
>[email-masked]
>	-
>	To unsubscribe, email [email-masked]' with
>	'unsubscribe ietf-radius' in the body of the message.
>
>
---------------------------------------------------------------
David Mitton			  		ESN: 248-4570
Consulting Engineer, Nortel Networks	978-916-4570 Direct
Carrier Packet Solutions, I&SP Netwks	978-916-4789 FAX
Billerica, MA 01821				[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: MARC DE VRIES WE41/KT <[email-masked]>
Date: Wed, 03 Mar 1999 17:52:04 +0200 (MET-DST)

There seems to be some confusion as to the purpose of Framed-IP-Pool-Id, so I
will attempt a clarification (based on current practice with a proprietary
pool-id attribute).

The NAS is configured with the following IP pools:
pool-1 10.0.0.1/24
pool-2 10.0.1.1/24
pool-3 10.0.2.1/24

The network operator serves three realms (using a proxy), each realm using
their own IP ranges.

When forwarding an Access-Accept containing Framed-Address=255.255.255.254 from
realm-1 to the NAS, the proxy adds the attribute:

Framed-IP-Pool-Id = 1

When forwarding an Access-Accept containing Framed-Address=255.255.255.254 from
realm-2 to the NAS, the proxy adds the attribute:

Framed-IP-Pool-Id = 2

etc.

The result is that users will get an IP address assigned that belongs to the
address space of their realm.

Regards,

Marc.

>Well in that case, returning the Framed-IP-Addr=255.255.255.254
>value should suffice.
>

-