Subject: RE: (radius) Matching NAS-IP-Address to actual real-life NAS IP a ddress

From: "Beadles, Mark A." <[email-masked]>
Date: Wed, 24 Feb 1999 17:18:05 -0500

From: Carl Rigney [mailto:[email-masked]]
>There's no point in attempting to match the NAS-IP-Address to the IP
address of
>the client the access-request is received from.  They won't match in proxy,
>so I don't see any particular value in requiring that they match for 
>multi-homed NASes.  The NAS-IP-Address is just a convenient and unique
identifier
>for NASes that don't use NAS-Identifier to uniquely identify themselves.

That is exactly right.  Imagine a back end database, shared among several
RADIUS servers, which keeps track of all the NAS-IP-Addresses of the clients
you talk to.  Not for tracking shared secrets, but doing things based on
geographical location, local time of day, country, etc. by using the
NAS-IP-Address as a means of identifying WHICH NAS it is.  It has nothing
intrinsically to do with the IP address of any particular interface card on
the NAS.

>Would people like me to add language to the RADIUS draft pointing this out?

I thought it was obvious until this thread, so maybe you should.

+ Mark Anthony Beadles +       MCI WorldCom      +
+  [email-masked]   +    http://www.wcom.net  +
+  Voice 614.723.1941  +      Fax 614.723.8407   +
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Alan DeKok <[email-masked]>
Date: Wed, 24 Feb 1999 19:04:15 -0500

"Beadles, Mark A." <[email-masked]> wrote:
>
> Imagine a back end database, shared among several RADIUS servers,
> which keeps track of all the NAS-IP-Addresses of the clients you
> talk to.  Not for tracking shared secrets, but doing things based on
> NAS-IP-Address as a means of identifying WHICH NAS it is.

  Wouldn't that identifier be better handled by using the pre-existing
NAS-Identifier attribute?

  (ducks the thrown shoe)

>  It has nothing intrinsically to do with the IP address of any
> particular interface card on the NAS.

  Hmm.. so the NAS-IP-Address isn't necessarily associated with a
RADIUS client, but if it is, it's randomly chosen from one of the IP
addresses that the client is using (multi-homed or aliased).

  What do you do when you've got 2 NASes, each with a private and a
public network, with the RADIUS server on the shared public network?
The server can get requests from each NAS, with the SAME
NAS-IP-Address.  e.g.  (ala Livingston 1.16)

radrecv: Request from 206.248.21.33
 ...
	NAS-IP-Address = 192.168.1.1
 ...

radrecv: Request from 206.248.21.200
 ...
        NAS-IP-Address = 192.168.1.1
 ...

  The same scenario applies to proxies, too.

  So NAS-IP-Address CANNOT be used as a unique NAS identifier.  That's
why I asked my original question.

  As for NAS-Identifier, I haven't seen many implementations actually
use it.  Would it be desirable to have the RFC suggest a method for
generating a *unique* per-NAS identifier?  (I won't do so here.)

> I thought it was obvious until this thread, so maybe you should.

  I think I've argued successfully that your suggested use of
NAS-IP-Address as a unique identifier has its problems.  Therefore,
the proper methods for implementating and handling that attribute are
not obvious.

  Alan DeKok.
-