Subject: Re: (radius) Matching NAS-IP-Address to actual real-life NAS IP address

From: Carl Rigney <[email-masked]>
Date: Thu, 25 Feb 1999 10:42:21 -0800 (PST)

I think NAS-IP-Address should be a unique identifier.  If a RADIUS proxy wants
to muck around with attributes to pretend it only has one NAS, that's within its
rights, but let's hope the proxy writer also does the right thing with NAS-Port
too, in that case.  And if the Proxy wants to hide NAS IP addresses, it would be
better to remove the NAS-IP-Address and insert a NAS-Identifier, but that seems
to fall squarely into the field of implementation decisions, which the RFC should
stay clear of dictating.

--
Carl
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Alan DeKok <[email-masked]>
Date: Thu, 25 Feb 1999 14:37:05 -0500

Carl Rigney <[email-masked]> wrote:

> I think NAS-IP-Address should be a unique identifier.

  I agree.  It should be a "MUST" requirement in the RFC.

  However, there should also be a sentence enhancing awareness of
private IP's.  Something like:

  Implementors of RADIUS proxy servers should be aware of the
  problems associated with ensuring uniqueness while proxying a
  NAS-IP-Address containing an IP address from a private network.

  That doesn't dictate implementation, but it does make people aware
of the issue.

  Alan DeKok.
-