Subject: [L2tpext] Extending the Proxy Authen AVPs for Extensible Authentication Protocol (EAP)

From: Mahesh Kelkar <[email-masked]>
Date: Mon, 25 Jul 2005 10:51:18 -0700 (PDT)

This draft defines a new Proxy Authen Type for EAP and
defines the contents of Proxy Authenticate Data for EAP.

Please see the appendix for the "possible
configurations/setups". It discusses different scenarios
for the EAP hand-off.

Your thoughts and comments would be greatly appreciated.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-kelkar-l2tpext-eap-proxy-authen-ext-00.txt

Thanks
Mahesh

+++++++++++++++++++++++++++++
 M a h e s h  V  K e l k a r

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

---

From: Ignacio Goyret <[email-masked]>
Date: Tue, 26 Jul 2005 17:55:57 -0700

Mahesh,
Great work for a first cut! Thanks for putting the effort in writing
this draft.

A few comments:
1) You should only describe the values for EAP. Let the other protocols
   be defined by RFC2661. Duplicating the information on that RFC will
   only lead to confusion.
   ie, instead of copying the section for "Proxy Authen Type (ICCN)"
   and showing all possible values, simply state that a new value is
   used for EAP. Same for the other AVPs.

2) I believe that your appendix A should be most of the gut of this draft.
   Consider moving it into its own section.

3) It seems your Scenarios are a little too restrictive and not very
   realistic. For example, Scenario III assumes that the LAC will not
   perform any PPP authentication, which necessarily requires a new LCP
   negotiation cycle (due to different authentication requirements).

4) In Scenario I, the LAC does not seem to do any authentication,
   just send an EAP message and that's it? How would it know that
   the user is a valid user if the authentication is not allowed
   to conclude?

5) In Scenario IV, the LAC should NOT send an EAP Success. If it did so,
   it would be allowing the client to proceed to the Network phase of PPP.
   The whole point of proxy authentication is to give the LNS a chance
   to avoid an LCP renegotiation.

This is a good start, but it needs more work.

Cheers,
-Ignacio