Subject: [radext] #149: Multiplexing secure and insecure on the same port

From: "radext issue tracker" <[email-masked]>
Date: Fri, 05 Apr 2013 04:39:05 -0000

#149: Multiplexing secure and insecure on the same port

 As I mentioned in the Orlando meeting I am becoming less convinced that
 multiplexing RADIUS over UDP and RADIUS over DTLS is the appropriate path
 to take.   It would be better to use multiplexing at the UDP level port
 instead.   Using UDP ports allows existing network devices to
 differentiate between encrypted and unencrypted RADIUS and enforce a
 security policy that allows only encrypted traffic.   Using the same port
 also increases the probability that there will be more implementation
 errors that impact the system security.   The overloading of command code
 22 is somewhat of a kludge, it is possible that TLS could introduce new
 message codes that could make new enhancements to TLS incompatible with
 this specification.    The only argument that I have heard for running
 insecure and secure on the same port is that you will not have to modify
 firewall rules, however If you are already using a firewall to filter
 RADIUS traffic you will want to differentiate between insecure and secure
 RADIUS.

-- 
--------------------------------+-----------------
 Reporter:  [email-masked]  |      Owner:
     Type:  defect              |     Status:  new
 Priority:  major               |  Milestone:
Component:  RDTLS               |    Version:
 Severity:  In WG Last Call     |   Keywords:
--------------------------------+-----------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/149>
radext <http://tools.ietf.org/radext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Mon, 08 Apr 2013 08:07:31 -0000

Changes (by [email-masked]):

 * owner:   => [email-masked]
 * component:  RDTLS => dtls

Comment:

 Changed the ticket from RDTLS to DTLS so that it is tracked on the correct
 document.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-radext-
  [email-masked]     |  [email-masked]
     Type:  defect       |      Status:  new
 Priority:  major        |   Milestone:
Component:  dtls         |     Version:
 Severity:  In WG Last   |  Resolution:
  Call                   |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/149#comment:1>
radext <http://tools.ietf.org/radext/>

---

From: "radext issue tracker" <[email-masked]>
Date: Wed, 17 Apr 2013 13:45:31 -0000

Changes (by [email-masked]):

 * status:  new => closed
 * resolution:   => fixed

Comment:

 Version -05 has been updated to allocate a port dedicated to RADIUS/DTLS,
 with supporting text.

-- 
-------------------------+-------------------------------------------------
 Reporter:               |       Owner:  draft-ietf-radext-
  [email-masked]     |  [email-masked]
     Type:  defect       |      Status:  closed
 Priority:  major        |   Milestone:
Component:  dtls         |     Version:
 Severity:  In WG Last   |  Resolution:  fixed
  Call                   |
 Keywords:               |
-------------------------+-------------------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/149#comment:2>
radext <http://tools.ietf.org/radext/>