[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: RFC 3579



In the normal case you describe below (where the NAS always starts off with an EAP-Identity Request) there is no need for the NAS to ever send an EAP-Start packet to the RADIUS server.  This is only useful if the Identity exchange might be superfluous and the RADIUS server can just start off with the EAP method Request from the beginning.  There are a very limited number of situations where this would be useful because:

 

a.    The NAS has to route the request to a RADIUS server without a User-Name attribute because there has been no Identity Exchange (e.g. only the Calling-Station-Id might be available to be placed in the User-Name attribute)

b.    The RADIUS server has to be prepared to choose the EAP method based on what is placed in the User-Name attribute, if anything. 

 

There are some limited situations in which this might be useful… but I’m not aware of much deployment experience.

 

The EAP-Start packet is a RADIUS Access-Request packet containing an EAP-Message attribute with a single NUL character.  So the length of the EAP-Message attribute is >=3.

Might make sense to file an errata to clarify.

 

There is no RADIUS attribute to encapsulate EAPoL, only EAP-Message, which is used to encapsulate EAP.   So there is no way to send an EAPoL-Start packet to a RADIUS server within an EAP-Message attribute.  If there is a need to convey EAPoL-Start data (e.g. IEEE 802.1X-REV extensions to EAPoL-Start such as NIDs) then you’d need to define a distinct RADIUS attribute to convey that.

 

 

 

 

 

From: Koehler, Yannick [mailto:yannick.koehler@hp.com]
Sent: Friday, November 06, 2009 2:46 PM
To: Bernard Aboba; pcalhoun@airespace.com
Subject: RFC 3579

 

Hello,

 

  I have read the RFC 3579 and I have some questions and I was hoping to get some answers from you.  In the RFC it says that the EAP-Start may be represented by an EAP-Message of length 2 (no data).  Yet, the specification of this EAP-Message attribute is defined with a length >= 3 and that, even in the RFC 3579.  Also, I do not follow why there is an EAP-Start packet is this the same as EAPOL-Start ?  And if not, why sending such an empty packet to a RADIUS server?  It seems to me like it waste a round-trip.

 

  My understanding of 802.1x nego is something like that:

 

  Client sends EAPOL-Start

                                                                                NAS answer EAP-Identity Request

  Client sends EAP-Identity response

                                                                                NAS sends RADIUS with EAP identity response to RADIUS

                                                                                                                                                                                                RADIUS reply

                                                                                NAS forward answer.

  Client continue exchange.

 

How is the EAP-Start affecting this negotiation and when is it used, and why?  Is there more documentation on this packet?

 

--

Yannick Koehler