RE: Meaning of "backward compatible" WAS RE: Consensus Call on RADEXT WG re-charter

["David B. Nelson" <dnelson@elbrysnetworks.com>]

Matt Holdrege writes...

> OK, that's fine, but then if *real* RADIUS clients aren't really
> a part of this effort, then why is it in this WG?

Hmmm.  Because the WG isn't limited to considering only RADIUS extensions
that [primarily] impact the NAS?

> I assume you have some reason for not using IETF recommended IPsec
> to secure proxy-to-proxy data? 

That issue has been discussed.  There are implementations and deployments of
RADIUS over IPsec.  The thing that some folks don't like about IPsec is that
it's a Layer 3 protocol and isn't visible to applications at Layer 4 (e.g.
at the socket interface) the way TLS is.  

> If so, why don't you create another proxy-server to proxy-server
> encryption protocol?

One could claim that RADSEC neatly fills that bill.



--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>