|
> When a NAS receives a Framed-Management-Protocol attribute in an > Access-Accept packet, it MUST deliver that specified form of management > access or disconnect the session. If the NAS does not support the > provisioned management application-layer protocol, or the management access > protocol requested by the user does not match that of the > Framed-Management-Protocol attribute in the Access-Accept packet, the NAS > must treat the response packet as if it had been an Access-Reject. [BA] Should this be "MUST"? Presumably if the NAS supports the new Service-Type, then it is also required to understand the Framed-Management-Protocol attribute and take the above action in response to an unsupportable value. > It is RECOMMENDED that the NAS include an appropriately valued > Management-Transport-Protection attribute in Access-Request packet, ^an > indicating the level of transport protection for the management access being > requested, when that information is available to the RADIUS Client. The > RADIUS Server MAY use this hint attribute in making its authorization > decision. > > The RADIUS Server MAY include a Management-Transport-Protection attribute in > an Access-Accept packet that also includes a Service-Type attribute with a > value of Framed-Management, when the RADIUS Server chooses to enforce an > management access security policy for the authenticated user, that dictates > a minimum level of transport security. > > When a NAS receives a Management-Transport-Protection attribute in an > Access-Accept packet, it MUST deliver the management access over a transport > with equal or better protection characteristics or disconnect the session. > If the NAS does not support protected management transport protocols, or the > level of protection available does not match that of the > Management-Transport-Protection attribute in the Access-Accept packet, the > NAS must treat the response packet as if it had been an Access-Reject. "must" -> "MUST" as above. Also, I'd suggest capitalizing the word "Attribute" when referring to a specific attribute, as was the custom in RFC 2865. > So, you're suggesting that I not expect IANA to search through the document > for all the (TBA) placeholders, but rather enumerate all the requests here? > OK, I can do that in version -03. Yes. This makes it easier for them. |