Re: REMINDER: RADEXT WG Last Call on Design Guidelines Document

[Alan DeKok <aland@deployingradius.com>]

Bernard Aboba wrote:
> Ugh.  I wonder how the RADSEC proxy would function when receiving packets 
> from an implementation like that.

  If both IP's are listed as clients, then all the packets get processed.

> RFC 5080 does suggest that NAS-Identifier be used to avoid 
> multi-homing confusion, at least within the RADIUS packet itself.  
> Using different source addresses does seem "novel" - and quite 
> likely to confuse.  One can imagine quite bizarre scenarios for an interop 
> torture test - like having a NAS sending RADIUS/EAP packets within the 
> same session from different IP addresses.  The RFC 5080 algorithm in 
> Section 2.1.2 references "source IP", so it would be confused by this, 
> wouldn't it? 

  Yes.  Luckily so far, devices do this only for accounting packets.

  Anyone crazy enough to do this for EAP will quickly discover that it
Just Doesn't Work.  They'll then fix their implementation.

  For accounting packets, it's harder to claim that this behavior
violates the spec.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>