Subject: (radius) Question about RADIUS terminology

From: [email-masked]
Date: Fri, 11 Feb 2000 16:22:20 +0200

Dear all,

I have a question related to the RADIUS terminology.
What is the difference between proxy authentication
and pre-authentication when talking about querying
VPN tunnel attributes?

Does proxy authentication mean that the first RADIUS
server (at the tunnel client endpoint) has all the
information needed to establish the tunnel and
the session, because its database is updated 
periodicly by the RADIUS server at the tunnel
server endpoint?

And does the pre-authentication mean that the
first RADIUS server proxies the Access-Request
(which may contain either PPP user name + password
or just the dialed number as a user name with
some dummy password) to the RADIUS server at the
tunnel server endpoint, which then returns the
tunnel attributes in the Access-Accept with or
without checking the PPP password?

So what I'm trying to ask is that is the distinction 
between the two terms:

A)	Whether the NAS at the tunnel client endpoint
	fills the initial Access-Request with the 
	PPP user name + password or dialed number + dummy
	password, in order to receive tunnel attributes.

B)	Whether the first RADIUS server needs to proxy the
	Access-Request in order to receive the tunnel 
	attributes or not.

C)	Whether the PPP password is checked by the first
	RADIUS server or not.

Best regards,
Mikko Alutoin
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "David Mitton" <[email-masked]>
Date: Fri, 11 Feb 2000 11:49:51 -0500

>periodicly by the RADIUS server at the tunnel

No.  Typically a proxy server does not keep a database of authenticated 
sessions, except maybe in RAM for active tracking.

In the case of roaming applications and broker proxies, it may track usage 
based on organization, but not the user's password.

>without checking the PPP password?

Yes.

>         password, in order to receive tunnel attributes.

Yes, both implementations could exist depending on the requirements and 
capabilities of the NAS and it's tunneling service.

>         Access-Request in order to receive the tunnel

It depends... If you read draft-ietf-radius-tunnel-imp-05.txt (soon to be 
an RFC) the authors lay out several alternatives.  It's going to vary with 
your implementation.

All of the implementations I'm familiar with, do NOT proxy, but instead 
pass tunnel server profile information back to the NAS.

The NAS establishes the connection to the tunnel server, using whatever 
service authentication that tunnel protocol supports, and then typically 
the PPP authentication inside the tunnel service, authenticates the user to 
the AAA support behind the tunnel server.

>C)      Whether the PPP password is checked by the first

Typically not.  The point is that client end is offering an access service, 
that is dependent on the successful authentication at the server end.  From 
a management standpoint, you don't want to be distributing your 
authentication information all over the network.

That first RADIUS server, in outsourcing models, could be any old ma & pop ISP.

>'unsubscribe ietf-radius' in the body of the message.

---------------------------------------------------------------
David Mitton                                  ESN: 248-4570
Advisor, Nortel Networks                      978-288-4570 Direct
Carrier Packet Solutions, Preside             978-288-3030 FAX
Billerica, MA 01821                    [email-masked]

-