Subject: (radius) RADIUS tunnel-auth-09 Comment

From: "Gokul Subramaniam" <[email-masked]>
Date: Fri, 25 Feb 2000 16:55:23 -0600

Hello.,

With the increased use of L2TP over IPSec to address the VPN scenarios and
deployments, there are some limitations in the use of RADIUS Attributes for
Tunnel Support<draft-ietf-radius-tunnel-auth-09.txt>.

NAS can communicate with the remote RADIUS Server during user authentication
(using Access Req/Accept)
messages and in the process get the tunnel server endpoint address and
tunnel type (example value: tunnel type=3 L2TP).
However, there is no option to differentiate between L2TP and L2TP over
IPSec.
It would be easier from a NAS stand-point to get this information from the
remote radius server in the access accept message.
in order to do this the draft should support a value for L2TP over IPSec.
The rationale for doing this in the RADIUS message is due to the increased
use of VPNs to access private and corporate networks. Along with the
enhancement of supporting a new value for tunnel-type, it would also be
essential to define a new attribute for the shared key to start IKE between
the tunnel initiator and the tunnel terminator.

The value of being able to do this via RADIUS authentication messages helps
the NAS to learn about the necessary remote network tunneling security
requirements (if this network is private or corporate or example). This way
a separate or proprietry message/vendor-specific messages need not be sent
to support L2TP over IPSec.

Suggestions to enhance the draft are:
Add new tunnel-type value.
Value 13 - L2TP over IPSec

Add new attribute:
Shared Key.

This way once authentication is done the NAS would have all the information
needed to start either L2TP or L2TP over IPSec (besides all the other tunnel
options).

If a new attribute for Shared Key is not added into the draft then option
would be to override the Tunnel-Password parameter to pass the shared key.
Since doing L2TP tunnel authentication is redundant if there is anyway going
to be L2TP over IPSec.
So whenever the tunnel-type value is 13, then the Tunnel Password will carry
the shared key for L2TP over IPSec.

Suggest me if there are anyother ways to handle the above mentioned
scenario.
Your feedback is appreciated.

-Gokul

Gokul V. Subramaniam          
NORTEL Networks
CDMA Wireless Data Development
email:[email-masked]
Ph:972 685 8214. ESN:445 8214