Re: [dhcwg] [radext] draft-ietf-dhc-dhcpv6-radius-opt-10

[Peter Deacon <[e-mail]>]

On Fri, 5 Apr 2013, Leaf Yeh wrote:

> Peter - With the DHCPv6 relay forwarding should relays forward attributes it
> does not know about to server?  From my read (section 5) it seems to say
> attributes are forwarded if the relay validates value which seems to imply
> it can't forward attributes it does not know about?

> Good question. I think the point here is the DHCPv6 relay only forward 
> those valid attribute in the registry of 'RADIUS attributes permitted in 
> DHCPv6 RADIUS option'. If the DHCPv6 server supports OPTION_RADIUS 
> defined here, it should know all the attributes received from the relay. 
> If the DHCPv6 server still does not know the attributes in 
> OPTION_RADIUS, the server just ignore those attributes per the Postel's 
> Law.

Hi Leaf,

Ok, my only concern here is relays tend to be "dumb" and outnumber DHCPv6 
servers in number and vendors involved.  It might be difficult to ever add 
new attributes in production as you would have to touch all relays to 
allow a new attribute to pass.  My guess VSAs would likely end up filling 
any gaps anyway.

> Peter - The DHCP analogue (RFC 4014 sec 4) lists other attributes just
> wondering what is different here that makes the attribute lists different
> ...IPv6 specific company excluded of course.

> I guess you are talking about the following attributes (in the table of the
> section 4 in RFC 4014):
>           1   User-Name (RFC 2865 [3])
>           6   Service-Type (RFC 2865)
>          27   Session-Timeout (RFC 2865)

> I still have not got the points (or understood the use case) for:
> a. User-Name : why the User-Name of AAA (or RADIUS) will be necessary to
> forward the DHCPv6 server; the standard DHCPv6 server sounds never use it
> before;
> b. Service-Type : what kind of service-type of AAA (or RADIUS,
> http://www.iana.org/assignments/radius-types/radius-types.xml#radius-types-4
> ) will be necessary to forward the DHCPv6 server;
> c. Session-Timeout : I think the NAS (DHCPv6 relay + RADIUS client) can be
> the 1st control point of trusted network , it can decide whether to forward
> the DHCPv6 messages from the client to the server. After the session is
> timeout, it just stop forward the DHCPv6 messages from the client to the
> server. This RADIUS attribute also sounds not necessary to forward to the
> DHCPv6 server. Right?

Yes, I can't think of much either.

User-Name might be used to correlate any user specific settings stored in 
DHCP server or just logging purposes to understand end user associated 
with DHCP queries.

regards,
Peter