RE: [dhcwg] DHCP interconnected to RADIUS for AAA

Thanks you all for the reply.

After review and discussion, we kind of lean toward over John's suggestion:
.1x for authentication, DHCP for address allocation, and all tied together
by RADIUS.  Anyone can point me to the product actually implementing: client
(network device, I think Windows XP is one), access device, RADIUS server
and DHCP server as per John's draft?

--
Weijing Chen
SBC Technology Resources
9505 Arboretum Blvd.
Austin, TX 78759
512 372 5710
wchen@tri.sbc.com

-----Original Message-----
From: John Schnizlein [mailto:jschnizl@cisco.com] 
Sent: Tuesday, March 11, 2003 9:40 AM
To: Erik Nordmark
Cc: Shankar Agarwal; rbhibbs@pacbell.net; Dhcwg; Chen, Weijing
Subject: Re: [dhcwg] DHCP interconnected to RADIUS for AAA

At 08:51 AM 3/11/2003, Erik Nordmark wrote:
>> Right now we don't have a simple username password authentication
>> mechanism for DHCP and we have something very complicated which will not
>> be used in most common deployments. In most of the cases we are happy
>> with either cleartext user name password or may be MD5 encoded username
>> password authentication. If we put this within the current DHCP
>> framework then this will help in replacing the ppp in DSL and cabel
>> modem world where username password is used to pick up the profile of
>> the user.
>
>An alternative would be to figure out how PANA and DHC would work
>together in this case.

Another alternative is to follow the AAA that controls initial access 
at layer 2 (e.g. RADIUS authentication for IEEE 802.1X) with sending
those RADIUS attributes to the DHCP server. This approach protects
the access network and separates the functions of user authentication 
from address (and other parameter) configuration. The mechanism for
interworking this way is in draft-ietf-dhc-agentopt-radius-02.txt.

John
_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
https://www1.ietf.org/mailman/listinfo/dhcwg