Re: [radext] WGLC #2 for draft-ietf-radext-dtls-04

["Joseph Salowey (jsalowey)" <[e-mail]>]

As I mentioned in the Orlando meeting I am becoming less convinced that multiplexing RADIUS over UDP and RADIUS over DTLS is the appropriate path to take.   It would be better to use multiplexing at the UDP level port instead.   Using UDP ports allows existing network devices to differentiate between encrypted and unencrypted RADIUS and enforce a security policy that allows only encrypted traffic.   Using the same port also increases the probability that there will be more implementation errors that impact the system security.   The overloading of command code 22 is somewhat of a kludge, it is possible that TLS could introduce new message codes that could make new enhancements to TLS incompatible with this specification.    The only argument that I have heard for running insecure and secure on the same port is that you will not have to modify firewall rules, however If you are already using a firewall to filter RADIUS traffic you will want to differentiate between insecure and secure RADIUS.    


Joe


On Apr 2, 2013, at 1:38 PM, Jouni <[e-mail]> wrote:

> Folks,
> 
> This email starts a quick one week WGLC #2 for draft-ietf-radext-dtls-04;
> "DTLS as a Transport Layer for RADIUS". The WGLC ends on Tuesday, 9th April.
> 
> Post your comments to the list and enter them also into Issue Tracker.
> 
> 
> - Jouni & Mauricio
> 
> 
> 
> _______________________________________________
> radext mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/radext