Re: [radext] #170: Allowed-Called-Station-Id usage scenarios

["radext issue tracker" <[e-mail]>]

#170: Allowed-Called-Station-Id usage scenarios


Comment (by [e-mail]):

 Some clean up of the proposed text for Section 2.1:

 2.1.  Allowed-Called-Station-Id

    Description

       The Allowed-Called-Station-Id Attribute allows the RADIUS server
       to specify the authenticator MAC addresses and/or networks to
       which the user is allowed to connect.  One or more Allowed-Called-
       Station-Id attributes MAY be included in an Access-Accept, CoA-
       Request or Accounting-Request packet.

       The Allowed-Called-Station-Id Attribute can be useful in
       situations where pre-authentication is supported (e.g.  IEEE
       802.11 pre-authentication).  In these scenarios, a Called-Station-
       Id Attribute typically will not be included within the Access-
       Request so that the RADIUS server will not know the network that
       the user is attempting to access.  The Allowed-Called-Station-Id
       enables the RADIUS server to restrict the networks and attachment
       points to which the user can subsequently connect.

       A summary of the Allowed-Called-Station-Id Attribute format is
       shown below.  The fields are transmitted from left to right.

        0                   1                   2                   3
        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
       |     Type      |  Length       |            String...
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

    Code

       TBD1

    Length

       >=3

    String

       The String field is one or more octets, specifying a Called-
       Station-Id that the user MAY connect to; if the Called-Station-Id
       that the user connects to does not match one of the Allowed-
       Called-Station-Id Attributes, the Network Authentication Server
       (NAS) MUST NOT permit the user to access the network.

       In the case of IEEE 802, the Allowed-Called-Station-Id Attribute
       is used to store the Medium Access Control (MAC) address in ASCII
       format (upper case only), with octet values separated by a "-".
       Example: "00-10-A4-23-19-C0".  Where restrictions on both the
       network and authenticator MAC address usage are intended, the
       network name MUST be appended to the authenticator MAC address,
       separated from the MAC address with a ":".  Example:
       "00-10-A4-23-19-C0:AP1".  Where no MAC address restriction is
       intended, the MAC address field MUST be omitted, but ":" and the
       network name field MUST be included.  Example: ":AP1".

       Within IEEE 802.11 [IEEE-802.11], the SSID constitutes the network
       name; within IEEE 802.1X [IEEE-802.1X], the Network-Id Name (NID-
       Name) constitutes the network name.  Since a NID-Name can be up to
       253 octets in length, when used with [IEEE-802.1X], there may not
       be sufficient room within the Allowed-Called-Station-Id Attribute
       to include both a MAC address and a Network Name.  However, since
       the Allowed-Called-Station-Id Attribute is expected to be used
       largely in wireless access scenarios, this restriction is not
       considered serious.

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |       Owner:  draft-ietf-radext-
  [e-mail]          |  [e-mail]
     Type:  defect                   |      Status:  new
 Priority:  minor                    |   Milestone:  milestone1
Component:  ieee802ext               |     Version:  1.0
 Severity:  In WG Last Call          |  Resolution:
 Keywords:                           |
-------------------------------------+-------------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/170#comment:1>
radext <http://tools.ietf.org/radext/>