Re: [radext] Client ID exhaustion

Hi, Stefan:

Yes, it does use multiple source ports.

Regards,   -- Enke

On 4/27/17 2:00 AM, Stefan Winter wrote:
> Hello,
> 
>> The case we have is with the wireless controller that needs to manage
>> thousands of APs and tens of thousands of clients. The wireless world
>> uses "centralized" management model.  The scaling requirements keep
>> increasing every year.
>>
>> Though RADIUS is an old protocol, it is a critical piece in the wireless
>> world.
> 
> Your reply did not indicate whether the wireless controller implements
> the MAY in RFC2865 (a piece of information I specifically asked for).
> Does it?
> 
> Greetings,
> 
> Stefan Winter
> 
>>
>> Thanks.  -- Enke
>>
>> On 4/26/17 5:43 AM, Stefan Winter wrote:
>>> Hello,
>>>
>>>
>>> we keep hearing assertions on the list that change is needed regarding
>>> the ID field in RADIUS.
>>>
>>>
>>> I would like to recall RFC2865's section 2.5
>>>
>>>
>>> "If a
>>>
>>>    NAS needs more than 256 IDs for outstanding requests, it MAY use
>>>    additional source ports to send requests from, and keep track of IDs
>>>    for each source port.  This allows up to 16 million or so outstanding
>>>    requests at one time to a single server."
>>>
>>>
>>> It's fairly clear that implementations which do not follow the MAY will
>>> run into exhaustion problems rather soon.
>>>
>>> It's less clear that implementations which do follow this MAY still do.
>>> We've heard finger-in-the-air calculations on the list that this may
>>> become a problem earlier than one might think. But is there actual
>>> evidence to that end in deployed reality?
>>>
>>> Can someone please share their experience regarding a deployment and
>>> implementation which DOES implement the MAY above but STILL runs out of
>>> RADIUS packet IDs?
>>>
>>> Obviously, for those implementors which do not implement the MAY, the
>>> suggestion would be to implement that before trying to make protocol
>>> changes. The corresponding advice in RFC2865 may be 17 years old now,
>>> but that doesn't mean it is not good advice.
>>>
>>> Greetings,
>>>
>>> Stefan Winter
>>>
>>>
>>>
>>> _______________________________________________
>>> radext mailing list
>>> radext@ietf.org
>>> https://www.ietf.org/mailman/listinfo/radext
>>>
> 
> 
> 
> 
> _______________________________________________
> radext mailing list
> radext@ietf.org
> https://www.ietf.org/mailman/listinfo/radext
> 