Re: [radext] #153: Section 2.8 Access-Info

[Bernard Aboba <[e-mail]>]

Joe said: 
  
"Access Status is advertised to the supplicant in EAPOL-Announcement Messages which are separate from authentication messages.    I would it expect to be communicated in any message from the AAA server as it is possible you have some level of access before authentication completes.   Access-Info needs to be included in an Access-Challenge message.  "
 
[BA]  As I understand it, the use of the Access-Info attribute is to allow for the setting (and reporting) of the Access Status, which might be provided in response to a request (or not); protected by MKA (or not); could relate to a particular NID or for the port in general.   This raises the question of what the usage scenarios are, and whether the document covers them. 
 
For example: 
 
a. Is there a scenario where the Access-Info attribute could be used along with Service-Type="Call Check"?  For example, if a request comes in, could the RADIUS client generate a Call-Check message (e.g. with the MAC address of the supplicant in the Calling-Station-Id parameter) and then use the information in the Access-Info Attribute within the EAPoL-Announcement sent in reply? 
 
b.  Is the Access-Info Attribute always used to communicate status for the port in general, or can it sometimes be used to indicate the status for a particular NID?  If the latter, how is the NID to which Access-Info relates communicated?  Does the inclusion of an Network-Id-Name Attribute in the Access-Accept indicate that the Access-Info Attribute is NID-specific? 
 
IEEE 802.1X-2010 Section 11.12.2 states:
 
The Access Information TLV provides the information specified in clause 10.1 (see Table 11-9) for a particular NID or for the port in general (if the TLV is encoded before any set TLV).