[radext] #149: Multiplexing secure and insecure on the same port

["radext issue tracker" <[e-mail]>]

#149: Multiplexing secure and insecure on the same port

 As I mentioned in the Orlando meeting I am becoming less convinced that
 multiplexing RADIUS over UDP and RADIUS over DTLS is the appropriate path
 to take.   It would be better to use multiplexing at the UDP level port
 instead.   Using UDP ports allows existing network devices to
 differentiate between encrypted and unencrypted RADIUS and enforce a
 security policy that allows only encrypted traffic.   Using the same port
 also increases the probability that there will be more implementation
 errors that impact the system security.   The overloading of command code
 22 is somewhat of a kludge, it is possible that TLS could introduce new
 message codes that could make new enhancements to TLS incompatible with
 this specification.    The only argument that I have heard for running
 insecure and secure on the same port is that you will not have to modify
 firewall rules, however If you are already using a firewall to filter
 RADIUS traffic you will want to differentiate between insecure and secure
 RADIUS.

-- 
--------------------------------+-----------------
 Reporter:  [e-mail]  |      Owner:
     Type:  defect              |     Status:  new
 Priority:  major               |  Milestone:
Component:  RDTLS               |    Version:
 Severity:  In WG Last Call     |   Keywords:
--------------------------------+-----------------

Ticket URL: <http://trac.tools.ietf.org/wg/radext/trac/ticket/149>
radext <http://tools.ietf.org/radext/>