Subject: (radius) NAS expects RADIUS server to return Hints sent in access request?

From: Ashwin Palekar <[email-masked]>
Date: Tue, 18 May 1999 13:40:21 -0700

I was told that some NASes actually expect that the attributes it sent to
the RADIUS server as hint in the access request should be returned in the
access accept. 

In this particular case, the NAS/VPN server (don't want to use the vendor's
name) sends a Tunnel-Name "VSA" to the RADIUS server, and expects the RADIUS
server to return it back in the response. This is not consistent with what
the RFC says. The RADIUS RFC states that "An Access-Request MAY contain
additional attributes as a hint to the server, but the server is not
required to honor the hint.".

What is the right behavior for a RADIUS server? and are there any other
NASes around which expect the RADIUS server to always return back the hints
in the access accept?

Ashwin Palekar

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Dave Mitton <[email-masked]>
Date: Fri, 28 May 1999 10:35:44 -0400

I aggree with you on this.  The RFC says nothing about it, and I'm pretty
sure that Livingston's original "reference" server did no such thing.

The Merit server, might due to how it internally handles attributes.

Ours does not, but you can flag any attributes in a return list with "Echo"
behavior.  That is they will echo the Access-Accept value.  That would
prempt any ability to set the attribute value for that user.

	Dave.

>'unsubscribe ietf-radius' in the body of the message.

---------------------------------------------------------------
David Mitton                                  ESN: 248-4570
Consulting Engineer, Nortel Networks           978-288-4570 Direct
Carrier Packet Solutions                       978-288-3030 FAX
Billerica, MA 01821                     [email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.