Subject: RE: [AAA-WG]: NASREQ Request-Type AVP???

From: Jacques Caron <[email-masked]>
Date: Thu, 14 Jun 2001 14:28:27 +0200

At 13:59 14/06/01, Martin Julien (ECE) wrote:
>Does it also mean that an authorization-only could be followed
>by an authentication-only?

It could happen (e.g. authorization on called/calling number to pick up the 
call, then PPP authentication, then PPP authorization (a la Tacacs+)).

>The thing is that I am wondering if an AAA server
>needs to keep a session opened for an authorization-only or not?
>For example, in the case that a request is received for
>authorization-only, which gets routed to a tunnel, is there any
>point of keeping a session in the AAA or not? I guess there is
>no point for accounting, neither authentication, am I right?

In some cases you might have authorization-only (based on called/calling 
number), then accounting start, and later on accounting stop. So, yes, you 
need to maintain state in that case too.

>By the way, when a AA-Request is received in a AAA server
>without a User-Name,
>but containing either a Called-Station-Id or a
>Calling-Station-Id, is it
>implicit that tunnelling should be defined in the receiving
>AAA node or not?

No comprendo.

>The thing is that I am wondering if it is possible for a AAA
>proxy server to
>forward an AA-Request based on DNI or ANIS? Is it common practice?

Yep. We need clarification on exactly which agents are allowed to infer a 
Destination-Realm to accomplish that. It's in my list of issues to open :-(

Jacques.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: David Mitton <[email-masked]>
Date: Fri, 15 Jun 2001 17:30:35 -0400

At 6/14/01 02:28 PM +0200, Jacques Caron wrote:
>It could happen (e.g. authorization on called/calling number to pick up 
>the call, then PPP authentication, then PPP authorization (a la Tacacs+)).
>

No.  Tunneling service usually has no difference in the request.
The server figures out that tunneling is the class of service to be given 
that user or port, and initiates it by the contents of the return message.

>>forward an AA-Request based on DNI or ANIS? Is it common practice?

Yes, typically those doing Called or Calling-Number requests, have a 
configured table of Numbers to realms or servers.

>Destination-Realm to accomplish that. It's in my list of issues to open :-(

Why does this need to be distinguished?

Dave.
----------------------------------------------------
David Mitton                            978-288-4570
Advisor, Nortel Networks
[email-masked]   or      [email-masked]