Subject: RE: [AAA-WG]: Ipsec Usage in DIAMETER

From: "Antonio Forzieri" <[email-masked]>
Date: Mon, 18 Nov 2002 14:04:23 +0100

>Via Tunnel attributes it is possible for the Diameter server to specify a
>compulsory IPsec tunnel (or other types of tunnels) to be brought up
>between the NAS and the Target. But if you want a tunnel between Joe and the Target then
>that is "voluntary tunneling" which is the responsibility of the end
>systems.

Ok that's right.

What I had in mind is the following:
I want to access to a VPN from a remote "untrusted" system.
An idea should be (IPSRA):

- Obtain an internet access;
- Connect to the edge-gateway of the target VPN
- Authenticate the user (DIAMETER ?!?)
- If Authentication is OK then return the remote user some credential (certificate+private key ?!?) else brig the connection down.
- Give remote user configuration parameters (valid_ip, dns address,...)
- Start IKE negotiation using the credential (Joe <--> Target)
- Bring up the tunnel (Joe <--> Target)

But It seems to me DIAMETER can't authenticate the user and then brig up a tunnel between the remote user and the edge gateway.
Am I right?

-- 
Antonio