Subject: [AAA-WG]: Issue 405: RADIUS compatibility

From: Bernard Aboba <[email-masked]>
Date: Wed, 12 Mar 2003 12:16:25 -0800 (PST)

Issue 405: RADIUS compatibility
Submitter name: Bernard Aboba
Submitter email address: [email-masked]
Date first submitted: March 11, 2003
Reference:
Document: NASREQ-11
Comment type: Technical
Priority: S
Section: 9
Rationale/Explanation of issue:
As noted in Section 2.2, it is possible for a Diameter server to
know that it is talking to a RADIUS client. This is indicated
by an AAR message containing a NAS-IP-Address, NAS-IPv6-Address
or NAS-Identifier AVP.

Given this, the Diameter can restrict itself to use of RADIUS
compatible attributes and commands. I would suggest that a discussion of
this
issue be included in a separate sub-section of Section 9:

"9.X.X RADIUS compatibility mode

Since the NAS-IP-Address, NAS-IPv6-Address or NAS-Identifier AVPs
are not used by Diameter clients within AAR messages, the presence
of these attribute indicates that the Request was originated
by a RADIUS client and subsequently translated.

A Diameter server receiving such a message SHOULD restrict itself
to use of AVPs within the range 0-255, so as to ensure RADIUS
backward compatibility. In addition, a Diameter server SHOULD NOT
by default attempt server-initiated re-authentication or re-authorization
for a session known to have been initiated by a RADIUS client.

In addition, the Authorization-Lifetime AVP SHOULD
NOT be included in an AA-Answer message relating to such a session;
instead the equivalent RADIUS attributes (e.g. Session-Timeout and
Termination-Action) SHOULD be used instead. Within Diameter these
attributes have the same meaning as within RADIUS."

---

From: Jari Arkko <[email-masked]>
Date: Thu, 13 Mar 2003 13:29:31 +0200

Works for me. --Jari