Subject: RE: [AAA-WG]: Question regarding IP Filter Rule

From: Avi Lior <[email-masked]>
Date: Wed, 17 Dec 2003 12:00:48 -0500

Hi Jari,

You could use Framed-Route but now all traffic would be routed to the Portal
etc.....

I think it would be more appropriate to introduce a new attribute so that:

A) the NAS would deal with the routing functions (as it always does) and the
Portal does not have to do it.

B) We would have the flexibility to decide whether to route all traffic or
just some traffic.

> -----Original Message-----
> From: Jari Arkko [mailto:[email-masked]] 
> Sent: Tuesday, December 16, 2003 4:47 PM
> To: Avi Lior
> Cc: [email-masked]'; [email-masked]
> Subject: Re: [AAA-WG]: Question regarding IP Filter Rule
> 
> 
> Avi Lior wrote:
> > The Black I-D and PWLAN draft prompted me to check something out.
> > 
> > It seems to me that something is missing in Diameter.  Using the 
> > filter specification in 3588 its not clear how I force a 
> forward.  The 
> > only actions supported are permit or deny whereas ipfw supports a 
> > forward mechanism as well.
> > 
> > The motivation for this is the requirement in (WLAN for example) 
> > whereby I want to force all http traffic to a specific 
> portal and deny 
> > all other traffic until the portal instructs the NAS 
> otherwise.  This 
> > needs to be done either during an Access Accept or 
> mid-session using 
> > COA.
> 
> Does it have to be http specific? You could set Framed-Route 
> and then do Re-Authz when the routing changes. But 
> Framed-Route is not specific to a protocol or port.
> 
> --Jari
>

---

From: Jari Arkko <[email-masked]>
Date: Thu, 18 Dec 2003 10:23:11 +0200

> B) We would have the flexibility to decide whether to route all traffic or

Perhaps.

Are the redirection schemes used for payment? I.e. I need to log in to the
web page before I can continue? Or for something else?

There is a difference because if its used for payment, redirecting
just some protocols may leave a hole to the protocols. For instance,
I have sometimes succeeded in doing all my e-mail over SSH even if
there was some http-directing thing that prevented all web traffic.

--Jari