Subject: [AAA-WG]: use of EAP over IKEv2

From: "David Mariblanca (ML/EEM)" <[email-masked]>
Date: Tue, 6 Apr 2004 11:23:20 +0200

Hi,
I have found a problem when EAP is used over IKEv2 and I would appreciate some help on the issue.
When EAP is carried over IKEv2, a common situation is that the host where EAP terminates is not the same as for IKEv2. In that case, the IKEv2 termination point unpacks the IKEv2 messages, take the EAP messages and forwards them to the EAP termination point over RADIUS or Diameter.
The problem I see is that the EAP server has no way to know that these EAP messages are being carried over IKEv2. This knowledge is important for the EAP server, for example to derive keys that will be used to generate AUTH payloads in IKEv2. 
The service type AVP does not have a reserved value for this, and I don't find any other suitable parameter to convey this information. How could this be done ?

Thanks a lot and best regards,
David.

---

From: Jari Arkko <[email-masked]>
Date: Tue, 06 Apr 2004 13:07:42 +0300

> The service type AVP does not have a reserved value for this, and I don't find any other suitable parameter to convey this information. How could this be done ?

I believe the keys should be the same regardless of
the which protocol (IKEv2/802.11/PPP) is being terminated.

However, it would be very useful if there was an attribute
that told the AAA server what service is being offered.
Looking at the RFC 2865 and draft-ietf-aaa-diameter-nasreq
values for Service-Type and Framed-Protocol, it is unclear
what values to fill in when using IKEv2. Has someone made
a suitable value allocation for these AVPs? Or should we use
some of the existing value? If so, which one and can that
be distinguished from e.g. 802.11 usage?

--Jari