Subject: RE: [Isms] RE: Network management authorization

From: "Martin Soukup" <[email-masked]>
Date: Tue, 18 Jan 2005 09:25:22 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Joseph Salowey
> 
> With EUSM we selected using EAP because of the integration possibilities
> with back end AAA authentication mechanisms.
> 
> We had envisioned two modes of operation:
> 
> 1. When the SNMP Manager/Client is aware of the location of the AAA server
> then it can establish keys with AAA server using RADIUS which then can
> cache
> them and localize them for each agent as needed.  Here EAP is encapsulated
> in RADIUS.
> 
> 2. When the SNMP Manager/Client is not aware of the AAA or there is no AAA
> server then the key negotiation would initiate between the SNMP
> Manage/Client and SNMP Agent and would be proxied to AAA over RADIUS if
> applicable.  We did not encapsulate EAP in SNMP since this would be a big
> change to the SNMP protocol but instead choose to encapsulate it in an out
> of band protocol to leverage existing work.  The protocols we had in mind
> were existing protocols that carry EAP such as PANA/NACP(EAP over UDP) or
> IKEv2, but other arrangements are possible.
> 
> The second mode allows for operation without AAA.

So then the Manager (separately from "SNMP") acts as the AAA server when an
external/remote AAA server is unavailable or not configured? I think this is
a nice solution. I like the idea of supporting USM as-is and providing
something in addition to support AAA.

Martin.
_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Tue, 18 Jan 2005 09:42:28 -0500

So, you're suggesting having the entity to-be-authenticated serve as
the AAA-server when the regular AAA server is not accessible?
Isn't that like asking the fox to authenticate/authorize itself to the
henhouse when the farmer's not available?
 
dbh

  _____  

From: Martin Soukup [mailto:[email-masked]] 
Sent: Tuesday, January 18, 2005 9:25 AM
To: 'Joseph Salowey'; 'Bernard Aboba'; [email-masked]
Cc: [email-masked]
Subject: RE: [Isms] RE: Network management authorization

> The second mode allows for operation without AAA. 

So then the Manager (separately from "SNMP") acts as the AAA server
when an external/remote AAA server is unavailable or not configured? I
think this is a nice solution. I like the idea of supporting USM as-is
and providing something in addition to support AAA.

Martin.

---

From: Kaushik Narayan <[email-masked]>
Date: Tue, 18 Jan 2005 11:11:59 -0800

Hi Martin,

I would like to clarify that it would be the agent and not the manager
that would act as a AAA server in cases there isn't an external AAA
server present.This would typically used in cases of fallback wherein
connectivity to a AAA server is lost and also in cases where the agent
is capable of authentication via local credentials as in the case with
X.509 certificates using EAP-TLS.

regards,
   kaushik!

At 06:25 AM 1/18/2005, Martin Soukup wrote:

> > From: [email-masked] 
> [<mailto:[email-masked]>mailto:[email-masked]] On
> > Behalf Of Joseph Salowey
> >
>So then the Manager (separately from "SNMP") acts as the AAA server when 
>an external/remote AAA server is unavailable or not configured? I think 
>this is a nice solution. I like the idea of supporting USM as-is and 
>providing something in addition to support AAA.
>
>Martin.