Subject: How to avoid getting "inappropriate" RADIUS attributes?

From: [email-masked]
Date: Fri, 10 Nov 2000 11:42:05 -0500

Sometimes you want the RADIUS server to return an attribute such as the 
Framed-IP-Address attribute. And sometimes you do not. 

For example, a PPP NAS sends an access-request for a previously 
unauthenticated link, it makes sense for the RADIUS server to return an IP 
address in an access-accept response.

However, if the NAS is doing a CHAP rechallenge for the link of an already 
authenticated/established PPP session, you certainly do not want the 
RADIUS server to attempt to allocate another IP address and return it to 
NAS in the access-accept.  The IP address has already been negotiated and 
you wouldn't change it.

Another situation where the correct behavior is not clear to me is when 
RADIUS is used with the multilink protocol (MP). As an example, suppose 
link A and link B are part of the same MP bundle. This implies that the 
same user name was used to authenticate both links. My naive expectation 
is that if RADIUS returned the IP address attribute, it should return the 
same IP address for both links. But it does not seem to work this way.

What is the commonly accepted way for a NAS to let the RADIUS server know 
it does not want an attribute? Or at least to ensure it does not get a 
different value for that attribute? Is including the attribute in the 
access-request sufficient? Is so, how would this work when using MP?

-john martz, 8-852-5539,  [email-masked]
IBM AS/400 TCP/IP PPP development (and stuff)