Subject: (radius) Class

From: Nayani Srikanth <[email-masked]>
Date: Wed, 13 Jan 1999 11:57:20 +0500

Sir/Madam,
      One of the radius attributes is Class(25) . This is a token that is
given by the Radius server when a Access-Request is accepted . It is
indicated (in Rfc 2138) that the same value should be sent to the Radius
server when sending a Accounting -Request packet.  

 I have two questions:

 1) Is the same Class used to match Accounting start and stop requests
    by the Radius server.

 2)How is this value differnt from Accounting-Session-ID attribue(44).

Thanks in advance,
Srikanth.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Dale E. Reed Jr." <[email-masked]>
Date: Wed, 13 Jan 1999 18:50:05 -0800

>  1) Is the same Class used to match Accounting start and stop requests

It could be, but you should use the Acct-Session-ID to match them (see
below).
 
>  2)How is this value differnt from Accounting-Session-ID attribue(44).

Its created by the RADIUS SERVER, not the RADIUS client.  For example,
the authenticating server may NOT be the accounting server, in which
case it might not be that useful.  However, it can allow for 
sophisticated tranaction management.

We've been looking at this heavily, but I am curious as to what
clients DO support the class and state attributes?

-- 
Dale E. Reed Jr.  ([email-masked])
_________________________________________________________________
       IEA Software, Inc.      |  RadiusNT, Emerald, and NT FAQs
 Internet Solutions for Today  |   http://www.iea-software.com
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Thomas Kinnen <[email-masked]>
Date: Wed, 13 Jan 1999 20:13:53 -0800

> clients DO support the class and state attributes?

The Portmasters with ComOS 3.8 or better support the Class attribute  We make
use if it with Radius ABM.

----
Thomas C Kinnen - <[email-masked]> <[email-masked]>
"All of the opinions stated above are my own and not my employer's,
unless they were given to me by my employer"
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Nayani Srikanth <[email-masked]>
Date: Thu, 14 Jan 1999 12:02:57 +0500

Sir/Madam,
        I have extensions to my previous qualms. 

  1) Is it essential for the accounting request to go to the same 
     radius server which has given a access-accept ?

  2) If so how will the Radius client keep track of the server which 
     gave the access-accept and insist on response for accounting -
     request from the same radius server.  In such a scenario what 
     are the roles played by Class attribute(25) and Accounting 
     session ID attribute.

Thanks in advance, 
Srikanth.    

-

---

From: Dave Mitton <[email-masked]>
Date: Thu, 14 Jan 1999 09:52:54 -0500

>     radius server which has given a access-accept ?

	Not by the protocol/RFC, But it may be an essential operational
requirement because of the benefits that you may derive from from that.
	Several RADIUS servers use the combination of authentication information
and accounting messages to attempt to track the real time status of the
NASes, and do resource managmement.
For example our BaySecure Access Control (BSAC) server (Funk SBR) has this
requirement.

	If you do not choose to meet that requirement, you simply don't get the
feature.

>     are the roles played by Class attribute(25) and Accounting 

	Most RADIUS clients are real dumb and only talk to one RADIUS server most
of the time.  The transferance of state in the case of failover is another
RADIUS black art.
I'm not aware of a client that is not this simply deterministic (but I
publicly make these kinds of statements to draw out evidence to the contrary.)

If you are working with some sort of distributed database, then you will
have to tie your RADIUS servers in on the game.

	Dave.
>'unsubscribe ietf-radius' in the body of the message.
---------------------------------------------------------------
David Mitton			  978-670-8888 Main, [ESN: 248-4570]
Consulting Engineer, Nortel Networks	978-916-4570 Direct
Carrier Packet Networks, I&SP Netwks	978-916-4789 FAX
Billerica, MA 01821				[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: MARC DE VRIES WE41/KT <[email-masked]>
Date: Thu, 14 Jan 1999 17:05:46 +0200 (MET-DST)

There has been discussion on this mailing list before about the use of Class
and Acct-Session-Id. I will attempt to summarise (a and b).

a) The Class attribute is given a value by the RADIUS authentication server.
This value MUST be given to the RADIUS accounting server by the NAS.

Typical uses are:
 - the authentication server passes additional info to the accounting server
(NAS is transparent)
 - used to link Access-Requests to Accounting-Requests (keeping session state
in the RADIUS (proxy) server for e.g. resource management)
 - as a grouping criterium when generating statistics (SNMP)
 - used to send class-based state info from NAS to RADIUS server (proprietary)

b) The Acct-Session-Id attribute is given a value by the NAS, and MUST be sent
in Accounting-Requests. Some NASses also send the Acct-Session-Id in
Access-Requests.

If also sent in Access-Request, typical uses are:
 - used to link Access-Requests to Accounting-Requests (keeping session state
in the RADIUS (proxy) server for e.g. resource management)

In my opinion, Acct-Session-Id should be sent in Access-Requests to allow a
proxy server to keep session state, while the Class atrribute can still be used
for grouping sessions and producing class-based statistics. 

If session state is to be maintained (either by Class or Session-Id), the
authentication and accounting server will need to be able to synchronise. They
can be the same server, but this is not required. The NAS should not be
required to send the Accounting-Request to the server which sent the
Access-Accept, and I have not seen any NAS do that yet.

I hope this answers the questions.

Regards,

Marc.

[previous text snipped a bit]

-