Subject: Re: (radius) WG LAST CALL on L2TP RADIUS Drafts

From: Dave Mitton <[email-masked]>
Date: Fri, 15 Jan 1999 15:59:26 -0500

(Harald; meant to send this to the list not just you)

At 02:03 PM 1/15/99 +0100, you wrote:
>I'll reiterate what I told Glen in private mail:
>
>A worry has been expressed to me that this set of drafts describe how to
>set up a tunnel between a corporate firewall and a NAS box.
>This would make the NAS box part of the trust boundary of the corporation,
>and expose the NAS box operator to heavy liability and operational problems.
>

	I have problems with this concern.  RADIUS makes the NAS a trust boundary
as it is.
What makes this any different?   This sort of strengthens the current house
of cards, or it's just more of the same.  What's the real problem here?  Is
someone is just waking up, or thinks they have a charter monopoly on
solutions?

I'm having real reality check problems here.

	Dave.

>Some possible responses:
>
>- The protocol does not require the endpoints of a tunnel to be in any
>  particular place. The tunnel endpoint could be at the connected system,
>  where it ought to be.
>
>  Counter: How would the NAS box tell the connected system to set up a
>           tunnel, if there is no such function in its connection protocol?
>           Anyway, if that's a recommended mode, it should be documented.
>
>- Tunnels aren't just for security. There might be other reasons to tunnel.
>  
>  Counter: But if you use tunnels for security, you should be warned that
>           you can't use this feature.
>
>I certainly don't understand this protocol well enough to see what's
possible,
>what's reasonable and what's obvious.
>
>But I know that I didn't feel like I understood the problem and the Right
>Way to solve it after reading the documents.
>
>And that I don't like.
>
>                         Harald A
>
>-- 
>Harald Tveit Alvestrand, Maxware, Norway
>[email-masked]
>
>-
>To unsubscribe, email [email-masked]' with
>'unsubscribe ietf-radius' in the body of the message.
>
>
---------------------------------------------------------------
David Mitton			  978-670-8888 Main, [ESN: 248-4570]
Consulting Engineer, Nortel Networks	978-916-4570 Direct
Carrier Packet Networks, I&SP Netwks	978-916-4789 FAX
Billerica, MA 01821				[email-masked]
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Mike O'Dell" <[email-masked]>
Date: Fri, 15 Jan 1999 16:44:14 -0500

handling crypto involves the exchange of bodily fluids

a NAS doing crypto tunnels for multiple clients simultaneously
raises the stakes exponentially, not to mention 
"creating an attractive nuisance"

so as a manufacturer of NAS equipment, is Bay prepared to
assume the liability in the ensuing lawsuit (eg, indemnify
the ISP using your hardware) when SEC-critical financial
information (being carried because - "it's safe - it's
encrypted!") from company A is disclosed to company B???

	-mo
-

---

From: Dave Mitton <[email-masked]>
Date: Fri, 15 Jan 1999 17:11:17 -0500

This argument silly.

a) Bay already supports the setup of L2TP tunnels (and BayDVS) using RADIUS.
However no "crypto" or bodily fluids are involved.
Because L2TP itself, last I looked at it, is not secure and does not
require those things.  At the moment, (and probably never will with this
product) we do not support IPsec.

A major ISP is using this technology today and outsourcing our corporate
network national access with it.  (well, actually they don't use RADIUS
because they're still heavily into our old ACP protocol, but they could)

b) Your second argument is incorrect, because we don't make those
representations.
Since it's not "secure", perhaps you are failing to see it's usefullness
for other features.

Level 3 tunnelling is very useful in solving IP address allocation and
partioning issues.  Other customers are using tunneling as a POP or access
outsourcing facility.  There is not much IPsec in practice yet.

	Dave.