Subject: (radius) Class.

From: Nayani Srikanth <[email-masked]>
Date: Mon, 18 Jan 1999 11:16:18 +0500

Sir/Madam,
       I have three qualms.

1) Does class denote the radius server's location so that the accounting
requests go to the same server which sent the access -accept.

2) Also does the Accounting -session -ID atttribute denote the ID of the
the accounting request sent to a particular server. i.e will the
combination of class and Accounting - session -ID uniquely identify an
accounting  - request. Or is it that the accounting-session-ID should be
universally unique. 

3) In the event of a Radius server going down after Accounting - Start has
been serviced what is the action taken by the Radius client on receiving a
corresponding accounting -stop.

Thanks in advance ,
 Srikanth.
***********************************************************
 Bridging the hiatus intervening hardware and software 
 SRIKANTH NAYANI,           VOICE: 91 - 40 - 774 2606
 RENDEZVOUS ON CHIP,        EMAIL: [email-masked]
 1st Floor, PLOT#14,
 KARKHANA, SECUNDERABAD-9.
***********************************************************

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: Aydin Edguer <[email-masked]>
Date: Mon, 18 Jan 1999 14:19:34 -0500 (EST)

>    requests go to the same server which sent the access -accept.

No, Class has nothing to do with location.  Class is a convenient method
for allowing the RADIUS server to add an attribute that will allow it or
other services to track responses.

This means that Class has actually been used for multiple conflicting
goals.

Example #1 - Class can be used to categorize users and allow summaries
of usage on a Class basis by a RADIUS accounting server, without having
to have access to a database to link a username and a class.

Example #2 - Class can be used to add a non-guessable unique value to
accounting responses to help minimize the risk of additional fraudulent 
billing records.  It does not eliminate the risk, and the originating
NAS can still change the time of records, but it is more difficult to
generate additional session records.

These two uses are conflicting and really depends upon the environment
and the RADIUS server.

> accounting  - request. Or is it that the accounting-session-ID should be

No, the Acct-Session-Id has nothing to do with the server.  In fact,
the NAS must guarantee that the Start and Stop records MUST have the
same Acct-Session-Id whether the Accounting-Request is sent to the
same RADIUS server or not.

It is purely NAS based.  Read the RADIUS accounting document (RFC 2139).
The guarantee is that the NAS will not re-use the Acct-Session-Id.  There
are no guarantees that the same Acct-Session-Id will not be used by
different NASes.

> corresponding accounting -stop.

Huh?  A RADIUS client will not *receive* an Accounting Stop message.
A RADIUS client (NAS) will *generate* an Accounting Stop message.
If the RADIUS server goes down then the NAS (RADIUS client) will either
continue to resend until the RADIUS server comes back up OR it will
try to send to a different RADIUS server.

-

---

From: "Dale E. Reed Jr." <[email-masked]>
Date: Mon, 18 Jan 1999 11:31:36 -0800

> requests go to the same server which sent the access -accept.

The RADIUS client SHOULD NOT interpret the class.  It must just send
it back unmodified.  Therefore, the client can not act upon it as
you are requesting.

> accounting  - request. Or is it that the accounting-session-ID should be

The NAS-Identifier and Acct-Session-ID uniquely identify a session.
 
> corresponding accounting -stop.

This is not defined, althogh a client could use an Accounting-On request
to signal that it has been restarted.  Some NASes send an all zero
Acct-Session-ID to signal they were rebooted.

-- 
Dale E. Reed Jr.  ([email-masked])
_________________________________________________________________
       IEA Software, Inc.      |  RadiusNT, Emerald, and NT FAQs
 Internet Solutions for Today  |   http://www.iea-software.com
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.