Subject: Re: (radius) L2TP attributes

From: Aydin Edguer <[email-masked]>
Date: Tue, 6 Apr 1999 17:22:41 -0400 (EDT)

> I know we have radius attribute "Tunnel-Password" for "outgoing tunnel
> password", do we have corresponding attributes for "tunnel shared secret"
> and "incoming tunnel password" ?

In my opinion...

I cannot come up with a scenario in L2TP where you would need both an
incoming and an outgoing tunnel password in the same user profile.

In L2TP, the "outgoing tunnel password" (on the LAC) must be the same as
the "incoming tunnel password" (on the LNS), because they are used as the
"tunnel shared secret".

Even if the "outgoing tunnel password" and the "incoming tunnel password"
were different, in RADIUS, the user profiles for (a) a user connecting to
the the LAC/NAS [that would require the "outgoing tunnel password" and
(b) the LAC which is trying to establish a tunnel to the LNS [that would
require an "incoming tunnel password"] will be different and thus the same
attribute, Tunnel-Password, can be used unambiguously for both purposes.

-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "Glen Zorn" <[email-masked]>
Date: Wed, 7 Apr 1999 13:23:57 -0700

> attribute, Tunnel-Password, can be used unambiguously for both purposes.

True, but the draft _does_ say "This Attribute may contain a password to be
used  to authenticate to a  remote server."  Perhaps it should be changed to
say "This Attribute may contain a password to be used  to  authenticate to
a  remote server or client."?

-