IP Security Protocol Working Group (IPSEC) T. Kivinen
INTERNET-DRAFT 2 April 2003
draft-ietf-ipsec-dhcp-over-ike-radius-00.txt
Expires: 2 October 2003
Using RADIUS backend for DHCP over IKE
Status of This Memo
This document is a submission to the IETF IP Security Protocol
(IPSEC) Working Group. Comments are solicited and should be
addressed to the working group mailing list (ipsec@lists.tislabs.com)
or to the editor.
This document is an Internet-Draft and is in full conformance
with all provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF), its areas, and its working groups. Note that
other groups may also distribute working documents as
Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other
documents at any time. It is inappropriate to use Internet-
Drafts as reference material or to cite them other than as
"work in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html.
Abstract
This document describes method of using Remote Authentication Dial In
User Service (RADIUS) as a backend for the internet key exchange (IKE)
version 2 host configuration protocol.
T. Kivinen [page 1]
INTERNET-DRAFT 2 April 2003
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Using RADIUS backend . . . . . . . . . . . . . . . . . . . . . . 2
3. Mapping of DHCP options to RADIUS request attributes . . . . . . 2
4. Mapping of RADIUS attributes to DHCP options . . . . . . . . . . 3
5. Security Considerations . . . . . . . . . . . . . . . . . . . . 3
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 3
7. Normative References . . . . . . . . . . . . . . . . . . . . . . 3
8. Non-Normative References . . . . . . . . . . . . . . . . . . . . 4
9. Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 4
1. Introduction
The IKEv2 [IKEV2] offers way to put DHCP [RFC2131] packets inside the
IKE packet exchange to do the host configuration for the remote access
clients. This protocol describes how to use existing RADIUS [RFC2865]
server to get the configuration data needed for the IKEv2 host
configuration protocol.
2. Using RADIUS backend
The security gateway using the RADIUS as backend for the configuration,
is acting as a protocol converted between DHCP and RADIUS. This can also
be seen as if there is minimalistic DHCP server in the security gateway,
and that DHCP server is then using the RADIUS server to get the actual
IP address. This DCHP server is then also responsible to remembering the
configuration given to client, in case client decides to request it
again later (i.e when client does RENEW or REBIND).
If the client sent DHCP(DISCOVER) to the security gateway, then the
security gateway MUST send the DHCP(OFFER) back with the configuration
parameters found from the RADIUS attributes. The client will then reply
to that with DHCP(REQUEST). The security gateway MUST then check that
the paremeters are valid compared to the configuration parameters
received earlier from the RADIUS and if so sent back DHCP(ACK). Note
that security gateway MUST NOT leave out the DHCP(OFFER) packet, i.e it
MUST NOT reply to DHCP(DISCOVER) with DHCP(ACK) even when there would
not be anything for the client to do with DHCP(OFFER). This would be
against the DHCP protocol.
The client may also start directly with DHCP(REQUEST), in which case
security security gateway simply verifies that the parameters are valid
(if there are no parameters inside then they are valid, and server can
reply back immediately with full set of parameters) and replies with
DHCP(ACK) with final configuration parameters. If the DHCP(REQUEST)
parameters are not valid, the security gateway MUST reply with DHCP(NAK)
which will cause the client to start again with DHCP(DISCOVER) payload.
3. Mapping of DHCP options to RADIUS request attributes
T. Kivinen [page 2]
INTERNET-DRAFT 2 April 2003
The mapping of the DHCP options in the DHCPDISCOVER or DHCPREQUST
payload to the RADIUS attributes is following:
DHCP option RADIUS attribute
----------- ----------------
Requested IP address (50) Framed-IP-Address (8)
Subnet Mask (1) Framed-IP-Netmask (9)
Domain Name Server (6) VendorID [ID#], VSA [#]
Hostname (12) VendorID [ID#], VSA [#]
NetBIOS Name Servers (44) VendorID [ID#], VSA [#]
IP Address Lease Time (51) Session-Timeout (27) or
VendorID [ID#], VSA [#]
The RADIUS server may also support other DHCP options by using vendor
specific attributes.
4. Mapping of RADIUS attributes to DHCP options
The mapping of the RADIUS attributes to DHCP options in the DHCPOFFER or
DHCPACK payload is following:
RADIUS attribute DHCP field
----------- ----------------
Framed-IP-Address (8) yiaddr
Framed-IP-Netmask (9) Subnet Mask Option (1)
VendorID [ID#], VSA [#] Domain Name Server Option (6)
VendorID [ID#], VSA [#] Hostname Option (12)
VendorID [ID#], VSA [#] NetBIOS Name Servers Option (44)
Session-Timeout (27) or IP Address Lease Time (51)
VendorID [ID#], VSA [#]
The RADIUS server may also support other DHCP options by using vendor
specific attributes.
The actual values for the Vendor ID and VSA (vendor specific attribute)
depends on the RADIUS server vendor.
5. Security Considerations
The connection between security gateway and RADIUS server migth be
vulnerable to different kind of attacks, and that connection should be
protected using IPsec or some other means.
6. IANA Considerations
This document does not have any actions for IANA.
7. Normative References
[IKEV2]
Kaufman C., "Internet Key Exchange (IKEv2) Protocol", draft-ietf-
ipsec-ikev2-05.txt, February 2003
T. Kivinen [page 3]
INTERNET-DRAFT 2 April 2003
[RFC2131]
Droms R., "Dynamic Host Configuration Protocol", March 1997
[RFC2865]
Rigney, C., S. Willens, A. Rubens, and Simpson W., "Remote
Authentication Dial In User Service (RADIUS)", June 2000.
8. Non-Normative References
9. Authors' Addresses
Tero Kivinen
SSH Communications Security Corp
Fredrikinkatu 42
FIN-00100 HELSINKI
Finland
E-mail: kivinen@ssh.fi
T. Kivinen [page 4]
--
kivinen@ssh.fi
SSH Communications Security http://www.ssh.fi/
SSH IPSEC Toolkit http://www.ssh.fi/ipsec/
