Hi
On 30 Apr 2008, at 14:08, Alan DeKok wrote:
Artur Hecker wrote:
Yes, as I said, the dependency in that sense might make sense. We
did it
in a student project, and I rather see the problem at the network
side:
the EAP-Server and the DHCP server almost never reside at the same
machine
Really? They must be running bad software. :)
There's no reason that the EAP server && DHCP server can't be the
same
*binary*.
;-) Yes, right. Freeradius is very cool :-)
But the reason for this is the following. In the current best
practice, the EAP-Server must never be reachable for clients, while
the DHCP server *must* be reachable from client by definition. I.e.
only access controllers (part of your infrastructure) speak to the EAP-
Server, while your clients speak to the DHCP server.
That said, I agree with the underlying strategy. I would have loved to
see DHCP integrated with 802.1X from the very beginning. Actually, I
would have gone farther and rather proposed a virtual and generic
signaling protocol for the session opening, where a client can
negotiate all kinds of options with the network on all layers at the
same time. This can be easily done with TLV, etc. Then, a provisioning
server could not only open the access but also preprovision the client
with IP config, proxies to use, existing printers, available servers
(SMTP, shares, etc.) etc etc etc, even before it gets IP layer access.
That would have been very nice for an enterprise integration. But well.
and typically are in different (logical) subnetworks (VLANs,
etc.) Imo, no standard protocol exists designed to do such things.
There is interest.
Of course there is :-) But no protocol.
artur
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
