Re: NAS/RAS-->RADIUS

Rajesh wrote:

> Hi all,
> I am pretty aware of Proxy RADIUS setup in kannle gateway.
> But my doubt is if we need to say only these NAS /RAS servers should requests to Proxy or RADIUS servers where can we specify that .
> For example my requirement is only allow particular I.P 's to send RADIUS packets to Proxy /RADIUS servers, where i have to mention that???.
> I feel it is bit related to NAS/RAS routing to RADIUS servers.
> Can any body give me thought on this ???

now, as far as I understand you, it's about restructing access to Kannel's 
RADIUS proxy, right?

The NAS/RAS sends UDP datagrams to Kannel's wapbox instance and Kannel forwards 
them (if desired) to the RADIUS server.

Actually we "could" define which IPs are allowed to inject RADIUS PDUs to 
wapbox, but that does not make sense to me, since you have already 2 security 
options to use:

   a) the iptables/firewall rules: simply allow only the NAS/RAS source IPs to 
reach the UDP port of Kannel's RADIUS proxy.

   b) even while someone within the physical network, which is able to reach 
your Kannel wapbox via UDP datagrams, he/she (as a foo) would not know the 
MD5-secret that is used to authenticate the RADIUS acct PDUs.

So b) is actually the most basic mechanism, but does not prevent from DOS 
attacking. a) and b) in combination, including an additional item c) network 
architecutre layout are the state-of-the-art way to approach for this.

Stipe

mailto:stolj_{at}_wapme-group.de
-------------------------------------------------------------------
Wapme Systems AG

Vogelsanger Weg 80
40470 Düsseldorf, NRW, Germany

phone: +49.211.74845.0
fax: +49.211.74845.299

mailto:info_{at}_wapme-systems.de
http://www.wapme-systems.de/
-------------------------------------------------------------------