Re: call for discussion on draft-heinanen-radius-pe-discovery-03.txt

>I'm no radius expert, but I think  what Bernard Aboba is objecting to is
>the proposed procedure by  which PEs seem to register  and unregister
>themselves dynamically in RADIUS  as supporters of a particular  VPN
>instance.  This is what he means by "service discovery", I think.

>"Service discovery"  doesn't mean figuring out  what service to  ask for,
>it means finding, from  a dynamically changing list of  servers, the
>servers to connect to at some given time.

>I think that using RADIUS to get  a preconfigured list of PEs attaching
>to a given  VPN is  probably  unproblematic, but  trying  to use  it to
>maintain dynamically learned PE/VPN associations  is probably
>overextending it, as  it is something that RADIUS is not typically used
>for.

I think this is a reasonable statement of my concern.  RFC 2868 allows a
PE to obtain a preconfigured list of potential VPN endpoints
and associated configuration. However, the PE then needs to
choose between those potential endpoints, and can only bring them up and
down within the context of a session.

Now it is possible to do dynamic authorization and disconnection, as
specified in draft-chiba-radius-dynamic-authorization-20.txt. But this is
under the control of the RADIUS server, not the PE or CE.