doc: Add RFC documents

1 files changed, 1123 insertions, 0 deletions

diff --git a/doc/rfc/rfc2881.txt b/doc/rfc/rfc2881.txt
new file mode 100644
index 0000000..b902cd3
--- /dev/null
+++ b/doc/rfc/rfc2881.txt
@@ -0,0 +1,1123 @@
+
+
+
+
+
+
+Network Working Group                                            D. Mitton
+Request for Comments: 2881                                 Nortel Networks
+Category: Informational                                         M. Beadles
+                                                           SmartPipes Inc.
+                                                                 July 2000
+
+
+     Network Access Server Requirements Next Generation (NASREQNG)
+                               NAS Model
+
+Status of this Memo
+
+   This memo provides information for the Internet community.  It does
+   not specify an Internet standard of any kind.  Distribution of this
+   memo is unlimited.
+
+Copyright Notice
+
+   Copyright (C) The Internet Society (2000).  All Rights Reserved.
+
+Abstract
+
+   This document describes the terminology and gives a model of typical
+   Network Access Server (NAS).  The purpose of this effort is to set
+   the reference space for describing and evaluating NAS service
+   protocols, such as RADIUS (RFCs 2865, 2866) [1], [2] and follow-on
+   efforts like AAA Working Group, and the Diameter protocol [3].  These
+   are protocols for carrying user service information for
+   authentication, authorization, accounting, and auditing, between a
+   Network Access Server which desires to authenticate its incoming
+   calls and a shared authentication server.
+
+Table of Contents
+
+   1. INTRODUCTION...................................................2
+    1.1 Scope of this Document ......................................2
+    1.2 Specific Terminology ........................................3
+   2. NETWORK ACCESS SYSTEM EQUIPMENT ASSUMPTIONS....................3
+   3. NAS SERVICES...................................................4
+   4. AUTHENTICATION, AUTHORIZATION AND ACCOUNTING (AAA) SERVERS.....5
+   5. TYPICAL NAS OPERATION SEQUENCE:................................5
+    5.1 Characteristics of Systems and Sessions: ....................6
+    5.2 Separation of NAS and AAA server functions ..................7
+    5.3 Network Management and Administrative features ..............7
+   6. AUTHENTICATION METHODS.........................................8
+   7. SESSION AUTHORIZATION INFORMATION..............................8
+   8. IP NETWORK INTERACTION.........................................9
+   9. A NAS MODEL...................................................10
+
+
+
+Mitton & Beadles             Informational                      [Page 1]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+    9.1 A Reference Model of a NAS .................................10
+    9.2 Terminology ................................................11
+    9.3 Analysis ...................................................13
+     9.3.1 Authentication and Security .............................13
+     9.3.2 Authorization and Policy ................................14
+     9.3.3 Accounting and Auditing .................................14
+     9.3.4 Resource Management .....................................14
+     9.3.5 Virtual Private Networks (VPN's) ........................14
+     9.3.6 Service Quality .........................................15
+     9.3.7 Roaming .................................................15
+   10. SECURITY CONSIDERATIONS......................................15
+   11. REFERENCES ..................................................16
+   12. ACKNOWLEDGMENTS..............................................17
+   13. AUTHORS' ADDRESSES ..........................................17
+   14. APPENDIX - ACRONYMS AND GLOSSARY:............................18
+   15. FULL COPYRIGHT STATEMENT.....................................20
+
+1. Introduction
+
+   A Network Access Server is the initial entry point to a network for
+   the majority of users of network services.  It is the first device in
+   the network to provide services to an end user, and acts as a gateway
+   for all further services.  As such, its importance to users and
+   service providers alike is paramount.  However, the concept of a
+   Network Access Server has grown up over the years without being
+   formally defined or analyzed [4].
+
+1.1 Scope of this Document
+
+   There are several tradeoffs taken in this document.  The purpose of
+   this document is to describe a model for evaluating NAS service
+   protocols.  It will give examples of typical NAS hardware and
+   software features, but these are not to be taken as hard limitations
+   of the model, but merely illustrative of the points of discussion.
+   An important goal of the model is to offer a framework that allows
+   further development and expansion of capabilities in NAS
+   implementation.
+
+   As with most IETF projects, the focus is on standardizing the
+   protocol interaction between the components of the system.  The
+   documents produced will not address the following areas:
+
+   - AAA server back-end implementation is abstracted and not
+     prescribed.  The actual organization of the data in the server, its
+     internal interfaces, and capabilities are left to the
+     implementation.
+
+
+
+
+
+Mitton & Beadles             Informational                      [Page 2]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   - NAS front-end call technology is not assumed to be static.
+     Alternate and new technology will be accommodated.  The resultant
+     protocol specifications must be flexible in design to allow for new
+     technologies and services to be added with minimal impact on
+     existing implementations.
+
+1.2 Specific Terminology
+
+   The following terms are used in this document in this manner:  A
+   "Call" - the initiation of a network service request to the NAS.
+   This can mean the arrival of a telephone call via a dial-in or
+   switched telephone network connection, or the creation of a tunnel to
+   a tunnel server which becomes a virtual NAS.  A "Session" - is the
+   NAS provided service to a specific authorized user entity.
+
+2. Network Access System Equipment Assumptions
+
+   A typical hardware-based NAS is implemented in a constrained system.
+   It is important that the NAS protocols don't assume unlimited
+   resources on the part of the platform.  The following are typical
+   constraints:
+
+   - A computer system of minimal to moderate performance
+     (example processors: Intel 386 or 486, Motorola 68000)
+   - A moderate amount, but not large RAM (typically varies with
+     supported # of ports 1MB to 8MB)
+   - Some small amount of non-volatile memory, and/or way to be
+     configured out-of-band
+   - No assumption of a local file system or disk storage
+
+   A NAS system may consist of a system of interconnected specialized
+   processor system units.  Typically they may be circuit boards (or
+   blades) that are arrayed in a card cage (or chassis) and referred to
+   by their position (i.e., slot number).  The bus interconnection
+   methods are typically proprietary and will not be addressed here.
+
+   A NAS is sometimes referred to as a Remote Access Server (RAS) as it
+   typically allows remote access to a network.  However, a more general
+   picture is that of an "Edge Server", where the NAS sits on the edge
+   of an IP network of some type, and allows dynamic access to it.
+
+   Such systems typically have;
+
+   - At least one LAN or high performance network interface (e.g.,
+     Ethernet, ATM, FR)
+
+
+
+
+
+
+Mitton & Beadles             Informational                      [Page 3]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   - At least one, but typically many, serial interface ports, which
+     could be;
+     -  serial RS232 ports direct wired or wired to a modem, or
+     -  have integral hardware or software modems (V.22bis,V.32, V.34,
+        X2, Kflex, V.90, etc.)
+     -  have direct connections to telephone network digital WAN lines
+        (ISDN, T1, T3, NFAS, or SS7)
+     -  an aggregation of xDSL connections or PPPoe sessions [5].
+
+   However, systems may perform some of the functions of a NAS, but not
+   have these kinds of hardware characteristics.  An example would be a
+   industry personal computer server system, that has several modem line
+   connections.  These lines will be managed like a dedicated NAS, but
+   the system itself is a general file server.  Likewise, with the
+   development of tunneling protocols (L2F [6], ATMP [7], L2TP [8]),
+   tunnel server systems must behave like a "virtual" NAS, where the
+   calls come from the network tunneled sessions and not hardware ports
+   ([11], [9], [10]).
+
+3. NAS Services
+
+   The core of what a NAS provides, are dynamic network services.  What
+   distinguishes a NAS from a typical routing system, is that these
+   services are provided on a per-user basis, based on an authentication
+   and the service is accounted for.  This accounting may lead to
+   policies and controls to limit appropriate usage to levels based on
+   the availability of network bandwidth, or service agreements between
+   the user and the provider.
+
+   Typical services include:
+
+   - dial-up or direct access serial line access; Ability to access the
+     network using a the public telephone network.
+   - network access (SLIP, PPP, IPX, NETBEUI, ARAP); The NAS allows the
+     caller to access the network directly.
+   - asynchronous terminal services (Telnet, Rlogin, LAT, others); The
+     NAS implements the network protocol on behalf of the caller, and
+     presents a terminal interface.
+   - dial-out connections; Ability to cause the NAS to initiate a
+     connection over the public telephone network, typically based on the
+     arrival of traffic to a specific network system.
+   - callback (NAS generates call to caller); Ability to cause the NAS to
+     reverse or initiate a network connection based on the arrival of a
+     dial-in call.
+   - tunneling (from access connection to remote server); The NAS
+     transports the callers network packets over a network to a remote
+     server using an encapsulation protocol. (L2TP [8], RADIUS support
+     [11])
+
+
+
+Mitton & Beadles             Informational                      [Page 4]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+4. Authentication, Authorization and Accounting (AAA) Servers
+
+   Because of the need to authenticate and account, and for practical
+   reasons of implementation, NAS systems have come to depend on
+   external server systems to implement authentication databases and
+   accounting recording.
+
+   By separating these functions from the NAS equipment, they can be
+   implemented in general purpose computer systems, that may provide
+   better suited long term storage media, and more sophisticated
+   database software infrastructures.  Not to mention that a centralized
+   server can allow the coordinated administration of many NAS systems
+   as appropriate (for example a single server may service an entire POP
+   consisting of multiple NAS systems).
+
+   For ease of management, there is a strong desire to piggyback NAS
+   authentication information with other authentication databases, so
+   that authentication information can be managed for several services
+   (such as OS shell login, or Web Server access) from the same
+   provider, without creating separate passwords and accounts for the
+   user.
+
+   Session activity information is stored and processed to produce
+   accounting usage records.  This is typically done with a long term
+   (nightly, weekly or monthly) batch type process.
+
+   However, as network operations grow in sophistication, there are
+   requirements to provide real-time monitoring of port and user status,
+   so that the state information can be used to implement policy
+   decisions, monitor user trends, and the ability to possibly terminate
+   access for administrative reasons.  Typically only the NAS knows the
+   true dynamic state of a session.
+
+5. Typical NAS Operation Sequence:
+
+   The following details a typical NAS operational sequence:
+
+      - Call arrival on port or network
+        -  Port:
+           - auto-detect (or not) type of call
+           - CLI/SLIP: prompt for username and password (if security
+             set)
+           - PPP: engage LCP, Authentication
+           - Request authentication from AAA server
+           - if okay, proceed to service
+           - may challenge
+           - may ask for password change/update
+
+
+
+
+Mitton & Beadles             Informational                      [Page 5]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+        -  Network:
+           - activate internal protocol server (telnet, ftp)
+           - engage protocol's authentication technique
+           - confirm authentication information with AAA server
+
+      - Call Management Services
+        -  Information from the telephone system or gateway controller
+           arrives indicating that a call has been received
+        -  The AAA server is consulted using the information supplied by
+           the telephone system (typically Called or Calling number
+           information)
+        -  The server indicates whether to respond to the call by
+           answering it, or by returning a busy to the caller.
+        -  The server may also need to allocate a port to receive a
+           call, and route it accordingly.
+
+      - Dial-out
+        -  packet destination matches outbound route pre-configured
+        -  find profile information to setup call
+        -  Request information from AAA server for call details
+
+      - VPN/Tunneling (compulsory)
+        -  authentication server identifies user as remote
+        -  tunnel protocol is invoked to a remote server
+        -  authentication information may be forwarded to remote AAA
+           server
+        -  if successful, the local link is given a remote identity
+
+      - Multi-link aggregation
+        -  after a new call is authenticated by the AAA server, if MP
+           options are present, then other bundles with the same
+           identifying information is searched for
+        -  bundle searches are performed across multiple systems
+        -  join calls that match authentication and originator
+           identities as one network addressable data source with a
+           single network IP address
+
+      - Hardwired (non-interactive) services
+        -  permanent WAN connections (Frame Relay or PSVCs)
+        -  permanent serial connections (printers)
+
+5.1 Characteristics of Systems and Sessions:
+
+   Sessions must have a user identifier and authenticator to complete
+   the authentication process. Accounting starts from time of call or
+   service, though finer details are allowed. At the end of service, the
+   call may be disconnected or allow re-authentication for additional
+   services.
+
+
+
+Mitton & Beadles             Informational                      [Page 6]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   Some systems allow decisions on call handling to be made based on
+   telephone system information provided before the call is answered
+   (e.g., caller id or destination number). In such systems, calls may
+   be busied-out or non-answered if system resources are not ready or
+   available.
+
+   Authorization to run services are supplied and applied after
+   authentication. A NAS may abort call if session authorization
+   information disagrees with call characteristics. Some system
+   resources may be controlled by server driven policies
+
+   Accounting messages are sent to the accounting server when service
+   begins, and ends, and possibly periodically during service delivery.
+   Accounting is not necessarily a real-time service, the NAS may be
+   queue and batch send event records.
+
+5.2 Separation of NAS and AAA server functions
+
+   As a distributed system, there is a separation of roles between the
+   NAS and the Server:
+
+     - Server provides authentication services; checks passwords
+       (static or dynamic)
+     - Server databases may be organized in any way (only protocol
+       specified)
+     - Server may use external systems to authenticate (including OS
+       user databases, token cards, one-time-lists, proxy or other
+       means)
+     - Server provides authorization information to NAS
+     - The process of providing a service may lead to requests for
+       additional information
+     - Service authorization may require real-time enforcement
+       (services may be based on Time of Day, or variable cost
+       debits)
+     - Session accounting information is tallied by the NAS and
+       reported to server
+
+5.3 Network Management and Administrative features
+
+   The NAS system is presumed to have a method of configuration that
+   allows it to know it's identity and network parameters at boot time.
+   Likewise, this configuration information is typically managed using
+   the standard management protocols (e.g., SNMP).  This would include
+   the configuration of the parameters necessary to contact the AAA
+   server itself.  The purpose of the AAA server is not to provide
+   network management for the NAS, but to authorize and characterize the
+   individual services for the users.  Therefore any feature that can be
+   user specific is open to supply from the AAA server.
+
+
+
+Mitton & Beadles             Informational                      [Page 7]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   The system may have other operational services that are used to run
+   and control the NAS.  Some users that have _Administrative_
+   privileges may have access to system configuration tools, or services
+   that affect the operation and configuration of the system (e.g.,
+   loading boot images, internal file system access, etc..)  Access to
+   these facilities may also be authenticated by the AAA server
+   (provided it is configured and reachable!) and levels of access
+   authorization may be provided.
+
+6. Authentication Methods
+
+   A NAS system typically supports a number of authentication systems.
+   For async terminal users, these may be a simple as a prompt and
+   input.  For network datalink users, such as PPP, several different
+   authentication methods will be supported (PAP, CHAP [12], MS-CHAP
+   [13]).  Some of these may actually be protocols in and of themselves
+   (EAP [14] [15], and Kerberos).
+
+   Additionally, the content of the authentication exchanges may not be
+   straightforward.  Hard token cards, such as the Safeword and SecurId,
+   systems may generate one-time passphrases that must be validated
+   against a proprietary server.  In the case of multi-link support, it
+   may be necessary to remember a session token or certificate for the
+   later authentication of additional links.
+
+   In the cases of VPN and compulsory tunneling services, typically a
+   Network Access Identifier (RFC 2486 [16]) is presented by the user.
+   This NAI is parsed into a destination network identifier either by
+   the NAS or by the AAA server.  The authentication information will
+   typically not be validated locally, but by a AAA service at the
+   remote end of the tunnel service.
+
+7. Session Authorization Information
+
+   Once a user has been authenticated, there are a number of individual
+   bits of information that the network management may wish to configure
+   and authorize for the given user or class of users.
+
+   Typical examples include:
+
+        For async terminal users:
+
+        - banners
+        - custom prompts
+        - menus
+        - CLI macros - which could be used for: shortcuts, compound
+          commands, restrictive scripts
+
+
+
+
+Mitton & Beadles             Informational                      [Page 8]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+        For network users:
+
+        - addresses, and routes
+        - callback instructions
+        - packet and activity filters
+        - network server addresses
+        - host server addresses
+
+   Some services may require dynamic allocation of resources.
+   Information about the resources required may not be known during the
+   authentication phase, it may come up later. (e.g., IP Addresses for
+   multi-link bundles) It's also possible that the authorization will
+   change over the time of the session. To provide these there has to be
+   a division of responsibility between the NAS and the AAA server, or a
+   cooperation using a stateful service.
+
+   Such services include:
+
+        - IP Address management
+        - Concurrent login limitations
+        - Tunnel usage limitations
+        - Real-time account expirations
+        - Call management policies
+
+   In the process of resolving resource information, it may be required
+   that a certain level of service be supplied, and if not available,
+   the request refused, or corrective action taken.
+
+8. IP Network Interaction
+
+   As the NAS participates in the IP network, it interacts with the
+   routing mechanisms of the network itself.  These interactions may
+   also be controlled on a per-user/session basis.
+
+   For example, some input streams may be directed to specific hosts
+   other than the default gateway for the destination subnet.  In order
+   to control services within the network provider's infrastructure,
+   some types of packets may be discarded (filtered) before entering the
+   network.  These filters could be applied based on examination of
+   destination address and port number.  Anti-spoofing packet controls
+   may be applied to disallow traffic sourced from addresses other than
+   what was assigned to the port.
+
+   A NAS may also be an edge router system, and apply Quality of Service
+   (QoS) policies to the packets.  This makes it a QOS Policy
+   Enforcement Point [19], [17].  It may learn QOS and other network
+   policies for the user via the AAA service.
+
+
+
+
+Mitton & Beadles             Informational                      [Page 9]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+9. A NAS Model
+
+   So far we have looked at examples of things that NASes do.  The
+   following attempts to define a NAS model that captures the
+   fundamentals of NAS structure to better categorize how it interacts
+   with other network components.
+
+   A Network Access Server is a device which sits on the edge of a
+   network, and provides access to services on that network in a
+   controlled fashion, based on the identity of the user of the network
+   services in question and on the policy of the provider of these
+   services.  For the purposes of this document, a Network Access Server
+   is defined primarily as a device which accepts multiple point-to-
+   point [18] links on one set of interfaces, providing access to a
+   routed network or networks on another set of interfaces.
+
+   Note that there are many things that a Network Access Server is not.
+   A NAS is not simply a router, although it will typically include
+   routing functionality in it's interface to the network.  A NAS is not
+   necessarily a dial access server, although dial access is one common
+   means of network access, and brings its own particular set of
+   requirements to NAS's.
+
+   A NAS is the first device in the IP network to provide services to an
+   end user, and acts as a gateway for all further services.  It is the
+   point at which users are authenticated, access policy is enforced,
+   network services are authorized, network usage is audited, and
+   resource consumption is tracked.  That is, a NAS often acts as the
+   policy enforcement point for network AAAA (authentication,
+   authorization, accounting, and auditing) services.  A NAS is
+   typically the first place in a network where security measures and
+   policy may be implemented.
+
+9.1 A Reference Model of a NAS
+
+   For reference in the following discussion, a diagram of a NAS, its
+   dependencies, and its interfaces is given below.  This diagram is
+   intended as an abstraction of a NAS as a reference model, and is not
+   intended to represent any particular NAS implementation.
+
+
+
+
+
+
+
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 10]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+                               Users
+                             v v v v v v v
+                             | | PSTN  | |
+                             | |  or   | |
+                             |encapsulated
+                          +-----------------+
+                          |    (Modems)     |
+                          +-----------------+
+                             | | | | | | |
+                   +--+----------------------------+
+                   |  |                            |
+                   |N |     Client Interface       |
+                   |  |                            |
+                   |A +----------Routing ----------+
+                   |  |                            |
+                   |S |    Network Interface       |
+                   |  |                            |
+                   +--+----------------------------+
+                           /      |     \
+                          /       |      \
+                         /        |       \
+                        /         |        \
+      POLICY MANAGEMENT/          |         \  DEVICE MANAGEMENT
+      +---------------+           |          +-------------------+
+      | Authentication|         _/^\_        |Device Provisioning|
+      +---------------+       _/     \_      +-------------------+
+      | Authorization |     _/         \_    |Device Monitoring  |
+      +---------------+   _/             \_  +-------------------+
+      | Accounting    |  /       The       \
+      +---------------+  \_   Network(s)  _/
+      | Auditing      |    \_           _/
+      +---------------+      \_       _/
+                               \_   _/
+                                 \_/
+
+9.2 Terminology
+
+   Following is a description of the modules and interfaces in the
+   reference model for a NAS given above:
+
+   Client Interfaces - A NAS has one or more client interfaces, which
+      provide the interface to the end users who are requesting network
+      access.  Users may connect to these client interfaces via modems
+      over a PSTN, or via tunnels over a data network.  Two broad
+      classes of NAS's may be defined, based on the nature of the
+      incoming client interfaces, as follows. Note that a single NAS
+      device may serve in both classes:
+
+
+
+
+Mitton & Beadles             Informational                     [Page 11]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   Dial Access Servers - A Dial Access Server is a NAS whose client
+      interfaces consist of modems, either local or remote, which are
+      attached to a PSTN.
+
+   Tunnel Servers - A Tunnel Server is a NAS whose client interfaces
+      consists of tunneling endpoints in a protocol such as L2TP
+
+   Network Interfaces - A NAS has one or more network interfaces, which
+      connect to the networks to which access is being granted.
+
+   Routing - If the network to which access is being granted is a routed
+      network, then a NAS will typically include routing functionality.
+
+   Policy Management Interface - A NAS provides an interface which
+      allows access to network services to be managed on a per-user
+      basis. This interface may be a configuration file, a graphical
+      user interface, an API, or a protocol such as RADIUS, Diameter, or
+      COPS [19].  This interface provides a mechanism for granular
+      resource management and policy enforcement.
+
+   Authentication - Authentication refers to the confirmation that a
+      user who is requesting services is a valid user of the network
+      services requested.  Authentication is accomplished via the
+      presentation of an identity and credentials.  Examples of types of
+      credentials are passwords, one-time tokens, digital certificates,
+      and phone numbers (calling/called).
+
+   Authorization - Authorization refers to the granting of specific
+      types of service (including "no service") to a user, based on
+      their authentication, what services they are requesting, and the
+      current system state.  Authorization may be based on restrictions,
+      for example time-of-day restrictions, or physical location
+      restrictions, or restrictions against multiple logins by the same
+      user.  Authorization determines the nature of the service which is
+      granted to a user.  Examples of types of service include, but are
+      not limited to: IP address filtering, address assignment, route
+      assignment, QoS/differential services, bandwidth control/traffic
+      management, compulsory tunneling to a specific endpoint, and
+      encryption.
+
+   Accounting - Accounting refers to the tracking of the consumption of
+      NAS resources by users. This information may be used for
+      management, planning, billing, or other purposes.  Real-time
+      accounting refers to accounting information that is delivered
+      concurrently with the consumption of the resources.  Batch
+      accounting refers to accounting information that is saved until it
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 12]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+      is delivered at a later time.  Typical information that is
+      gathered in accounting is the identity of the user, the nature of
+      the service delivered, when the service began, and when it ended.
+
+   Auditing - Auditing refers to the tracking of activity by users.  As
+      opposed to accounting, where the purpose is to track consumption
+      of resources, the purpose of auditing is to determine the nature
+      of a user's network activity.  Examples of auditing information
+      include the identity of the user, the nature of the services used,
+      what hosts were accessed when, what protocols were used, etc.
+
+   AAAA Server - An AAAA Server is a server or servers that provide
+      authentication, authorization, accounting, and auditing services.
+      These may be co-located with the NAS, or more typically, are
+      located on a separate server and communicate with the NAS's User
+      Management Interface via an AAAA protocol.  The four AAAA
+      functions may be located on a single server, or may be broken up
+      among multiple servers.
+
+   Device Management Interface - A NAS is a network device which is
+      owned, operated, and managed by some entity.  This interface
+      provides a means for this entity to operate and manage the NAS.
+      This interface may be a configuration file, a graphical user
+      interface, an API, or a protocol such as SNMP [20].
+
+   Device Monitoring - Device monitoring refers to the tracking of
+      status, activity, and usage of the NAS as a network device.
+
+   Device Provisioning - Device provisioning refers to the
+      configurations, settings, and control of the NAS as a network
+      device.
+
+9.3 Analysis
+
+   Following is an analysis of the functions of a NAS using the
+   reference model above:
+
+9.3.1 Authentication and Security
+
+   NAS's serve as the first point of authentication for network users,
+   providing security to user sessions.  This security is typically
+   performed by checking credentials such as a PPP PAP user
+   name/password pair or a PPP CHAP user name and challenge/response,
+   but may be extended to authentication via telephone number
+   information, digital certificates, or biometrics.  NAS's also may
+   authenticate themselves to users.  Since a NAS may be shared among
+   multiple administrative entities, authentication may actually be
+   performed via a back-end proxy, referral, or brokering process.
+
+
+
+Mitton & Beadles             Informational                     [Page 13]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   In addition to user security, NAS's may themselves be operated as
+   secure devices.  This may include secure methods of management and
+   monitoring, use of IP Security [21] and even participation in a
+   Public Key Infrastructure.
+
+9.3.2 Authorization and Policy
+
+   NAS's are the first point of authorization for usage of network
+   resources, and NAS's serve as policy enforcement points for the
+   services that they deliver to users.  NAS's may provision these
+   services to users in a statically or dynamically configured fashion.
+   Resource management can be performed at a NAS by granting specific
+   types of service based on the current network state.  In the case of
+   shared operation, NAS policy may be determined based on the policy of
+   multiple end systems.
+
+9.3.3 Accounting and Auditing
+
+   Since NAS services are consumable resources, usage information must
+   often be collected for the purposes of soft policy management,
+   reporting, planning, and accounting.  A dynamic, real-time view of
+   NAS usage is often required for network auditing purposes.  Since a
+   NAS may be shared among multiple administrative entities, usage
+   information must often be delivered to multiple endpoints.
+   Accounting is performed using such protocols as RADIUS [2].
+
+9.3.4 Resource Management
+
+   NAS's deliver resources to users, often in a dynamic fashion.
+   Examples of the types of resources doled out by NAS's are IP
+   addresses, network names and name server identities, tunnels, and
+   PSTN resources such as phone lines and numbers.  Note that NAS's may
+   be operated in a outsourcing model, where multiple entities are
+   competing for the same resources.
+
+9.3.5 Virtual Private Networks (VPN's)
+
+   NAS's often participate in VPN's, and may serve as the means by which
+   VPN's are implemented.  Examples of the use of NAS's in VPN's are:
+   Dial Access Servers that build compulsory tunnels, Dial Access
+   Servers that provide services to voluntary tunnelers, and Tunnel
+   Servers that provide tunnel termination services.  NAS's may
+   simultaneously provide VPN and public network services to different
+   users, based on policy and user identity.
+
+
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 14]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+9.3.6 Service Quality
+
+   A NAS may delivery different qualities, types, or levels of service
+   to different users based on policy and identity.  NAS's may perform
+   bandwidth management, allow differential speeds or methods of access,
+   or even participate in provisioned or signaled Quality of Service
+   (QoS) networks.
+
+9.3.7 Roaming
+
+   NAS's are often operated in a shared or outsourced manner, or a NAS
+   operator may enter into agreements with other service providers to
+   grant access to users from these providers (roaming operations).
+   NAS's often are operated as part of a global network.  All these
+   imply that a NAS often provides services to users from multiple
+   administrative domains simultaneously.  The features of NAS's may
+   therefore be driven by requirements of roaming [22].
+
+10. Security Considerations
+
+   This document describes a model not a particular solution.
+
+   As mentioned in section 9.3.1 and elsewhere, NAS'es are concerned
+   about the security of several aspects of their operation, including:
+
+      - Providing sufficiently robust authentication techniques as
+        required by network policies,
+      - NAS authentication of configured authentication server(s),
+      - Server ability to authenticate configured clients,
+      - Hiding of the authentication information from network snooping
+        to protect from attacks and provide user privacy,
+      - Protecting the integrity of message exchanges from attacks
+        such as; replay, or man-in-the middle,
+      - Inability of other hosts to interfere with services authorized
+        to NAS, or gain unauthorized services,
+      - Inability of other hosts to probe or guess at authentication
+        information.
+      - Protection of NAS system configuration and administration from
+        unauthorized users
+      - Protection of the network from illegal packets sourced by
+        accessing connections
+
+
+
+
+
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 15]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+11. References
+
+   [1]  Rigney, C., Willens, S., Rubens, A. and W. Simpson, "Remote
+        Authentication Dial In User Service (RADIUS)", RFC 2865, June
+        2000.
+
+   [2]  Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
+
+   [3]  Calhoun, P., "Diameter Base Protocol", Work in Progress.
+
+   [4]  Zorn, G., "Yet Another Authentication Protocol (YAAP)", Work in
+        Progress.
+
+   [5]  Mamakos, L., Lidl, K., Evarts, K., Carrel, D., Simone, D. and R.
+        Wheeler, "A Method for Transmitting PPP Over Ethernet (PPPoE)",
+        RFC 2516, February 1999.
+
+   [6]  Valencia, A., Littlewood, M. and T. Kolar, "Cisco Layer Two
+        Forwarding (Protocol) L2F", RFC 2341, May 1998.
+
+   [7]  Hamzeh, K., "Ascend Tunnel Management Protocol - ATMP", RFC
+        2107, February 1997.
+
+   [8]  Valencia, A., Townsley, W., Rubens, A., Pall, G., Zorn, G., and
+        B. Palter, "Layer Two Tunneling Protocol (L2TP)", RFC 2661,
+        August 1999.
+
+   [9]  Zorn, G., Leifer, D., Rubens, A., Shriver, J. and M. Holdrege,
+        "RADIUS Attributes for Tunnel Protocol Support", RFC 2868, June
+        2000.
+
+   [10] Zorn, G., Aboba, B. and D. Mitton, "RADIUS Accounting
+        Modifications for Tunnel Protocol Support", RFC 2867, June 2000.
+
+   [11] Aboba, B. and G. Zorn, "Implementation of PPTP/L2TP Compulsory
+        Tunneling via RADIUS", RFC 2809, April 2000.
+
+   [12] Simpson, W., "PPP Challenge Handshake Authentication Protocol
+        (CHAP)", RFC 1994, August 1996.
+
+   [13] Zorn, G. and S. Cobb, "Microsoft PPP CHAP Extensions", RFC 2433,
+        March 1998.
+
+   [14] Blunk, L. and J. Vollbrecht, "PPP Extensible Authentication
+        Protocol (EAP)", RFC 2284, March 1998.
+
+   [15] Calhoun, et al., "Extensible Authentication Protocol Support in
+        RADIUS", Work in Progress.
+
+
+
+Mitton & Beadles             Informational                     [Page 16]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   [16] Aboba, B. and M. Beadles, "The Network Access Identifier", RFC
+        2486, January 1999.
+
+   [17] Braden, R., Zhang, L., Berson, S., Herzog, S. and S. Jamin,
+        "Resource ReSerVation Protocol (RSVP) Version 1 Functional
+        Specification", RFC 2205, September 1997.
+
+   [18] Simpson, W., Editor, "The Point-to-Point Protocol (PPP)", STD
+        51, RFC 1661, July 1994.
+
+   [19] Boyle, J., Cohen, R., Durham, D., Herzog, S., Raja, R. and A.
+        Sastry. "The COPS (Common Open Policy Service) Protocol", RFC
+        2748, January 2000.
+
+   [20] Case, J., Fedor, M., Schoffstall, M. and J. Davin. "A Simple
+        Network Management Protocol (SNMP)", STD 15, RFC 1157, May 1990.
+
+   [21] Atkinson, R. and S. Kent, "Security Architecture for the
+        Internet Protocol", RFC 2401, November 1998.
+
+   [22] Aboba, Zorn, "Dialup Roaming Requirements", Work in Progress.
+
+12. Acknowledgments
+
+   This document is a synthesis of my earlier draft and Mark Beadles'
+   NAS Reference Model draft.
+
+13. Authors' Addresses
+
+   David Mitton
+   Nortel Networks
+   880 Technology Park Drive
+   Billerica, MA 01821
+
+   Phone: 978-288-4570
+   EMail: dmitton@nortelnetworks.com
+
+
+   Mark Beadles
+   SmartPipes Inc.
+   545 Metro Place South
+   Suite 100
+   Dublin, OH 43017
+
+   Phone: 614-327-8046
+   EMail: mbeadles@smartpipes.com
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 17]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+14. Appendix - Acronyms and Glossary:
+
+   AAA - Authentication, Authorization, Accounting, The three primary
+   services required by a NAS server or protocol.
+
+   NAS - Network Access Server, a system that provides access to a
+   network.  In some cases also know as a RAS, Remote Access Server.
+
+   CLI - Command Line Interface, an interface to a command line service
+   for use with an common asynchronous terminal facility.
+
+   SLIP - Serial Line Internet Protocol, an IP-only serial datalink,
+   predecessor to PPP.
+
+   PPP - Point-to-Point Protocol; a serial datalink level protocol that
+   supports IP as well as other network protocols. PPP has three major
+   states of operation: LCP - Link layer Control Protocol,
+   Authentication, of which there are several types (PAP, CHAP, EAP),
+   and NCP - Network layer Control Protocol, which negotiates the
+   network layer parameters for each of the protocols in use.
+
+   IPX - Novell's NetWare transport protocol
+
+   NETBEUI - A Microsoft/IBM LAN protocol used by Microsoft file
+   services and the NETBIOS applications programming interface.
+
+   ARAP - AppleTalk Remote Access Protocol
+
+   LAT - Local Area Transport; a Digital Equipment Corp. LAN protocol
+   for terminal services.
+
+   PPPoe - PPP over Ethernet; a protocol that forwards PPP frames on an
+   LAN infrastructure.  Often used to aggregate PPP streams at a common
+   server bank.
+
+   VPN - Virtual Private Network; a term for networks that appear to be
+   private to the user by the use of tunneling techniques.
+
+   FR - Frame Relay, a synchronous WAN protocol and telephone network
+   intraconnect service.
+
+   PSVC - Permanent Switched Virtual Circuit - a service which delivers
+   an virtual permanent circuit by a switched network.
+
+   PSTN - Public Switched Telephone Network
+
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 18]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+   ISDN - Integrated Services Digital Network, a telephone network
+   facility for transmitting digital and analog information over a
+   digital network connection.  A NAS may have the ability to receive
+   the information from the telephone network in digital form.
+
+   ISP - Internet Service Provider; a provider of Internet access (also
+   Network Service Provider, NSP).
+
+   BRI - Basic Rate Interface; a digital telephone interface.
+
+   PRI - Primary Rate Interface; a digital telephone interface of 64K
+   bits per second.
+
+   T1 - A digital telephone interface which provides 24-36 channels of
+   PRI data and one control channel (2.048 Mbps).
+
+   T3 - A digital telephone interface which provides 28 T1 services.
+   Signalling control for the entire connection is provided on a
+   dedicated in-band channel.
+
+   NFAS - Non-Facility Associated Signaling, a telephone network
+   protocol/service for providing call information on a separate wire
+   connection from the call itself.  Used with multiple T1 or T3
+   connections.
+
+   SS7 - A telephone network protocol for communicating call supervision
+   information on a separate data network from the voice network.
+
+   POP - Point Of Presence; a geographic location of equipment and
+   interconnection to the network.  An ISP typically manages all
+   equipment in a single POP in a similar manner.
+
+   VSA - Vendor Specific Attributes; RADIUS attributes defined by
+   vendors using the provision of attribute 26.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 19]
+
+RFC 2881                    NASreq NAS Model                   July 2000
+
+
+15.  Full Copyright Statement
+
+   Copyright (C) The Internet Society (2000).  All Rights Reserved.
+
+   This document and translations of it may be copied and furnished to
+   others, and derivative works that comment on or otherwise explain it
+   or assist in its implementation may be prepared, copied, published
+   and distributed, in whole or in part, without restriction of any
+   kind, provided that the above copyright notice and this paragraph are
+   included on all such copies and derivative works.  However, this
+   document itself may not be modified in any way, such as by removing
+   the copyright notice or references to the Internet Society or other
+   Internet organizations, except as needed for the purpose of
+   developing Internet standards in which case the procedures for
+   copyrights defined in the Internet Standards process must be
+   followed, or as required to translate it into languages other than
+   English.
+
+   The limited permissions granted above are perpetual and will not be
+   revoked by the Internet Society or its successors or assigns.
+
+   This document and the information contained herein is provided on an
+   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
+   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
+   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
+   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
+   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
+
+Acknowledgement
+
+   Funding for the RFC Editor function is currently provided by the
+   Internet Society.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Mitton & Beadles             Informational                     [Page 20]
+