1 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS - IETF 62 L2VPN RADIUS Auto-discovery and provisioning draft-ietf-l2vpn-radius-pe-discovery-01 Mark Townsley, Greg Weber, Wei Luo, Skip Booth (Juha Heinanen) IETF 62

222 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 draft-ietf-l2vpn-radius-pe-discovery presented at IETF-61 Protocol-independent information model corresponding to multi-layered authorization Different layers may map to different protocol- specific solutions based on deployments RADIUS-specific mappings defined Collapsible layers

333 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 L2VPN Authorization Steps 1. CE/AC Authorization – Attachment Circuit to VPN ID 2. VPN Authorization – VPN ID to PE Membership 3. PW Authorization – PE Membership to PW signaling CE PE Each step is independent and may be performed by any combination of local configuration, RADIUS, BGP, etc.

444 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 L2VPN Authorization Steps 1. CE/AC Authorization – Attachment Circuit to VPN ID 2. VPN Authorization – VPN ID to PE Membership 3. PW Authorization – PE Membership to PW signaling CE PE Each step is independent and may be performed by any combination of local configuration, RADIUS, BGP, etc. VPN-ID=“101:14”

555 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 L2VPN Authorization Steps 1. CE/AC Authorization – Attachment Circuit to VPN ID 2. VPN Authorization – VPN ID to PE Membership CE PE Each step is independent and may be performed by any combination of local configuration, RADIUS, BGP, etc. VPN-ID=“101:14” PE-A PE-B 3. PW Authorization – PE Membership to PW signaling

666 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF CE/AC Authorization – Attachment Circuit to VPN ID 2. VPN Authorization – VPN ID to PE Membership 3. PW Authorization – PE Membership to PW signaling L2VPN Authorization Steps CE PE Each step is independent and may be performed by any combination of local configuration, RADIUS, BGP, etc. PE-A PE-B

777 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 Changes in the -01 version draft-ietf-l2vpn-radius-pe-discovery Updated terminology Generalized from VPLS to VPLS/VPWS/etc. Reduce L2VPN-specific requirements on RADIUS servers: e.g. make servers less stateful. Defined RADIUS attributes to support the above

888 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 AII: Attachment Individual Identifier AC: Attachment Circuit AGI: Attachment Group Identifier AS: Autonomous System CE: Customer Equipment L2VPN: Layer 2 Provider Provisioned Virtual Private Network NAI Network Access Identifier NAS: Network Access Server PE: Provider Equipment SAI: Source Attachment Identifier SAII: Source Attachment Individual Identifier RADIUS: Remote Authentication Dial In User Service TAI: Target Attachment Identifier TAII: Target Attachment Individual Identifier VPLS: Virtual Private LAN Service VPN: Virtual Private Network VPWS: Virtual Private Wire Service Updated Terminology Latest terminology from: draft-ietf-l2vpn-l2-framework-05 draft-ietf-l2vpn-signaling-03

999 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 RADIUS Attributes VPN-ID RFC 2685, “Virtual Private Networks Identifier” Router-Distinguisher draft-ietf-l3vpn-rfc2547bis-03, “BGP/MPLS IP VPNs” Attachment-Individual-ID draft-ietf-l2vpn-signaling-03, “Provisioning Models and Endpoint Identifiers in L2VPN Signaling” Per-Hop-Behavior RFC 3140, “Per Hop Behavior Identification Codes” PE-Router-ID draft-ietf-l2vpn-signaling-03, “Provisioning Models and Endpoint Identifiers in L2VPN Signaling” PE-Address IP address of PE PE-Record PE-Router-ID + AII [+PW attributes/value pairs]

10 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 RADIUS Transactions Access-RequestAccess-Response CE/AC Authorization User-Name = NAI or AC name NAS-IP-Address VPN-ID or Router-Distinguisher VSAs for circuit specific parameters VPN Authorization User-Name = VPN-ID or Router-Distinguisher NAS-IP-Address PE-Router-ID PE-Address Attachment-Individual-Identifier or Multiple PE-Records like: “PE-Router-ID:AII” Pseudowire Authorization User-Name = PE-Router-ID NAS-IP-Address VPN-ID or Router-Distinguisher Attachment-Individual-Identifier Per-Hop-Behavior Possibly DSCP setting Collapsed Transaction User-Name = NAI or AC name NAS-IP-Address Multiple PE-Records like: “PE-Router-ID:AII:PHB= ”

11 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 RADIUS Examples CE/AC Authorization Request User-Name = (CE NAI) NAS-IP-Address = " " Response VPN-ID = "100:14" Request User-Name = "ATM14.0.1" (AC Name) NAS-IP-Address = " " Response Router-Distinguisher = "1: :10001"

12 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 RADIUS Examples VPN Authorization Request User-Name = "100:14" (VPN-ID) NAS-IP-Address = " " Response PE-Record = " :14" (PE-Router-ID:AII) PE-Record = " :15" PE-Record = " :24" PE-Record = " :25" Request User-Name = "100:14" (VPN-ID) NAS-IP-Address = " " Response PE-Record = " :14:PHB=256"

13 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 RADIUS Examples Pseudowire Authorization Request User-Name = " " (PE-Router-ID) NAS-IP-Address = " " Attachment-Individual-ID = "14" VPN-ID = "100:14" Response Per-Hop-Behavior = "256"

14 © 2004 Cisco Systems, Inc. All rights reserved. L2VPN RADIUS – IETF 62 To do… Address accounting Steps #1 & #3 most interesting Address dynamic authorization changes (via RFC 3576) Input from RADEXT WG (this week) Security, IANA Scalability Considerations for IPv6? How do CE credentials get to the PE for authenticated “zero-touch” provisioning?