Complex eduroam radius design

[Phil Mayers]

On 13/11/12 16:38, Olivier Beytrison wrote:
>
> Well not really a solution here. The central LDAP system is one of the

Fair enough.

> To summarize, if I proxy the outer tunnel, there will be more load on
> the central server, and I'll add the custom attributes to the outer
> reply in order for the local radius to analyse them and add the
> nas-specific attribute.

Yes.

>
> if I proxy the inner tunnel, the TLS is handled by the local radius
> (more CERT to buy), on the central server I add the attributes in the
> normal reply, and the local radius keep doing the authorization part.
> I just have to take care of the encryption between the local and central
> servers. thankfully l2l vpn are already established.

Yes. However, buying separate certs might not be a good idea as it will 
complicate the client setup - they'll all have to come from the same CA 
and share the same CN (or you'll have to rely on wildcard CN matching on 
the clients).

For this reason, it might be easier to do all the TLS on the central 
servers, and have the same cert on both of them.