Allowing generic RADIUS authenticator select a source IP address.

Why is this useful?

Allowing the selection of a source IP address in the generic RADIUS authenticator is critical for environments where:

• SYSPLEX-wide distributed IP addresses are used, which do not support UDP traffic.
• Multiple IP stacks exist, and specific systems require traffic to originate from a particular IP to ensure compatibility with network routing, firewall rules, or external authentication systems.

In your case, three systems are unable to use MFA via RADIUS because the default source IP is a distributed one that doesn’t support UDP. Without the ability to specify a source IP, these systems are effectively blocked from using MFA, creating a security and compliance gap.

Who would benefit from it?

This feature would benefit:

• Mainframe environments with SYSPLEX configurations, especially those using distributed IP addresses.
• Organizations with complex network topologies, where routing or firewall rules depend on specific source IPs.
• Security teams implementing MFA across all systems, ensuring consistent coverage without exceptions.
• Any customer using multi-stack TCP/IP configurations, who needs granular control over network traffic for authentication.
  
  How should it work?

The implementation could mirror the flexibility seen in RSA SecurID’s SDOPTS.REC file, allowing users to define the source IP address for outbound RADIUS requests. For AZFRADP1, this could be achieved by:

1. Configuration Option: Introduce a parameter in the AZFRADP1 configuration (e.g., AZFRAUTH or AZFCONFIG) to specify the desired source IP.
2. Per-Instance Control: Allow this setting to be defined per authenticator instance, so different systems can use different source IPs as needed.
3. Fallback Logic: If no source IP is specified, default behavior remains unchanged to preserve backward compatibility.
4. Validation: Include checks to ensure the specified IP is valid and bound to the system’s stack.