Request for Comments: 4005 G. Zorn
Category: Standards Track Cisco Systems Inc.
D. Spence
Consultant
D. Mitton
Circular Networks
August 2005
Diameter Network Access Server Application
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2005).
Abstract
This document describes the Diameter protocol application used for
Authentication, Authorization, and Accounting (AAA) services in the
Network Access Server (NAS) environment. When combined with the
Diameter Base protocol, Transport Profile, and Extensible
Authentication Protocol specifications, this application
specification satisfies typical network access services requirements.
Initial deployments of the Diameter protocol are expected to include
legacy systems. Therefore, this application has been carefully
designed to ease the burden of protocol conversion between RADIUS and
Diameter. This is achieved by including the RADIUS attribute space
to eliminate the need to perform many attribute translations.
The interactions between Diameter applications and RADIUS specified
in this document are to be applied to all Diameter applications. In
this sense, this document extends the Base Diameter protocol.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 5
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . 5
1.2. Requirements Language . . . . . . . . . . . . . . . . . 6
1.3. Advertising Application Support . . . . . . . . . . . . 6
2. NAS Calls, Ports, and Sessions . . . . . . . . . . . . . . . . 6
2.1. Diameter Session Establishment . . . . . . . . . . . . . 7
2.2. Diameter Session Reauthentication or Reauthorization . . 7
2.3. Diameter Session Termination . . . . . . . . . . . . . . 8
3. NAS Messages . . . . . . . . . . . . . . . . . . . . . . . . . 9
3.1. AA-Request (AAR) Command . . . . . . . . . . . . . . . . 9
3.2. AA-Answer (AAA) Command . . . . . . . . . . . . . . . . 11
3.3. Re-Auth-Request (RAR) Command . . . . . . . . . . . . . 13
3.4. Re-Auth-Answer (RAA) Command . . . . . . . . . . . . . . 14
3.5. Session-Termination-Request (STR) Command . . . . . . . 15
3.6. Session-Termination-Answer (STA) Command . . . . . . . . 15
3.7. Abort-Session-Request (ASR) Command . . . . . . . . . . 16
3.8. Abort-Session-Answer (ASA) Command . . . . . . . . . . . 17
3.9. Accounting-Request (ACR) Command . . . . . . . . . . . . 17
3.10. Accounting-Answer (ACA) Command. . . . . . . . . . . . . 19
4. NAS Session AVPs . . . . . . . . . . . . . . . . . . . . . . . 20
4.1. Call and Session Information . . . . . . . . . . . . . . 21
4.2. NAS-Port AVP . . . . . . . . . . . . . . . . . . . . . . 22
4.3. NAS-Port-Id AVP . . . . . . . . . . . . . . . . . . . . 22
4.4. NAS-Port-Type AVP . . . . . . . . . . . . . . . . . . . 22
4.5. Called-Station-Id AVP . . . . . . . . . . . . . . . . . 23
4.6. Calling-Station-Id AVP . . . . . . . . . . . . . . . . . 23
4.7. Connect-Info AVP . . . . . . . . . . . . . . . . . . . . 24
4.8. Originating-Line-Info AVP . . . . . . . . . . . . . . . 24
4.9. Reply-Message AVP . . . . . . . . . . . . . . . . . . . 25
5. NAS Authentication AVPs . . . . . . . . . . . . . . . . . . . 26
5.1. User-Password AVP . . . . . . . . . . . . . . . . . . . 26
5.2. Password-Retry AVP . . . . . . . . . . . . . . . . . . . 27
5.3. Prompt AVP . . . . . . . . . . . . . . . . . . . . . . . 27
5.4. CHAP-Auth AVP . . . . . . . . . . . . . . . . . . . . . 27
5.5. CHAP-Algorithm AVP . . . . . . . . . . . . . . . . . . . 28
5.6. CHAP-Ident AVP . . . . . . . . . . . . . . . . . . . . . 28
5.7. CHAP-Response AVP . . . . . . . . . . . . . . . . . . . 28
5.8. CHAP-Challenge AVP . . . . . . . . . . . . . . . . . . . 28
5.9. ARAP-Password AVP . . . . . . . . . . . . . . . . . . . 28
5.10. ARAP-Challenge-Response AVP. . . . . . . . . . . . . . . 28
5.11. ARAP-Security AVP. . . . . . . . . . . . . . . . . . . . 29
5.12. ARAP-Security-Data AVP . . . . . . . . . . . . . . . . . 29
6. NAS Authorization AVPs . . . . . . . . . . . . . . . . . . . . 29
6.1. Service-Type AVP . . . . . . . . . . . . . . . . . . . . 30
6.2. Callback-Number AVP . . . . . . . . . . . . . . . . . . 32
6.3. Callback-Id AVP . . . . . . . . . . . . . . . . . . . . 32
6.4. Idle-Timeout AVP . . . . . . . . . . . . . . . . . . . . 32
6.5. Port-Limit AVP . . . . . . . . . . . . . . . . . . . . . 32
6.6. NAS-Filter-Rule AVP . . . . . . . . . . . . . . . . . . 32
6.7. Filter-Id AVP . . . . . . . . . . . . . . . . . . . . . 33
6.8. Configuration-Token AVP . . . . . . . . . . . . . . . . 33
6.9. QoS-Filter-Rule AVP . . . . . . . . . . . . . . . . . . 33
6.10. Framed Access Authorization AVPs . . . . . . . . . . . . 35
6.10.1. Framed-Protocol AVP . . . . . . . . . . . . . . 35
6.10.2. Framed-Routing AVP. . . . . . . . . . . . . . . 35
6.10.3. Framed-MTU AVP. . . . . . . . . . . . . . . . . 35
6.10.4. Framed-Compression AVP. . . . . . . . . . . . . 36
6.11. IP Access Authorization AVPs.. . . . . . . . . . . . . . 36
6.11.1. Framed-IP-Address AVP . . . . . . . . . . . . . 36
6.11.2. Framed-IP-Netmask AVP . . . . . . . . . . . . . 36
6.11.3. Framed-Route AVP. . . . . . . . . . . . . . . . 37
6.11.4. Framed-Pool AVP . . . . . . . . . . . . . . . . 37
6.11.5. Framed-Interface-Id AVP . . . . . . . . . . . . 37
6.11.6. Framed-IPv6-Prefix AVP. . . . . . . . . . . . . 38
6.11.7. Framed-IPv6-Route AVP . . . . . . . . . . . . . 38
6.11.8. Framed-IPv6-Pool AVP. . . . . . . . . . . . . . 38
6.12. IPX Access . . . . . . . . . . . . . . . . . . . . . . . 38
6.12.1. Framed-IPX-Network AVP. . . . . . . . . . . . . 39
6.13. AppleTalk Network Access . . . . . . . . . . . . . . . . 39
6.13.1. Framed-AppleTalk-Link AVP . . . . . . . . . . . 39
6.13.2. Framed-AppleTalk-Network AVP . . . . . . . . . 39
6.13.3. Framed-AppleTalk-Zone AVP . . . . . . . . . . . 40
6.14. AppleTalk Remote Access. . . . . . . . . . . . . . . . . 40
6.14.1. ARAP-Features AVP . . . . . . . . . . . . . . . 40
6.14.2. ARAP-Zone-Access AVP. . . . . . . . . . . . . . 40
6.15. Non-Framed Access Authorization AVPs . . . . . . . . . . 40
6.15.1. Login-IP-Host AVP . . . . . . . . . . . . . . . 40
6.15.2. Login-IPv6-Host AVP . . . . . . . . . . . . . . 41
6.15.3. Login-Service AVP . . . . . . . . . . . . . . . 41
6.16. TCP Services . . . . . . . . . . . . . . . . . . . . . . 42
6.16.1. Login-TCP-Port AVP . . . . . . . . . . . . . . 42
6.17. LAT Services . . . . . . . . . . . . . . . . . . . . . . 42
6.17.1. Login-LAT-Service AVP . . . . . . . . . . . . . 42
6.17.2. Login-LAT-Node AVP. . . . . . . . . . . . . . . 43
6.17.3. Login-LAT-Group AVP . . . . . . . . . . . . . . 43
6.17.4. Login-LAT-Port AVP. . . . . . . . . . . . . . . 43
7. NAS Tunneling . . . . . . . . . . . . . . . . . . . . . . . . 44
7.1. Tunneling AVP . . . . . . . . . . . . . . . . . . . . . 44
7.2. Tunnel-Type AVP . . . . . . . . . . . . . . . . . . . . 45
7.3. Tunnel-Medium-Type AVP . . . . . . . . . . . . . . . . . 46
7.4. Tunnel-Client-Endpoint AVP . . . . . . . . . . . . . . . 46
7.5. Tunnel-Server-Endpoint AVP . . . . . . . . . . . . . . . 47
7.6. Tunnel-Password AVP . . . . . . . . . . . . . . . . . . 48
7.7. Tunnel-Private-Group-Id AVP . . . . . . . . . . . . . . 48
7.8. Tunnel-Assignment-Id AVP . . . . . . . . . . . . . . . . 48
7.9. Tunnel-Preference AVP . . . . . . . . . . . . . . . . . 49
7.10. Tunnel-Client-Auth-Id AVP. . . . . . . . . . . . . . . . 50
7.11. Tunnel-Server-Auth-Id AVP. . . . . . . . . . . . . . . . 50
8. NAS Accounting . . . . . . . . . . . . . . . . . . . . . . . . 50
8.1. Accounting-Input-Octets AVP . . . . . . . . . . . . . . 51
8.2. Accounting-Output-Octets AVP . . . . . . . . . . . . . . 52
8.3. Accounting-Input-Packets AVP . . . . . . . . . . . . . . 52
8.4. Accounting-Output-Packets AVP . . . . . . . . . . . . . 52
8.5. Acct-Session-Time AVP . . . . . . . . . . . . . . . . . 52
8.6. Acct-Authentic AVP . . . . . . . . . . . . . . . . . . . 52
8.7. Accounting-Auth-Method AVP . . . . . . . . . . . . . . . 53
8.8. Acct-Delay-Time . . . . . . . . . . . . . . . . . . . . 53
8.9. Acct-Link-Count . . . . . . . . . . . . . . . . . . . . 54
8.10. Acct-Tunnel-Connection AVP . . . . . . . . . . . . . . . 54
8.11. Acct-Tunnel-Packets-Lost AVP . . . . . . . . . . . . . . 55
9. RADIUS/Diameter Protocol Interactions . . . . . . . . . . . . 55
9.1. RADIUS Request Forwarded as Diameter Request . . . . . . 55
9.1.1. RADIUS Dynamic Authorization Considerations . . 59
9.2. Diameter Request Forwarded as RADIUS Request . . . . . . 60
9.2.1. RADIUS Dynamic Authorization Considerations . . 62
9.3. AVPs Used Only for Compatibility . . . . . . . . . . . . 63
9.3.1. NAS-Identifier AVP. . . . . . . . . . . . . . . 63
9.3.2. NAS-IP-Address AVP. . . . . . . . . . . . . . . 64
9.3.3. NAS-IPv6-Address AVP. . . . . . . . . . . . . . 65
9.3.4. State AVP . . . . . . . . . . . . . . . . . . . 65
9.3.5. Termination-Cause AVP Code Values . . . . . . . 66
9.3.6. Origin-AAA-Protocol . . . . . . . . . . . . . . 68
9.4. Prohibited RADIUS Attributes . . . . . . . . . . . . . . 69
9.5. Translatable Diameter AVPs . . . . . . . . . . . . . . . 69
9.6. RADIUS Vendor-Specific Attributes . . . . . . . . . . . 69
9.6.1. Forwarding a Diameter Vendor Specific AVP as a
RADIUS VSA . . . . . . . . . . . . . . . . . . . 70
9.6.2. Forwarding a RADIUS VSA as a Diameter Vendor
Specific AVP . . . . . . . . . . . . . . . . . . 70
10. AVP Occurrence Tables. . . . . . . . . . . . . . . . . . . . . 71
10.1. AA-Request/Answer AVP Table. . . . . . . . . . . . . . . 71
10.2. Accounting AVP Tables. . . . . . . . . . . . . . . . . . 73
10.2.1. Accounting Framed Access AVP Table. . . . . . . 74
10.2.2. Accounting Non-Framed Access AVP Table. . . . . 76
11. IANA Considerations. . . . . . . . . . . . . . . . . . . . . . 77
11.1. Command Codes. . . . . . . . . . . . . . . . . . . . . . 77
11.2. AVP Codes. . . . . . . . . . . . . . . . . . . . . . . . 78
11.3. Application Identifier . . . . . . . . . . . . . . . . . 78
11.4. CHAP-Algorithm AVP Values. . . . . . . . . . . . . . . . 78
11.5. Accounting-Auth-Method AVP Values. . . . . . . . . . . . 78
11.6. Origin-AAA-Protocol AVP Values . . . . . . . . . . . . . 78
12. Security Considerations. . . . . . . . . . . . . . . . . . . . 78
13. References . . . . . . . . . . . . . . . . . . . . . . . . . . 79
13.1. Normative References . . . . . . . . . . . . . . . . . . 79
13.2. Informative References . . . . . . . . . . . . . . . . . 80
14. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 83
Authors’ Addresses . . . . . . . . . . . . . . . . . . . . . . . . 84
Full Copyright Statement . . . . . . . . . . . . . . . . . . . . . 85
1. Introduction
This document describes the Diameter protocol application used for
AAA in the Network Access Server (NAS) environment. When combined
with the Diameter Base protocol [BASE], Transport Profile
[DiamTrans], and EAP [DiamEAP] specifications, this Diameter NAS
application specification satisfies NAS-related requirements defined
in RFC 2989 [AAACriteria] and RFC 3169 [NASCriteria].
Initial deployments of the Diameter protocol are expected to include
legacy systems. Therefore, this application has been carefully
designed to ease the burden of protocol conversion between RADIUS and
Diameter. This is achieved by including the RADIUS attribute space
to eliminate the need to perform many attribute translations.
The interactions specified in this document between Diameter
applications and RADIUS are to be applied to all Diameter
applications. In this sense, this document extends the Base Diameter
protocol [BASE].
First, this document describes the operation of a Diameter NAS
application. Then it defines the Diameter message Command-Codes.
The following sections list the AVPs used in these messages, grouped
by common usage. These are session identification, authentication,
authorization, tunneling, and accounting. The authorization AVPs are
further broken down by service type. Interaction and backward
compatibility issues with RADIUS are discussed in later sections.
1.1. Terminology
The base Diameter [BASE] specification section 1.4 defines most of
the terminology used in this document. Additionally, the following
terms and acronyms are used in this application:
NAS (Network Access Server) - A device that provides an access
service for a user to a network. The service may be a network
connection or a value-added service such as terminal emulation
[NASModel].
PPP (Point-to-Point Protocol) - A multiprotocol serial datalink. PPP
is the primary IP datalink used for dial-in NAS connection service
[PPP].
CHAP (Challenge Handshake Authentication Protocol) - An
authentication process used in PPP [PPPCHAP].
PAP (Password Authentication Protocol) - A deprecated PPP
authentication process, but often used for backward compatibility
[PAP].
SLIP (Serial Line Interface Protocol) - A serial datalink that only
supports IP. A design prior to PPP.
ARAP (Appletalk Remote Access Protocol) - A serial datalink for
accessing Appletalk networks [ARAP].
IPX (Internet Packet Exchange) - The network protocol used by NetWare
networks [IPX].
LAT (Local Area Transport) - A Digital Equipment Corp. LAN protocol
for terminal services [LAT].
VPN (Virtual Private Network) - In this document, this term is used
to describe access services that use tunneling methods.
1.2. Requirements Language
In this document, the key words "MAY", "MUST", "MUST NOT",
"OPTIONAL", "RECOMMENDED", "SHOULD", and "SHOULD NOT" are to be
interpreted as described in [Keywords].
1.3. Advertising Application Support
Diameter applications conforming to this specification MUST advertise
support by including the value of one (1) in the Auth-Application-Id
of Capabilities-Exchange-Request (CER), AA-Request (AAR), and AA-
Answer (AAA) messages. All other messages are defined by [BASE] and
use the Base application id value.
2. NAS Calls, Ports, and Sessions
The arrival of a new call or service connection at a port of a
Network Access Server (NAS) starts a Diameter NAS message exchange.
Information about the call, the identity of the user, and the user’s
authentication information are packaged into a Diameter AA-Request
(AAR) message and sent to a server.
The server processes the information and responds with a Diameter
AA-Answer (AAA) message that contains authorization information for
the NAS, or a failure code (Result-Code AVP). A value of
DIAMETER_MULTI_ROUND_AUTH indicates an additional authentication
exchange, and several AAR and AAA messages may be exchanged until the
transaction completes.
Depending on the Auth-Request-Type AVP, the Diameter protocol allows
authorization-only requests that contain no authentication
information from the client. This capability goes beyond the Call
Check capabilities described in section 5.6 of [RADIUS] in that no
access decision is requested. As a result, service cannot be started
as a result of a response to an authorization-only request without
introducing a significant security vulnerability.
Since no equivalent capability exists in RADIUS, authorization-only
requests from a NAS implementing Diameter may not be easily
translated to an equivalent RADIUS message by a Diameter/RADIUS
gateway. For example, when a Diameter authorization-only request
cannot be translated to a RADIUS Call Check, it would be necessary
for the Diameter/RADIUS gateway to add authentication information to
the RADIUS Access Request. On receiving the Access-Reply, the
Diameter/RADIUS gateway would need to discard the access decision
(Accept/Reject). It is not clear whether these translations can be
accomplished without adding significant security vulnerabilities.
2.1. Diameter Session Establishment
When the authentication or authorization exchange completes
successfully, the NAS application SHOULD start a session context. If
the Result-Code of DIAMETER_MULTI_ROUND_AUTH is returned, the
exchange continues until a success or error is returned.
If accounting is active, the application MUST also send an Accounting
message [BASE]. An Accounting-Record-Type of START_RECORD is sent
for a new session. If a session fails to start, the EVENT_RECORD
message is sent with the reason for the failure described.
Note that the return of an unsupportable Accounting-Realtime-Required
value [BASE] would result in a failure to establish the session.
2.2. Diameter Session Reauthentication or Reauthorization
The Diameter Base protocol allows users to be periodically
reauthenticated and/or reauthorized. In such instances, the
Session-Id AVP in the AAR message MUST be the same as the one present
in the original authentication/authorization message.
A Diameter server informs the NAS of the maximum time allowed before
reauthentication or reauthorization via the Authorization-Lifetime
AVP [BASE]. A NAS MAY reauthenticate and/or reauthorize before the
end, but A NAS MUST reauthenticate and/or reauthorize at the end of
the period provided by the Authorization-Lifetime AVP. The failure
of a reauthentication exchange will terminate the service.
Furthermore, it is possible for Diameter servers to issue an