values and their use. For more information on current assignment
values, see [ANITypes].
Value Description
------------------------------------------------------------
00 Plain Old Telephone Service (POTS)
01 Multiparty Line (more than 2)
02 ANI Failure
03 ANI Observed
04 ONI Observed
05 ANI Failure Observed
06 Station Level Rating
07 Special Operator Handling Required
08 InterLATA Restricted
10 Test Call
20 Automatic Identified Outward Dialing (AIOD)
23 Coin or Non-Coin
24 Toll Free Service (Non-Pay Origination)
25 Toll Free Service (Pay Origination)
27 Toll Free Service (Coin Control Origination)
29 Prison/Inmate Service
30-32 Intercept
30 Intercept (Blank)
31 Intercept (Trouble)
32 Intercept (Regular)
34 Telco Operator Handled Call
40-49 Unrestricted Use
52 Outward Wide Area Telecommunications Service (OUTWATS)
60 Telecommunications Relay Service (TRS)(Unrestricted)
61 Cellular/Wireless PCS (Type 1)
62 Cellular/Wireless PCS (Type 2)
63 Cellular/Wireless PCS (Roaming)
66 TRS (Hotel)
67 TRS (Restricted)
70 Pay Station, No Coin Control
93 Access for Private Virtual Network Service
4.9. Reply-Message AVP
The Reply-Message AVP (AVP Code 18) is of type UTF8String and
contains text that MAY be displayed to the user. When used in an
AA-Answer message with a successful Result-Code AVP, it indicates
success. When found in an AAA message with a Result-Code other than
DIAMETER_SUCCESS, the AVP contains a failure message.
The Reply-Message AVP MAY indicate dialog text to prompt the user
before another AA-Request attempt. When used in an AA-Answer with a
Result-Code of DIAMETER_MULTI_ROUND_AUTH or in an Re-Auth-Request
message, it MAY contain a dialog text to prompt the user for a
response.
Multiple Reply-Messages MAY be included, and if any are displayed,
they MUST be displayed in the same order as they appear in the
Diameter message.
5. NAS Authentication AVPs
This section defines the AVPs necessary to carry the authentication
information in the Diameter protocol. The functionality defined here
provides a RADIUS-like AAA service over a more reliable and secure
transport, as defined in the base protocol [BASE].
The following table describes the AVPs; their AVP Code values, types,
and possible flag values, and whether the AVP MAY be encrypted.
+---------------------+
| AVP Flag rules |
|----+-----+----+-----|----+
AVP Section | | |SHLD| MUST| |
Attribute Name Code Defined Value Type |MUST| MAY | NOT| NOT|Encr|
-----------------------------------------|----+-----+----+-----|----|
User-Password 2 5.1 OctetString| M | P | | V | Y |
Password-Retry 75 5.2 Unsigned32 | M | P | | V | Y |
Prompt 76 5.3 Enumerated | M | P | | V | Y |
CHAP-Auth 402 5.4 Grouped | M | P | | V | Y |
CHAP-Algorithm 403 5.5 Enumerated | M | P | | V | Y |
CHAP-Ident 404 5.6 OctetString| M | P | | V | Y |
CHAP-Response 405 5.7 OctetString| M | P | | V | Y |
CHAP-Challenge 60 5.8 OctetString| M | P | | V | Y |
ARAP-Password 70 5.9 OctetString| M | P | | V | Y |
ARAP-Challenge- 84 5.10 OctetString| M | P | | V | Y |
Response | | | | | |
ARAP-Security 73 5.11 Unsigned32 | M | P | | V | Y |
ARAP-Security- 74 5.12 OctetString| M | P | | V | Y |
Data | | | | | |
-----------------------------------------|----+-----+----+-----|----|
5.1. User-Password AVP
The User-Password AVP (AVP Code 2) is of type OctetString and
contains the password of the user to be authenticated, or the user’s
input in a multi-round authentication exchange.
The User-Password AVP contains a user password or one-time password
and therefore represents sensitive information. As required in
[BASE], Diameter messages are encrypted by using IPsec or TLS.
Unless this AVP is used for one-time passwords, the User-Password AVP
SHOULD NOT be used in untrusted proxy environments without encrypting
it by using end-to-end security techniques, such as the proposed CMS
Security [DiamCMS].
The clear-text password (prior to encryption) MUST NOT be longer than
128 bytes in length.
5.2. Password-Retry AVP
The Password-Retry AVP (AVP Code 75) is of type Unsigned32 and MAY be
included in the AA-Answer if the Result-Code indicates an
authentication failure. The value of this AVP indicates how many
authentication attempts a user is permitted before being
disconnected. This AVP is primarily intended for use when the
Framed-Protocol AVP (see section 6.10.1) is set to ARAP.
5.3. Prompt AVP
The Prompt AVP (AVP Code 76) is of type Enumerated and MAY be present
in the AA-Answer message. When present, it is used by the NAS to
determine whether the user’s response, when entered, should be
echoed.
The supported values are listed in [RADIUSTypes]. The following list
is informational:
0 No Echo
1 Echo
5.4. CHAP-Auth AVP
The CHAP-Auth AVP (AVP Code 402) is of type Grouped and contains the
information necessary to authenticate a user using the PPP
Challenge-Handshake Authentication Protocol (CHAP) [PPPCHAP]. If the
CHAP-Auth AVP is found in a message, the CHAP-Challenge AVP MUST be
present as well. The optional AVPs containing the CHAP response
depend upon the value of the CHAP-Algorithm AVP. The grouped AVP has
the following ABNF grammar:
CHAP-Auth ::= < AVP Header: 402 >
{ CHAP-Algorithm }
{ CHAP-Ident }
[ CHAP-Response ]
* [ AVP ]
5.5. CHAP-Algorithm AVP
The CHAP-Algorithm AVP (AVP Code 403) is of type Enumerated and
contains the algorithm identifier used in the computation of the CHAP
response [PPPCHAP]. The following values are currently supported:
CHAP with MD5 5
The CHAP response is computed by using the procedure described
in [PPPCHAP]. This algorithm requires that the CHAP-Response
AVP MUST be present in the CHAP-Auth AVP.
5.6. CHAP-Ident AVP
The CHAP-Ident AVP (AVP Code 404) is of type OctetString and contains
the 1 octet CHAP Identifier used in the computation of the CHAP
response [PPPCHAP].
5.7. CHAP-Response AVP
The CHAP-Response AVP (AVP Code 405) is of type OctetString and
contains the 16 octet authentication data provided by the user in
response to the CHAP challenge [PPPCHAP].
5.8. CHAP-Challenge AVP
The CHAP-Challenge AVP (AVP Code 60) is of type OctetString and
contains the CHAP Challenge sent by the NAS to the CHAP peer
[PPPCHAP].
5.9. ARAP-Password AVP
The ARAP-Password AVP (AVP Code 70) is of type OctetString and is
only present when the Framed-Protocol AVP (see section 6.10.1) is
included in the message and is set to ARAP. This AVP MUST NOT be
present if either the User-Password or the CHAP-Auth AVP is present.
See [RADIUSExt] for more information on the contents of this AVP.
5.10. ARAP-Challenge-Response AVP
The ARAP-Challenge-Response AVP (AVP Code 84) is of type OctetString
and is only present when the Framed-Protocol AVP (see section 6.10.1)
is included in the message and is set to ARAP. This AVP contains an
8 octet response to the dial-in client’s challenge. The RADIUS
server calculates this value by taking the dial-in client’s challenge
from the high-order 8 octets of the ARAP-Password AVP and performing
DES encryption on this value with the authenticating user’s password
as the key. If the user’s password is fewer than 8 octets in length,
the password is padded at the end with NULL octets to a length of 8
before it is used as a key.
5.11. ARAP-Security AVP
The ARAP-Security AVP (AVP Code 73) is of type Unsigned32 and MAY be
present in the AA-Answer message if the Framed-Protocol AVP (see
section 6.10.1) is set to the value of ARAP, and the Result-Code AVP
is set to DIAMETER_MULTI_ROUND_AUTH. See [RADIUSExt] for more
information on the format of this AVP.
5.12. ARAP-Security-Data AVP
The ARAP-Security AVP (AVP Code 74) is of type OctetString and MAY be
present in the AA-Request or AA-Answer message if the Framed-Protocol
AVP is set to the value of ARAP, and the Result-Code AVP is set to
DIAMETER_MULTI_ROUND_AUTH. This AVP contains the security module
challenge or response associated with the ARAP Security Module
specified in ARAP-Security.
6. NAS Authorization AVPs
This section contains the authorization AVPs supported in the NAS
Application. The Service-Type AVP SHOULD be present in all messages,
and, based on its value, additional AVPs defined in this section and
in section 7 MAY be present.
Due to space constraints, the short-form IPFltrRule is used to
represent IPFilterRule, and QoSFltrRule is used for QoSFilterRule.
+---------------------+
| AVP Flag rules |
|----+-----+----+-----|----+
AVP Section | | |SHLD| MUST| |
Attribute Name Code Defined Value Type |MUST| MAY | NOT| NOT|Encr|
-----------------------------------------|----+-----+----+-----|----|
Service-Type 6 6.1 Enumerated | M | P | | V | Y |
Callback-Number 19 6.2 UTF8String | M | P | | V | Y |
Callback-Id 20 6.3 UTF8String | M | P | | V | Y |
Idle-Timeout 28 6.4 Unsigned32 | M | P | | V | Y |
Port-Limit 62 6.5 Unsigned32 | M | P | | V | Y |
NAS-Filter-Rule 400 6.6 IPFltrRule | M | P | | V | Y |
Filter-Id 11 6.7 UTF8String | M | P | | V | Y |
Configuration- 78 6.8 OctetString| M | | | P,V | |
Token | | | | | |
QoS-Filter-Rule 407 6.9 QoSFltrRule| | | | | |
Framed-Protocol 7 6.10.1 Enumerated | M | P | | V | Y |
Framed-Routing 10 6.10.2 Enumerated | M | P | | V | Y |
Framed-MTU 12 6.10.3 Unsigned32 | M | P | | V | Y |
Framed- 13 6.10.4 Enumerated | M | P | | V | Y |
Compression | | | | | |
Framed-IP-Address 8 6.11.1 OctetString| M | P | | V | Y |
Framed-IP-Netmask 9 6.11.2 OctetString| M | P | | V | Y |
Framed-Route 22 6.11.3 UTF8String | M | P | | V | Y |
Framed-Pool 88 6.11.4 OctetString| M | P | | V | Y |
Framed- 96 6.11.5 Unsigned64 | M | P | | V | Y |
Interface-Id | | | | | |
Framed-IPv6- 97 6.11.6 OctetString| M | P | | V | Y |
Prefix | | | | | |
Framed-IPv6- 99 6.11.7 UTF8String | M | P | | V | Y |
Route | | | | | |
Framed-IPv6-Pool 100 6.11.8 OctetString| M | P | | V | Y |
Framed-IPX- 23 6.12.1 UTF8String | M | P | | V | Y |
Network | | | | | |
Framed-Appletalk- 37 6.13.1 Unsigned32 | M | P | | V | Y |
Link | | | | | |
Framed-Appletalk- 38 6.13.2 Unsigned32 | M | P | | V | Y |
Network | | | | | |
Framed-Appletalk- 39 6.13.3 OctetString| M | P | | V | Y |
Zone | | | | | |
ARAP-Features 71 6.14.1 OctetString| M | P | | V | Y |
ARAP-Zone-Access 72 6.14.2 Enumerated | M | P | | V | Y |
Login-IP-Host 14 6.15.1 OctetString| M | P | | V | Y |
Login-IPv6-Host 98 6.15.2 OctetString| M | P | | V | Y |
Login-Service 15 6.15.3 Enumerated | M | P | | V | Y |
Login-TCP-Port 16 6.16.1 Unsigned32 | M | P | | V | Y |
Login-LAT-Service 34 6.17.1 OctetString| M | P | | V | Y |
Login-LAT-Node 35 6.17.2 OctetString| M | P | | V | Y |
Login-LAT-Group 36 6.17.3 OctetString| M | P | | V | Y |
Login-LAT-Port 63 6.17.4 OctetString| M | P | | V | Y |
-----------------------------------------|----+-----+----+-----|----|
6.1. Service-Type AVP
The Service-Type AVP (AVP Code 6) is of type Enumerated and contains
the type of service the user has requested or the type of service to
be provided. One such AVP MAY be present in an authentication and/or
authorization request or response. A NAS is not required to
implement all of these service types. It MUST treat unknown or
unsupported Service-Types received in a response as a failure and end
the session with a DIAMETER_INVALID_AVP_VALUE Result-Code.
When used in a request, the Service-Type AVP SHOULD be considered a
hint to the server that the NAS believes the user would prefer the
kind of service indicated. The server is not required to honor the
hint. Furthermore, if the service specified by the server is
supported, but not compatible with the current mode of access, the
NAS MUST fail to start the session. The NAS MUST also generate the
appropriate error message(s).
The following values have been defined for the Service-Type AVP. The
complete list of defined values can be found in [RADIUS] and
[RADIUSTypes]. The following list is informational:
1 Login
2 Framed
3 Callback Login
4 Callback Framed
5 Outbound
6 Administrative
7 NAS Prompt
8 Authenticate Only
9 Callback NAS Prompt
10 Call Check
11 Callback Administrative
12 Voice
13 Fax
14 Modem Relay
15 IAPP-Register [IEEE 802.11f]
16 IAPP-AP-Check [IEEE 802.11f]
17 Authorize Only [RADDynAuth]
The following values are further qualified:
Login 1
The user should be connected to a host. The message MAY
include additional AVPs defined in sections 6.16 or 6.17.
Framed 2
A Framed Protocol, such as PPP or SLIP, should be started for
the User. The message MAY include additional AVPs defined in
section 6.10, or section 7 for tunneling services.
Callback Login 3
The user should be disconnected and called back, then connected
to a host. The message MAY include additional AVPs defined in
this section.
Callback Framed 4
The user should be disconnected and called back, and then a
Framed Protocol, such as PPP or SLIP, should be started for the
User. The message MAY include additional AVPs defined in
section 6.10, or in section 7 for tunneling services.
6.2. Callback-Number AVP
The Callback-Number AVP (AVP Code 19) is of type UTF8String and
contains a dialing string to be used for callback. It MAY be used in
an authentication and/or authorization request as a hint to the
server that a Callback service is desired, but the server is not
required to honor the hint in the corresponding response.
The codification of this field’s allowed usage range is outside the
scope of this specification.
6.3. Callback-Id AVP
The Callback-Id AVP (AVP Code 20) is of type UTF8String and contains
the name of a place to be called, to be interpreted by the NAS. This
AVP MAY be present in an authentication and/or authorization
response.
This AVP is not roaming-friendly as it assumes that the Callback-Id
is configured on the NAS. Using the Callback-Number AVP therefore
preferable.
6.4. Idle-Timeout AVP
The Idle-Timeout AVP (AVP Code 28) is of type Unsigned32 and sets the
maximum number of consecutive seconds of idle connection allowable to
the user before termination of the session or before a prompt is
issued. The default is none, or system specific.
6.5. Port-Limit AVP
The Port-Limit AVP (AVP Code 62) is of type Unsigned32 and sets the
maximum number of ports the NAS provides to the user. It MAY be used
in an authentication and/or authorization request as a hint to the
server that multilink PPP [PPPMP] service is desired, but the server
is not required to honor the hint in the corresponding response.
6.6. NAS-Filter-Rule AVP
The NAS-Filter-Rule AVP (AVP Code 400) is of type IPFilterRule and
provides filter rules that need to be configured on the NAS for the
user. One or more of these AVPs MAY be present in an authorization
response.
6.7. Filter-Id AVP
The Filter-Id AVP (AVP Code 11) is of type UTF8String and contains
the name of the filter list for this user. Zero or more Filter-Id
AVPs MAY be sent in an authorization answer.
Identifying a filter list by name allows the filter to be used on
different NASes without regard to filter-list implementation details.
However, this AVP is not roaming friendly, as filter naming differs
from one service provider to another.
In non-RADIUS environments, it is RECOMMENDED that the NAS-Filter-
Rule AVP be used instead.
6.8. Configuration-Token AVP
The Configuration-Token AVP (AVP Code 78) is of type OctetString and
is sent by a Diameter Server to a Diameter Proxy Agent or Translation
Agent in an AA-Answer command to indicate a type of user profile to
be used. It should not be sent to a Diameter Client (NAS).
The format of the Data field of this AVP is site specific.
6.9. QoS-Filter-Rule AVP
The QoS-Filter-Rule AVP (AVP Code 407) is of type QoSFilterRule and
provides QoS filter rules that need to be configured on the NAS for
the user. One or more such AVPs MAY be present in an authorization
response.
Note: Due to an editorial mistake in [BASE], only the AVP format is
discussed. The complete QoSFilterRule definition was not included.
It is reprinted here for clarification.
QoSFilterRule
The QosFilterRule format is derived from the OctetString AVP Base
Format. It uses the ASCII charset. Packets may be marked or
metered based on the following information:
Direction (in or out)
Source and destination IP address (possibly masked)
Protocol
Source and destination port (lists or ranges)
DSCP values (no mask or range)
Rules for the appropriate direction are evaluated in order; the
first matched rule terminates the evaluation. Each packet is
evaluated once. If no rule matches, the packet is treated as best
effort. An access device unable to interpret or apply a QoS rule
SHOULD NOT terminate the session.
QoSFilterRule filters MUST follow the following format:
action dir proto from src to dst [options]
tag - Mark packet with a specific DSCP