[DIFFSERV]. The DSCP option MUST be
included.
meter - Meter traffic. The metering options
MUST be included.
dir The format is as described under IPFilterRule.
proto The format is as described under IPFilterRule.
src and dst The format is as described under IPFilterRule.
options:
DSCP <color>
Color values as defined in [DIFFSERV]. Exact
matching of DSCP values is required (no masks or
ranges).
metering <rate> <color_under> <color_over>
The metering option provides Assured Forwarding,
as defined in [DIFFSERVAF], and MUST be present
if the action is set to meter. The rate option is
the throughput, in bits per second, used
by the access device to mark packets. Traffic
over the rate is marked with the color_over
codepoint, and traffic under the rate is marked
with the color_under codepoint. The color_under
and color_over options contain the drop
preferences and MUST conform to the recommended
codepoint keywords described in [DIFFSERVAF]
(e.g., AF13).
The metering option also supports the strict
limit on traffic required by Expedited
Forwarding, as defined in [DIFFSERVEF]. The
color_over option may contain the keyword "drop"
to prevent forwarding of traffic that exceeds the
rate parameter.
The rule syntax is a modified subset of ipfw(8) from FreeBSD,
and the ipfw.c code may provide a useful base for
implementations.
6.10. Framed Access Authorization AVPs
This section lists the authorization AVPs necessary to
support framed access, such as PPP and SLIP. AVPs defined in this
section MAY be present in a message if the Service-Type AVP was set
to "Framed" or "Callback Framed".
6.10.1. Framed-Protocol AVP
The Framed-Protocol AVP (AVP Code 7) is of type Enumerated and
contains the framing to be used for framed access. This AVP MAY be
present in both requests and responses. The supported values are
listed in [RADIUSTypes]. The following list is informational:
1 PPP
2 SLIP
3 AppleTalk Remote Access Protocol (ARAP)
4 Gandalf proprietary SingleLink/MultiLink protocol
5 Xylogics proprietary IPX/SLIP
6 X.75 Synchronous
6.10.2. Framed-Routing AVP
The Framed-Routing AVP (AVP Code 10) is of type Enumerated and
contains the routing method for the user when the user is a router to
a network. This AVP SHOULD only be present in authorization
responses. The supported values are listed in [RADIUSTypes]. The
following list is informational:
0 None
1 Send routing packets
2 Listen for routing packets
3 Send and Listen
6.10.3. Framed-MTU AVP
The Framed-MTU AVP (AVP Code 12) is of type Unsigned32 and contains
the Maximum Transmission Unit to be configured for the user, when it
is not negotiated by some other means (such as PPP). This AVP SHOULD
only be present in authorization responses. The MTU value MUST be in
the range from 64 to 65535.
6.10.4. Framed-Compression AVP
The Framed-Compression AVP (AVP Code 13) is of type Enumerated and
contains the compression protocol to be used for the link. It MAY be
used in an authorization request as a hint to the server that a
specific compression type is desired, but the server is not required
to honor the hint in the corresponding response.
More than one compression protocol AVP MAY be sent. The NAS is
responsible for applying the proper compression protocol to the
appropriate link traffic.
The supported values are listed in [RADIUSTypes]. The following list
is informational:
0 None
1 VJ TCP/IP header compression
2 IPX header compression
3 Stac-LZS compression
6.11. IP Access Authorization AVPs
The AVPs defined in this section are used when the user requests, or
is being granted, access service to IP.
6.11.1. Framed-IP-Address AVP
The Framed-IP-Address AVP (AVP Code 8) [RADIUS] is of type
OctetString and contains an IPv4 address of the type specified in the
attribute value to be configured for the user. It MAY be used in an
authorization request as a hint to the server that a specific address
is desired, but the server is not required to honor the hint in the
corresponding response.
Two values have special significance: 0xFFFFFFFF and 0xFFFFFFFE. The
value 0xFFFFFFFF indicates that the NAS should allow the user to
select an address (i.e., negotiated). The value 0xFFFFFFFE indicates
that the NAS should select an address for the user (e.g., assigned
from a pool of addresses kept by the NAS).
6.11.2. Framed-IP-Netmask AVP
The Framed-IP-Netmask AVP (AVP Code 9) is of type OctetString and
contains the four octets of the IPv4 netmask to be configured for the
user when the user is a router to a network. It MAY be used in an
authorization request as a hint to the server that a specific netmask
is desired, but the server is not required to honor the hint in the
corresponding response. This AVP MUST be present in a response if
the request included this AVP with a value of 0xFFFFFFFF.
6.11.3. Framed-Route AVP
The Framed-Route AVP (AVP Code 22) is of type UTF8String and contains
the ASCII routing information to be configured for the user on the
NAS. Zero or more of these AVPs MAY be present in an authorization
response.
The string MUST contain a destination prefix in dotted quad form
optionally followed by a slash and a decimal length specifier stating
how many high-order bits of the prefix should be used. This is
followed by a space, a gateway address in dotted quad form, a space,
and one or more metrics separated by spaces; for example,
"192.168.1.0/24 192.168.1.1 1".
The length specifier may be omitted, in which case it should default
to 8 bits for class A prefixes, to 16 bits for class B prefixes, and
to 24 bits for class C prefixes; for example,
"192.168.1.0 192.168.1.1 1".
Whenever the gateway address is specified as "0.0.0.0" the IP address
of the user SHOULD be used as the gateway address.
6.11.4. Framed-Pool AVP
The Framed-Pool AVP (AVP Code 88) is of type OctetString and contains
the name of an assigned address pool that SHOULD be used to assign an
address for the user. If a NAS does not support multiple address
pools, the NAS SHOULD ignore this AVP. Address pools are usually
used for IP addresses but can be used for other protocols if the NAS
supports pools for those protocols.
Although specified as type OctetString for compatibility with RADIUS
[RADIUSExt], the encoding of the Data field SHOULD also conform to
the rules for the UTF8String Data Format.
6.11.5. Framed-Interface-Id AVP
The Framed-Interface-Id AVP (AVP Code 96) is of type Unsigned64 and
contains the IPv6 interface identifier to be configured for the user.
It MAY be used in authorization requests as a hint to the server that
a specific interface id is desired, but the server is not required to
honor the hint in the corresponding response.
6.11.6. Framed-IPv6-Prefix AVP
The Framed-IPv6-Prefix AVP (AVP Code 97) is of type OctetString and
contains the IPv6 prefix to be configured for the user. One or more
AVPs MAY be used in authorization requests as a hint to the server
that specific IPv6 prefixes are desired, but the server is not
required to honor the hint in the corresponding response.
6.11.7. Framed-IPv6-Route AVP
The Framed-IPv6-Route AVP (AVP Code 99) is of type UTF8String and
contains the ASCII routing information to be configured for the user
on the NAS. Zero or more of these AVPs MAY be present in an
authorization response.
The string MUST contain an IPv6 address prefix followed by a slash
and a decimal length specifier stating how many high order bits of
the prefix should be used. This is followed by a space, a gateway
address in hexadecimal notation, a space, and one or more metrics
separated by spaces; for example,
"2000:0:0:106::/64 2000::106:a00:20ff:fe99:a998 1".
Whenever the gateway address is the IPv6 unspecified address, the IP
address of the user SHOULD be used as the gateway address, such as
in:
"2000:0:0:106::/64 :: 1".
6.11.8. Framed-IPv6-Pool AVP
The Framed-IPv6-Pool AVP (AVP Code 100) is of type OctetString and
contains the name of an assigned pool that SHOULD be used to assign
an IPv6 prefix for the user. If the access device does not support
multiple prefix pools, it MUST ignore this AVP.
Although specified as type OctetString for compatibility with RADIUS
[RADIUSIPv6], the encoding of the Data field SHOULD also conform to
the rules for the UTF8String Data Format.
6.12. IPX Access
The AVPs defined in this section are used when the user requests, or
is being granted, access to an IPX network service.
6.12.1. Framed-IPX-Network AVP
The Framed-IPX-Network AVP (AVP Code 23) is of type Unsigned32 and
contains the IPX Network number to be configured for the user. It
MAY be used in an authorization request as a hint to the server that
a specific address is desired, but the server is not required to
honor the hint in the corresponding response.
Two addresses have special significance: 0xFFFFFFFF and 0xFFFFFFFE.
The value 0xFFFFFFFF indicates that the NAS should allow the user to
select an address (i.e., Negotiated). The value 0xFFFFFFFE indicates
that the NAS should select an address for the user (e.g., assign it
from a pool of one or more IPX networks kept by the NAS).
6.13. AppleTalk Network Access
The AVPs defined in this section are used when the user requests, or
is being granted, access to an AppleTalk network [AppleTalk].
6.13.1. Framed-AppleTalk-Link AVP
The Framed-AppleTalk-Link AVP (AVP Code 37) is of type Unsigned32 and
contains the AppleTalk network number that should be used for the
serial link to the user, which is another AppleTalk router. This AVP
MUST only be present in an authorization response and is never used
when the user is not another router.
Despite the size of the field, values range from 0 to 65,535. The
special value of 0 indicates an unnumbered serial link. A value of 1
to 65,535 means that the serial line between the NAS and the user
should be assigned that value as an AppleTalk network number.
6.13.2. Framed-AppleTalk-Network AVP
The Framed-AppleTalk-Network AVP (AVP Code 38) is of type Unsigned32
and contains the AppleTalk Network number that the NAS should probe
to allocate an AppleTalk node for the user. This AVP MUST only be
present in an authorization response and is never used when the user
is not another router. Multiple instances of this AVP indicate that
the NAS may probe, using any of the network numbers specified.
Despite the size of the field, values range from 0 to 65,535. The
special value 0 indicates that the NAS should assign a network for
the user, using its default cable range. A value between 1 and
65,535 (inclusive) indicates to the AppleTalk Network that the NAS
should probe to find an address for the user.
6.13.3. Framed-AppleTalk-Zone AVP
The Framed-AppleTalk-Zone AVP (AVP Code 39) is of type OctetString
and contains the AppleTalk Default Zone to be used for this user.
This AVP MUST only be present in an authorization response. Multiple
instances of this AVP in the same message are not allowed.
The codification of this field’s allowed range is outside the scope
of this specification.
6.14. AppleTalk Remote Access
The AVPs defined in this section are used when the user requests, or
is being granted, access to the AppleTalk network via the AppleTalk
Remote Access Protocol [ARAP]. They are only present if the Framed-
Protocol AVP (see section 6.10.1) is set to ARAP. Section 2.2 of RFC
2869 [RADIUSExt] describes the operational use of these attributes.
6.14.1. ARAP-Features AVP
The ARAP-Features AVP (AVP Code 71) is of type OctetString and MAY be
present in the AA-Accept message if the Framed-Protocol AVP is set to
the value of ARAP. See [RADIUSExt] for more information about the
format of this AVP.
6.14.2. ARAP-Zone-Access AVP
The ARAP-Zone-Access AVP (AVP Code 72) is of type Enumerated and MAY
be present in the AA-Accept message if the Framed-Protocol AVP is set
to the value of ARAP.
The supported values are listed in [RADIUSTypes] and defined in
[RADIUSExt].
6.15. Non-Framed Access Authorization AVPs
This section contains the authorization AVPs that are needed to
support terminal server functionality. AVPs defined in this section
MAY be present in a message if the Service-Type AVP was set to
"Login" or "Callback Login".
6.15.1. Login-IP-Host AVP
The Login-IP-Host AVP (AVP Code 14) [RADIUS] is of type OctetString
and contains the IPv4 address of a host with which to connect the
user when the Login-Service AVP is included. It MAY be used in an
AA-Request command as a hint to the Diameter Server that a specific
host is desired, but the Diameter Server is not required to honor the
hint in the AA-Answer.
Two addresses have special significance: all ones and 0. The value
of all ones indicates that the NAS SHOULD allow the user to select an
address. The value 0 indicates that the NAS SHOULD select a host to
connect the user to.
6.15.2. Login-IPv6-Host AVP
The Login-IPv6-Host AVP (AVP Code 98) [RADIUSIPv6] is of type
OctetString and contains the IPv6 address of a host with which to
connect the user when the Login-Service AVP is included. It MAY be
used in an AA-Request command as a hint to the Diameter Server that a
specific host is desired, but the Diameter Server is not required to
honor the hint in the AA-Answer.
Two addresses have special significance:
0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF and 0. The value
0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF indicates that the NAS SHOULD
allow the user to select an address. The value 0 indicates that the
NAS SHOULD select a host to connect the user to.
6.15.3. Login-Service AVP
The Login-Service AVP (AVP Code 15) is of type Enumerated and
contains the service that should be used to connect the user to the
login host. This AVP SHOULD only be present in authorization
responses.
The supported values are listed in [RADIUSTypes]. The following list
is informational:
0 Telnet
1 Rlogin
2 TCP Clear
3 PortMaster (proprietary)
4 LAT
5 X25-PAD
6 X25-T3POS
8 TCP Clear Quiet (suppresses any NAS-generated connect
string)
6.16. TCP Services
The AVPs described in this section MAY be present if the Login-
Service AVP is set to Telnet, Rlogin, TCP Clear, or TCP Clear Quiet.
6.16.1. Login-TCP-Port AVP
The Login-TCP-Port AVP (AVP Code 16) is of type Unsigned32 and
contains the TCP port with which the user is to be connected when the
Login-Service AVP is also present. This AVP SHOULD only be present
in authorization responses. The value MUST NOT be greater than
65,535.
6.17. LAT Services
The AVPs described in this section MAY be present if the Login-
Service AVP is set to LAT [LAT].
6.17.1. Login-LAT-Service AVP
The Login-LAT-Service AVP (AVP Code 34) is of type OctetString and
contains the system with which the user is to be connected by LAT.
It MAY be used in an authorization request as a hint to the server
that a specific service is desired, but the server is not required to
honor the hint in the corresponding response. This AVP MUST only be
present in the response if the Login-Service AVP states that LAT is
desired.
Administrators use this service attribute when dealing with clustered
systems, such as a VAX or Alpha cluster. In these environments,
several different time-sharing hosts share the same resources (disks,
printers, etc.), and administrators often configure each host to
offer access (service) to each of the shared resources. In this
case, each host in the cluster advertises its services through LAT
broadcasts.
Sophisticated users often know which service providers (machines) are
faster and tend to use a node name when initiating a LAT connection.
Some administrators want particular users to use certain machines as
a primitive form of load balancing (although LAT knows how to do load
balancing itself).
The String field contains the identity of the LAT service to use.
The LAT Architecture allows this string to contain $ (dollar), -
(hyphen), . (period), _ (underscore), numerics, upper- and lowercase
alphabetics, and the ISO Latin-1 character set extension [ISOLatin].
All LAT string comparisons are case insensitive.
6.17.2. Login-LAT-Node AVP
The Login-LAT-Node AVP (AVP Code 35) is of type OctetString and
contains the Node with which the user is to be automatically
connected by LAT. It MAY be used in an authorization request as a
hint to the server that a specific LAT node is desired, but the
server is not required to honor the hint in the corresponding
response. This AVP MUST only be present in a response if the Login-
Service-Type AVP is set to LAT.
The String field contains the identity of the LAT service to use.
The LAT Architecture allows this string to contain $ (dollar), -
(hyphen), . (period), _ (underscore), numerics, upper- and lowercase
alphabetics, and the ISO Latin-1 character set extension [ISOLatin].
All LAT string comparisons are case insensitive.
6.17.3. Login-LAT-Group AVP
The Login-LAT-Group AVP (AVP Code 36) is of type OctetString and
contains a string identifying the LAT group codes this user is
authorized to use. It MAY be used in an authorization request as a
hint to the server that a specific group is desired, but the server
is not required to honor the hint in the corresponding response.
This AVP MUST only be present in a response if the Login-Service-Type
AVP is set to LAT.
LAT supports 256 different group codes, which LAT uses as a form of
access rights. LAT encodes the group codes as a 256-bit bitmap.
Administrators can assign one or more of the group code bits at the
LAT service provider; it will only accept LAT connections that have
these group codes set in the bitmap. The administrators assign a
bitmap of authorized group codes to each user. LAT gets these from
the operating system and uses them in its requests to the service
providers.
The codification of the range of allowed usage of this field is
outside the scope of this specification.
6.17.4. Login-LAT-Port AVP
The Login-LAT-Port AVP (AVP Code 63) is of type OctetString and
contains the Port with which the user is to be connected by LAT. It
MAY be used in an authorization request as a hint to the server that
a specific port is desired, but the server is not required to honor
the hint in the corresponding response. This AVP MUST only be
present in a response if the Login-Service-Type AVP is set to LAT.
The String field contains the identity of the LAT service to use.
The LAT Architecture allows this string to contain $ (dollar), -
(hyphen), . (period), _ (underscore), numerics, upper- and lower-case
alphabetics, and the ISO Latin-1 character set extension [ISOLatin].
All LAT string comparisons are case insensitive.
7. NAS Tunneling
Some NASes support compulsory tunnel services in which the incoming
connection data is conveyed by an encapsulation method to a gateway
elsewhere in the network. This is typically transparent to the
service user, and the tunnel characteristics may be described by the
remote AAA server, based on the user’s authorization information.
Several tunnel characteristics may be returned, and the NAS
implementation may choose one [RADTunnels], [RADTunlAcct].
+---------------------+
| AVP Flag rules |
|----+-----+----+-----|----+
AVP Section | | |SHLD| MUST| |
Attribute Name Code Defined Value Type |MUST| MAY | NOT| NOT |Encr|
-----------------------------------------|----+-----+----+-----|----|
Tunneling 401 7.1 Grouped | M | P | | V | N |
Tunnel-Type 64 7.2 Enumerated | M | P | | V | Y |
Tunnel-Medium- 65 7.3 Enumerated | M | P | | V | Y |
Type | | | | | |
Tunnel-Client- 66 7.4 UTF8String | M | P | | V | Y |
Endpoint | | | | | |
Tunnel-Server- 67 7.5 UTF8String | M | P | | V | Y |
Endpoint | | | | | |
Tunnel-Password 69 7.6 OctetString| M | P | | V | Y |
Tunnel-Private- 81 7.7 OctetString| M | P | | V | Y |
Group-Id | | | | | |
Tunnel- 82 7.8 OctetString| M | P | | V | Y |
Assignment-Id | | | | | |
Tunnel-Preference 83 7.9 Unsigned32 | M | P | | V | Y |
Tunnel-Client- 90 7.10 UTF8String | M | P | | V | Y |
Auth-Id | | | | | |
Tunnel-Server- 91 7.11 UTF8String | M | P | | V | Y |
Auth-Id | | | | | |
-----------------------------------------|----+-----+----+-----|----|
7.1. Tunneling AVP
The Tunneling AVP (AVP Code 401) is of type Grouped and contains the