Address attribute value. Diameter/RADIUS translation agents MUST
check a received NAS-IP-Address or NAS-IPv6-Address attribute against
the source address of the RADIUS packet. If they do not match and
the Diameter/RADIUS translation agent does not know whether the
packet was sent by a RADIUS proxy or NAS (e.g., no Proxy-State
attribute), then by default it is assumed that the source address
corresponds to a RADIUS proxy, and that the NAS Address is behind
that proxy, potentially with some additional RADIUS proxies in
between. The Diameter/RADIUS translation agent MUST insert entries
in the Route-Record AVP corresponding to the apparent route. This
implies doing a reverse lookup on the source address and NAS-IP-
Address or NAS-IPv6-Address attributes to determine the corresponding
FQDNs.
If the source address and the NAS-IP-Address or NAS-IPv6-Address do
not match, and the Diameter/RADIUS translation agent knows that it is
talking directly to the NAS (e.g., there are no RADIUS proxies
between it and the NAS), then the error should be logged, and the
packet MUST be discarded.
Diameter agents and servers MUST check whether the NAS-IP-Address AVP
corresponds to an entry in the Route-Record AVP. This is done by
doing a reverse lookup (PTR RR) for the NAS-IP-Address to retrieve
the corresponding FQDN, and by checking for a match with the Route-
Record AVP. If no match is found, then an error is logged, but no
other action is taken.
9.3.3. NAS-IPv6-Address AVP
The NAS-IPv6-Address AVP (AVP Code 95) [RADIUSIPv6] is of type
OctetString and contains the IPv6 Address of the NAS providing
service to the user. This AVP SHOULD only be added by a
RADIUS/Diameter Translation Agent. When this AVP is present, the
Origin-Host AVP identifies the NAS providing service to the user.
In RADIUS it would be possible for a rogue NAS to forge the NAS-
IPv6-Address attribute. Diameter/RADIUS translation agents MUST
check a received NAS-IPv6-Address attribute against the source
address of the RADIUS packet. If they do not match and the
Diameter/RADIUS translation agent does not know whether the packet
was sent by a RADIUS proxy or NAS (e.g., no Proxy-State attribute),
then by default it is assumed that the source address corresponds to
a RADIUS proxy, and that the NAS-IPv6-Address is behind that proxy,
potentially with some additional RADIUS proxies in between. The
Diameter/RADIUS translation agent MUST insert entries in the Route-
Record AVP corresponding to the apparent route. This implies doing a
reverse lookup on the source address and NAS-IPv6-Address attributes
to determine the corresponding FQDNs.
If the source address and the NAS-IPv6-Address do not match, and the
Diameter/RADIUS translation agent knows that it is talking directly
to the NAS (e.g., there are no RADIUS proxies between it and the
NAS), then the error should be logged, and the packet MUST be
discarded.
Diameter agents and servers MUST check whether the NAS-IPv6-Address
AVP corresponds to an entry in the Route-Record AVP. This is done by
doing a reverse lookup (PTR RR) for the NAS-IPv6-Address to retrieve
the corresponding FQDN, and by checking for a match with the Record-
Route AVP. If no match is found, then an error is logged, but no
other action is taken.
9.3.4. State AVP
The State AVP (AVP Code 24) [RADIUS] is of type OctetString and has
two uses in the Diameter NAS application.
The State AVP MAY be sent by a Diameter Server to a NAS in an AA-
Response command that contains a Result-Code of
DIAMETER_MULTI_ROUND_AUTH. If so, the NAS MUST return it unmodified
in the subsequent AA-Request command.
The State AVP MAY also be sent by a Diameter Server to a NAS in an
AA-Response command that also includes a Termination-Action AVP with
the value of AA-REQUEST. If the NAS performs the Termination-Action
by sending a new AA-Request command upon termination of the current
service, it MUST return the State AVP unmodified in the new request
command.
In either usage, the NAS MUST NOT interpret the AVP locally. Usage
of the State AVP is implementation dependent.
9.3.5. Termination-Cause AVP Code Values
This section defines a mapping between Termination-Cause AVP code
values and RADIUS Acct-Terminate-Cause attribute code values from RFC
2866 [RADIUSAcct] and [RADIUSTypes], thereby allowing a
RADIUS/Diameter Translation Agent to convert between the attribute
and AVP values. This section thus extends the definitions in the
"Termination-Cause AVP" section of the Base Diameter specification.
The table in this section defines the mapping between Termination-
Cause AVP and RADIUS Acct-Terminate-Cause causes.
+-----------------------+
| Value |
+-----------+-----------+
Cause Value Name | RADIUS | Diameter |
------------------------------|-----------+-----------+
User Request | 1 | 11 |
Lost Carrier | 2 | 12 |
Lost Service | 3 | 13 |
Idle Timeout | 4 | 14 |
Session Timeout | 5 | 15 |
Admin Reset | 6 | 16 |
Admin Reboot | 7 | 17 |
Port Error | 8 | 18 |
NAS Error | 9 | 19 |
NAS Request | 10 | 20 |
NAS Reboot | 11 | 21 |
Port Unneeded | 12 | 22 |
Port Preempted | 13 | 23 |
Port Suspended | 14 | 24 |
Service Unavailable | 15 | 25 |
Callback | 16 | 26 |
User Error | 17 | 27 |
Host Request | 18 | 28 |
Supplicant Restart | 19 | 29 | [RAD802.1X]
Reauthentication Failure | 20 | 30 | [RAD802.1X]
Port Reinit | 21 | 31 | [RAD802.1X]
Port Disabled | 22 | 32 | [RAD802.1X]
------------------------------|-----------+-----------+
From RFC 2866, the termination causes are as follows:
User Request User requested termination of service, for
example with LCP Terminate or by logging out.
Lost Carrier DCD was dropped on the port.
Lost Service Service can no longer be provided; for
example, user’s connection to a host was
interrupted.
Idle Timeout Idle timer expired.
Session Timeout Maximum session length timer expired.
Admin Reset Administrator reset the port or session.
Admin Reboot Administrator is ending service on the NAS,
for example, prior to rebooting the NAS.
Port Error NAS detected an error on the port that
required ending the session.
NAS Error NAS detected an error (other than on the
port) that required ending the session.
NAS Request NAS ended the session for a non-error reason not
otherwise listed here.
NAS Reboot NAS ended the session to reboot
non-administratively ("crash").
Port Unneeded NAS ended the session because resource usage
fell below a low-water mark (for example, if
a bandwidth-on-demand algorithm decided that
the port was no longer needed).
Port Preempted NAS ended the session to allocate the
port to a higher priority use.
Port Suspended NAS ended the session to suspend a virtual
session.
Service Unavailable NAS was unable to provide requested service.
Callback NAS is terminating the current session
to perform callback for a new session.
User Error Input from user is in error, causing
session termination.
Host Request Login Host terminated session normally.
9.3.6. Origin-AAA-Protocol
The Origin-AAA-Protocol AVP (AVP Code 408) is of the type Enumerated
and should be inserted in a Diameter message translated by a gateway
system from another AAA protocol, such as RADIUS. It identifies the
source protocol of the message to the Diameter system receiving the
message.
The supported values are:
1 RADIUS
9.4. Prohibited RADIUS Attributes
The following RADIUS attributes MUST NOT appear in a Diameter
message. Instead, they are translated to other Diameter AVPs or
handled in some special manner. The rules for the treatment of the
attributes are discussed in sections 9.1, 9.2, and 9.6.
Attribute Description Defined Nearest Diameter AVP
-----------------------------------------------------------------
3 CHAP-Password RFC 2865 CHAP-Auth Group
26 Vendor-Specific RFC 2865 Vendor Specific AVP
29 Termination-Action RFC 2865 Authorization-Lifetime
40 Acct-Status-Type RFC 2866 Accounting-Record-Type
42 Acct-Input-Octets RFC 2866 Accounting-Input-Octets
43 Acct-Output-Octets RFC 2866 Accounting-Output-Octets
47 Acct-Input-Packets RFC 2866 Accounting-Input-Packets
48 Acct-Output-Packets RFC 2866 Accounting-Output-Packets
49 Acct-Terminate-Cause RFC 2866 Termination-Cause
52 Acct-Input-Gigawords RFC 2869 Accounting-Input-Octets
53 Acct-Output-Gigawords RFC 2869 Accounting-Output-Octets
80 Message-Authenticator RFC 2869 none - check and discard
9.5. Translatable Diameter AVPs
In general, Diameter AVPs that are not RADIUS compatible have code
values greater than 255. The table in the section above shows the
AVPs that can be converted into RADIUS attributes.
Another problem may occur with Diameter AVP values that may be more
than 253 octets in length. Some RADIUS attributes (including but not
limited to (8)Reply-Message, (79)EAP-Message, and (77)Connect-Info)
allow concatenation of multiple instances to overcome this
limitation. If this is not possible, a Result-Code of
DIAMETER_INVALID_AVP_LENGTH should be returned.
9.6. RADIUS Vendor Specific Attributes
RADIUS supports the inclusion of Vendor Specific Attributes (VSAs)
through the use of attribute 26. The recommended format [RADIUS] of
the attribute data field includes a 4 octet vendor code followed by a
one octet vendor type field and a one octet length field. The last
two fields MAY be repeated.
A system communicating between Diameter and RADIUS MAY have specific
knowledge of vendor formats, and MAY be able to translate between the
two formats. However, given the deployment of many RADIUS vendor
formats that do not follow the example format in RFC 2865 [RADIUS],
(e.g., those that use a longer vendor type code) the translations in
the next two sections will not work in general for those VSAs. RFC
2865 states that a robust implementation SHOULD support the field as
undistinguished octets.
Systems that don’t have vendor format knowledge MAY discard such
attributes without knowing a suitable translation. An alternative
format is under consideration [VSA], which proposes encodings that
would preserve the native information and not require vendor
knowledge in the gateway system.
The following sections are an example for translating RADIUS VSAs
that use the example RADIUS format, and Diameter VSAs that have type
codes less than 255, and value field lengths less than 252.
9.6.1. Forwarding a Diameter Vendor Specific AVP as a RADIUS VSA
For Type codes less than 255, the value field length MUST be less
than 252 or the AVP will be discarded. The RADIUS VSA attribute
should consist of the following fields;
RADIUS Type = 26, Vendor Specific Attribute
RADIUS Length = total length of attribute (header + data)
RADIUS Vendor code = Diameter Vendor code
RADIUS Vendor type code = low order byte of Diameter AVP code
RADIUS Vendor data length = length of Diameter data
If the Diameter AVP code is greater than 255, then the RADIUS
speaking code may use a Vendor specific field coding, if it knows one
for that vendor. Otherwise, the AVP will be ignored. If it is
flagged as Mandatory, a "DIAMETER_AVP_UNSUPPORTED" Result-Code will
be returned, and the RADIUS message will not be sent.
9.6.2. Forwarding a RADIUS VSA as a Diameter Vendor Specific AVP
The Diameter AVP will consist of the following fields:
Diameter Flags: V=1, M=0, P=0
Diameter Vendor code = RADIUS VSA Vendor code
Diameter AVP code = RADIUS VSA Vendor type code
Diameter AVP length = length of AVP (header + data)
Diameter Data = RADIUS VSA vendor data
Note that the VSAs are considered optional by RADIUS rules, and this
specification does not set the Mandatory flag. If an implementor
desires a VSA be made mandatory because it represents a required
service policy, the RADIUS gateway should have a process to set the
bit on the Diameter side.
If the RADIUS receiving code knows of vendor specific field
interpretations for the specific vendor, it may employ them to parse
an extended AVP code or data length. Otherwise the recommended
standard fields will be used.
Nested Multiple vendor data fields MUST be expanded into multiple
Diameter AVPs.
10. AVP Occurrence Tables
The following tables present the AVPs used by NAS applications in NAS
messages and specify in which Diameter messages they MAY or MAY NOT
be present. [BASE] messages and AVPs are not described in this
document. Note that AVPs that can only be present within a Grouped
AVP are not represented in this table.
The table uses the following symbols:
0 The AVP MUST NOT be present in the message.
0+ Zero or more instances of the AVP MAY be present in the
message.
0-1 Zero or one instance of the AVP MAY be present in the
message.
1 One instance of the AVP MUST be present in the message.
10.1. AA-Request/Answer AVP Table
The table in this section is limited to the Command Codes defined in
this specification.
+-----------+
| Command |
|-----+-----+
Attribute Name | AAR | AAA |
------------------------------|-----+-----+
Acct-Interim-Interval | 0 | 0-1 |
ARAP-Challenge-Response | 0 | 0-1 |
ARAP-Features | 0 | 0-1 |
ARAP-Password | 0-1 | 0 |
ARAP-Security | 0-1 | 0-1 |
ARAP-Security-Data | 0+ | 0+ |
ARAP-Zone-Access | 0 | 0-1 |
Auth-Application-Id | 1 | 1 |
Auth-Grace-Period | 0-1 | 0-1 |
Auth-Request-Type | 1 | 1 |
Auth-Session-State | 0-1 | 0-1 |
Authorization-Lifetime | 0-1 | 0-1 |
------------------------------|-----+-----+
+-----------+
| Command |
|-----+-----+
Attribute Name | AAR | AAA |
------------------------------|-----+-----+
Callback-Id | 0 | 0-1 |
Callback-Number | 0-1 | 0-1 |
Called-Station-Id | 0-1 | 0 |
Calling-Station-Id | 0-1 | 0 |
CHAP-Auth | 0-1 | 0 |
CHAP-Challenge | 0-1 | 0 |
Class | 0 | 0+ |
Configuration-Token | 0 | 0+ |
Connect-Info | 0+ | 0 |
Destination-Host | 0-1 | 0 |
Destination-Realm | 1 | 0 |
Error-Message | 0 | 0-1 |
Error-Reporting-Host | 0 | 0-1 |
Failed-AVP | 0+ | 0+ |
Filter-Id | 0 | 0+ |
Framed-Appletalk-Link | 0 | 0-1 |
Framed-Appletalk-Network | 0 | 0+ |
Framed-Appletalk-Zone | 0 | 0-1 |
Framed-Compression | 0+ | 0+ |
Framed-Interface-Id | 0-1 | 0-1 |
Framed-IP-Address | 0-1 | 0-1 |
Framed-IP-Netmask | 0-1 | 0-1 |
Framed-IPv6-Prefix | 0+ | 0+ |
Framed-IPv6-Pool | 0 | 0-1 |
Framed-IPv6-Route | 0 | 0+ |
Framed-IPX-Network | 0 | 0-1 |
Framed-MTU | 0-1 | 0-1 |
Framed-Pool | 0 | 0-1 |
Framed-Protocol | 0-1 | 0-1 |
Framed-Route | 0 | 0+ |
Framed-Routing | 0 | 0-1 |
Idle-Timeout | 0 | 0-1 |
Login-IP-Host | 0+ | 0+ |
Login-IPv6-Host | 0+ | 0+ |
Login-LAT-Group | 0-1 | 0-1 |
Login-LAT-Node | 0-1 | 0-1 |
Login-LAT-Port | 0-1 | 0-1 |
Login-LAT-Service | 0-1 | 0-1 |
Login-Service | 0 | 0-1 |
Login-TCP-Port | 0 | 0-1 |
Multi-Round-Time-Out | 0 | 0-1 |
------------------------------|-----+-----+
+-----------+
| Command |
|-----+-----+
Attribute Name | AAR | AAA |
------------------------------|-----+-----+
NAS-Filter-Rule | 0 | 0+ |
NAS-Identifier | 0-1 | 0 |
NAS-IP-Address | 0-1 | 0 |
NAS-IPv6-Address | 0-1 | 0 |
NAS-Port | 0-1 | 0 |
NAS-Port-Id | 0-1 | 0 |
NAS-Port-Type | 0-1 | 0 |
Origin-AAA-Protocol | 0-1 | 0-1 |
Origin-Host | 1 | 1 |
Origin-Realm | 1 | 1 |
Origin-State-Id | 0-1 | 0-1 |
Originating-Line-Info | 0-1 | 0 |
Password-Retry | 0 | 0-1 |
Port-Limit | 0-1 | 0-1 |
Prompt | 0 | 0-1 |
Proxy-Info | 0+ | 0+ |
QoS-Filter-Rule | 0 | 0+ |
Re-Auth-Request-Type | 0 | 0-1 |
Redirect-Host | 0 | 0+ |