Redirect-Host-Usage | 0 | 0-1 |
Redirect-Max-Cache-Time | 0 | 0-1 |
Reply-Message | 0 | 0+ |
Result-Code | 0 | 1 |
Route-Record | 0+ | 0+ |
Service-Type | 0-1 | 0-1 |
Session-Id | 1 | 1 |
Session-Timeout | 0 | 0-1 |
State | 0-1 | 0-1 |
Tunneling | 0+ | 0+ |
User-Name | 0-1 | 0-1 |
User-Password | 0-1 | 0 |
------------------------------|-----+-----+
10.2. Accounting AVP Tables
The tables in this section are used to show which AVPs defined in
this document are to be present and used in NAS application
Accounting messages. These AVPs are defined in this document, as
well as in [BASE] and [RADIUSAcct].
10.2.1. Accounting Framed Access AVP Table
The table in this section is used when the Service-Type specifies
Framed Access.
+-----------+
| Command |
|-----+-----+
Attribute Name | ACR | ACA |
---------------------------------------|-----+-----+
Accounting-Auth-Method | 0-1 | 0 |
Accounting-Input-Octets | 1 | 0 |
Accounting-Input-Packets | 1 | 0 |
Accounting-Output-Octets | 1 | 0 |
Accounting-Output-Packets | 1 | 0 |
Accounting-Record-Number | 0-1 | 0-1 |
Accounting-Record-Type | 1 | 1 |
Accounting-Realtime-Required | 0-1 | 0-1 |
Accounting-Sub-Session-Id | 0-1 | 0-1 |
Acct-Application-Id | 0-1 | 0-1 |
Acct-Session-Id | 1 | 0-1 |
Acct-Multi-Session-Id | 0-1 | 0-1 |
Acct-Authentic | 1 | 0 |
Acct-Delay-Time | 0-1 | 0 |
Acct-Interim-Interval | 0-1 | 0-1 |
Acct-Link-Count | 0-1 | 0 |
Acct-Session-Time | 1 | 0 |
Acct-Tunnel-Connection | 0-1 | 0 |
Acct-Tunnel-Packets-Lost | 0-1 | 0 |
Authorization-Lifetime | 0-1 | 0 |
Callback-Id | 0-1 | 0 |
Callback-Number | 0-1 | 0 |
Called-Station-Id | 0-1 | 0 |
Calling-Station-Id | 0-1 | 0 |
Class | 0+ | 0+ |
Connection-Info | 0+ | 0 |
Destination-Host | 0-1 | 0 |
Destination-Realm | 1 | 0 |
Event-Timestamp | 0-1 | 0-1 |
Error-Message | 0 | 0-1 |
Error-Reporting-Host | 0 | 0-1 |
Failed-AVP | 0 | 0+ |
---------------------------------------|-----+-----+
+-----------+
| Command |
|-----+-----+
Attribute Name | ACR | ACA |
---------------------------------------|-----+-----+
Framed-AppleTalk-Link | 0-1 | 0 |
Framed-AppleTalk-Network | 0-1 | 0 |
Framed-AppleTalk-Zone | 0-1 | 0 |
Framed-Compression | 0-1 | 0 |
Framed-IP-Address | 0-1 | 0 |
Framed-IP-Netmask | 0-1 | 0 |
Framed-IPv6-Prefix | 0+ | 0 |
Framed-IPv6-Pool | 0-1 | 0 |
Framed-IPX-Network | 0-1 | 0 |
Framed-MTU | 0-1 | 0 |
Framed-Pool | 0-1 | 0 |
Framed-Protocol | 0-1 | 0 |
Framed-Route | 0-1 | 0 |
Framed-Routing | 0-1 | 0 |
NAS-Filter-Rule | 0+ | 0 |
NAS-Identifier | 0-1 | 0-1 |
NAS-IP-Address | 0-1 | 0-1 |
NAS-IPv6-Address | 0-1 | 0-1 |
NAS-Port | 0-1 | 0-1 |
NAS-Port-Id | 0-1 | 0-1 |
NAS-Port-Type | 0-1 | 0-1 |
Origin-AAA-Protocol | 0-1 | 0-1 |
Origin-Host | 1 | 1 |
Origin-Realm | 1 | 1 |
Origin-State-Id | 0-1 | 0-1 |
Originating-Line-Info | 0-1 | 0 |
Proxy-Info | 0+ | 0+ |
QoS-Filter-Rule | 0+ | 0 |
Route-Record | 0+ | 0+ |
Result-Code | 0 | 1 |
Service-Type | 0-1 | 0-1 |
Session-Id | 1 | 1 |
Termination-Cause | 0-1 | 0-1 |
Tunnel-Assignment-Id | 0-1 | 0 |
Tunnel-Client-Endpoint | 0-1 | 0 |
Tunnel-Medium-Type | 0-1 | 0 |
Tunnel-Private-Group-Id | 0-1 | 0 |
Tunnel-Server-Endpoint | 0-1 | 0 |
Tunnel-Type | 0-1 | 0 |
User-Name | 0-1 | 0-1 |
Vendor-Specific-Application-Id | 0-1 | 0-1 |
---------------------------------------|-----+-----+
10.2.2. Accounting Non-Framed Access AVP Table
The table in this section is used when the Service-Type specifies
Non-Framed Access.
+-----------+
| Command |
|-----+-----+
Attribute Name | ACR | ACA |
---------------------------------------|-----+-----+
Accounting-Auth-Method | 0-1 | 0 |
Accounting-Input-Octets | 1 | 0 |
Accounting-Output-Octets | 1 | 0 |
Accounting-Record-Type | 1 | 1 |
Accounting-Record-Number | 0-1 | 0-1 |
Accounting-Realtime-Required | 0-1 | 0-1 |
Accounting-Sub-Session-Id | 0-1 | 0-1 |
Acct-Application-Id | 0-1 | 0-1 |
Acct-Session-Id | 1 | 0-1 |
Acct-Multi-Session-Id | 0-1 | 0-1 |
Acct-Authentic | 1 | 0 |
Acct-Delay-Time | 0-1 | 0 |
Acct-Interim-Interval | 0-1 | 0-1 |
Acct-Link-Count | 0-1 | 0 |
Acct-Session-Time | 1 | 0 |
Authorization-Lifetime | 0-1 | 0 |
Callback-Id | 0-1 | 0 |
Callback-Number | 0-1 | 0 |
Called-Station-Id | 0-1 | 0 |
Calling-Station-Id | 0-1 | 0 |
Class | 0+ | 0+ |
Connection-Info | 0+ | 0 |
Destination-Host | 0-1 | 0 |
Destination-Realm | 1 | 0 |
Event-Timestamp | 0-1 | 0-1 |
Error-Message | 0 | 0-1 |
Error-Reporting-Host | 0 | 0-1 |
Failed-AVP | 0 | 0+ |
Login-IP-Host | 0+ | 0 |
Login-IPv6-Host | 0+ | 0 |
Login-LAT-Service | 0-1 | 0 |
Login-LAT-Node | 0-1 | 0 |
Login-LAT-Group | 0-1 | 0 |
Login-LAT-Port | 0-1 | 0 |
Login-Service | 0-1 | 0 |
Login-TCP-Port | 0-1 | 0 |
---------------------------------------|-----+-----+
+-----------+
| Command |
|-----+-----+
Attribute Name | ACR | ACA |
---------------------------------------|-----+-----+
NAS-Identifier | 0-1 | 0-1 |
NAS-IP-Address | 0-1 | 0-1 |
NAS-IPv6-Address | 0-1 | 0-1 |
NAS-Port | 0-1 | 0-1 |
NAS-Port-Id | 0-1 | 0-1 |
NAS-Port-Type | 0-1 | 0-1 |
Origin-AAA-Protocol | 0-1 | 0-1 |
Origin-Host | 1 | 1 |
Origin-Realm | 1 | 1 |
Origin-State-Id | 0-1 | 0-1 |
Originating-Line-Info | 0-1 | 0 |
Proxy-Info | 0+ | 0+ |
QoS-Filter-Rule | 0+ | 0 |
Route-Record | 0+ | 0+ |
Result-Code | 0 | 1 |
Session-Id | 1 | 1 |
Service-Type | 0-1 | 0-1 |
Termination-Cause | 0-1 | 0-1 |
User-Name | 0-1 | 0-1 |
Vendor-Specific-Application-Id | 0-1 | 0-1 |
---------------------------------------|-----+-----+
11. IANA Considerations
This section provides guidance to the Internet Assigned Numbers
Authority (IANA) regarding registration of values related to the
Diameter protocol, in accordance with BCP 26 [IANAConsid].
This document defines values in the namespaces that have been created
and defined in the Diameter Base [BASE]. The IANA Considerations
section of that document details the assignment criteria. Values
assigned in this document, or by future IANA action, must be
coordinated within this shared namespace.
11.1. Command Codes
This specification assigns the value 265 from the Command Code
namespace defined in [BASE]. See sections 3.1 and 3.2 for the
assignment of the namespace in this specification.
11.2. AVP Codes
This specification assigns the values 363 - 366 and 400 - 408 from
the AVP Code namespace defined in [BASE]. See sections 4 and 5 for
the assignment of the namespace in this specification. Note that the
values 363 - 366 are jointly, but consistently, assigned in
[DiamMIP]. This document also creates one new namespace to be
managed by IANA, as described in section 11.5.
This specification also specifies the use of AVPs in the 0 - 255
range, which are defined in [RADIUSTypes]. These values are assigned
by the policy in RFC 2865 section 6 [RADIUS] and are amended by RFC
3575 [RADIUSIANA].
11.3. Application Identifier
This specification uses the value one (1) in the Application
Identifier namespace as assigned in [BASE]. See section 1.2 above
for more information.
11.4. CHAP-Algorithm AVP Values
As defined in section 5.5, the CHAP-Algorithm AVP (AVP Code 403) uses
the values of the "PPP AUTHENTICATION ALGORITHMS" namespace defined
in [PPPCHAP].
11.5. Accounting-Auth-Method AVP Values
As defined in section 8.6, the Accounting-Auth-Method AVP (AVP Code
406) defines the values 1 - 5. All remaining values are available
for assignment via IETF Consensus [IANA].
11.6. Origin-AAA-Protocol AVP Values
As defined in section 9.3.6, the Origin-AAA-Protocol AVP (AVP Code
408) defines the value 1. All remaining values are available for
assignment with a "Specification Required" policy [IANAConsid].
12. Security Considerations
This document describes the extension of Diameter for the NAS
application. The security considerations of the Diameter protocol
itself have been discussed in [BASE]. Use of this application of
Diameter MUST take into consideration the security issues and
requirements of the Base protocol.
This document does not contain a security protocol but does discuss
how PPP authentication protocols can be carried within the Diameter
protocol. The PPP authentication protocols described are PAP and
CHAP.
The use of PAP SHOULD be discouraged, as it exposes users’ passwords
to possibly non-trusted entities. However, PAP is also frequently
used for use with One-Time Passwords, which do not expose a security
risk.
This document also describes how CHAP can be carried within the
Diameter protocol, which is required for RADIUS backward
compatibility. The CHAP protocol, as used in a RADIUS environment,
facilitates authentication replay attacks.
The use of the EAP authentication protocols described in [DiamEAP]
can offer better security, given a method suitable for the
circumstances.
13. References
13.1. Normative References
[BASE] Calhoun, P., Loughney, J., Guttman, E., Zorn, G., and
J. Arkko, "Diameter Base Protocol", RFC 3588,
September 2003.
[DiamTrans] Aboba, B. and J. Wood, "Authentication, Authorization
and Accounting (AAA) Transport Profile", RFC 3539,
June 2003.
[RADIUS] Rigney, C., Willens, S., Rubens, A., and W. Simpson,
"Remote Authentication Dial In User Service (RADIUS)",
RFC 2865, June 2000.
[RADIUSTypes] IANA, "RADIUS Types", URL:
<http://www.iana.org/assignments/radius-types>
[RADIUSIPv6] Aboba, B., Zorn, G., and D. Mitton, "RADIUS and IPv6",
RFC 3162, August 2001.
[IPv6Addr] Nerenberg, L., "IMAP4 Binary Content Extension", RFC
3516, April 2003.
[PPPCHAP] Simpson, W., "PPP Challenge Handshake Authentication
Protocol (CHAP)", RFC 1994, August 1996.
[IANAConsid] Narten, T. and H. Alvestrand, "Guidelines for Writing
an IANA Considerations Section in RFCs", BCP 26, RFC
2434, October 1998.
[IANA] IANA Assigned Numbers Database, URL:
<http://www.iana.org/numbers.html>
[Keywords] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[ANITypes] NANPA Number Resource Info, ANI Assignments, URL:
<http://www.nanpa.com/number_resource_info/
ani_ii_assignments.html>
13.2. Informative References
[RADIUSAcct] Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.
[RADIUSExt] Rigney, C., Willats, W., and P. Calhoun, "RADIUS
Extensions", RFC 2869, June 2000.
[RADTunnels] Zorn, G., Leifer, D., Rubens, A., Shriver, J.,
Holdrege, M., and I. Goyret, "RADIUS Attributes for
Tunnel Protocol Support", RFC 2868, June 2000.
[RADTunlAcct] Zorn, G., Aboba, B., and D. Mitton, "RADIUS Accounting
Modifications for Tunnel Protocol Support", RFC 2867,
June 2000.
[RADDynAuth] Chiba, M., Dommety, G., Eklund, M., Mitton, D., and B.
Aboba, "Dynamic Authorization Extensions to Remote
Authentication Dial In User Service (RADIUS)", RFC
3576, July 2003.
[RADIUSIANA] Aboba, B., "IANA Considerations for RADIUS (Remote
Authentication Dial In User Service)", RFC 3575, July
2003.
[NASModel] Mitton, D. and M. Beadles, "Network Access Server
Requirements Next Generation (NASREQNG) NAS Model",
RFC 2881, July 2000.
[NASCriteria] Beadles, M. and D. Mitton, "Criteria for Evaluating
Network Access Server Protocols", RFC 3169, September
2001.
[AAACriteria] Aboba, B., Calhoun, P., Glass, S., Hiller, T., McCann,
P., Shiino, H., Zorn, G., Dommety, G., Perkins, C.,