[ Service-Type ]
[ State ]
[ Authorization-Lifetime ]
[ Auth-Grace-Period ]
[ Auth-Session-State ]
[ Callback-Number ]
[ Called-Station-Id ]
[ Calling-Station-Id ]
[ Originating-Line-Info ]
[ Connect-Info ]
* [ Framed-Compression ]
[ Framed-Interface-Id ]
[ Framed-IP-Address ]
* [ Framed-IPv6-Prefix ]
[ Framed-IP-Netmask ]
[ Framed-MTU ]
[ Framed-Protocol ]
* [ Tunneling ]
* [ Proxy-Info ]
* [ Route-Record ]
* [ AVP ]
3.2. Diameter-EAP-Answer (DEA) Command
The Diameter-EAP-Answer (DEA) message, indicated by the Command-Code
field set to 268 and the ’R’ bit cleared in the Command Flags field,
is sent by the Diameter server to the client for one of the following
reasons:
1. The message is part of a multi-round authentication exchange, and
the server is expecting a subsequent Diameter-EAP-Request. This
is indicated by setting the Result-Code to
DIAMETER_MULTI_ROUND_AUTH, and MAY include zero or more State
AVPs.
2. The EAP client has been successfully authenticated and
authorized, in which case the message MUST include the
Result-Code AVP indicating success, and SHOULD include an
EAP-Payload of type EAP-Success. This event MUST cause the
access device to provide service to the EAP client.
3. The EAP client has not been successfully authenticated and/or
authorized, and the Result-Code AVP is set to indicate failure.
This message SHOULD include an EAP-Payload, but this AVP is not
used to determine whether service is to be provided.
If the message from the Diameter client included a request for
authorization, a successful response MUST include the authorization
AVPs that are relevant to the service being provided.
Message format
<Diameter-EAP-Answer> ::= < Diameter Header: 268, PXY >
< Session-Id >
{ Auth-Application-Id }
{ Auth-Request-Type }
{ Result-Code }
{ Origin-Host }
{ Origin-Realm }
[ User-Name ]
[ EAP-Payload ]
[ EAP-Reissued-Payload ]
[ EAP-Master-Session-Key ]
[ EAP-Key-Name ]
[ Multi-Round-Time-Out ]
[ Accounting-EAP-Auth-Method ]
[ Service-Type ]
* [ Class ]
* [ Configuration-Token ]
[ Acct-Interim-Interval ]
[ Error-Message ]
[ Error-Reporting-Host ]
* [ Failed-AVP ]
[ Idle-Timeout ]
[ Authorization-Lifetime ]
[ Auth-Grace-Period ]
[ Auth-Session-State ]
[ Re-Auth-Request-Type ]
[ Session-Timeout ]
[ State ]
* [ Reply-Message ]
[ Origin-State-Id ]
* [ Filter-Id ]
[ Port-Limit ]
[ Callback-Id ]
[ Callback-Number ]
[ Framed-Appletalk-Link ]
* [ Framed-Appletalk-Network ]
[ Framed-Appletalk-Zone ]
* [ Framed-Compression ]
[ Framed-Interface-Id ]
[ Framed-IP-Address ]
* [ Framed-IPv6-Prefix ]
[ Framed-IPv6-Pool ]
* [ Framed-IPv6-Route ]
[ Framed-IP-Netmask ]
* [ Framed-Route ]
[ Framed-Pool ]
[ Framed-IPX-Network ]
[ Framed-MTU ]
[ Framed-Protocol ]
[ Framed-Routing ]
* [ NAS-Filter-Rule ]
* [ QoS-Filter-Rule ]
* [ Tunneling ]
* [ Redirect-Host ]
[ Redirect-Host-Usage ]
[ Redirect-Max-Cache-Time ]
* [ Proxy-Info ]
* [ AVP ]
4. Attribute-Value Pairs
This section both defines new AVPs, unique to the EAP Diameter
application and describes the usage of AVPs defined elsewhere (if
that usage in the EAP application is noteworthy).
4.1. New AVPs
4.1.1. EAP-Payload AVP
The EAP-Payload AVP (AVP Code 462) is of type OctetString and is used
to encapsulate the actual EAP packet that is being exchanged between
the EAP client and the home Diameter server.
4.1.2. EAP-Reissued-Payload AVP
The EAP-Reissued-Payload AVP (AVP Code 463) is of type OctetString.
The use of this AVP is described in Section 2.4.
4.1.3. EAP-Master-Session-Key AVP
The EAP-Master-Session-Key AVP (AVP Code 464) is of type OctetString.
It contains keying material for protecting the communications between
the user and the NAS. Exactly how this keying material is used
depends on the link layer in question, and is beyond the scope of
this document.
4.1.4. EAP-Key-Name AVP
The EAP-Key-Name AVP (Radius Attribute Type 102) is of type
OctetString. It contains an opaque key identifier (name) generated
by the EAP method. Exactly how this name is used depends on the link
layer in question, and is beyond the scope of this document (see
[EAPKey] for more discussion).
Note that not all link layers use this name, and currently most EAP
methods do not generate it. Since the NAS operates in pass-through
mode, it cannot know the Key-Name before receiving it from the AAA
server. As a result, a Key-Name AVP sent in a Diameter-EAP-Request
MUST NOT contain any data. A home Diameter server receiving a
Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST
silently discard the AVP. In addition, the home Diameter server
SHOULD include this AVP in Diameter-EAP-Response only if an empty
EAP-Key-Name AVP was present in Diameter-EAP-Request.
4.1.5. Accounting-EAP-Auth-Method AVP
The Accounting-EAP-Auth-Method AVP (AVP Code 465) is of type
Unsigned64. In case of expanded types [EAP, Section 5.7], this AVP
contains the value ((Vendor-Id * 2^32) + Vendor-Type).
The use of this AVP is described in Section 2.7.
5. AVP Occurrence Tables
The following tables use these symbols:
0 The AVP MUST NOT be present in the message
0+ Zero or more instances of the AVP MAY be present in the message
0-1 Zero or one instance of the AVP MAY be present in the message
1 One instance of the AVP MUST be present in the message
Note that AVPs that can only be present within a Grouped AVP are not
represented in these tables.
5.1. EAP Command AVP Table
The following table lists the AVPs that may be present in the DER and
DEA Commands, as defined in this document; the AVPs listed are
defined both here and in [NASREQ].
+---------------+
| Command-Code |
|-------+-------+
Attribute Name | DER | DEA |
------------------------------------|-------+-------|
Accounting-EAP-Auth-Method | 0 | 0+ |
Acct-Interim-Interval [BASE] | 0 | 0-1 |
Auth-Application-Id [BASE] | 1 | 1 |
Auth-Grace-Period [BASE] | 0-1 | 0-1 |
Auth-Request-Type [BASE] | 1 | 1 |
Auth-Session-State [BASE] | 0-1 | 0-1 |
Authorization-Lifetime [BASE] | 0-1 | 0-1 |
Callback-Id [NASREQ] | 0 | 0-1 |
Callback-Number [NASREQ] | 0-1 | 0-1 |
Called-Station-Id [NASREQ] | 0-1 | 0 |
Calling-Station-Id [NASREQ] | 0-1 | 0 |
Class [BASE] | 0 | 0+ |
Configuration-Token [NASREQ] | 0 | 0+ |
Connect-Info [NASREQ] | 0-1 | 0 |
Destination-Host [BASE] | 0-1 | 0 |
Destination-Realm [BASE] | 1 | 0 |
EAP-Master-Session-Key | 0 | 0-1 |
EAP-Key-Name | 0-1 | 0-1 |
EAP-Payload | 1 | 0-1 |
EAP-Reissued-Payload | 0 | 0-1 |
Error-Message [BASE] | 0 | 0-1 |
Error-Reporting-Host [BASE] | 0 | 0-1 |
Failed-AVP [BASE] | 0 | 0+ |
Filter-Id [NASREQ] | 0 | 0+ |
Framed-Appletalk-Link [NASREQ] | 0 | 0-1 |
Framed-Appletalk-Network [NASREQ] | 0 | 0+ |
Framed-Appletalk-Zone [NASREQ] | 0 | 0-1 |
Framed-Compression [NASREQ] | 0+ | 0+ |
Framed-Interface-Id [NASREQ] | 0-1 | 0-1 |
Framed-IP-Address [NASREQ] | 0-1 | 0-1 |
Framed-IP-Netmask [NASREQ] | 0-1 | 0-1 |
Framed-IPv6-Prefix [NASREQ] | 0+ | 0+ |
Framed-IPv6-Pool [NASREQ] | 0 | 0-1 |
Framed-IPv6-Route [NASREQ] | 0 | 0+ |
Framed-IPX-Network [NASREQ] | 0 | 0-1 |
Framed-MTU [NASREQ] | 0-1 | 0-1 |
Framed-Pool [NASREQ] | 0 | 0-1 |
Framed-Protocol [NASREQ] | 0-1 | 0-1 |
Framed-Route [NASREQ] | 0 | 0+ |
Framed-Routing [NASREQ] | 0 | 0-1 |
Idle-Timeout [NASREQ] | 0 | 0-1 |
Multi-Round-Time-Out [BASE] | 0 | 0-1 |
NAS-Filter-Rule [NASREQ] | 0 | 0+ |
NAS-Identifier [NASREQ] | 0-1 | 0 |
NAS-IP-Address [NASREQ] | 0-1 | 0 |
NAS-IPv6-Address [NASREQ] | 0-1 | 0 |
NAS-Port [NASREQ] | 0-1 | 0 |
NAS-Port-Id [NASREQ] | 0-1 | 0 |
NAS-Port-Type [NASREQ] | 0-1 | 0 |
Originating-Line-Info [NASREQ] | 0-1 | 0 |
Origin-Host [BASE] | 1 | 1 |
Origin-Realm [BASE] | 1 | 1 |
Origin-State-Id [BASE] | 0-1 | 0-1 |
Port-Limit [NASREQ] | 0-1 | 0-1 |
Proxy-Info [BASE] | 0+ | 0+ |
QoS-Filter-Rule [NASREQ] | 0 | 0+ |
Re-Auth-Request-Type [BASE] | 0 | 0-1 |
Redirect-Host [BASE] | 0 | 0+ |
Redirect-Host-Usage [BASE] | 0 | 0-1 |
Redirect-Max-Cache-Time [BASE] | 0 | 0-1 |
Reply-Message [NASREQ] | 0 | 0+ |
Result-Code [BASE] | 0 | 1 |
Route-Record [BASE] | 0+ | 0+ |
Service-Type [NASREQ] | 0-1 | 0-1 |
Session-Id [BASE] | 1 | 1 |
Session-Timeout [BASE] | 0 | 0-1 |
State [NASREQ] | 0-1 | 0-1 |
Tunneling [NASREQ] | 0+ | 0+ |
User-Name [BASE] | 0-1 | 0-1 |
5.2. Accounting AVP Table
The table in this section is used to represent which AVPs defined in
this document are to be present in the Accounting messages, as
defined in [BASE].
+-----------+
| Command |
| Code |
|-----+-----+
Attribute Name | ACR | ACA |
---------------------------------------|-----+-----+
Accounting-EAP-Auth-Method | 0+ | 0 |
6. RADIUS/Diameter Interactions
Section 9 of [NASREQ] describes basic guidelines for translation
agents that translate between RADIUS and Diameter protocols. These
guidelines SHOULD be followed for Diameter EAP application as well,
with some additional guidelines given in this section. Note that
this document does not restrict implementations from creating
additional methods, as long as the translation function does not
violate the RADIUS or the Diameter protocols.
6.1. RADIUS Request Forwarded as Diameter Request
RADIUS Access-Request to Diameter-EAP-Request:
o RADIUS EAP-Message attribute(s) are translated to a Diameter
EAP-Payload AVP. If multiple RADIUS EAP-Message attributes are
present, they are concatenated and translated to a single Diameter
EAP-Payload AVP.
o An empty RADIUS EAP-Message attribute (with length 2) signifies
EAP-Start, and it is translated to an empty EAP-Payload AVP.
Diameter-EAP-Answer to RADIUS Access-Accept/Reject/Challenge:
o Diameter EAP-Payload AVP is translated to RADIUS EAP-Message
attribute(s). If necessary, the value is split into multiple
RADIUS EAP-Message attributes.
o Diameter EAP-Reissued-Payload AVP is translated to a message that
contains RADIUS EAP-Message attribute(s), and a RADIUS Error-Cause
attribute [RFC3576] with value 202 (decimal), "Invalid EAP Packet
(Ignored)" [RFC3579].
o As described in [NASREQ], if the Result-Code AVP set to
DIAMETER_MULTI_ROUND_AUTH and the Multi-Round-Time-Out AVP is
present, it is translated to the RADIUS Session-Timeout attribute.
o Diameter EAP-Master-Session-Key AVP can be translated to the
vendor-specific RADIUS MS-MPPE-Recv-Key and MS-MPPE-Send-Key
attributes [RFC2548]. The first up to 32 octets of the key is
stored into MS-MPPE-Recv-Key, and the next up to 32 octets (if
present) are stored into MS-MPPE-Send-Key. The encryption of this
attribute is described in [RFC2548].
o Diameter Accounting-EAP-Auth-Method AVPs, if present, are
discarded.
6.2. Diameter Request Forwarded as RADIUS Request
Diameter-EAP-Request to RADIUS Access-Request:
o The Diameter EAP-Payload AVP is translated to RADIUS EAP-Message
attribute(s).
o An empty Diameter EAP-Payload AVP signifies EAP-Start, and is
translated to an empty RADIUS EAP-Message attribute.
o The type (or expanded type) field from the EAP-Payload AVP can be
saved either in a local state table, or encoded in a RADIUS
Proxy-State attribute. This information is needed to construct an
Accounting-EAP-Auth-Method AVP for the answer message (see below).
RADIUS Access-Accept/Reject/Challenge to Diameter-EAP-Answer:
o If the RADIUS Access-Challenge message does not contain an
Error-Cause attribute [RFC3576] with value 202 (decimal), "Invalid
EAP Packet (Ignored)" [RFC3579], any RADIUS EAP-Message attributes
are translated to a Diameter EAP-Payload AVP, concatenating them
if multiple attributes are present.
o If the Error-Cause attribute with value 202 is present, any RADIUS
EAP-Message attributes are translated to a Diameter
EAP-Reissued-Payload AVP, concatenating them if multiple
attributes are present.
o As described in [NASREQ], if the Session-Timeout attribute is
present in a RADIUS Access-Challenge message, it is translated to
the Diameter Multi-Round-Time-Out AVP.
o If the vendor-specific RADIUS MS-MPPE-Recv-Key and/or
MS-MPPE-Send-Key attributes [RFC2548] are present, they can be
translated to a Diameter EAP-Master-Session-Key AVP. The
attributes have to be decrypted before conversion, and the Salt,
Key-Length and Padding sub-fields are discarded. The Key
sub-fields are concatenated (MS-MPPE-Recv-Key first,
MS-MPPE-Send-Key next), and the concatenated value is stored into