|
|
|
|
|
|
|
Refers to the user to be authenticated in the Access-Request. The format for IPoE/PPPoE hosts depends on configuration parameters pppoe-access-method, ppp-user-name or user-name-format in the CLI context configure subscriber-mgmt authentication-policy < name>. The format for ARP-hosts is not configurable and always the host IPv4-address.The RADIUS User-Name specified in an Access-Accept or CoA is reflected in the corresponding accounting messages. The attribute is omitted in authentication/accounting via configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute no user-name.
|
|
|
|
|
|
|
|
Provided by a PPPoE CHAP user in response to the CHAP challenge. The CHAP challenge sent by the NAS to a PPPoE CHAP user is part of the CHAP authentication sequence RFC 1994, PPP Challenge Handshake Authentication Protocol (CHAP), (Challenge, Response, Success, Failure). The user generated CHAP password length is equal to the defined Limits and contains a one byte CHAP-Identifier from the user's CHAP Response followed by the CHAP Response from the user.
|
|
|
|
The address can be overwritten with the configured source-address (configure aaa radius-server-policy < policy-name> servers source-address < ip-address>).
|
|
|
|
The physical access-circuit on the NAS which is used for the Authentication or Accounting of the user. The format of this attribute is configurable on the NAS as a fixed 32 bit value or a parameterized 32 bit value. The parameters can be a combination of outer-vlan-id(o), inner-vlan-id(i), slot number(s), MDA number(m), port number or lag-id(p), ATM VPI(v) and ATM VCI(c), fixed bit values zero (0) or one (1) but cannot exceed 32 bit. The format can be configured for following applications: configure aaa l2tp-accounting-policy < name> include-radius-attribute nas-port, configure router l2tp cisco-nas-port, configure service vprn < service-id> l2tp cisco-nas-port, configure subscriber-mgmt authentication-policy < name> include-radius-attribute nas-port, configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute nas-port.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If an identical managed route is associated with different routed subscriber hosts in the context of the same IES/VPRN service up to <max-ecmp-routes> managed routes are installed in the routing table (configured as ecmp < max-ecmp-routes> in the routing instance). Candidate ECMP Framed-Routes have identical prefix, equal lowest preference and equal lowest metric. The “lowest ip next-hop” is the tie breaker if more candidate ECMP Framed-Routes are available than the configured < max-ecmp-routes>. Other identical managed routes are shadowed (not installed in the routing table) and an event is logged. An alternative to RADIUS managed routes are managed routes via host dynamic BGP peering.
Valid RADIUS learned managed routes can be included in RADIUS accounting messages with following configuration: configure subscriber-mgmt radius-accounting-policy <name> include-radius-attribute framed-route. Associated managed routes for an instantiated routed subscriber host are included in RADIUS accounting messages independent of the state of the managed route (Installed, Shadowed or HostInactive).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Allows the NAS to send unique information identifying the user who requested the service. This format is driven by configuration (configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute calling-station-id < llid| mac| remote-id| sap-id| sap-string>). The LLID (logical link identifier) is the mapping from a physical to logical identification of a subscriber line and supplied by a RADIUS llid-server. The sap-string maps to configure service < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name> sap < sap-id> calling-station-id < sap-string>. A [31] Calling-Station-Id attribute value longer than the allowed maximum is treated as a setup failure. The attribute is omitted in authentication/accounting via configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute no calling-station-id.
|
|
|
|
A string (configure system name < system-name>) identifying the NAS originating the Authentication or Accounting requests and sent when nas-identifier is included for the corresponding application: configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting).
|
|
|
|
|
|
|
|
The CHAP challenge sent by the NAS to a PPPoE CHAP user as part of the chap authentication sequence RFC 1994 (Challenge, Response, Success, Failure). The generated challenge length for each new pppoe session is by default a random value between [32..64] bytes unless configured different under configure subscriber-mgmt ppp-policy < ppp-policy-name> ppp-chap-challenge-length [8..64] or configure router l2tp group < tunnel-group-name> ppp chap-challenge-length [8..64] for LNS. The CHAP challenge value is copied into the request-authenticator field of the RADIUS Access-Request message if the minimum and maximum value is configured at exact 16 (RFC 2865, Remote Authentication Dial In User Service (RADIUS), section 2.2, Interoperation with PAP and CHAP). Attribute CHAP-Password is provided by a PPPoE CHAP user in response to the [60] CHAP-challenge.
|
|
|
|
The type of the physical port of the NAS which is authenticating the user and value automatically determined from subscriber SAP encapsulation. It can be overruled by configuration. Included only if include-radius-attribute nas-port-type is added per application: configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting). Checked for correctness if returned in CoA.
The NAS-Port-Type attribute is always included when the Nas-Port-Id is also included.
|
|
|
|
|
|
|
|
Included only if include-radius-attribute nas-port-id is added per application: configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting). For a capture-sap, the nas-port-id attribute is always included in authentication requests.
|
|
|
|
The name of one address pool or the name of a primary and secondary address pool separated with a one character configurable delimiter (configure router/service vprn < service-id> dhcp local-dhcp-server < server-name> use-pool-from-client delimiter < delimiter>) that should be used to assign an address for the user and maps to either:
1) dhcpv4 option [82] vendor-specific-option [9] sub-option [13] dhcpPool if option is enabled on the node (configure service ies/vprn < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name> dhcp option vendor-specific-option pool-name) or
2) used directly as pool-name in the local configured dhcp server when local-address-assignment is used and client-application is ppp-v4 (configure service ies/vprn < service-id> subscriber-interface ip-int-name group-interface ip-int-name local-address-assignment). Alternative to [26-2352-36] Ip-Address-Pool-Name and [26-4874-2] ERX-Address-Pool-Name. Framed-Pool names longer than the allowed maximum are treated as host setup failures. Simultaneous returned attributes [88] Framed-Pool and [8] Framed-IP-Address are also handled as host setup failures.
|
|
|
|
“Base” or “VPRN” — The ipv6 address of the system interface (configure router interface system ipv6 address < ipv6-address>).
The address can be overwritten with the configured ipv6-source-address (configure aaa radius-server-policy < policy-name> servers ipv6-source-address < ipv6-address>).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Attribute that carries the Prefix (ipv6-prefix/prefix-length) to be delegated via DHCPv6 (IA-PD) for the LAN side of the user (IPoE, PPPoE). Maps to DHCPv6 option IA-PD [25] sub-option IA-Prefix [26] Prefix. An exact Delegated-prefix-Length [DPL] match with configure service < service-id> subscriber-interface < ip-int-name> ipv6 delegated-prefix-length [48..64] is required with the received attribute prefix-length unless a variable DPL is configured ( configure service < service-id> subscriber-interface < ip-int-name> ipv6 delegated-prefix-length variable). In the latter case multiple hosts for the same group-interface having different prefix-length [48..64] per host are supported. Simultaneous returned attributes [123] Delegated-IPv6-Prefix and [26-6527-131] Alc-Delegated-IPv6-Pool are handled as host setup failures. Attribute is also used in CoA and Disconnect Message (part of the ESM or AA user identification-key). Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute no delegated-ipv6-prefix.
|
|
|
|
|
|
|
|
A IPv4 address of the secondary DNS server for this subscribers connection and maps to 'PPPoE IPCP option 131 Secondary DNS Server address or DHCPv4 option 6 Domain Server. Is an alternative for 26-4874-5 ERX-Secondary-Dns or 26-6527-10 Alc-Secondary-Dns.
|
|
|
|
The name of an assigned address pool that should be used to assign an address for the user and maps to dhcpv4 option[82] vendor-specific-option [9] sub-option [13] dhcpPool if option is enabled on the node (configure service < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name> dhcp option vendor-specific-option pool-name). Alternative to [88] Pool-Name and [26-4874-2] ERX-Address-Pool-Name. Framed-Pool names longer than the allowed maximum are treated as host setup failures. Simultaneous returned attributes Pool-Names [8] and Framed-IP-Address are also handled as host setup failures.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The last mile encapsulation used by the subscriber on the DSL access loop and maps to values received during PPPoE discovery Tags (tag 0x0105) or DHCP Tags (opt-82). Attribute is included/excluded in RADIUS/Accounting-Request based on configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute access-loop-options. Last mile encapsulation information can be used to adjust automatically the egress aggregate rate for this subscriber. Pre-configured encapsulation types are used if PPP/IPoE access loop information (tags) is not available ( configure subscriber-mgmt sub-profile < subscriber-profile-name> egress encap-offset < type> or configure subscriber-mgmt local-user-db < local-user-db-name> ppp host access-loop encap-offset < type>). [26-6527-133] Alc-Access-Loop-Encap-Offset when returned in Access-Accept is taken into account (overrules received tags and pre-configured encapsulation types) for ALE adjust (last mile aware shaping) but is not reflected in access-loop-options send to RADIUS. Alc-Access-Loop-Encap from ANCP are currently not taken into account for ALE adjust.
|
|
|
|
|
|
|
|
The name of an assigned address pool that should be used to assign an address for the user and maps to dhcpv4 option[82] vendor-specific-option [9] sub-option [13] dhcpPool if option is enabled on the node (configure service < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name> dhcp option vendor-specific-option pool-name). Alternative to [88] Pool-Name and [26-2352-36] Ip-Address-Pool-Name. Framed-Pool names longer than the allowed maximum are treated as host setup failures. Simultaneous returned attributes Pool-Names [8] and Framed-IP-Address are also handled as host setup failures.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The subscriber profile is a template which contains settings (accounting, igmp, HQoS,...) which are applicable to all hosts belonging to the same subscriber were [26-6527-12] Alc-Subsc-Prof-Str is the string that maps (configure subscriber-mgmt sub-ident-policy sub-profile-map) to such an subscriber profile ( configure subscriber-mgmt sub-profile < subscriber-profile-name>). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (string does not map to a policy) are silently ignored and a fallback to pre-configured defaults is done. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute no sub-profile.
|
|
|
|
The SLA profile is a template which contains settings (filter, QoS, host-limit...) which are applicable to individual hosts were [26-6527-13] Alc-SLA-Prof-Str is the string that maps (configure subscriber-mgmt sub-ident-policy < sub-ident-policy-name> sla-profile-map) to such a sla profile ( configure subscriber-mgmt sla-profile < sla-profile-name>). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (string does not map to a policy) are silently ignored and a fallback to pre-configured defaults is done. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute no sla-profile.
|
|
|
|
|
|
|
|
|
|
|
|
MAC address from a user that requests a service and included in CoA, Authentication or Accounting (configure subscriber-mgmt authentication-policy/radius-accounting-policy include-radius-attribute mac-address).
|
|
|
|
A string representing an aggregation point (for example, Access Node) and interpreted as the intermediate destination id. Subscribers connected to the same aggregation point should get the same int-dest-id string assigned. The int-dest-id is used in mc-ring access redundancy to identify subscribers behind a ring node (configure redundancy multi-chassis peer < ip-address> mc-ring ring/l3-ring < name> ring-node < ring-node-name>). The int-dest-id can be used in QoS to shape the egress traffic of a group of subscribers to an aggregate rate using vports ( configure port < port-id> ethernet access egress vport < name> host-match dest < destination-string>) or secondary shapers on HS-MDAv2 ( configure port < port-id> ethernet egress exp-secondary-shaper <secondary-shaper-name>). For egress policed subscriber traffic, the inter-dest-id can be used to select the egress queue-group for forwarding ( configure port < port-id> ethernet access egress queue-group < name> host-match dest < destination-string>). Strings longer than the allowed maximum are treated as setup failures.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Maps to PADI field PPPoE tags [0x0101] service-name and is sent in the Access-Request if enabled under configure subscriber-mgmt authentication-policy < name> include-radius-attribute pppoe-service-name. A PPPoE-Service-Name above the allowed maximum length is handled as a PPPOE session setup failure.
|
|
|
|
Initiated by DHCP clients via option 60 [Class-id] and reflected in Authentication. (configure subscriber-mgmt authentication-policy < name> include-radius-attribute dhcp-vendor-class-id or configure aaa isa-radius-policy < name> auth-include-attributes dhcp-vendor-class-id). DHCP option [60] Class-ID can also be used as User-name in RADIUS requests. ( configure subscriber-mgmt authentication-policy < name> user-name-format dhcp-client-vendor-opts).
|
|
|
|
Application Assurance for residential, business or transit-AA subscribers is enabled through the assignment of an application profile as part of either enhanced subscriber management or static configuration. [26-6527-45] Alc-App-Prof-is is a string that maps (configure subscriber-mgmt sub-ident-policy <sub- ident-policy-name> app-profile-map) to such an application profile ( configure application-assurance group < aa-group-id:partition-id> policy app-profile < app-profile-name>). This attribute is used in access-accept (to assign an application profile during esm host creation) and CoA (to change the application profile of a AA-subscriber or to create transit AA-subscriber). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (strings not mapping to an application profile) will silently trigger a fallback to pre-configured default values if allowed. If no default value is pre-configured, the subscriber's application profile is silently disabled for esm AA-subscriber; in case of a transit AA-subscriber creation the CoA will be rejected. The change of an application profile to one configured under a different group/partition or the modification of the application profile of a static AA-subscriber is not allowed and will be treated as setup failures.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The ATM Traffic Descriptor override for a PPPoA or PPPoEoA host and refers to the pre-configured traffic description QoS profile applied on the ingress ATM Virtual Circuit (configure qos atm-td-profile < traffic-desc-profile-id>). All subscriber hosts on a given ATM VC must have same ATM traffic descriptors and this attribute is ignored if it specifies an ATM Traffic Descriptor override while it has already specified another one for another host on the same ATM Virtual Circuit. A pre-configured description profile per ATM Virtual Circuit is used when this attribute is omitted. ( configure subscriber-mgmt msap-policy < msap-policy-name> atm egress/ingress traffic-desc or configure service vprn < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name> sap < sap-id> atm egress/ingress traffic-desc). A Traffic Descriptor profile above the Limit is treated as a setup failure. Unreferenced Traffic Descriptor profiles within the Limit, or a Traffic Descriptor profile for a non ATM host are silently ignored.
|
|
|
|
The ATM Traffic Descriptor override for a PPPoA or PPPoEoA host and refers to the pre-configured traffic description QoS profile applied on the egress ATM Virtual Circuit (configure qos atm-td-profile < traffic-desc-profile-id>). All subscriber hosts on a given ATM VC must have same ATM traffic descriptors and this attribute is ignored if it specifies an ATM Traffic Descriptor override while it has already specified another one for another host on the same ATM Virtual Circuit. A pre-configured description profile per ATM Virtual Circuit is used when this attribute is omitted ( configure subscriber-mgmt msap-policy atm egress/ingress traffic-desc or configure service vprn < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name> sap < sap-id> atm egress/ingress traffic-desc). A Traffic Descriptor profile above the Limits is treated as a setup failure. Unreferenced Traffic Descriptor profiles within the Limits, or a Traffic Descriptor profile for a non ATM host are silently ignored.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/ radius-accounting-policy < name> include-radius-attribute access-loop-options.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Attribute is included/excluded based on configure subscriber-mgmt authentication-policy <name> include-radius-attribute dhcp6-options
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Overrides the configured policy in the sub-profile for the subscriber: configure subscriber-mgmt sub-profile < name> upnp-policy < policy-name>.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The dotted-decimal IP address of the initiator end of the tunnel. Pre-configured values are used when attribute is omitted (configure router/service vprn < service-id> l2tp local-address). If omitted in Access Accept on LAC and no local-address configured, then the address is taken from the interface with name system. This attribute is included on LNS in the Access-Request and Acct-Request only if the CLI RADIUS policy include-radius-attribute tunnel-server-attrs is enabled on 7x50 LNS. For L2TP Tunnel/Link Accounting this attribute is always included on LAC and LNS as untagged.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The name of the tunnel group that refers to the CLI created tunnel-group-name context.(configure router < router-name> l2tp group < tunnel-group-name>. Any other RADIUS returned L2TP parameter is ignored and other required info to setup the tunnel will have to come from the CLI created context. Strings above the Limits are treated as a setup failure.
|
|
|
|
The tunnel-group-name that refers to the CLI created tunnel-group-name context.(configure router < router-name> l2tp group < tunnel-group-name>. Any other RADIUS returned L2TP parameter is ignored and other required info to setup the tunnel will have to come from the CLI created context. Strings above the Limits are treated as a setup failure.
|
|
|
|
The value existing-first specifies that the first suitable tunnel is used or set up for the first session and re-used for all subsequent sessions.
The weighted-access value specifies that the sessions are equally distributed over the available tunnels; new tunnels are set up until the maximum number is reached; the distribution aims at an equal ratio of the actual number of sessions to the maximum number of sessions. When there are multiple tunnels with an equal number of sessions (equal weight), LAC selects the first tunnel from the candidate list.
The weighted-random value enhances the weighted-access algorithm such that when there are multiple tunnels with an equal number of sessions (equal weight), LAC randomly selects a tunnel.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The ies/vprn < service-id> on LNS node where the PPP sessions are established ( configure service ies/vprn < service-id> subscriber-interface < name> group-interface < name>. Pre-configured values are used if attribute is omitted ( configure subscriber-mgmt local-user-db ppp host interface < ip-int-name> service-id < service-id> or configure router/service vprn < service-id> l2tp group ppp default-group-interface < ip-int-name> service-id < service-id>). Values above the Limits or unreferenced are treated as a setup failure.
|
|
|
|
Refers to the group interface <name> on LNS node only where the PPP sessions are established ( configure service ies/vprn < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name>). Pre-configured values are used if the attribute is omitted ( configure subscriber-mgmt local-user-db <local-user-db-name> ppp host interface < ip-int-name> service-id < service-id> or configure router/service vprn < service-id> l2tp group ppp default-group-interface < ip-int-name> service-id < service-id>). Alc-interface names longer than the maximum allowed value are treated as session setup failures.
|
|
|
|
|
|
|
|
|
|
|
|
Refers to a pre-configured L2TP tunnel accounting policy-name (configure aaa l2tp-accounting-policy < policy-name>). L2TP tunnel accounting (RFC 2867) can collect usage data based either on L2TP tunnel and/or L2TP session and send these accounting data to a RADIUS server. Different RADIUS attributes like [66] Tunnel-Client-Endpoint, [67] Tunnel-Server-Endpoint, [68] Acct-Tunnel-Connection, [82] Tunnel-Assignment-ID could be used to identify the tunnel or session. The value with tag 0 is used as default for the tunnels where the value is not specified. Pre-configured values are used when attribute is omitted ( configure router/service vprn < service-id> l2tp radius-accounting-policy). Unreferenced policy-names or policy-names longer than the allowed maximum are treated as host setup failures.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Refers to the user to be authenticated in the Access-Request. The format for IPoE/PPPoE hosts depends on configuration parameters pppoe-access-method, ppp-user-name or user-name-format in the CLI context configure subscriber-mgmt authentication-policy < name>. The format for ARP-hosts is not configurable and always the host IPv4-address. The RADIUS User-Name specified in an Access-Accept or CoA is reflected in the corresponding accounting messages. The attribute is omitted in authentication/accounting via configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute no user-name.
|
|
|
|
ESM: configure aaa radius-server-policy < policy-name> servers source-address < ip- address>
DSM: configure aaa isa-radius-policy < name> nas-ip-address-origin { isa-ip| system-ip}
|
|
|
|
The physical access-circuit on the NAS which is used for the Authentication or Accounting of the user. The format of this attribute is configurable on the NAS as a fixed 32 bit value or a parameterized 32 bit value. The parameters can be a combination of outer-vlan-id(o), inner-vlan-id(i), slot number(s), MDA number(m), port number or lag-id(p), ATM VPI(v) and ATM VCI(c), fixed bit values zero (0) or one (1) but cannot exceed 32 bit. The format can be configured for following applications: configure aaa l2tp-accounting-policy < name> include-radius-attribute nas-port, configure router l2tp cisco-nas-port, configure service vprn < service-id> l2tp cisco-nas-port, configure subscriber-mgmt authentication-policy < name> include-radius-attribute nas-port, configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute nas-port.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The routing information (IPv4 managed route) to be configured on the NAS for a host (dhcp, pppoe, arp) that operates as a router without NAT (so called Routed subscriber host). Valid RADIUS learned managed routes can be included in RADIUS accounting messages with following configuration: configure subscriber-mgmt radius-accounting-policy <name> include-radius-attribute framed-route. Associated managed routes for an instantiated routed subscriber host are included in RADIUS accounting messages independent of the state of the managed route (Installed, Shadowed or HostInactive). In case of a PPP session, when a Framed-Route is available while the corresponding routed subscriber host is not yet instantiated, the managed route is in the state “notYetInstalled” and will not be included in RADIUS accounting messages.
|
|
|
|
|
|
|
|
|
|
|
|
Allows the NAS to send unique information identifying the user who requested the service. This format is driven by configuration (configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute calling-station-id < llid| mac| remote-id| sap-id| sap-string>). The LLID (logical link identifier) is the mapping from a physical to logical identification of a subscriber line and supplied by a RADIUS llid-server. The sap-string maps to configure service < service-id> subscriber-interface < ip-int-name> group-interface < ip-int-name> sap < sap-id> calling-station-id <sap-string>. A [31] Calling-Station-Id attribute value longer than the allowed maximum is treated as a setup failure. The attribute is omitted in authentication/accounting via configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute no calling-station-id.
|
|
|
|
A string (configure system name < system-name>) identifying the NAS originating the Authentication or Accounting requests and sent when nas-identifier is included for the corresponding application: configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting).
|
|
|
|
|
|
|
|
|
|
|
|
Indicates how many octets have been received from the user over the course of this service being provided and included when standard accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute std-acct-attributes). [52] Acct-Input-Gigawords indicates how many times (if greater than zero) the [42] Acct-Input-Octets counter has wrapped around 2^32.
|
|
|
|
Indicates how many octets have been send from the user over the course of this service being provided and included when standard accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute std-acct-attributes). [53] Acct-Output-Gigawords indicates how many times (if greater than zero) the [43] Acct-Output-Octets counter has wrapped around 2^32.
|
|
|
|
|
|
|
|
Indicates how the user was authenticated. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute no acct-authentic.
|
|
|
|
|
|
|
|
|
|
|
|
Indicates how many packets have been send to the user over the course of this service being provided and included when standard accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute std-acct-attributes). There is no overflow attribute when attribute wraps around 2^32.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The type of the physical port of the NAS which is authenticating the user and value automatically determined from subscriber SAP encapsulation. It can be overruled by configuration. Included only if include-radius-attribute nas-port-type is added per application: configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting). Checked for correctness if returned in CoA.
|
|
|
|
|
|
|
|
The address can be overwritten with the configured ipv6-source-address (configure aaa radius-server-policy < policy-name> servers ipv6-source-address < ipv6-address>).
|
|
|
|
Contains the IPv6 interface ID from the user. The attribute can optionally be included in Accounting messages (configure subscriber-mgmt radius-accounting-policy include-radius-attribute framed-interface-id). The Framed-Interface-Id attribute is not sent in RADIUS Authentication and silently ignored in RADIUS Accept.
|
|
|
|
|
|
|
|
The routing information (IPv6 managed route) to be configured on the NAS for a v6 wan-host (IPoE or PPPoE) that operates as a router. Valid RADIUS learned managed routes can be included in RADIUS accounting messages with following configuration: configure subscriber-mgmt radius-accounting-policy <name> include-radius-attribute framed-ipv6-route. Associated managed routes for an instantiated routed subscriber host are included in RADIUS accounting messages independent of the state of the managed route (Installed, Shadowed or HostInactive). In case of a PPP session, when a Framed-IPv6-Route is available while the corresponding routed subscriber host is not yet instantiated, the managed route is in the state “notYetInstalled” and will not be included in RADIUS accounting messages.
|
|
|
|
Attribute that carries the Prefix (ipv6-prefix/prefix-length) to be delegated via DHCPv6 (IA-PD) for the LAN side of the user (IPoE, PPPoE). Maps to DHCPv6 option IA-PD [25] sub-option IA-Prefix [26] Prefix. An exact Delegated-prefix-Length [DPL] match with configure service < service-id> subscriber-interface < ip-int-name> ipv6 delegated-prefix-length [48..64] is required with the received attribute prefix-length unless a variable DPL is configured ( configure service < service-id> subscriber-interface < ip-int-name> ipv6 delegated-prefix-length variable).In the latter case we support multiple hosts for the same group-interface having different prefix-length [48..64] per host. Simultaneous returned attributes [123] Delegated-IPv6-Prefix and [26-6527-131] Alc-Delegated-IPv6-Pool are handled as host setup failures. Attribute is also used in CoA and Disconnect Message (part of the ESM or AA user identification-key). Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute no delegated-ipv6-prefix.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The last mile encapsulation used by the subscriber on the DSL access loop and maps to values received during PPPoE discovery Tags (tag 0x0105) or DHCP Tags (opt-82). Attribute is included/excluded in RADIUS/Accounting-Request based on configure subscriber-mgmt authentication-policy/ radius-accounting-policy < name> include-radius-attribute access-loop-options. Last mile encapsulation information can be used to adjust automatically the egress aggregate rate for this subscriber. Pre-configured encapsulation types are used if PPP/IPoE access loop information (tags) is not available ( configure subscriber-mgmt sub-profile < subscriber-profile-name> egress encap-offset < type> or configure subscriber-mgmt local-user-db < local-user-db-name> ppp host access-loop encap-offset < type>). [26-6527-133] Alc-Access-Loop-Encap-Offset when returned in Access-Accept is taken into account (overrules received tags and pre-configured encapsulation types) for ALE adjust (last mile aware shaping) but is not reflected in access-loop-options send to RADIUS. Alc-Access-Loop-Encap from ANCP are currently not taken into account for ALE adjust.
|
|
|
|
|
|
|
|
|
|
|
|
The subscriber profile is a template which contains settings (accounting, igmp, HQoS, etc.) which are applicable to all hosts belonging to the same subscriber were [26-6527-12] Alc-Subsc-Prof-Str is the string that maps (configure subscriber-mgmt sub-ident-policy sub-profile-map) to such an subscriber profile ( configure subscriber-mgmt sub-profile < subscriber-profile-name>). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (string does not map to a policy) are silently ignored and a fallback to pre-configured defaults is done. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute no sub-profile.
|
|
|
|
The SLA profile is a template which contains settings (filter, QoS, host-limit...) which are applicable to individual hosts were [26-6527-13] Alc-SLA-Prof-Str is the string that maps (configure subscriber-mgmt sub-ident-policy < sub-ident-policy-name> sla-profile-map) to such a sla profile ( configure subscriber-mgmt sla-profile < sla-profile-name>). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (string does not map to a policy) are silently ignored and a fallback to pre-configured defaults is done. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute no sla-profile.
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The attribute is included when detailed queue/policer statistics VSAs are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute detailed-acct-attributes).
|
|
|
|
The MAC address from a user that requests a service and included in CoA, Authentication or Accounting (configure subscriber-mgmt authentication-policy/radius-accounting-policy < name> include-radius-attribute mac-address).
|
|
|
|
Initiated by DHCP clients via option 60 [Class-id] and reflected in Accounting. (configure subscriber-mgmt radius-accounting-policy < name> incl ude-radius-attribute dhcp-vendor-class-id).
|
|
|
|
Up to eight hsmda- counter-override counters can be specified in CLI (configure qos sap-egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
Up to eight hsmda- counter-override counters can be specified in CLI (configure qos sap-egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
Up to eight hsmda- counter-override counters can be specified in CLI (configure qos sap-egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
Up to eight hsmda- counter-override counters can be specified in CLI (configure qos sap-egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters high-octets-discarded-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters low-octets-discarded-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters high-packets-discarded-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters low-packets-discarded-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters high-octets-offered-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters low-octets-offered-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters high-packets-offered-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters low-packets-offered-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters uncolored-octets-offered-count is enabled.Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> i-counters uncolored-packets-offered-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> e-counters in-profile-packets-discarded-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue < queue-id> e-counters in-profile-octets-forwarded-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
A customized record and provides the flexibility to reduce the volume of data generated, network operators can define the record that needs to be collected. This attribute is generated when configure subscriber-mgmt radius-accounting-policy < name> custom-record queue <queue-id> e-counters out-profile-octets-discarded-count is enabled. Customized records are available for queues, not for policers.
|
|
|
|
Up to eight hsmda-counter-override counters can be specified in CLI (configure qos sap- egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
Up to eight hsmda-counter-override counters can be specified in CLI (configure qos sap- egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
Up to eight hsmda-counter-override counters can be specified in CLI (configure qos sap- egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
Up to eight hsmda-counter-override counters can be specified in CLI (configure qos sap- egress < policy-id> prec| dscp| ip-criteria| ipv6-criteria).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Identifies what ingress counters the operator wishes to maintain for the policer and defined by configure qos sap-ingress < policy-id> policer < policer-id> stat-mode < stat-mode>. The default stat-mode is minimal and the current stats-modes are: no-stats, minimal, offered-profile-no-cir, offered-priority-no- cir, offered-profile-cir, offered-priority-cir, offered-total-cir, offered-limited- profile-cir, offered-profile-capped-cir and offered-limited-capped-cir.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Holds for the NAT user his public outside ipv4 address, his assigned outside public port range(s) and the outside routing instance. For LSN accounting, the attribute is sent when port-range-block is included under configure aaa isa-radius-policy. The attribute is also sent for ESM subscriber accounting if NAT is enabled and if configured in configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute nat-port-range.
|
|
|
|
Identifies what egress counters the operator wishes to maintain for the policer and defined by configure qos sap-egress < policy-id> policer < policer-id> stat-mode < stat-mode>. The default stat-mode is minimal and the current stats-modes are: no-stats, minimal, offered-profile-no-cir, offered-profile-cir, offered-total-cir, offered-limited-capped-cir and offered-profile-capped-cir
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/ radius-accounting-policy < name> include-radius-attribute access-loop-options.
|
|
|
|
|
|
|
|
|
|
|
|
Included when IPv6 aggregated accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute v6-aggregate-stats). There is no overflow attribute when counter wraps around 2^32.
|
|
|
|
Included when IPv6 aggregated accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute v6-aggregate-stats).
|
|
|
|
Included when IPv6 aggregated accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute v6-aggregate-stats).
|
|
|
|
Included when IPv6 aggregated accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute v6-aggregate-stats). There is no overflow attribute when counter wraps around 2^32.
|
|
|
|
Included when IPv6 aggregated accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute v6-aggregate-stats).
|
|
|
|
Included when IPv6 aggregated accounting attributes are configured. (configure subscriber-mgmt radius-accounting-policy < name> include-radius-attribute v6-aggregate-stats).
|
|
|
|
(configure subscriber-mgmt radius-accounting-policy < name> include- radius-attribute wifi-ssid-vlan).
|
|
|
|
|
(*) Note on acct-on/off: The table represents the acct-on-off attributes for an accounting server configured via a radius-server-policy (configure subscriber-mgmt radius-accounting-policy <
name>
radius-server-policy <
radius-server-policy-name> and with
acct-on-off enabled. If the accounting server is configured direct under the radius-accounting-server (
configure subscriber-mgmt radius-accounting-policy <
name>
radius-accounting-server server <
server-index>, then the following attributes are not sent in acct-on/off messages: [44] Acct-Session-Id, [45] Acct-Authentic and [49] Acct-Terminate-Cause; and attribute [26-6527-12] Alc-Subsc-Prof-Str is sent.
Table 74 specifies the different Terminate Causes generated by the SR OS in [49] Acct-Terminate-Cause attribute.
Table 76 details the different attributes that can be used in a CoA and Disconnect Message to identify one or multiple subscriber host(s).
Table 77 details the attribute that can be used in a CoA and Disconnect Message to target migrant users. A Disconnect Message removes any existing migrant state for the specified UE. A CoA can only be sent for a UE in portal state to trigger the creation of an ESM or DSM user. In contrast to most CoA’s this update is not incremental: the CoA must include all required authentication attributes to create the user. The applicability of attributes is the same as for an Access-Accept message in an authentication procedure.
Table 78 details the different attributes that can be used in a CoA and Disconnect Message to identify a single DSM UE.
Table 79 details the different attributes that can be used in a Disconnect Message to identify one or multiple IKEv2 remote-access tunnel(s).
Table 80 provides an overview of all attributes that are supported in a RADIUS Change of Authorization (CoA) message. For attribute details, refer to the other sections in this document.
Table 81 provides an overview of the [101] Error-Cause attribute values as defined in RFC 5176 and lists if they are generated in SR OS.
Table 82 lists the possible [101] Error-Cause attribute values generated in SR OS in response to a Disconnect Message targeting an IPsec tunnel.
