draft-ietf-radext-rfc3576bis-06.txt   draft-ietf-radext-rfc3576bis-07.txt 
Network Working Group Murtaza S. Chiba Network Working Group Murtaza S. Chiba
INTERNET-DRAFT Gopal Dommety INTERNET-DRAFT Gopal Dommety
Obsoletes: 3576 Mark Eklund Obsoletes: 3576 Mark Eklund
Category: Informational Cisco Systems, Inc. Category: Informational Cisco Systems, Inc.
<draft-ietf-radext-rfc3576bis-06.txt> David Mitton <draft-ietf-radext-rfc3576bis-07.txt> David Mitton
23 May 2007 RSA Security, Inc. 27 May 2007 RSA Security, Inc.
Bernard Aboba Bernard Aboba
Microsoft Corporation Microsoft Corporation
Dynamic Authorization Extensions to Remote Authentication Dial In User Dynamic Authorization Extensions to Remote Authentication Dial In User
Service (RADIUS) Service (RADIUS)
By submitting this Internet-Draft, each author represents that any By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79. aware will be disclosed, in accordance with Section 6 of BCP 79.
skipping to change at page 2, line 15 skipping to change at page 2, line 15
Table of Contents Table of Contents
1. Introduction .......................................... 3 1. Introduction .......................................... 3
1.1 Applicability ................................... 3 1.1 Applicability ................................... 3
1.2 Requirements Language ........................... 4 1.2 Requirements Language ........................... 4
1.3 Terminology ..................................... 4 1.3 Terminology ..................................... 4
2. Overview ............................................. 5 2. Overview ............................................. 5
2.1 Disconnect Messages (DM) ........................ 5 2.1 Disconnect Messages (DM) ........................ 5
2.2 Change-of-Authorization Messages (CoA) .......... 5 2.2 Change-of-Authorization Messages (CoA) .......... 5
2.3 Packet Format ................................... 6 2.3 Packet Format ................................... 6
3. Attributes ............................................ 9 3. Attributes ............................................ 10
3.1 Proxy State ..................................... 11 3.1 Proxy State ..................................... 12
3.2 Authorize Only .................................. 12 3.2 Authorize Only .................................. 12
3.3 State ........................................... 12 3.3 State ........................................... 13
3.4 Message-Authenticator ........................... 13 3.4 Message-Authenticator ........................... 14
3.5 Error-Cause ..................................... 14 3.5 Error-Cause ..................................... 15
3.6 Table of Attributes ............................. 17 3.6 Table of Attributes ............................. 18
4. Diameter Considerations ............................... 20 4. Diameter Considerations ............................... 21
5. IANA Considerations ................................... 22 5. IANA Considerations ................................... 23
6. Security Considerations ............................... 23 6. Security Considerations ............................... 24
6.1 Authorization Issues ............................ 23 6.1 Authorization Issues ............................ 24
6.2 Impersonation ................................... 23 6.2 Impersonation ................................... 25
6.3 IPsec Usage Guidelines .......................... 24 6.3 IPsec Usage Guidelines .......................... 25
6.4 Replay Protection ............................... 27 6.4 Replay Protection ............................... 28
7. Example Traces ........................................ 28 7. Example Traces ........................................ 29
8. References ............................................ 28 8. References ............................................ 29
8.1 Normative References ............................ 28 8.1 Normative References ............................ 29
8.2 Informative References .......................... 29 8.2 Informative References .......................... 30
ACKNOWLEDGMENTS .............................................. 30 ACKNOWLEDGMENTS .............................................. 31
AUTHORS' ADDRESSES ........................................... 31 AUTHORS' ADDRESSES ........................................... 32
Appendix A - Changes from RFC 3576 ........................... 32 Appendix A - Changes from RFC 3576 ........................... 33
Full Copyright Statement ..................................... 33 Full Copyright Statement ..................................... 35
Intellectual Property ........................................ 33 Intellectual Property ........................................ 35
1. Introduction 1. Introduction
The RADIUS protocol, defined in [RFC2865], does not support The RADIUS protocol, defined in [RFC2865], does not support
unsolicited messages sent from the RADIUS server to the Network unsolicited messages sent from the RADIUS server to the Network
Access Server (NAS). Access Server (NAS).
However, there are many instances in which it is desirable for However, there are many instances in which it is desirable for
changes to be made to session characteristics, without requiring the changes to be made to session characteristics, without requiring the
NAS to initiate the exchange. For example, it may be desirable for NAS to initiate the exchange. For example, it may be desirable for
administrators to be able to terminate a user session in progress. administrators to be able to terminate a user session in progress.
Alternatively, if the user changes authorization level, this may Alternatively, if the user changes authorization level, this may
require that authorization attributes be added/deleted from a user require that authorization attributes be added/deleted from a user
session. session.
To overcome these limitations, several vendors have implemented To overcome these limitations, several vendors have implemented
additional RADIUS commands in order to be able to support unsolicited additional RADIUS commands in order to be able to support unsolicited
messages sent from the RADIUS server to the NAS. These extended messages to be sent to the NAS. These extended commands provide
commands provide support for Disconnect and Change-of-Authorization support for Disconnect and Change-of-Authorization (CoA) packets.
(CoA) packets. Disconnect packets cause a user session to be Disconnect packets cause a user session to be terminated immediately,
terminated immediately, whereas CoA packets modify session whereas CoA packets modify session authorization attributes such as
authorization attributes such as data filters. data filters.
1.1. Applicability 1.1. Applicability
This protocol is being recommended for publication as an This protocol is being recommended for publication as an
Informational RFC rather than as a standards-track RFC because of Informational RFC rather than as a standards-track RFC because of
problems that cannot be fixed without creating incompatibilities with problems that cannot be fixed without creating incompatibilities with
deployed implementations. This includes security vulnerabilities, as deployed implementations. This includes security vulnerabilities, as
well as semantic ambiguities resulting from the design of the Change- well as semantic ambiguities resulting from the design of the Change-
of-Authorization (CoA) commands. While fixes are recommended, they of-Authorization (CoA) commands. While fixes are recommended, they
cannot be made mandatory since this would be incompatible with cannot be made mandatory since this would be incompatible with
existing implementations. existing implementations.
Existing implementations of this protocol do not support Existing implementations of this protocol do not support
authorization checks, so that an ISP sharing a NAS with another ISP authorization checks, so that an ISP sharing a NAS with another ISP
could disconnect or change authorizations for another ISP's users. could disconnect or change authorizations for another ISP's users.
In order to remedy this problem, a "Reverse Path Forwarding" check is In order to remedy this problem, a "Reverse Path Forwarding" check is
recommended. See Section 6.1. for details. described; see Section 6.1. for details.
Existing implementations utilize per-packet authentication and Existing implementations utilize per-packet authentication and
integrity protection algorithms with known weaknesses [MD5Attack]. integrity protection algorithms with known weaknesses [MD5Attack].
To provide stronger per-packet authentication and integrity To provide stronger per-packet authentication and integrity
protection, the use of IPsec is recommended. See Section 6.3 for protection, the use of IPsec is recommended. See Section 6.3 for
details. details.
Existing implementations lack replay protection. In order to support Existing implementations lack replay protection. In order to support
replay detection, it is recommended that an Event-Timestamp Attribute replay detection, it is recommended that an Event-Timestamp Attribute
be added to all packets in situations where IPsec replay protection be added to all packets in situations where IPsec replay protection
skipping to change at page 4, line 33 skipping to change at page 4, line 33
1.2. Requirements Language 1.2. Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. document are to be interpreted as described in [RFC2119].
1.3. Terminology 1.3. Terminology
This document frequently uses the following terms: This document frequently uses the following terms:
Dynamic Authorization Client (DAC)
The entity originating Change of Authorization (CoA) Requests or
Disconnect-Requests. While it is possible that the DAC is co-
resident with a RADIUS authentication or accounting server, this
need not necessarily be the case.
Dynamic Authorization Server (DAS)
The entity receiving CoA-Request or Disconnect-Request packets.
The DAS may be a NAS or a RADIUS proxy.
Network Access Server (NAS) Network Access Server (NAS)
The device providing access to the network. The device providing access to the network.
service service
The NAS provides a service to the user, such as IEEE 802 or PPP. The NAS provides a service to the user, such as IEEE 802 or Point-
to-Point Protocol (PPP).
session session
Each service provided by the NAS to a user constitutes a session, Each service provided by the NAS to a user constitutes a session,
with the beginning of the session defined as the point where with the beginning of the session defined as the point where
service is first provided and the end of the session defined as the service is first provided and the end of the session defined as the
point where service is ended. A user may have multiple sessions in point where service is ended. A user may have multiple sessions in
parallel or series if the NAS supports that. parallel or series if the NAS supports that.
silently discard silently discard
This means the implementation discards the packet without further This means the implementation discards the packet without further
processing. The implementation SHOULD provide the capability of processing. The implementation SHOULD provide the capability of
logging the error, including the contents of the silently discarded logging the error, including the contents of the silently discarded
packet, and SHOULD record the event in a statistics counter. packet, and SHOULD record the event in a statistics counter.
2. Overview 2. Overview
This section describes the most commonly implemented features of This section describes the most commonly implemented features of
Disconnect and Change-of-Authorization packets. Disconnect and Change-of-Authorization (CoA) packets.
2.1. Disconnect Messages (DM) 2.1. Disconnect Messages (DM)
A Disconnect-Request packet is sent by the RADIUS server in order to A Disconnect-Request packet is sent by the Dynamic Authorization
terminate a user session on a NAS and discard all associated session Client in order to terminate a user session on a NAS and discard all
context. The Disconnect-Request packet is sent to UDP port 3799, and associated session context. The Disconnect-Request packet is sent to
identifies the NAS as well as the user session to be terminated by UDP port 3799, and identifies the NAS as well as the user session to
inclusion of the identification attributes described in Section 3. be terminated by inclusion of the identification attributes described
in Section 3.
+----------+ Disconnect-Request +----------+ +----------+ +----------+
| | <-------------------- | | | | Disconnect-Request | |
| NAS | | RADIUS | | | <-------------------- | Dynamic |
| | Disconnect-Response | Server | | NAS | | Authz |
| | Disconnect-Response | Client |
| | ---------------------> | | | | ---------------------> | |
+----------+ +----------+ +----------+ +----------+
The NAS responds to a Disconnect-Request packet sent by a RADIUS The NAS responds to a Disconnect-Request packet sent by a Dynamic
server with a Disconnect-ACK if all associated session context is Authorization Client with a Disconnect-ACK if all associated session
discarded and the user session is no longer connected, or a context is discarded and the user session is no longer connected, or
Disconnect-NAK, if the NAS was unable to disconnect the session and a Disconnect-NAK, if the NAS was unable to disconnect the session and
discard all associated session context. A Disconnect-ACK MAY contain discard all associated session context. A Disconnect-ACK MAY contain
the Attribute Acct-Terminate-Cause (49) [RFC2866] with the value set the Attribute Acct-Terminate-Cause (49) [RFC2866] with the value set
to 6 for Admin-Reset. to 6 for Admin-Reset.
2.2. Change-of-Authorization Messages (CoA) 2.2. Change-of-Authorization Messages (CoA)
CoA-Request packets contain information for dynamically changing CoA-Request packets contain information for dynamically changing
session authorizations. Typically this is used to change data session authorizations. Typically this is used to change data
filters. The data filters can be of either the ingress or egress filters. The data filters can be of either the ingress or egress
kind, and are sent in addition to the identification attributes as kind, and are sent in addition to the identification attributes as
skipping to change at page 6, line 5 skipping to change at page 6, line 16
The following attributes MAY be sent in a CoA-Request: The following attributes MAY be sent in a CoA-Request:
Filter-ID (11) - Indicates the name of a data filter list Filter-ID (11) - Indicates the name of a data filter list
to be applied for the session that the to be applied for the session that the
identification attributes map to. identification attributes map to.
NAS-Filter-Rule (92) - Provides a filter list to be applied NAS-Filter-Rule (92) - Provides a filter list to be applied
for the session that the identification for the session that the identification
attributes map to [RFC4849]. attributes map to [RFC4849].
+----------+ CoA-Request +----------+ +----------+ +----------+
| | <-------------------- | | | | CoA-Request | |
| NAS | | RADIUS | | | <-------------------- | Dynamic |
| | CoA-Response | Server | | NAS | | Authz |
| | CoA-Response | Client |
| | ---------------------> | | | | ---------------------> | |
+----------+ +----------+ +----------+ +----------+
The NAS responds to a CoA-Request sent by a RADIUS server with a CoA- The NAS responds to a CoA-Request sent by a Dynamic Authorization
ACK if the NAS is able to successfully change the authorizations for Client with a CoA-ACK if the NAS is able to successfully change the
the user session, or a CoA-NAK if the Request is unsuccessful. A NAS authorizations for the user session, or a CoA-NAK if the CoA-Request
MUST respond to a CoA-Request including a Service-Type Attribute with is unsuccessful. A NAS MUST respond to a CoA-Request including a
an unsupported value with a CoA-NAK; an Error-Cause Attribute with Service-Type Attribute with an unsupported value with a CoA-NAK; an
value "Unsupported Service" SHOULD be included. Error-Cause Attribute with value "Unsupported Service" SHOULD be
included.
2.3. Packet Format 2.3. Packet Format
For either Disconnect-Request or CoA-Request packets UDP port 3799 is For either Disconnect-Request or CoA-Request packets UDP port 3799 is
used as the destination port. For responses, the source and used as the destination port. For responses, the source and
destination ports are reversed. Exactly one RADIUS packet is destination ports are reversed. Exactly one RADIUS packet is
encapsulated in the UDP Data field. encapsulated in the UDP Data field.
A summary of the data format is shown below. The fields are A summary of the data format is shown below. The fields are
transmitted from left to right. transmitted from left to right.
skipping to change at page 7, line 16 skipping to change at page 7, line 35
40 - Disconnect-Request [RFC3575] 40 - Disconnect-Request [RFC3575]
41 - Disconnect-ACK [RFC3575] 41 - Disconnect-ACK [RFC3575]
42 - Disconnect-NAK [RFC3575] 42 - Disconnect-NAK [RFC3575]
43 - CoA-Request [RFC3575] 43 - CoA-Request [RFC3575]
44 - CoA-ACK [RFC3575] 44 - CoA-ACK [RFC3575]
45 - CoA-NAK [RFC3575] 45 - CoA-NAK [RFC3575]
Identifier Identifier
The Identifier field is one octet, and aids in matching requests The Identifier field is one octet, and aids in matching requests
and replies. RADIUS clients implementing this specification MUST and replies. A Dynamic Authorization Server implementing this
be capable of detecting a duplicate request if it has the same specification MUST be capable of detecting a duplicate request if
server source IP address, source UDP port and Identifier within a it has the same source IP address, source UDP port and Identifier
short span of time. within a short span of time.
Unlike RADIUS as defined in [RFC2865], the responsibility for The responsibility for retransmission of Disconnect-Request and
retransmission of Disconnect-Request and CoA-Request packets lies CoA-Request packets lies with the Dynamic Authorization Client.
with the RADIUS server. If after sending these packets, the If after sending these packets, the Dynamic Authorization Client
RADIUS server does not receive a response, it will retransmit. does not receive a response, it will retransmit.
The Identifier field MUST be changed whenever the content of the The Identifier field MUST be changed whenever the content of the
Attributes field changes, or whenever a valid reply has been Attributes field changes, or whenever a valid reply has been
received for a previous request. For retransmissions where the received for a previous request. For retransmissions where the
contents are identical, the Identifier MUST remain unchanged. contents are identical, the Identifier MUST remain unchanged.
If the RADIUS server is retransmitting a Disconnect-Request or If the Dynamic Authorization Client is retransmitting a
CoA-Request to the same client as before, and the Attributes Disconnect-Request or CoA-Request to the same Dynamic
haven't changed, the same Request Authenticator, Identifier and Authorization Server as before, and the Attributes haven't
source port MUST be used. If any Attributes have changed, a new changed, the same Request Authenticator, Identifier and source
port MUST be used. If any Attributes have changed, a new
Authenticator and Identifier MUST be used. Authenticator and Identifier MUST be used.
If the Request to a primary proxy fails, a secondary proxy must be If the Request to a primary Dynamic Authorization Server fails, a
queried, if available. Issues relating to failover algorithms are secondary Dynamic Authorization Server must be queried, if
described in [RFC3539]. Since this represents a new request, a available; issues relating to failover algorithms are described in
new Request Authenticator and Identifier MUST be used. However, [RFC3539]. Since this represents a new request, a new Request
where the RADIUS server is sending directly to the client, Authenticator and Identifier MUST be used. However, where the
failover typically does not make sense, since Disconnect or CoA Dynamic Authorization Client is sending directly to the NAS,
packets need to be delivered to the NAS where the session resides. failover typically does not make sense, since CoA-Request or
Disconnect-Request packets need to be delivered to the NAS where
the session resides.
Length Length
The Length field is two octets. It indicates the length of the The Length field is two octets. It indicates the length of the
packet including the Code, Identifier, Length, Authenticator and packet including the Code, Identifier, Length, Authenticator and
Attribute fields. Octets outside the range of the Length field Attribute fields. Octets outside the range of the Length field
MUST be treated as padding and ignored on reception. If the MUST be treated as padding and ignored on reception. If the
packet is shorter than the Length field indicates, it MUST be packet is shorter than the Length field indicates, it MUST be
silently discarded. The minimum length is 20 and maximum length silently discarded. The minimum length is 20 and maximum length
is 4096. is 4096.
Authenticator Authenticator
The Authenticator field is sixteen (16) octets. The most The Authenticator field is sixteen (16) octets. The most
significant octet is transmitted first. This value is used to significant octet is transmitted first. This value is used to
authenticate packets between the RADIUS server and client. authenticate packets between the Dynamic Authorization Client and
the Dynamic Authorization Server.
Request Authenticator Request Authenticator
In Request packets, the Authenticator value is a 16 octet MD5 In Request packets, the Authenticator value is a 16 octet MD5
[RFC1321] checksum, called the Request Authenticator. The [RFC1321] checksum, called the Request Authenticator. The
Request Authenticator is calculated the same way as for an Request Authenticator is calculated the same way as for an
Accounting-Request, specified in [RFC2866]. Accounting-Request, specified in [RFC2866].
Note that the Request Authenticator of a Disconnect or CoA- Note that the Request Authenticator of a CoA-Request or
Request cannot be computed the same way as the Request Disconnect-Request cannot be computed the same way as the
Authenticator of a RADIUS Access-Request, because there is no Request Authenticator of a RADIUS Access-Request, because there
User-Password Attribute in a Disconnect-Request or CoA-Request. is no User-Password Attribute in a CoA-Request or Disconnect-
Request.
Response Authenticator Response Authenticator
The Authenticator field in a Response packet (e.g. Disconnect- The Authenticator field in a Response packet (e.g. Disconnect-
ACK, Disconnect-NAK, CoA-ACK, or CoA-NAK) is called the ACK, Disconnect-NAK, CoA-ACK, or CoA-NAK) is called the
Response Authenticator, and contains a one-way MD5 hash Response Authenticator, and contains a one-way MD5 hash
calculated over a stream of octets consisting of the Code, calculated over a stream of octets consisting of the Code,
Identifier, Length, the Request Authenticator field from the Identifier, Length, the Request Authenticator field from the
packet being replied to, and the response Attributes if any, packet being replied to, and the response Attributes if any,
followed by the shared secret. The resulting 16 octet MD5 hash followed by the shared secret. The resulting 16 octet MD5 hash
value is stored in the Authenticator field of the Response value is stored in the Authenticator field of the Response
packet. packet.
Administrative note: As noted in [RFC2865] Section 3, the secret Administrative note: As noted in [RFC2865] Section 3, the secret
(password shared between the client and the RADIUS server) SHOULD (password shared between the Dynamic Authorization Client and the
be at least as large and unguessable as a well-chosen password. Dynamic Authorization Server) SHOULD be at least as large and
RADIUS clients MUST use the source IP address of the RADIUS UDP unguessable as a well-chosen password. The Dynamic Authorization
packet to decide which shared secret to use, so that requests can Server MUST use the source IP address of the RADIUS UDP packet to
be proxied. decide which shared secret to use, so that requests can be
proxied.
Attributes Attributes
In Disconnect and CoA-Request packets, all Attributes are treated In Disconnect and CoA-Request packets, all attributes are treated
as mandatory. If one or more authorization changes specified in a as mandatory. If one or more authorization changes specified in a
CoA-Request cannot be carried out, the NAS MUST send a CoA-NAK. A CoA-Request cannot be carried out, the NAS MUST send a CoA-NAK. A
NAS MUST respond to a CoA-Request containing one or more NAS MUST respond to a CoA-Request containing one or more
unsupported Attributes or Attribute values with a CoA-NAK; an unsupported Attributes or Attribute values with a CoA-NAK; an
Error-Cause Attribute with value 401 (Unsupported Attribute) or Error-Cause Attribute with value 401 (Unsupported Attribute) or
407 (Invalid Attribute Value) MAY be included. A NAS MUST respond 407 (Invalid Attribute Value) MAY be included. A NAS MUST respond
to a Disconnect-Request containing one or more unsupported to a Disconnect-Request containing one or more unsupported
Attributes or Attribute values with a Disconnect-NAK; an Error- Attributes or Attribute values with a Disconnect-NAK; an Error-
Cause Attribute with value 401 (Unsupported Attribute) or 407 Cause Attribute with value 401 (Unsupported Attribute) or 407
(Invalid Attribute Value) MAY be included. (Invalid Attribute Value) MAY be included.
State changes resulting from a CoA-Request MUST be atomic: if the State changes resulting from a CoA-Request MUST be atomic: if the
Request is successful, a CoA-ACK MUST be sent in reply, and all CoA-Request is successful, the Dynamic Authorization Server MUST
requested authorization changes MUST be made. If the CoA-Request send a CoA-ACK in reply, and all requested authorization changes
is unsuccessful, a CoA-NAK MUST be sent in reply, and the MUST be made. If the CoA-Request is unsuccessful, a CoA-NAK MUST
requested authorization changes MUST NOT be made. Similarly, a be sent in reply, and the requested authorization changes MUST NOT
state change MUST NOT occur as a result of an unsuccessful be made. Similarly, a state change MUST NOT occur as a result of
Disconnect-Request; a Disconnect-NAK MUST be sent in reply. an unsuccessful Disconnect-Request; the Dynamic Authorization
Server MUST send a Disconnect-NAK in reply.
Within this specification attributes can be used for Within this specification attributes can be used for
identification, authorization or other purposes. RADIUS Attribute identification, authorization or other purposes. RADIUS Attribute
specifications created after publication of this document SHOULD specifications created after publication of this document SHOULD
state whether an attribute can be included in CoA or Disconnect state whether an attribute can be included in CoA or Disconnect
messages and if so, which messages it can be included in and messages and if so, which messages it can be included in and
whether it serves as an identification or authorization attribute. whether it serves as an identification or authorization attribute.
Even if a NAS implements an attribute for use with RADIUS Even if a NAS implements an attribute for use with RADIUS
authentication and accounting, it is possible that it will not authentication and accounting, it is possible that it will not
support inclusion of that attribute within Disconnect-Request or support inclusion of that attribute within CoA-Request and
CoA-Request packets, given the difference in attribute semantics. Disconnect-Request packets, given the difference in attribute
This is true even for attributes specified as allowable within semantics. This is true even for attributes specified as
Access-Accept packets (such as those defined within [RFC2865], allowable within Access-Accept packets (such as those defined
[RFC2868], [RFC2869], [RFC3162], [RFC3579], [RFC4372], [RFC4675], within [RFC2865], [RFC2868], [RFC2869], [RFC3162], [RFC3579],
[RFC4818] and [RFC4849]). [RFC4372], [RFC4675], [RFC4818] and [RFC4849]).
3. Attributes 3. Attributes
In Disconnect-Request and CoA-Request packets, certain attributes are In Disconnect-Request and CoA-Request packets, certain attributes are
used to uniquely identify the NAS as well as a user session on the used to uniquely identify the NAS as well as a user session on the
NAS. All NAS identification attributes included in a Request packet NAS. All NAS identification attributes included in a Request packet
MUST match in order for a Disconnect-Request or CoA-Request to be MUST match in order for a Disconnect-Request or CoA-Request to be
successful; otherwise a Disconnect-NAK or CoA-NAK SHOULD be sent. successful; otherwise a Disconnect-NAK or CoA-NAK SHOULD be sent.
For session identification attributes, the User-Name and Acct- For session identification attributes, the User-Name and Acct-
Session-Id Attributes, if included, MUST match in order for a Session-Id Attributes, if included, MUST match in order for a
skipping to change at page 10, line 46 skipping to change at page 11, line 23
unique (e.g. "anonymous"). unique (e.g. "anonymous").
To address security concerns described in Section 6.1, either the To address security concerns described in Section 6.1, either the
User-Name or Chargeable-User-Identity attribute SHOULD be present in User-Name or Chargeable-User-Identity attribute SHOULD be present in
Disconnect-Request and CoA-Request packets. Disconnect-Request and CoA-Request packets.
Where a Diameter client utilizes the same Session-Id for both Where a Diameter client utilizes the same Session-Id for both
authorization and accounting, inclusion of an Acct-Session-Id authorization and accounting, inclusion of an Acct-Session-Id
Attribute in a Disconnect-Request or CoA-Request can assist with Attribute in a Disconnect-Request or CoA-Request can assist with
Diameter/RADIUS translation, since Diameter RAR and ASR commands Diameter/RADIUS translation, since Diameter RAR and ASR commands
include a Session-Id AVP. An Acct-Session-Id attribute SHOULD be include a Session-Id AVP. An Acct-Session-Id Attribute SHOULD be
included in Disconnect-Request and CoA-Request packets. included in Disconnect-Request and CoA-Request packets.
Where the Acct-Session-Id Attribute is not present in a CoA-Request A NAS implementing this specification SHOULD send an Acct-Session-Id
or Disconnect-Request, it is possible that the User-Name or or Acct-Multi-Session-Id Attribute within an Access-Request. Where
Chargeable-User-Identity attributes will not be sufficient to an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not included
uniquely identify the session (e.g. if the same user has multiple within an Access-Request, the Dynamic Authorizatoin Client will not
sessions on the NAS, or the privacy NAI is used). As a result, one know the Acct-Session-Id or Acct-Multi-Session-Id of the session it
or more of the Acct-Multi-Session-Id, Called-Station-Id, Calling- is attempting to target, unless it also has access to the accounting
Station-Id, NAS-Port and NAS-Port-Id attributes MAY be used as data for that session.
additional session identification.
Where an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not
present in a CoA-Request or Disconnect-Request, it is possible that
the the User-Name or Chargeable-User-Identity attributes will not be
sufficient to uniquely identify the session (e.g. if the same user
has multiple sessions on the NAS, or if the privacy NAI is used). In
this case, session identification MAY be performed by using one or
more of the Called-Station-Id, Calling-Station-Id, NAS-Port and NAS-
Port-Id attributes.
To address security concerns described in Section 6.2, one or more of To address security concerns described in Section 6.2, one or more of
the NAS-IP-Address or NAS-IPv6-Address Attributes SHOULD be present the NAS-IP-Address or NAS-IPv6-Address Attributes SHOULD be present
in Disconnect-Request and CoA-Request packets; the NAS-Identifier in CoA-Request and Disconnect-Request packets; the NAS-Identifier
Attribute MAY be present. Attribute MAY be present.
A Disconnect-Request MUST contain only NAS and session identification A Disconnect-Request MUST contain only NAS and session identification
attributes. If other attributes are included in a Disconnect- attributes. If other attributes are included in a Disconnect-
Request, implementations MUST send a Disconnect-NAK; an Error-Cause Request, implementations MUST send a Disconnect-NAK; an Error-Cause
Attribute with value "Unsupported Attribute" MAY be included. Attribute with value "Unsupported Attribute" MAY be included.
3.1. Proxy State 3.1. Proxy State
If there are any Proxy-State attributes in a Disconnect-Request or If there are any Proxy-State attributes in a Disconnect-Request or
CoA-Request received from the server, the forwarding proxy or NAS CoA-Request received from the Dynamic Authorization Client, the
MUST include those Proxy-State attributes in its response to the Dynamic Authorization Server MUST include those Proxy-State
server. attributes in its response to the Dynamic Authorization Client.
A forwarding proxy or NAS MUST NOT modify existing Proxy-State, A forwarding proxy or NAS MUST NOT modify existing Proxy-State,
State, or Class attributes present in the packet. The forwarding State, or Class attributes present in the packet. The forwarding
proxy or NAS MUST treat any Proxy-State attributes already in the proxy or NAS MUST treat any Proxy-State attributes already in the
packet as opaque data. Its operation MUST NOT depend on the content packet as opaque data. Its operation MUST NOT depend on the content
of Proxy-State attributes added by previous proxies. The forwarding of Proxy-State attributes added by previous proxies. The forwarding
proxy MUST NOT modify any other Proxy-State attributes that were in proxy MUST NOT modify any other Proxy-State attributes that were in
the packet; it may choose not to forward them, but it MUST NOT change the packet; it may choose not to forward them, but it MUST NOT change
their contents. If the forwarding proxy omits the Proxy-State their contents. If the forwarding proxy omits the Proxy-State
attributes in the request, it MUST attach them to the response before attributes in the request, it MUST attach them to the response before
skipping to change at page 12, line 8 skipping to change at page 12, line 42
When the proxy receives a response to a CoA-Request or Disconnect- When the proxy receives a response to a CoA-Request or Disconnect-
Request, it MUST remove its own Proxy-State (the last Proxy- State in Request, it MUST remove its own Proxy-State (the last Proxy- State in
the packet) Attribute before forwarding the response. Since the packet) Attribute before forwarding the response. Since
Disconnect and CoA responses are authenticated on the entire packet Disconnect and CoA responses are authenticated on the entire packet
contents, the stripping of the Proxy-State Attribute invalidates the contents, the stripping of the Proxy-State Attribute invalidates the
integrity check - so the proxy needs to recompute it. integrity check - so the proxy needs to recompute it.
3.2. Authorize Only 3.2. Authorize Only
Support for a CoA-Request including a Service-Type Attribute with Support for a CoA-Request including a Service-Type Attribute with
value "Authorize Only" is OPTIONAL on the NAS and RADIUS server. A value "Authorize Only" is OPTIONAL on the NAS and Dynamic
Service-Type Attribute MUST NOT be included within a Disconnect- Authorization Client. A Service-Type Attribute MUST NOT be included
Request. within a Disconnect-Request.
A NAS MUST respond to a CoA-Request including a Service-Type A NAS MUST respond to a CoA-Request including a Service-Type
Attribute with value "Authorize Only" with a CoA-NAK; a CoA-ACK MUST Attribute with value "Authorize Only" with a CoA-NAK; a CoA-ACK MUST
NOT be sent. If the NAS does not support a Service-Type value of NOT be sent. If the NAS does not support a Service-Type value of
"Authorize Only" then it MUST respond with a CoA-NAK; an Error-Cause "Authorize Only" then it MUST respond with a CoA-NAK; an Error-Cause
value of 405 (Unsupported Service) SHOULD be included. value of 405 (Unsupported Service) SHOULD be included.
A CoA-Request containing a Service-Type Attribute with value A CoA-Request containing a Service-Type Attribute with value
"Authorize Only" MUST in addition contain only NAS or session "Authorize Only" MUST in addition contain only NAS or session
identification attributes, as well as a State Attribute. If other identification attributes, as well as a State Attribute. If other
attributes are included in such a CoA-Request, a CoA-NAK MUST be attributes are included in such a CoA-Request, a CoA-NAK MUST be
sent; an Error-Cause Attribute with value 401 (Unsupported Attribute) sent; an Error-Cause Attribute with value 401 (Unsupported Attribute)
SHOULD be included. SHOULD be included.
If a CoA-Request packet including a Service-Type value of "Authorize If a CoA-Request packet including a Service-Type value of "Authorize
Only" is successfully processed, the NAS MUST respond with a CoA-NAK Only" is successfully processed, the NAS MUST respond with a CoA-NAK
containing a Service-Type Attribute with value "Authorize Only", and containing a Service-Type Attribute with value "Authorize Only", and
an Error-Cause Attribute with value 507 (Request Initiated). The NAS an Error-Cause Attribute with value 507 (Request Initiated). The NAS
then MUST send an Access-Request to the RADIUS server including a then MUST send an Access-Request to the RADIUS server including a
Service-Type Attribute with value "Authorize Only". This Access- Service-Type Attribute with value "Authorize Only", along with a
Request SHOULD contain the NAS identification attributes from the State Attribute. This Access-Request SHOULD contain the NAS
CoA-Request, as well as the session identification attributes from identification attributes from the CoA-Request, as well as the
the CoA-Request legal for inclusion in an Access-Request as specified session identification attributes from the CoA-Request permitted in
in [RFC2865], [RFC2868], [RFC2869] and [RFC3162]. As noted in an Access-Request. As noted in [RFC2869] Section 5.19, a Message-
[RFC2869] Section 5.19, a Message-Authenticator attribute SHOULD be Authenticator attribute SHOULD be included in an Access-Request that
included in an Access-Request that does not contain a User-Password, does not contain a User-Password, CHAP-Password, ARAP-Password or
CHAP-Password, ARAP-Password or EAP-Message Attribute. The RADIUS EAP-Message Attribute. The RADIUS server then will respond to the
server then will respond to the Access-Request with an Access-Accept Access-Request with an Access-Accept to (re-)authorize the session or
to (re-)authorize the session or an Access-Reject to refuse to an Access-Reject to refuse to (re-)authorize it.
(re-)authorize it.
3.3. State 3.3. State
The State Attribute is available to be sent by the RADIUS server to The State Attribute is available to be sent by the Dynamic
the NAS in a CoA-Request packet and MUST be sent unmodified from the Authorization Client to the NAS in a CoA-Request packet and MUST be
NAS to the RADIUS server in a subsequent ACK or NAK packet. sent unmodified from the NAS to the Dynamic Authorization Client in a
subsequent ACK or NAK packet.
[RFC2865] Section 5.44 states: [RFC2865] Section 5.44 states:
An Access-Request MUST contain either a User-Password or a CHAP- An Access-Request MUST contain either a User-Password or a CHAP-
Password or State. An Access-Request MUST NOT contain both a Password or State. An Access-Request MUST NOT contain both a
User-Password and a CHAP-Password. If future extensions allow User-Password and a CHAP-Password. If future extensions allow
other kinds of authentication information to be conveyed, the other kinds of authentication information to be conveyed, the
attribute for that can be used in an Access-Request instead of attribute for that can be used in an Access-Request instead of
User-Password or CHAP-Password. User-Password or CHAP-Password.
In order to satisfy the requirements of [RFC2865] Section 5.44, an In order to satisfy the requirements of [RFC2865] Section 5.44, an
Access-Request with Service-Type="Authorize-Only" MUST contain a Access-Request with Service-Type="Authorize-Only" MUST contain a
State attribute. State attribute.
In order to provide a State attribute to the NAS, a server sending a In order to provide a State attribute to the NAS, a Dynamic
CoA-Request with a Service-Type value of "Authorize-Only" MUST Authorization Client sending a CoA-Request with a Service-Type value
include a State Attribute, and the NAS MUST send the State Attribute of "Authorize-Only" MUST include a State Attribute, and the NAS MUST
unmodified to the RADIUS server in the resulting Access-Request, if send the State Attribute unmodified to the RADIUS server in the
any. A NAS receiving a CoA-Request containing a Service-Type value resulting Access-Request, if any. A NAS receiving a CoA-Request
of "Authorize-Only" but lacking a State attribute MUST send a CoA-NAK containing a Service-Type value of "Authorize-Only" but lacking a
and SHOULD include an Error-Cause attribute with value 402 (Missing State attribute MUST send a CoA-NAK and SHOULD include an Error-Cause
Attribute). attribute with value 402 (Missing Attribute).
The State Attribute is also available to be sent by the RADIUS server The State Attribute is also available to be sent by the Dynamic
to the NAS in a CoA-Request that also includes a Termination-Action Authorization Client to the NAS in a CoA-Request that also includes a
Attribute with the value of RADIUS-Request. If the client performs Termination-Action Attribute with the value of RADIUS-Request. If
the Termination-Action by sending a new Access-Request upon the NAS performs the Termination-Action by sending a new Access-
termination of the current session, it MUST include the State Request upon termination of the current session, it MUST include the
Attribute unchanged in that Access-Request. In either usage, the State Attribute unchanged in that Access-Request. In either usage,
client MUST NOT interpret the Attribute locally. A CoA-Request the Dynamic Authorization Server MUST NOT interpret the Attribute
packet must have only zero or one State Attribute. Usage of the locally. A CoA-Request packet MUST have only zero or one State
State Attribute is implementation dependent. Attribute. Usage of the State Attribute is implementation dependent.
3.4. Message-Authenticator 3.4. Message-Authenticator
The Message-Authenticator Attribute MAY be used to authenticate and The Message-Authenticator Attribute MAY be used to authenticate and
integrity-protect CoA-Request, CoA-ACK, CoA-NAK, Disconnect-Request, integrity-protect CoA-Request, CoA-ACK, CoA-NAK, Disconnect-Request,
Disconnect-ACK and Disconnect-NAK packets order to prevent spoofing. Disconnect-ACK and Disconnect-NAK packets order to prevent spoofing.
A RADIUS client receiving a CoA-Request or Disconnect-Request with a A Dynamic Authorization Server receiving a CoA-Request or Disconnect-
Message-Authenticator Attribute present MUST calculate the correct Request with a Message-Authenticator Attribute present MUST calculate
value of the Message-Authenticator and silently discard the packet if the correct value of the Message-Authenticator and silently discard
it does not match the value sent. A RADIUS server receiving a the packet if it does not match the value sent. A Dynamic
CoA/Disconnect-ACK or CoA/Disconnect-NAK with a Message-Authenticator Authorization Client receiving a CoA/Disconnect-ACK or
Attribute present MUST calculate the correct value of the Message- CoA/Disconnect-NAK with a Message-Authenticator Attribute present
Authenticator and silently discard the packet if it does not match MUST calculate the correct value of the Message-Authenticator and
the value sent. silently discard the packet if it does not match the value sent.
When a Message-Authenticator Attribute is included within a CoA- When a Message-Authenticator Attribute is included within a CoA-
Request or Disconnect-Request, it is calculated as follows: Request or Disconnect-Request, it is calculated as follows:
Message-Authenticator = HMAC-MD5 (Type, Identifier, Length, Message-Authenticator = HMAC-MD5 (Type, Identifier, Length,
Request Authenticator, Attributes) Request Authenticator, Attributes)
When the HMAC-MD5 message integrity check is calculated the When the HMAC-MD5 message integrity check is calculated the
Request Authenticator field and Message-Authenticator Attribute Request Authenticator field and Message-Authenticator Attribute
should be considered to be sixteen octets of zero. The Message- should be considered to be sixteen octets of zero. The Message-
Authenticator Attribute is calculated and inserted in the packet Authenticator Attribute is calculated and inserted in the packet
before the Request Authenticator is calculated. before the Request Authenticator is calculated.
When a Message-Authenticator Attribute is included within a CoA- When a Message-Authenticator Attribute is included within a CoA-
ACK, CoA-NAK, Disconnect-ACK or Disconnect-NAK, it is calculated ACK, CoA-NAK, Disconnect-ACK or Disconnect-NAK, it is calculated
as follows: as follows:
skipping to change at page 14, line 28 skipping to change at page 15, line 14
Message-Authenticator Attribute should be considered to be sixteen Message-Authenticator Attribute should be considered to be sixteen
octets of zero. The Request Authenticator is taken from the octets of zero. The Request Authenticator is taken from the
corresponding CoA/Disconnect-Request. The Message-Authenticator corresponding CoA/Disconnect-Request. The Message-Authenticator
is calculated and inserted in the packet before the Response is calculated and inserted in the packet before the Response
Authenticator is calculated. Authenticator is calculated.
3.5. Error-Cause 3.5. Error-Cause
Description Description
It is possible that the NAS cannot honor Disconnect-Request or It is possible that a Dynamic Authorization Server cannot honor
CoA-Request packets for some reason. The Error-Cause Attribute Disconnect-Request or CoA-Request packets for some reason. The
provides more detail on the cause of the problem. It MAY be Error-Cause Attribute provides more detail on the cause of the
included within Disconnect-NAK and CoA-NAK packets. problem. It MAY be included within CoA-NAK and Disconnect-NAK
packets.
A summary of the Error-Cause Attribute format is shown below. The A summary of the Error-Cause Attribute format is shown below. The
fields are transmitted from left to right. fields are transmitted from left to right.
0 1 2 3 0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type | Length | Value | Type | Length | Value
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Value (cont) | Value (cont) |
skipping to change at page 15, line 4 skipping to change at page 15, line 38
Value (cont) | Value (cont) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Type Type
101 for Error-Cause 101 for Error-Cause
Length Length
6 6
Value Value
The Value field is four octets, containing an integer specifying The Value field is four octets, containing an integer specifying
the cause of the error. Values 0-199 and 300-399 are reserved. the cause of the error. Values 0-199 and 300-399 are reserved.
Values 200-299 represent successful completion, so that these Values 200-299 represent successful completion, so that these
values may only be sent within Disconnect-ACK or CoA-ACK packets values may only be sent within CoA-ACK or Disconnect-ACK packets
and MUST NOT be sent within a Disconnect-NAK or CoA-NAK. Values and MUST NOT be sent within a CoA-NAK or Disconnect-NAK packet.
400-499 represent fatal errors committed by the RADIUS server, so Values 400-499 represent fatal errors committed by the Dynamic
that they MAY be sent within CoA-NAK or Disconnect-NAK packets, Authorization Client, so that they MAY be sent within CoA-NAK or
and MUST NOT be sent within CoA-ACK or Disconnect-ACK packets. Disconnect-NAK packets, and MUST NOT be sent within CoA-ACK or
Values 500-599 represent fatal errors occurring on a NAS or RADIUS Disconnect-ACK packets. Values 500-599 represent fatal errors
proxy, so that they MAY be sent within CoA-NAK and Disconnect-NAK occurring on a Dynamic Authorization Server, so that they MAY be
packets, and MUST NOT be sent within CoA-ACK or Disconnect-ACK sent within CoA-NAK and Disconnect-NAK packets, and MUST NOT be
packets. Error-Cause values SHOULD be logged by the RADIUS sent within CoA-ACK or Disconnect-ACK packets. Error-Cause values
server. Error-Code values (expressed in decimal) include: SHOULD be logged by the Dynamic Authorization Client. Error-Code
values (expressed in decimal) include:
# Value # Value
--- ----- --- -----
201 Residual Session Context Removed 201 Residual Session Context Removed
202 Invalid EAP Packet (Ignored) 202 Invalid EAP Packet (Ignored)
401 Unsupported Attribute 401 Unsupported Attribute
402 Missing Attribute 402 Missing Attribute
403 NAS Identification Mismatch 403 NAS Identification Mismatch
404 Invalid Request 404 Invalid Request
405 Unsupported Service 405 Unsupported Service
skipping to change at page 16, line 25 skipping to change at page 17, line 13
EAP- Message Attribute(s)) are not formatted properly. EAP- Message Attribute(s)) are not formatted properly.
"Unsupported Service" is a fatal error sent if a Service-Type "Unsupported Service" is a fatal error sent if a Service-Type
Attribute included with the Request is sent with an invalid or Attribute included with the Request is sent with an invalid or
unsupported value. This error cannot be sent in response to a unsupported value. This error cannot be sent in response to a
Disconnect-Request. Disconnect-Request.
"Unsupported Extension" is a fatal error sent due to lack of "Unsupported Extension" is a fatal error sent due to lack of
support for an extension such as Disconnect and/or CoA packets. support for an extension such as Disconnect and/or CoA packets.
This will typically be sent by a proxy receiving an ICMP port This will typically be sent by a proxy receiving an ICMP port
unreachable message after attempting to forward a Request to the unreachable message after attempting to forward a CoA or
NAS. Disconnect-Request to the NAS.
"Unsupported Attribute Value" is a fatal error sent if a Request "Invalid Attribute Value" is a fatal error sent if a CoA-Request
contains an attribute with an unsupported value. or Disconnect-Request contains an attribute with an unsupported
value.
"Administratively Prohibited" is a fatal error sent if the NAS is "Administratively Prohibited" is a fatal error sent if the NAS is
configured to prohibit honoring of Request packets for the configured to prohibit honoring of CoA-Request or Disconnect-
specified session. Request packets for the specified session.
"Request Not Routable" is a fatal error which MAY be sent by a "Request Not Routable" is a fatal error which MAY be sent by a
RADIUS proxy and MUST NOT be sent by a NAS. It indicates that the proxy and MUST NOT be sent by a NAS. It indicates that the proxy
RADIUS proxy was unable to determine how to route the Request to was unable to determine how to route a CoA or Disconnect-Request
the NAS. For example, this can occur if the required entries are to the NAS. For example, this can occur if the required entries
not present in the proxy's realm routing table. are not present in the proxy's realm routing table.
"Session Context Not Found" is a fatal error sent if the session "Session Context Not Found" is a fatal error sent if the session
context identified in the Request does not exist on the NAS. context identified in the CoA-Request or Disconnect-Request does
not exist on the NAS.
"Session Context Not Removable" is a fatal error sent in response "Session Context Not Removable" is a fatal error sent in response
to a Disconnect-Request if the NAS was able to locate the session to a Disconnect-Request if the NAS was able to locate the session
context, but could not remove it for some reason. It MUST NOT be context, but could not remove it for some reason. It MUST NOT be
sent within a CoA-ACK, CoA-NAK or Disconnect-ACK, only within a sent within a CoA-ACK, CoA-NAK or Disconnect-ACK, only within a
Disconnect-NAK. Disconnect-NAK.
"Other Proxy Processing Error" is a fatal error sent in response "Other Proxy Processing Error" is a fatal error sent in response
to a Request that could not be processed by a proxy, for reasons to a CoA or Disconnect-Request that could not be processed by a
other than routing. proxy, for reasons other than routing.
"Resources Unavailable" is a fatal error sent when a Request could "Resources Unavailable" is a fatal error sent when a CoA or
not be honored due to lack of available NAS resources (memory, Disconnect-Request could not be honored due to lack of available
non- volatile storage, etc.). NAS resources (memory, non- volatile storage, etc.).
"Request Initiated" is a fatal error sent in response to a CoA- "Request Initiated" is a fatal error sent by a NAS in response to
Request including a Service-Type Attribute with a value of a CoA-Request including a Service-Type Attribute with a value of
"Authorize Only". It indicates that the CoA-Request has not been "Authorize Only". It indicates that the CoA-Request has not been
honored, but that a RADIUS Access-Request including a Service-Type honored, but that the NAS is sending a RADIUS Access-Request
Attribute with value "Authorize Only" is being sent to the RADIUS including a Service-Type Attribute with value "Authorize Only" to
server. the RADIUS server.
3.6. Table of Attributes 3.6. Table of Attributes
The following table provides a guide to which attributes may be found The following table provides a guide to which attributes may be found
in which packets, and in what quantity. in which packets, and in what quantity.
Change-of-Authorization Messages Change-of-Authorization Messages
Request ACK NAK # Attribute Request ACK NAK # Attribute
0-1 0 0 1 User-Name [Note 1] 0-1 0 0 1 User-Name [Note 1]
skipping to change at page 17, line 52 skipping to change at page 18, line 42
0-1 0 0 23 Framed-IPX-Network [Note 6] 0-1 0 0 23 Framed-IPX-Network [Note 6]
0-1 0-1 0-1 24 State 0-1 0-1 0-1 24 State
0+ 0 0 25 Class [Note 3] 0+ 0 0 25 Class [Note 3]
0+ 0 0 26 Vendor-Specific [Note 3] 0+ 0 0 26 Vendor-Specific [Note 3]
0-1 0 0 27 Session-Timeout [Note 3] 0-1 0 0 27 Session-Timeout [Note 3]
0-1 0 0 28 Idle-Timeout [Note 3] 0-1 0 0 28 Idle-Timeout [Note 3]
0-1 0 0 29 Termination-Action [Note 3] 0-1 0 0 29 Termination-Action [Note 3]
0-1 0 0 30 Called-Station-Id [Note 1] 0-1 0 0 30 Called-Station-Id [Note 1]
0-1 0 0 31 Calling-Station-Id [Note 1] 0-1 0 0 31 Calling-Station-Id [Note 1]
0-1 0 0 32 NAS-Identifier [Note 1] 0-1 0 0 32 NAS-Identifier [Note 1]
Request ACK NAK # Attribute
Request ACK NAK # Attribute
0+ 0+ 0+ 33 Proxy-State 0+ 0+ 0+ 33 Proxy-State
0-1 0 0 34 Login-LAT-Service [Note 3] 0-1 0 0 34 Login-LAT-Service [Note 3]
0-1 0 0 35 Login-LAT-Node [Note 3] 0-1 0 0 35 Login-LAT-Node [Note 3]
0-1 0 0 36 Login-LAT-Group [Note 3] 0-1 0 0 36 Login-LAT-Group [Note 3]
0-1 0 0 37 Framed-AppleTalk-Link [Note 3] 0-1 0 0 37 Framed-AppleTalk-Link [Note 3]
0+ 0 0 38 Framed-AppleTalk-Network [Note 3] 0+ 0 0 38 Framed-AppleTalk-Network [Note 3]
0-1 0 0 39 Framed-AppleTalk-Zone [Note 3] 0-1 0 0 39 Framed-AppleTalk-Zone [Note 3]
0-1 0 0 44 Acct-Session-Id [Note 1] 0-1 0 0 44 Acct-Session-Id [Note 1]
0-1 0 0 50 Acct-Multi-Session-Id [Note 1] 0-1 0 0 50 Acct-Multi-Session-Id [Note 1]
Request ACK NAK # Attribute
Request ACK NAK # Attribute
0-1 0-1 0-1 55 Event-Timestamp 0-1 0-1 0-1 55 Event-Timestamp
0+ 0 0 56 Egress-VLANID [Note 3] 0+ 0 0 56 Egress-VLANID [Note 3]
0-1 0 0 57 Ingress-Filters [Note 3] 0-1 0 0 57 Ingress-Filters [Note 3]
0+ 0 0 58 Egress-VLAN-Name [Note 3] 0+ 0 0 58 Egress-VLAN-Name [Note 3]
0-1 0 0 59 User-Priority-Table [Note 3] 0-1 0 0 59 User-Priority-Table [Note 3]
0-1 0 0 61 NAS-Port-Type [Note 3] 0-1 0 0 61 NAS-Port-Type [Note 3]
0-1 0 0 62 Port-Limit [Note 3] 0-1 0 0 62 Port-Limit [Note 3]
0-1 0 0 63 Login-LAT-Port [Note 3] 0-1 0 0 63 Login-LAT-Port [Note 3]
0+ 0 0 64 Tunnel-Type [Note 5] 0+ 0 0 64 Tunnel-Type [Note 5]
0+ 0 0 65 Tunnel-Medium-Type [Note 5] 0+ 0 0 65 Tunnel-Medium-Type [Note 5]
skipping to change at page 20, line 17 skipping to change at page 21, line 17
Message/Notification-Response Attribute. Message/Notification-Response Attribute.
[Note 3] When included within a CoA-Request, these attributes [Note 3] When included within a CoA-Request, these attributes
represent an authorization change request. When one of these represent an authorization change request. When one of these
attributes is omitted from a CoA-Request, the NAS assumes that the attributes is omitted from a CoA-Request, the NAS assumes that the
attribute value is to remain unchanged. Attributes included in a attribute value is to remain unchanged. Attributes included in a
CoA-Request replace all existing value(s) of the same attribute(s). CoA-Request replace all existing value(s) of the same attribute(s).
[Note 4] When included within a successful Disconnect-Request (where [Note 4] When included within a successful Disconnect-Request (where
a Disconnect-ACK is subsequently sent), the Class Attribute SHOULD be a Disconnect-ACK is subsequently sent), the Class Attribute SHOULD be
sent unmodified by the client to the accounting server in the sent unmodified by the NAS to the RADIUS accounting server in the
Accounting Stop packet. If the Disconnect-Request is unsuccessful, Accounting Stop packet. If the Disconnect-Request is unsuccessful,
then the Class Attribute is not processed. then the Class Attribute is not processed.
[Note 5] When included within a CoA-Request, these attributes [Note 5] When included within a CoA-Request, these attributes
represent an authorization change request. Where tunnel attribute(s) represent an authorization change request. Where tunnel attribute(s)
are included within a successful CoA-Request, all existing tunnel are included within a successful CoA-Request, all existing tunnel
attributes are removed and replaced by the new attribute(s). attributes are removed and replaced by the new attribute(s).
[Note 6] Where included within a CoA-Request, these attributes [Note 6] Where included within a CoA-Request, these attributes
represent a renumbering request. Since these attributes are not used represent a renumbering request. Since these attributes are not used
skipping to change at page 20, line 45 skipping to change at page 21, line 45
Due to differences in handling change-of-authorization requests in Due to differences in handling change-of-authorization requests in
RADIUS and Diameter, it may be difficult or impossible for a RADIUS and Diameter, it may be difficult or impossible for a
Diameter/RADIUS gateway to successfully translate a Diameter Re-Auth- Diameter/RADIUS gateway to successfully translate a Diameter Re-Auth-
Request (RAR) to a CoA-Request and vice versa. For example, since a Request (RAR) to a CoA-Request and vice versa. For example, since a
CoA-Request only initiates an authorization change but does not CoA-Request only initiates an authorization change but does not
initiate re-authentication, a RAR command containing a Re-Auth- initiate re-authentication, a RAR command containing a Re-Auth-
Request-Type AVP with value "AUTHORIZE_AUTHENTICATE" cannot be Request-Type AVP with value "AUTHORIZE_AUTHENTICATE" cannot be
directly translated to a CoA-Request. A Diameter/RADIUS gateway directly translated to a CoA-Request. A Diameter/RADIUS gateway
receiving a CoA-Request containing authorization changes will need to receiving a CoA-Request containing authorization changes will need to
translate this into two Diameter exchange. First, the translate this into two Diameter exchanges. First, the
Diameter/RADIUS gateway will issue a RAR command including a Session- Diameter/RADIUS gateway will issue a RAR command including a Session-
Id AVP and a Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY". Id AVP and a Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY".
Then the Diameter/RADIUS gateway will respond to the ensuing access Then the Diameter/RADIUS gateway will respond to the ensuing access
request with a response including the authorization attributes request with a response including the authorization attributes
gleaned from the CoA-Request. For the translation to be possible, gleaned from the CoA-Request. For the translation to be possible,
the CoA-Request MUST include a Acct-Session-Id Attribute. If the the CoA-Request MUST include a Acct-Session-Id Attribute. If the
Diameter client uses the same Session-Id for both authorization and Diameter client uses the same Session-Id for both authorization and
accounting, then the Diameter/RADIUS gateway can copy the contents of accounting, then the Diameter/RADIUS gateway can copy the contents of
the Acct-Session-Id Attribute into the Session-Id AVP; otherwise, it the Acct-Session-Id Attribute into the Session-Id AVP; otherwise, it
will need to map the Acct-Session-Id value to an equivalent Session- will need to map the Acct-Session-Id value to an equivalent Session-
Id for use within a RAR command. Id for use within a RAR command.
To simplify translation between RADIUS and Diameter, a server To simplify translation between RADIUS and Diameter, Dynamic
compliant with this specification MAY include a Service-Type Authorization Clients can include a Service-Type Attribute with value
Attribute with value "Authorize Only" within a CoA-Request. Such a "Authorize Only" within a CoA-Request, as described in Section 3.2.
CoA-Request MUST contain a State Attribute. A NAS supporting the A Diameter/RADIUS gateway receiving a CoA-Request containing a
"Authorize Only" Service-Type within a CoA-Request responds with a Service-Type with value "Authorize Only" translates this to a RAR
CoA-NAK containing a Service-Type Attribute with value "Authorize with Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY". The
Only", and an Error-Cause Attribute with value "Request Initiated". received RAA is then translated to a CoA-NAK with a Service-Type
The NAS will then send an Access-Request containing a Service-Type
Attribute with a value of "Authorize Only", along with a State
Attribute. A Diameter/RADIUS gateway receiving a CoA-Request
containing a Service-Type with value "Authorize Only" translates this
to a RAR with Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY".
The received RAA is then translated to a CoA-NAK with a Service-Type
value of "Authorize Only". If the Result-Code AVP in the RAA has a value of "Authorize Only". If the Result-Code AVP in the RAA has a
value in the success category, then an Error-Cause Attribute with value in the success category, then an Error-Cause Attribute with
value "Request Initiated" is included in the CoA-NAK. If the value "Request Initiated" is included in the CoA-NAK. If the
Result-Code AVP in the RAA has a value indicating a Protocol Error or Result-Code AVP in the RAA has a value indicating a Protocol Error or
a Transient or Permanent Failure, then an alternate Error-Cause a Transient or Permanent Failure, then an alternate Error-Cause
Attribute is returned as suggested below. Attribute is returned as suggested below.
Within Diameter, a server can request that a session be aborted by Within Diameter, a server can request that a session be aborted by
sending an Abort-Session-Request (ASR), identifying the session to be sending an Abort-Session-Request (ASR), identifying the session to be
terminated using Session-ID and User-Name AVPs. The ASR command is terminated using Session-ID and User-Name AVPs. The ASR command is
translated to a Disconnect-Request containing an Acct-Session-Id and translated to a Disconnect-Request containing Acct-Session-Id and
User-Name attribute. If the Diameter client utilizes the same User-Name attributes. If the Diameter client utilizes the same
Session-Id in both authorization and accounting, then the value of Session-Id in both authorization and accounting, then the value of
the Session-ID AVP may be placed in the Acct-Session-Id attribute; the Session-ID AVP may be placed in the Acct-Session-Id attribute;
otherwise the value of the Session-ID AVP will need to be mapped to otherwise the value of the Session-ID AVP will need to be mapped to
an appropriate Acct-Session-Id value. For a Disconnect-Request to an appropriate Acct-Session-Id value. For a Disconnect-Request to
be translatable to an ASR, an Acct-Session-Id attribute MUST be be translatable to an ASR, an Acct-Session-Id attribute MUST be
present. If the Diameter client utilizes the same Session-Id in both present. If the Diameter client utilizes the same Session-Id in both
authorization and accounting, then the value of the Acct-Session-Id authorization and accounting, then the value of the Acct-Session-Id
may be placed into the Session-ID AVP within the ASR; otherwise the may be placed into the Session-ID AVP within the ASR; otherwise the
value of the Acct-Session-Id will need to be mapped to an appropriate value of the Acct-Session-Id will need to be mapped to an appropriate
Session-ID value. Session-ID value.
An Abort-Session-Answer (ASA) command is sent in response to an ASR An Abort-Session-Answer (ASA) command is sent in response to an ASR
in order to indicate the disposition of the request. A in order to indicate the disposition of the request. A
Diameter/RADIUS gateway receiving a Disconnect-ACK translates this to Diameter/RADIUS gateway receiving a Disconnect-ACK translates this to
an ASA command with a Result-Code AVP of "DIAMETER_SUCCESS". A an ASA command with a Result-Code AVP of "DIAMETER_SUCCESS". A
Disconnect-NAK received from the server is translated to an ASA Disconnect-NAK received from the NAS is translated to an ASA command
command with a Result-Code AVP which depends on the value of the with a Result-Code AVP which depends on the value of the Error-Cause
Error-Cause Attribute. Suggested translations between Error-Cause Attribute. Suggested translations between Error-Cause Attribute
Attribute values and Result-Code AVP values are included below: values and Result-Code AVP values are included below:
# Error-Cause Attribute Value Result-Code AVP # Error-Cause Attribute Value Result-Code AVP
--- --------------------------- ------------------------ --- --------------------------- ------------------------
201 Residual Session Context DIAMETER_SUCCESS 201 Residual Session Context DIAMETER_SUCCESS
Removed Removed
202 Invalid EAP Packet DIAMETER_LIMITED_SUCCESS 202 Invalid EAP Packet DIAMETER_LIMITED_SUCCESS
(Ignored) (Ignored)
401 Unsupported Attribute DIAMETER_AVP_UNSUPPORTED 401 Unsupported Attribute DIAMETER_AVP_UNSUPPORTED
402 Missing Attribute DIAMETER_MISSING_AVP 402 Missing Attribute DIAMETER_MISSING_AVP
403 NAS Identification DIAMETER_REALM_NOT_SERVED 403 NAS Identification DIAMETER_REALM_NOT_SERVED
skipping to change at page 22, line 36 skipping to change at page 23, line 34
Removable Removable
505 Other Proxy Processing DIAMETER_UNABLE_TO_COMPLY 505 Other Proxy Processing DIAMETER_UNABLE_TO_COMPLY
Error Error
506 Resources Unavailable DIAMETER_RESOURCES_EXCEEDED 506 Resources Unavailable DIAMETER_RESOURCES_EXCEEDED
507 Request Initiated DIAMETER_SUCCESS 507 Request Initiated DIAMETER_SUCCESS
Since both the ASR/ASA and Disconnect-Request/Disconnect- Since both the ASR/ASA and Disconnect-Request/Disconnect-
NAK/Disconnect-ACK exchanges involve just a request and response, NAK/Disconnect-ACK exchanges involve just a request and response,
inclusion of an "Authorize Only" Service-Type within a Disconnect- inclusion of an "Authorize Only" Service-Type within a Disconnect-
Request is not needed to assist in Diameter/RADIUS translation, and Request is not needed to assist in Diameter/RADIUS translation, and
may make translation more difficult. As a result, the Service-Type may make translation more difficult. As a result, as noted in
Attribute MUST NOT be used within a Disconnect-Request. Section 3.2, the Service-Type Attribute MUST NOT be used within a
Disconnect-Request.
5. IANA Considerations 5. IANA Considerations
This document uses the RADIUS [RFC2865] namespace, see This document uses the RADIUS [RFC2865] namespace, see
<http://www.iana.org/assignments/radius-types>. In addition to the <http://www.iana.org/assignments/radius-types>. In addition to the
allocations already made in [RFC3576], this specification requests allocations already made in [RFC3575] and [RFC3576], this
allocation of an additional value of the Error-Cause Attribute (101): specification requests allocation of an additional value of the
Error-Cause Attribute (101):
# Value # Value
--- ----- --- -----
407 Invalid Attribute Value 407 Invalid Attribute Value
6. Security Considerations 6. Security Considerations
6.1. Authorization Issues 6.1. Authorization Issues
Where a NAS is shared by multiple providers, it is undesirable for Where a NAS is shared by multiple providers, it is undesirable for
one provider to be able to send Disconnect-Request or CoA-Requests one provider to be able to send Disconnect-Request or CoA-Requests
affecting the sessions of another provider. affecting the sessions of another provider.
A NAS or RADIUS proxy MUST silently discard Disconnect-Request or A Dynamic Authorization Server MUST silently discard Disconnect-
CoA-Request packets from untrusted sources. By default, a RADIUS Request or CoA-Request packets from untrusted sources. In situations
proxy SHOULD perform a "reverse path forwarding" (RPF) check to where the Dynamic Authorization Client is co-resident with a RADIUS
verify that a Disconnect-Request or CoA-Request originates from an authentication or accounting server, a proxy MAY perform a "reverse
authorized RADIUS server. In addition, it SHOULD be possible to path forwarding" (RPF) check to verify that a Disconnect-Request or
explicitly authorize additional sources of Disconnect-Request or CoA- CoA-Request originates from an authorized Dynamic Authorization
Request packets relating to certain classes of sessions. For Client. In addition, it SHOULD be possible to explicitly authorize
example, a particular source can be explicitly authorized to send additional sources of Disconnect-Request or CoA-Request packets
CoA-Request packets relating to users within a set of realms. relating to certain classes of sessions. For example, a particular
source can be explicitly authorized to send CoA-Request packets
relating to users within a set of realms.
To perform the RPF check, the proxy uses the session identification To perform the RPF check, the Dynamic Authorization Server uses the
attributes included in Disconnect-Request or CoA-Request packets, in session identification attributes included in Disconnect-Request or
order to determine the RADIUS server(s) to which an equivalent CoA-Request packets, in order to determine the RADIUS server(s) to
Access-Request could be routed. If the source address of the which an equivalent Access-Request could be routed. If the source
Disconnect-Request or CoA-Request is within this set, then the address of the Disconnect-Request or CoA-Request is within this set,
Request is forwarded; otherwise it MUST be silently discarded. then the CoA-Request or Disconnect-Request is forwarded; otherwise it
MUST be silently discarded.
Typically the proxy will extract the realm from the Network Access Typically the Dynamic Authorization Server will extract the realm
Identifier [RFC4282] included within the User-Name Attribute, and from the Network Access Identifier [RFC4282] included within the
determine the corresponding RADIUS servers in the proxy routing User-Name or Chargeble-User-Identity Attribute, and determine the
tables. The RADIUS servers for that realm are then compared against corresponding RADIUS servers in the realm routing tables. If the
the source address of the packet. Where no RADIUS proxy is present, Dynamic Authorization Server maintains long-term session state, it
the RPF check will need to be performed by the NAS itself. MAY perform the authorization check based on the session
identification attributes in the CoA-Request. The session
identification attributes can be used to tie a session to a
particular proxy or set of proxies, as with the NAI realm.
Where no proxy is present, the RPF check can only be performed by the
NAS if it maintains its own a realm routing table. If the NAS does
not maintain a realm routing table (e.g. it selects forwarding
proxies based on primary/secondary configuration and/or liveness
checks), then an RPF check cannot be performed.
Since authorization to send a Disconnect-Request or CoA-Request is Since authorization to send a Disconnect-Request or CoA-Request is
determined based on the source address and the corresponding shared determined based on the source address and the corresponding shared
secret, the NASes or proxies SHOULD configure a different shared secret, the Dynamic Authorization Server SHOULD configure a different
secret for each RADIUS server. shared secret for each Dynamic Authorization Client.
6.2. Impersonation 6.2. Impersonation
[RFC2865] Section 3 states: [RFC2865] Section 3 states:
A RADIUS server MUST use the source IP address of the RADIUS A RADIUS server MUST use the source IP address of the RADIUS
UDP packet to decide which shared secret to use, so that UDP packet to decide which shared secret to use, so that
RADIUS requests can be proxied. RADIUS requests can be proxied.
When RADIUS requests are forwarded by a proxy, the NAS-IP-Address or When RADIUS Access-Requests are forwarded by a proxy, the NAS-IP-
NAS-IPv6-Address Attributes will typically not match the source Address or NAS-IPv6-Address Attributes will typically not match the
address observed by the RADIUS server. Since the NAS-Identifier source address observed by the RADIUS server. Since the NAS-
Attribute need not contain an FQDN, this attribute may not be Identifier Attribute need not contain an FQDN, this Attribute may not
resolvable to the source address observed by the RADIUS server, even be resolvable to the source address observed by the RADIUS server,
when no proxy is present. even when no proxy is present.
As a result, the authenticity check performed by a RADIUS server or As a result, the authenticity check performed by a RADIUS server or
proxy does not verify the correctness of NAS identification proxy does not verify the correctness of NAS identification
attributes. This makes it possible for a rogue NAS to forge NAS-IP- attributes. This makes it possible for a rogue NAS to forge NAS-IP-
Address, NAS-IPv6-Address or NAS-Identifier Attributes within a Address, NAS-IPv6-Address or NAS-Identifier Attributes within a
RADIUS Access-Request in order to impersonate another NAS. It is RADIUS Access-Request in order to impersonate another NAS. It is
also possible for a rogue NAS to forge session identification also possible for a rogue NAS to forge attributes such as the Called-
attributes such as the Called-Station-Id, Calling-Station-Id, or Station-Id, Calling-Station-Id, or Originating-Line-Info [RFC4005].
Originating-Line-Info [RFC4005]. This could fool the RADIUS server This could fool the Dynamic Authorization Client into sending CoA-
into sending Disconnect-Request or CoA-Request packets containing Request or Disconnect-Request packets containing forged session
forged session identification attributes to a NAS targeted by an identification attributes to a NAS targeted by an attacker.
attacker.
To address these vulnerabilities RADIUS proxies SHOULD check whether To address these vulnerabilities RADIUS proxies one hop from the NAS
NAS identification attributes (see Section 3) match the source SHOULD check whether NAS identification attributes (see Section 3)
address of packets originating from the NAS. Where one or more match the packet source address. Where one or more attributes do not
attributes do not match, Disconnect-Request or CoA-Request packets match, Access-Request packets SHOULD be silently discarded.
SHOULD be silently discarded.
Such a check may not always be possible. Since the NAS-Identifier Such a check may not always be possible. Since the NAS-Identifier
Attribute need not correspond to an FQDN, it may not be resolvable to Attribute need not correspond to an FQDN, it may not be resolvable to
an IP address to be matched against the source address. Also, where an IP address to be matched against the source address. Also, where
a NAT exists between the RADIUS client and proxy, checking the NAS- a NAT exists between the RADIUS client and proxy, checking the NAS-
IP-Address or NAS-IPv6-Address Attributes may not be feasible. IP-Address or NAS-IPv6-Address Attributes may not be feasible.
6.3. IPsec Usage Guidelines 6.3. IPsec Usage Guidelines
In addition to security vulnerabilities unique to Disconnect or CoA In addition to security vulnerabilities unique to Disconnect or CoA
skipping to change at page 25, line 13 skipping to change at page 26, line 21
the Response Authenticator. the Response Authenticator.
Since in RADIUS a shared secret is used to provide confidentiality as Since in RADIUS a shared secret is used to provide confidentiality as
well as integrity protection and authentication, only use of IPsec well as integrity protection and authentication, only use of IPsec
ESP with a non-null transform can provide security services ESP with a non-null transform can provide security services
sufficient to substitute for RADIUS application-layer security. sufficient to substitute for RADIUS application-layer security.
Therefore, where IPsec AH or ESP null is used, it will typically Therefore, where IPsec AH or ESP null is used, it will typically
still be necessary to configure a RADIUS shared secret. still be necessary to configure a RADIUS shared secret.
Where RADIUS is run over IPsec ESP with a non-null transform, the Where RADIUS is run over IPsec ESP with a non-null transform, the
secret shared between the NAS and the RADIUS server MAY NOT be secret shared between the Dynamic Authorization Server and the
configured. In this case, a shared secret of zero length MUST be Dynamic Authorization Client MAY NOT be configured. In this case, a
assumed. However, a RADIUS server that cannot know whether incoming shared secret of zero length MUST be assumed. However, a Dynamic
traffic is IPsec-protected MUST be configured with a non-null RADIUS Authorization Client that cannot know whether incoming traffic is
shared secret. IPsec-protected MUST be configured with a non-null RADIUS shared
secret.
When IPsec ESP is used with RADIUS, per-packet authentication, When IPsec ESP is used with RADIUS, per-packet authentication,
integrity and replay protection MUST be used. 3DES-CBC MUST be integrity and replay protection MUST be used. 3DES-CBC MUST be
supported as an encryption transform and AES-CBC SHOULD be supported. supported as an encryption transform and AES-CBC SHOULD be supported.
AES-CBC SHOULD be offered as a preferred encryption transform if AES-CBC SHOULD be offered as a preferred encryption transform if
supported. HMAC-SHA1-96 MUST be supported as an authentication supported. HMAC-SHA1-96 MUST be supported as an authentication
transform. DES-CBC SHOULD NOT be used as the encryption transform. transform. DES-CBC SHOULD NOT be used as the encryption transform.
A typical IPsec policy for an IPsec-capable RADIUS client is A typical IPsec policy for an IPsec-capable RADIUS client is
"Initiate IPsec, from me to any destination port UDP 1812". This "Initiate IPsec, from me to any destination port UDP 1812". This
IPsec policy causes an IPsec SA to be set up by the RADIUS client IPsec policy causes an IPsec SA to be set up by the RADIUS client
prior to sending RADIUS traffic. If some RADIUS servers contacted by prior to sending a RADIUS Access-Request to a RADIUS server. If some
the client do not support IPsec, then a more granular policy will be RADIUS servers contacted by the RADIUS client do not support IPsec,
required: "Initiate IPsec, from me to IPsec-Capable-RADIUS-Server, then a more granular policy will be required: "Initiate IPsec, from
destination port UDP 1812." me to IPsec-Capable-RADIUS-Server, destination port UDP 1812."
For a client implementing this specification the policy would be For a Dynamic Authorization Server implementing this specification
"Accept IPsec, from any to me, destination port UDP 3799". This the policy would be "Accept IPsec, from any to me, destination port
causes the RADIUS client to accept (but not require) use of IPsec. UDP 3799". This causes the Dynamic Authorization Server to accept
It may not be appropriate to require IPsec for all RADIUS servers (but not require) use of IPsec. It may not be appropriate to require
connecting to an IPsec-enabled RADIUS client, since some RADIUS IPsec for all Dynamic Authorization Clients connecting to an IPsec-
servers may not support IPsec. enabled Dynamic Authorization Server, since some Dynamic
Authorization Clients may not support IPsec.
For an IPsec-capable RADIUS server, a typical IPsec policy is "Accept For an IPsec-capable RADIUS server, a typical IPsec policy is "Accept
IPsec, from any to me, destination port 1812". This causes the IPsec, from any to me, destination port 1812". This causes the
RADIUS server to accept (but not require) use of IPsec. It may not RADIUS server to accept (but not require) use of IPsec. It may not
be appropriate to require IPsec for all RADIUS clients connecting to be appropriate to require IPsec for all RADIUS clients connecting to
an IPsec-enabled RADIUS server, since some RADIUS clients may not an IPsec-enabled RADIUS server, since some RADIUS clients may not
support IPsec. support IPsec.
For servers implementing this specification, the policy would be For Dynamic Authorization Clients implementing this specification,
"Initiate IPsec, from me to any, destination port UDP 3799". This the policy would be "Initiate IPsec, from me to any, destination port
causes the RADIUS server to initiate IPsec when sending RADIUS UDP 3799". This causes the Dynamic Authorization Client to initiate
extension traffic to any RADIUS client. If some RADIUS clients IPsec when sending Dynamic Authorization traffic to any Dynamic
contacted by the server do not support IPsec, then a more granular Authorization Server. If some Dynamic Authorization Servers
policy will be required, such as "Initiate IPsec, from me to IPsec- contacted by the Dynamic Authorization Client do not support IPsec,
capable-RADIUS-client, destination port UDP 3799". then a more granular policy will be required, such as "Initiate
IPsec, from me to IPsec-capable-Dynamic-Authorization-Server,
destination port UDP 3799".
Where IPsec is used for security, and no RADIUS shared secret is Where IPsec is used for security, and no RADIUS shared secret is
configured, it is important that the RADIUS client and server perform configured, it is important that the Dynamic Authorization Server and
an authorization check. Before enabling a host to act as a RADIUS Dynamic Authorization Client perform an authorization check. Before
client, the RADIUS server SHOULD check whether the host is authorized enabling a host to act as a Dynamic Authorization Server, the Dynamic
to provide network access. Similarly, before enabling a host to act Authorization Client SHOULD check whether the host is authorized to
as a RADIUS server, the RADIUS client SHOULD check whether the host act in that role. Similarly, before enabling a host to act as a
is authorized for that role. Dynamic Authorization Client, the Dynamic Authorization Server SHOULD
check whether the host is authorized for that role.
RADIUS servers can be configured with the IP addresses (for IKE Dynamic Authorization Clients can be configured with the IP addresses
Aggressive Mode with pre-shared keys) or FQDNs (for certificate (for IKEv1 Aggressive Mode with pre-shared keys) or FQDNs (for
authentication) of RADIUS clients. Alternatively, if a separate certificate authentication) of Dynamic Authorization Servers.
Certification Authority (CA) exists for RADIUS clients, then the Alternatively, if a separate Certification Authority (CA) exists for
RADIUS server can configure this CA as a trust anchor [RFC3280] for Dynamic Authorization Servers, then the Dynamic Authorization Client
use with IPsec. can configure this CA as a trust anchor [RFC3280] for use with IKEv1.
Similarly, RADIUS clients can be configured with the IP addresses Similarly, Dynamic Authorization Servers can be configured with the
(for IKE Aggressive Mode with pre-shared keys) or FQDNs (for IP addresses (for IKEv1 Aggressive Mode with pre-shared keys) or
certificate authentication) of RADIUS servers. Alternatively, if a FQDNs (for certificate authentication) of Dynamic Authorization
separate CA exists for RADIUS servers, then the RADIUS client can Clients. Alternatively, if a separate CA exists for Dynamic
configure this CA as a trust anchor for use with IPsec. Authorization Clients, then the Dynamic Authorization Server can
configure this CA as a trust anchor for use with IKEv1.
Since unlike SSL/TLS, IKE does not permit certificate policies to be Since unlike SSL/TLS, IKEv1 does not permit certificate policies to
set on a per-port basis, certificate policies need to apply to all be set on a per-port basis, certificate policies need to apply to all
uses of IPsec on RADIUS clients and servers. In IPsec deployment uses of IKEv1 on Dynamic Authorization Servers and Dynamic
supporting only certificate authentication, a management station Authorization Clients. In a deployment supporting only certificate
initiating an IPsec-protected telnet session to the RADIUS server authentication, a management station initiating an IPsec-protected
would need to obtain a certificate chaining to the RADIUS client CA. telnet session to the Dynamic Authorization Client would need to
Issuing such a certificate migh not be appropriate if the management obtain a certificate chaining to the Dynamic Authorization Server CA.
station was not authorized as a RADIUS client. Issuing such a certificate might not be appropriate if the management
station was not authorized as a Dynamic Authorization Server.
Where RADIUS clients may obtain their IP address dynamically (such as Where Dynamic Authorization Servers obtain their IP address
an Access Point supporting DHCP), Main Mode with pre-shared keys dynamically (such as an Access Point supporting DHCP), IKEv1 Main
[RFC2409] SHOULD NOT be used, since this requires use of a group pre- Mode with pre-shared keys [RFC2409] SHOULD NOT be used, since this
shared key; instead, Aggressive Mode SHOULD be used. Where RADIUS requires use of a group pre-shared key; instead, Aggressive Mode
client addresses are statically assigned either Aggressive Mode or SHOULD be used. Where Dynamic Authorization Server addresses are
Main Mode MAY be used. With certificate authentication, Main Mode statically assigned either IKEv1 Aggressive Mode or Main Mode MAY be
SHOULD be used. used. With certificate authentication, IKEv1 Main Mode SHOULD be
used.
Care needs to be taken with IKE Phase 1 Identity Payload selection in Care needs to be taken with IKEv1 Phase 1 Identity Payload selection
order to enable mapping of identities to pre-shared keys even with in order to enable mapping of identities to pre-shared keys even with
Aggressive Mode. Where the ID_IPV4_ADDR or ID_IPV6_ADDR Identity Aggressive Mode. Where the ID_IPV4_ADDR or ID_IPV6_ADDR Identity
Payloads are used and addresses are dynamically assigned, mapping of Payloads are used and addresses are dynamically assigned, mapping of
identities to keys is not possible, so that group pre-shared keys are identities to keys is not possible, so that group pre-shared keys are
still a practical necessity. As a result, the ID_FQDN identity still a practical necessity. As a result, the ID_FQDN identity
payload SHOULD be employed in situations where Aggressive mode is payload SHOULD be employed in situations where Aggressive mode is
utilized along with pre-shared keys and IP addresses are dynamically utilized along with pre-shared keys and IP addresses are dynamically
assigned. This approach also has other advantages, since it allows assigned. This approach also has other advantages, since it allows
the RADIUS server and client to configure themselves based on the the Dynamic Authorization Client and Dynamic Authorization Server to
fully qualified domain name of their peers. configure themselves based on the fully qualified domain name of
their peers.
Note that with IPsec, security services are negotiated at the Note that with IPsec, security services are negotiated at the
granularity of an IPsec SA, so that RADIUS exchanges requiring a set granularity of an IPsec SA, so that exchanges requiring a set of
of security services different from those negotiated with existing security services different from those negotiated with existing IPsec
IPsec SAs will need to negotiate a new IPsec SA. Separate IPsec SAs SAs will need to negotiate a new IPsec SA. Separate IPsec SAs are
are also advisable where quality of service considerations dictate also advisable where quality of service considerations dictate
different handling RADIUS conversations. Attempting to apply different handling RADIUS conversations. Attempting to apply
different quality of service to connections handled by the same IPsec different quality of service to connections handled by the same IPsec
SA can result in reordering, and falling outside the replay window. SA can result in reordering, and falling outside the replay window.
For a discussion of the issues, see [RFC2983]. For a discussion of the issues, see [RFC2983].
6.4. Replay Protection 6.4. Replay Protection
Where IPsec replay protection is not used, an Event-Timestamp (55) Where IPsec replay protection is not used, an Event-Timestamp (55)
[RFC2869] Attribute SHOULD be included within CoA-Request and [RFC2869] Attribute SHOULD be included within CoA-Request and
Disconnect-Request packets, and MAY be included within CoA-ACK, CoA- Disconnect-Request packets, and MAY be included within CoA-ACK, CoA-
NAK, Disconnect-ACK and Disconnect-NAK packets. NAK, Disconnect-ACK and Disconnect-NAK packets.
When the Event-Timestamp attribute is present, both the NAS and the When the Event-Timestamp attribute is present, both the Dynamic
RADIUS server MUST check that the Event-Timestamp Attribute is Authorization Server and the Dynamic Authorization Client MUST check
current within an acceptable time window. If the Event-Timestamp that the Event-Timestamp Attribute is current within an acceptable
Attribute is not current, then the packet MUST be silently discarded. time window. If the Event-Timestamp Attribute is not current, then
This implies the need for loose time synchronization within the the packet MUST be silently discarded. This implies the need for
network, which can be achieved by a variety of means, including SNTP, loose time synchronization within the network, which can be achieved
as described in [RFC4330]. Implementations SHOULD be configurable to by a variety of means, including SNTP, as described in [RFC4330].
discard CoA-Request or Disconnect-Request packets not containing an Implementations SHOULD be configurable to discard CoA-Request or
Event-Timestamp attribute. Disconnect-Request packets not containing an Event-Timestamp
attribute.
If the Event-Timestamp Attribute is included, it represents the time If the Event-Timestamp Attribute is included, it represents the time
at which the original packet was sent, and therefore it SHOULD NOT be at which the original packet was sent, and therefore it SHOULD NOT be
updated when the packet is retransmitted. If the Event-Timestamp updated when the packet is retransmitted. If the Event-Timestamp
attribute is not updated, this implies that the Identifier is not attribute is not updated, this implies that the Identifier is not
changed in retransmitted packets. As a result, the ability to detect changed in retransmitted packets. As a result, the ability to detect
replay within the time window is dependent on support for duplicate replay within the time window is dependent on support for duplicate
detection within that same window. As noted in Section 2.3, detection within that same window. As noted in Section 2.3,
duplicate detection is REQUIRED for RADIUS clients implementing this duplicate detection is REQUIRED for Dynamic Authorization Servers
specification. implementing this specification.
The time window used for duplicate detection MUST be the same as the The time window used for duplicate detection MUST be the same as the
window used to detect stale Event-Timestamp Attributes. Since the window used to detect stale Event-Timestamp Attributes. Since the
RADIUS Identifier cannot be repeated within the selected time window, RADIUS Identifier cannot be repeated within the selected time window,
no more than 256 Requests can be accepted within the time window. As no more than 256 Requests can be accepted within the time window. As
a result, the chosen time window will depend on the expected maximum a result, the chosen time window will depend on the expected maximum
volume of CoA/Disconnect-Requests, so that unnecessary discards can volume of CoA/Disconnect-Requests, so that unnecessary discards can
be avoided. A default time window of 300 seconds should be adequate be avoided. A default time window of 300 seconds should be adequate
in many circumstances. in many circumstances.
skipping to change at page 29, line 26 skipping to change at page 30, line 44
Access Identifier", RFC 4282, December 2005. Access Identifier", RFC 4282, December 2005.
[RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet [RFC4301] Kent, S. and K. Seo, "Security Architecture for the Internet
Protocol", RFC 4301, December 2005. Protocol", RFC 4301, December 2005.
[RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC 4303, [RFC4303] Kent, S., "IP Encapsulating Security Payload (ESP)", RFC 4303,
December 2005. December 2005.
8.2. Informative References 8.2. Informative References
[MD5Attack]
Dobbertin, H., "The Status of MD5 After a Recent Attack",
CryptoBytes Vol.2 No.2, Summer 1996.
[RFC2868] Zorn, G., Leifer, D., Rubens, A., Shriver, J., Holdrege, M. [RFC2868] Zorn, G., Leifer, D., Rubens, A., Shriver, J., Holdrege, M.
and I. Goyret, "RADIUS Attributes for Tunnel Protocol and I. Goyret, "RADIUS Attributes for Tunnel Protocol
Support", RFC 2868, June 2000. Support", RFC 2868, June 2000.
[RFC2983] Black, D. "Differentiated Services and Tunnels", RFC 2983, [RFC2983] Black, D. "Differentiated Services and Tunnels", RFC 2983,
October 2000. October 2000.
[RFC3539] Aboba, B. and J. Wood, "Authentication, Authorization and [RFC3539] Aboba, B. and J. Wood, "Authentication, Authorization and
Accounting Transport Profile", RFC 3539, June 2003. Accounting Transport Profile", RFC 3539, June 2003.
skipping to change at page 30, line 14 skipping to change at page 31, line 36
[RFC4675] Congdon, P., Sanchez, M. and B. Aboba, "RADIUS Attributes for [RFC4675] Congdon, P., Sanchez, M. and B. Aboba, "RADIUS Attributes for
Virtual LAN and Priority Support", RFC 4675, September 2006. Virtual LAN and Priority Support", RFC 4675, September 2006.
[RFC4818] Salowey, J. and R. Droms, "RADIUS Delegated-IPv6-Prefix [RFC4818] Salowey, J. and R. Droms, "RADIUS Delegated-IPv6-Prefix
Attribute", RFC 4818, April 2007. Attribute", RFC 4818, April 2007.
[RFC4849] Congdon, P., Sanchez, M. and B. Aboba, "RADIUS Filter Rule [RFC4849] Congdon, P., Sanchez, M. and B. Aboba, "RADIUS Filter Rule
Attribute", RFC 4849, April 2007. Attribute", RFC 4849, April 2007.
[MD5Attack]
Dobbertin, H., "The Status of MD5 After a Recent Attack",
CryptoBytes Vol.2 No.2, Summer 1996.
Acknowledgments Acknowledgments
This protocol was first developed and distributed by Ascend This protocol was first developed and distributed by Ascend
Communications. Example code was distributed in their free server Communications. Example code was distributed in their free server
kit. kit.
The authors would like to acknowledge the valuable suggestions and The authors would like to acknowledge valuable suggestions and
feedback from the following people: feedback from Avi Lior, Randy Bush, Steve Bellovin, Glen Zorn, Mark
Jones, Claudio Lapidus, Anurag Batta, Kuntal Chowdhury, Tim Moore,
Avi Lior <avi@bridgewatersystems.com>, Russ Housley, Joe Salowey, Alan DeKok and David Nelson.
Randy Bush <randy@psg.net>,
Steve Bellovin <smb@research.att.com>
Glen Zorn <gwz@cisco.com>,
Mark Jones <mjones@bridgewatersystems.com>,
Claudio Lapidus <clapidus@hotmail.com>,
Anurag Batta <Anurag_Batta@3com.com>,
Kuntal Chowdhury <chowdury@nortelnetworks.com>
Tim Moore <timmoore@microsoft.com>
Russ Housley <housley@vigilsec.com>
Joe Salowey <jsalowey@cisco.com>
Authors' Addresses Authors' Addresses
Murtaza Chiba Murtaza Chiba
Cisco Systems, Inc. Cisco Systems, Inc.
170 West Tasman Dr. 170 West Tasman Dr.
San Jose CA, 95134 San Jose CA, 95134
EMail: mchiba@cisco.com EMail: mchiba@cisco.com
Phone: +1 408 525 7198 Phone: +1 408 525 7198
skipping to change at page 32, line 11 skipping to change at page 33, line 11
EMail: bernarda@microsoft.com EMail: bernarda@microsoft.com
Phone: +1 425 706 6605 Phone: +1 425 706 6605
Fax: +1 425 936 7329 Fax: +1 425 936 7329
Appendix A - Changes from RFC 3576 Appendix A - Changes from RFC 3576
This Appendix lists the major changes between [RFC3576] and this This Appendix lists the major changes between [RFC3576] and this
document. Minor changes, including style, grammar, spelling, and document. Minor changes, including style, grammar, spelling, and
editorial changes are not mentioned here. editorial changes are not mentioned here.
o Added requirement for duplicate detection on the RADIUS client o The term "Dynamic Authorization Client" is used instead of RADIUS
(Section 2.3). server where it applies to the originator of CoA and Disconnect-
Request packets. Similarly, the term "Dynamic Authorizatin Server"
is used instead of NAS where it applies to the receiver of CoA and
Disconnect-Request packets. Definitions of these terms have been
added (Section 1.3).
o Added requirement for duplicate detection on the Dynamic
Authorization Server (Section 2.3).
o Added Chargeable-User-Identity as a session identification o Added Chargeable-User-Identity as a session identification
attribute. Removed Framed-IP-Address, Framed-IPv6-Prefix, Framed- attribute. Removed Framed-IP-Address, Framed-IPv6-Prefix, Framed-
Interface-Id and NAS-Port-Type attributes as session identification Interface-Id and NAS-Port-Type attributes as session identification
attributes (Section 3). attributes. Recommended inclusion of Acct-Session-Id or Acct-Multi-
Session-Id attributes in an Access-Request (Section 3).
o Added recommendation that an Acct-Session-Id or Acct-Mult-Session-
Id Attribute be included in an Access-Request (Section 3).
o Added details relating to handling of the Proxy-State Attribute o Added details relating to handling of the Proxy-State Attribute
(Section 3.1). (Section 3.1).
o Added statement that support for "Authorize Only" Service-Type is o Added clarification that support for a Service-Type Attribute with
optional (Section 3.2). value "Authorize Only" is optional on both the NAS and Dynamic
Authorization Client (Section 3.2).
o Added requirements for inclusion of the State Attribute in CoA- o Added requirement for inclusion of the State Attribute in CoA-
Request packets with a Service-Type of "Authorize Only" (Section Request packets including a Service-Type Attribute with a value of
3.3). "Authorize Only" (Section 3.3).
o Added clarification on the calculation of the Message-Authenticator o Added clarification on the calculation of the Message-Authenticator
Attribute (Section 3.4). Attribute (Section 3.4).
o An additional Error-Cause Attribute value (407) is allocated for o An additional Error-Cause Attribute value (407) is allocated for
Invalid Attribute Value (Sections 3.5, 4). Invalid Attribute Value (Sections 3.5, 4).
o Updated CoA-Request Attribute Table to include Filter-Rule, o Updated the CoA-Request Attribute Table to include Filter-Rule,
Delegated-IPv6-Prefix, Egress-VLANID, Ingress-Filters, Egress-VLAN- Delegated-IPv6-Prefix, Egress-VLANID, Ingress-Filters, Egress-VLAN-
Name and User-Priority attributes (Section 3.6). Name and User-Priority attributes (Section 3.6).
o Added the Chargeable-User-Identity Attribute to both the CoA- o Added the Chargeable-User-Identity Attribute to both the CoA-
Request and Disconnect-Request Attribute table (Section 3.6). Request and Disconnect-Request Attribute table (Section 3.6).
o Added note on the use of the CoA-Request for renumbering (Section o Added note on the use of the CoA-Request for renumbering (Section
3.6). 3.6).
o Use of Service-Type Attribute within a Disconnect-Request is o Use of the Service-Type Attribute within a Disconnect-Request is
prohibited (Sections 3.2, 3.6, 4). prohibited (Sections 3.2, 3.6).
o Added Diameter Considerations (Section 4). o Added Diameter Considerations (Section 4).
o Changed the text to indicate that the Event-Timestamp Attribute o Changed the text to indicate that the Event-Timestamp Attribute
should not be recalculated on retransmission. The implications for should not be recalculated on retransmission. The implications for
replay and duplicate detection are discussed (Section 6.4). replay and duplicate detection are discussed (Section 6.4).
o Operation of the RPF check has been clarified. Use of the RPF
check is optional rather than recommended by default (Section 6.1).
Full Copyright Statement Full Copyright Statement
Copyright (C) The IETF Trust (2007). Copyright (C) The IETF Trust (2007).
This document is subject to the rights, licenses and restrictions This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors contained in BCP 78, and except as set forth therein, the authors
retain all their rights. retain all their rights.
This document and the information contained herein are provided on an This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
 End of changes. 86 change blocks. 
356 lines changed or deleted 413 lines changed or added

This html diff was produced by rfcdiff 1.33. The latest version is available from http://tools.ietf.org/tools/rfcdiff/