draft-ietf-radext-rfc3576bis-07.txt   draft-ietf-radext-rfc3576bis-08.txt 
Network Working Group Murtaza S. Chiba Network Working Group Murtaza S. Chiba
INTERNET-DRAFT Gopal Dommety INTERNET-DRAFT Gopal Dommety
Obsoletes: 3576 Mark Eklund Obsoletes: 3576 Mark Eklund
Category: Informational Cisco Systems, Inc. Category: Informational Cisco Systems, Inc.
<draft-ietf-radext-rfc3576bis-07.txt> David Mitton <draft-ietf-radext-rfc3576bis-08.txt> David Mitton
27 May 2007 RSA Security, Inc. 4 June 2007 RSA Security, Inc.
Bernard Aboba Bernard Aboba
Microsoft Corporation Microsoft Corporation
Dynamic Authorization Extensions to Remote Authentication Dial In User Dynamic Authorization Extensions to Remote Authentication Dial In User
Service (RADIUS) Service (RADIUS)
By submitting this Internet-Draft, each author represents that any By submitting this Internet-Draft, each author represents that any
applicable patent or other IPR claims of which he or she is aware applicable patent or other IPR claims of which he or she is aware
have been or will be disclosed, and any of which he or she becomes have been or will be disclosed, and any of which he or she becomes
aware will be disclosed, in accordance with Section 6 of BCP 79. aware will be disclosed, in accordance with Section 6 of BCP 79.
skipping to change at page 2, line 17 skipping to change at page 2, line 17
1. Introduction .......................................... 3 1. Introduction .......................................... 3
1.1 Applicability ................................... 3 1.1 Applicability ................................... 3
1.2 Requirements Language ........................... 4 1.2 Requirements Language ........................... 4
1.3 Terminology ..................................... 4 1.3 Terminology ..................................... 4
2. Overview ............................................. 5 2. Overview ............................................. 5
2.1 Disconnect Messages (DM) ........................ 5 2.1 Disconnect Messages (DM) ........................ 5
2.2 Change-of-Authorization Messages (CoA) .......... 5 2.2 Change-of-Authorization Messages (CoA) .......... 5
2.3 Packet Format ................................... 6 2.3 Packet Format ................................... 6
3. Attributes ............................................ 10 3. Attributes ............................................ 10
3.1 Proxy State ..................................... 12 3.1 Proxy State ..................................... 12
3.2 Authorize Only .................................. 12 3.2 Authorize Only .................................. 13
3.3 State ........................................... 13 3.3 State ........................................... 13
3.4 Message-Authenticator ........................... 14 3.4 Message-Authenticator ........................... 14
3.5 Error-Cause ..................................... 15 3.5 Error-Cause ..................................... 15
3.6 Table of Attributes ............................. 18 3.6 Table of Attributes ............................. 18
4. Diameter Considerations ............................... 21 4. Diameter Considerations ............................... 22
5. IANA Considerations ................................... 23 5. IANA Considerations ................................... 24
6. Security Considerations ............................... 24 6. Security Considerations ............................... 25
6.1 Authorization Issues ............................ 24 6.1 Authorization Issues ............................ 25
6.2 Impersonation ................................... 25 6.2 Impersonation ................................... 26
6.3 IPsec Usage Guidelines .......................... 25 6.3 IPsec Usage Guidelines .......................... 26
6.4 Replay Protection ............................... 28 6.4 Replay Protection ............................... 29
7. Example Traces ........................................ 29 7. Example Traces ........................................ 30
8. References ............................................ 29 8. References ............................................ 30
8.1 Normative References ............................ 29 8.1 Normative References ............................ 30
8.2 Informative References .......................... 30 8.2 Informative References .......................... 31
ACKNOWLEDGMENTS .............................................. 31 ACKNOWLEDGMENTS .............................................. 32
AUTHORS' ADDRESSES ........................................... 32 AUTHORS' ADDRESSES ........................................... 33
Appendix A - Changes from RFC 3576 ........................... 33 Appendix A - Changes from RFC 3576 ........................... 34
Full Copyright Statement ..................................... 35 Full Copyright Statement ..................................... 36
Intellectual Property ........................................ 35 Intellectual Property ........................................ 36
1. Introduction 1. Introduction
The RADIUS protocol, defined in [RFC2865], does not support The RADIUS protocol, defined in [RFC2865], does not support
unsolicited messages sent from the RADIUS server to the Network unsolicited messages sent from the RADIUS server to the Network
Access Server (NAS). Access Server (NAS).
However, there are many instances in which it is desirable for However, there are many instances in which it is desirable for
changes to be made to session characteristics, without requiring the changes to be made to session characteristics, without requiring the
NAS to initiate the exchange. For example, it may be desirable for NAS to initiate the exchange. For example, it may be desirable for
administrators to be able to terminate a user session in progress. administrators to be able to terminate user session(s) in progress.
Alternatively, if the user changes authorization level, this may Alternatively, if the user changes authorization level, this may
require that authorization attributes be added/deleted from a user require that authorization attributes be added/deleted from user
session. session(s).
To overcome these limitations, several vendors have implemented To overcome these limitations, several vendors have implemented
additional RADIUS commands in order to be able to support unsolicited additional RADIUS commands in order to be able to support unsolicited
messages to be sent to the NAS. These extended commands provide messages to be sent to the NAS. These extended commands provide
support for Disconnect and Change-of-Authorization (CoA) packets. support for Disconnect and Change-of-Authorization (CoA) packets.
Disconnect packets cause a user session to be terminated immediately, Disconnect packets cause user session(s) to be terminated
whereas CoA packets modify session authorization attributes such as immediately, whereas CoA packets modify session authorization
data filters. attributes such as data filters.
1.1. Applicability 1.1. Applicability
This protocol is being recommended for publication as an This protocol is being recommended for publication as an
Informational RFC rather than as a standards-track RFC because of Informational RFC rather than as a standards-track RFC because of
problems that cannot be fixed without creating incompatibilities with problems that cannot be fixed without creating incompatibilities with
deployed implementations. This includes security vulnerabilities, as deployed implementations. This includes security vulnerabilities, as
well as semantic ambiguities resulting from the design of the Change- well as semantic ambiguities resulting from the design of the Change-
of-Authorization (CoA) commands. While fixes are recommended, they of-Authorization (CoA) commands. While fixes are recommended, they
cannot be made mandatory since this would be incompatible with cannot be made mandatory since this would be incompatible with
skipping to change at page 5, line 23 skipping to change at page 5, line 23
packet, and SHOULD record the event in a statistics counter. packet, and SHOULD record the event in a statistics counter.
2. Overview 2. Overview
This section describes the most commonly implemented features of This section describes the most commonly implemented features of
Disconnect and Change-of-Authorization (CoA) packets. Disconnect and Change-of-Authorization (CoA) packets.
2.1. Disconnect Messages (DM) 2.1. Disconnect Messages (DM)
A Disconnect-Request packet is sent by the Dynamic Authorization A Disconnect-Request packet is sent by the Dynamic Authorization
Client in order to terminate a user session on a NAS and discard all Client in order to terminate user session(s) on a NAS and discard all
associated session context. The Disconnect-Request packet is sent to associated session context. The Disconnect-Request packet is sent to
UDP port 3799, and identifies the NAS as well as the user session to UDP port 3799, and identifies the NAS as well as the user session(s)
be terminated by inclusion of the identification attributes described to be terminated by inclusion of the identification attributes
in Section 3. described in Section 3.
+----------+ +----------+ +----------+ +----------+
| | Disconnect-Request | | | | Disconnect-Request | |
| | <-------------------- | Dynamic | | | <-------------------- | Dynamic |
| NAS | | Authz | | NAS | | Authz |
| | Disconnect-Response | Client | | | Disconnect-Response | Client |
| | ---------------------> | | | | ---------------------> | |
+----------+ +----------+ +----------+ +----------+
The NAS responds to a Disconnect-Request packet sent by a Dynamic The NAS responds to a Disconnect-Request packet sent by a Dynamic
Authorization Client with a Disconnect-ACK if all associated session Authorization Client with a Disconnect-ACK if all associated session
context is discarded and the user session is no longer connected, or context is discarded and the user session(s) are no longer connected,
a Disconnect-NAK, if the NAS was unable to disconnect the session and or a Disconnect-NAK, if the NAS was unable to disconnect one or more
discard all associated session context. A Disconnect-ACK MAY contain sessions and discard all associated session context. A Disconnect-
the Attribute Acct-Terminate-Cause (49) [RFC2866] with the value set ACK MAY contain the Attribute Acct-Terminate-Cause (49) [RFC2866]
to 6 for Admin-Reset. with the value set to 6 for Admin-Reset.
2.2. Change-of-Authorization Messages (CoA) 2.2. Change-of-Authorization Messages (CoA)
CoA-Request packets contain information for dynamically changing CoA-Request packets contain information for dynamically changing
session authorizations. Typically this is used to change data session authorizations. Typically this is used to change data
filters. The data filters can be of either the ingress or egress filters. The data filters can be of either the ingress or egress
kind, and are sent in addition to the identification attributes as kind, and are sent in addition to the identification attributes as
described in section 3. The port used, and packet format (described described in section 3. The port used, and packet format (described
in Section 2.3), are the same as that for Disconnect-Request packets. in Section 2.3), are the same as that for Disconnect-Request packets.
The following attributes MAY be sent in a CoA-Request: The following attributes MAY be sent in a CoA-Request:
Filter-ID (11) - Indicates the name of a data filter list Filter-ID (11) - Indicates the name of a data filter list
to be applied for the session that the to be applied for the session(s) that the
identification attributes map to. identification attributes map to.
NAS-Filter-Rule (92) - Provides a filter list to be applied NAS-Filter-Rule (92) - Provides a filter list to be applied
for the session that the identification for the session(s) that the identification
attributes map to [RFC4849]. attributes map to [RFC4849].
+----------+ +----------+ +----------+ +----------+
| | CoA-Request | | | | CoA-Request | |
| | <-------------------- | Dynamic | | | <-------------------- | Dynamic |
| NAS | | Authz | | NAS | | Authz |
| | CoA-Response | Client | | | CoA-Response | Client |
| | ---------------------> | | | | ---------------------> | |
+----------+ +----------+ +----------+ +----------+
The NAS responds to a CoA-Request sent by a Dynamic Authorization The NAS responds to a CoA-Request sent by a Dynamic Authorization
Client with a CoA-ACK if the NAS is able to successfully change the Client with a CoA-ACK if the NAS is able to successfully change the
authorizations for the user session, or a CoA-NAK if the CoA-Request authorizations for the user session(s), or a CoA-NAK if the CoA-
is unsuccessful. A NAS MUST respond to a CoA-Request including a Request is unsuccessful. A NAS MUST respond to a CoA-Request
Service-Type Attribute with an unsupported value with a CoA-NAK; an including a Service-Type Attribute with an unsupported value with a
Error-Cause Attribute with value "Unsupported Service" SHOULD be CoA-NAK; an Error-Cause Attribute with value "Unsupported Service"
included. SHOULD be included.
2.3. Packet Format 2.3. Packet Format
For either Disconnect-Request or CoA-Request packets UDP port 3799 is For either Disconnect-Request or CoA-Request packets UDP port 3799 is
used as the destination port. For responses, the source and used as the destination port. For responses, the source and
destination ports are reversed. Exactly one RADIUS packet is destination ports are reversed. Exactly one RADIUS packet is
encapsulated in the UDP Data field. encapsulated in the UDP Data field.
A summary of the data format is shown below. The fields are A summary of the data format is shown below. The fields are
transmitted from left to right. transmitted from left to right.
skipping to change at page 9, line 22 skipping to change at page 9, line 22
Administrative note: As noted in [RFC2865] Section 3, the secret Administrative note: As noted in [RFC2865] Section 3, the secret
(password shared between the Dynamic Authorization Client and the (password shared between the Dynamic Authorization Client and the
Dynamic Authorization Server) SHOULD be at least as large and Dynamic Authorization Server) SHOULD be at least as large and
unguessable as a well-chosen password. The Dynamic Authorization unguessable as a well-chosen password. The Dynamic Authorization
Server MUST use the source IP address of the RADIUS UDP packet to Server MUST use the source IP address of the RADIUS UDP packet to
decide which shared secret to use, so that requests can be decide which shared secret to use, so that requests can be
proxied. proxied.
Attributes Attributes
In Disconnect and CoA-Request packets, all attributes are treated In CoA-Request and Disconnect-Request packets, all attributes MUST
as mandatory. If one or more authorization changes specified in a be treated as mandatory. If one or more authorization changes
CoA-Request cannot be carried out, the NAS MUST send a CoA-NAK. A specified in a CoA-Request cannot be carried out, the NAS MUST
NAS MUST respond to a CoA-Request containing one or more send a CoA-NAK. A NAS MUST respond to a CoA-Request containing
unsupported Attributes or Attribute values with a CoA-NAK; an one or more unsupported Attributes or Attribute values with a CoA-
Error-Cause Attribute with value 401 (Unsupported Attribute) or NAK; an Error-Cause Attribute with value 401 (Unsupported
407 (Invalid Attribute Value) MAY be included. A NAS MUST respond Attribute) or 407 (Invalid Attribute Value) MAY be included. A
to a Disconnect-Request containing one or more unsupported NAS MUST respond to a Disconnect-Request containing one or more
Attributes or Attribute values with a Disconnect-NAK; an Error- unsupported Attributes or Attribute values with a Disconnect-NAK;
Cause Attribute with value 401 (Unsupported Attribute) or 407 an Error-Cause Attribute with value 401 (Unsupported Attribute) or
(Invalid Attribute Value) MAY be included. 407 (Invalid Attribute Value) MAY be included.
State changes resulting from a CoA-Request MUST be atomic: if the State changes resulting from a CoA-Request MUST be atomic: if the
CoA-Request is successful, the Dynamic Authorization Server MUST CoA-Request is successful for all matching sessions, the NAS MUST
send a CoA-ACK in reply, and all requested authorization changes send a CoA-ACK in reply, and all requested authorization changes
MUST be made. If the CoA-Request is unsuccessful, a CoA-NAK MUST MUST be made. If the CoA-Request is unsuccessful for any matching
be sent in reply, and the requested authorization changes MUST NOT sessions, the NAS MUST send as CoA-NAK in reply, and the requested
be made. Similarly, a state change MUST NOT occur as a result of authorization changes MUST NOT be made for any of the matching
an unsuccessful Disconnect-Request; the Dynamic Authorization sessions. Similarly, a state change MUST NOT occur as a result of
Server MUST send a Disconnect-NAK in reply. a Disconnect-Request that is unsuccessful with respect to any of
the matching sessions; a NAS MUST send a Disconnect-NAK in reply
if any of the matching sessions cannot be successfully terminated.
A NAS which does not support dynamic authorization changes
applying to multiple sessions MUST send a CoA-NAK or Disconnect-
NAK in reply; an Error-Cause Attribute with value 508 (Multiple
Session Selection Unsupported) SHOULD be included.
Within this specification attributes can be used for Within this specification attributes can be used for
identification, authorization or other purposes. RADIUS Attribute identification, authorization or other purposes. RADIUS Attribute
specifications created after publication of this document SHOULD specifications created after publication of this document SHOULD
state whether an attribute can be included in CoA or Disconnect state whether an attribute can be included in CoA or Disconnect
messages and if so, which messages it can be included in and messages and if so, which messages it can be included in and
whether it serves as an identification or authorization attribute. whether it serves as an identification or authorization attribute.
Even if a NAS implements an attribute for use with RADIUS Even if a NAS implements an attribute for use with RADIUS
authentication and accounting, it is possible that it will not authentication and accounting, it is possible that it will not
support inclusion of that attribute within CoA-Request and support inclusion of that attribute within CoA-Request and
Disconnect-Request packets, given the difference in attribute Disconnect-Request packets, given the difference in attribute
semantics. This is true even for attributes specified as semantics. This is true even for attributes specified as
allowable within Access-Accept packets (such as those defined allowable within Access-Accept packets (such as those defined
within [RFC2865], [RFC2868], [RFC2869], [RFC3162], [RFC3579], within [RFC2865], [RFC2868], [RFC2869], [RFC3162], [RFC3579],
[RFC4372], [RFC4675], [RFC4818] and [RFC4849]). [RFC4372], [RFC4675], [RFC4818] and [RFC4849]).
3. Attributes 3. Attributes
In Disconnect-Request and CoA-Request packets, certain attributes are In Disconnect-Request and CoA-Request packets, certain attributes are
used to uniquely identify the NAS as well as a user session on the used to uniquely identify the NAS as well as user session(s) on the
NAS. All NAS identification attributes included in a Request packet NAS. All NAS and session identification attributes included in a
MUST match in order for a Disconnect-Request or CoA-Request to be CoA-Request or Disconnect-Request packet MUST match at least one
successful; otherwise a Disconnect-NAK or CoA-NAK SHOULD be sent. session in order for a Request to be successful; otherwise a
For session identification attributes, the User-Name and Acct- Disconnect-NAK or CoA-NAK MUST be sent. If all NAS identification
Session-Id Attributes, if included, MUST match in order for a attributes match, and more than one session matches all of the
Disconnect-Request or CoA-Request to be successful; other session session identification attributes, then a CoA-Request or Disconnect-
identification attributes SHOULD match. Where a mismatch of session Request MUST apply to all matching sessions.
identification attributes is detected, a Disconnect-NAK or CoA-NAK
SHOULD be sent.
The ability to use NAS or session identification attributes to map to
unique/multiple sessions is beyond the scope of this document.
Identification attributes include NAS and session identification Identification attributes include NAS and session identification
attributes, as described below. attributes, as described below.
NAS identification attributes NAS identification attributes
Attribute # Reference Description Attribute # Reference Description
--------- --- --------- ----------- --------- --- --------- -----------
NAS-IP-Address 4 [RFC2865] The IPv4 address of the NAS. NAS-IP-Address 4 [RFC2865] The IPv4 address of the NAS.
NAS-Identifier 32 [RFC2865] String identifying the NAS. NAS-Identifier 32 [RFC2865] String identifying the NAS.
NAS-IPv6-Address 95 [RFC3162] The IPv6 address of the NAS. NAS-IPv6-Address 95 [RFC3162] The IPv6 address of the NAS.
Session identification attributes Session identification attributes
Attribute # Reference Description Attribute # Reference Description
--------- --- --------- ----------- --------- --- --------- -----------
User-Name 1 [RFC2865] The name of the user User-Name 1 [RFC2865] The name of the user
associated with the session. associated with one or
NAS-Port 5 [RFC2865] The port on which the more sessions.
NAS-Port 5 [RFC2865] The port on which a
session is terminated. session is terminated.
Framed-IP-Address 8 [RFC2865] The IPv4 address associated
with a session.
Vendor-Specific 26 [RFC2865] One or more vendor-specific
identification attributes.
Called-Station-Id 30 [RFC2865] The link address to which Called-Station-Id 30 [RFC2865] The link address to which
the session is connected. a session is connected.
Calling-Station-Id 31 [RFC2865] The link address from which Calling-Station-Id 31 [RFC2865] The link address from which
the session is connected. one or more sessions are
connected.
Acct-Session-Id 44 [RFC2866] The identifier uniquely Acct-Session-Id 44 [RFC2866] The identifier uniquely
identifying the session identifying a session
on the NAS. on the NAS.
Acct-Multi-Session-Id 50 [RFC2866] The identifier uniquely Acct-Multi-Session-Id 50 [RFC2866] The identifier uniquely
identifying related sessions. identifying related sessions.
NAS-Port-Id 87 [RFC2869] String identifying the port NAS-Port-Id 87 [RFC2869] String identifying the port
where the session is. where a session is.
Chargeable-User- 89 [RFC4372] The CUI associated with the Chargeable-User- 89 [RFC4372] The CUI associated with one
Identity session. Needed where a Identity or more sessions. Needed
privacy NAI is used, because where a privacy NAI is used,
the User-Name may not be since in this case the
unique (e.g. "anonymous"). User-Name (e.g. "anonymous")
may not identify sessions
belonging to a given user.
Framed-Interface-Id 96 [RFC3162] The IPv6 Interface Identifier
associated with a session;
always sent with
Framed-IPv6-Prefix.
Framed-IPv6-Prefix 97 [RFC3162] The IPv6 prefix associated
with a session, always sent
with Framed-Interface-Id.
To address security concerns described in Section 6.1, either the To address security concerns described in Section 6.1, either the
User-Name or Chargeable-User-Identity attribute SHOULD be present in User-Name or Chargeable-User-Identity attribute SHOULD be present in
Disconnect-Request and CoA-Request packets. Disconnect-Request and CoA-Request packets.
Where a Diameter client utilizes the same Session-Id for both Where a Diameter client utilizes the same Session-Id for both
authorization and accounting, inclusion of an Acct-Session-Id authorization and accounting, inclusion of an Acct-Session-Id
Attribute in a Disconnect-Request or CoA-Request can assist with Attribute in a Disconnect-Request or CoA-Request can assist with
Diameter/RADIUS translation, since Diameter RAR and ASR commands Diameter/RADIUS translation, since Diameter RAR and ASR commands
include a Session-Id AVP. An Acct-Session-Id Attribute SHOULD be include a Session-Id AVP. An Acct-Session-Id Attribute SHOULD be
included in Disconnect-Request and CoA-Request packets. included in Disconnect-Request and CoA-Request packets.
A NAS implementing this specification SHOULD send an Acct-Session-Id A NAS implementing this specification SHOULD send an Acct-Session-Id
or Acct-Multi-Session-Id Attribute within an Access-Request. Where or Acct-Multi-Session-Id Attribute within an Access-Request. Where
an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not included an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not included
within an Access-Request, the Dynamic Authorizatoin Client will not within an Access-Request, the Dynamic Authorization Client will not
know the Acct-Session-Id or Acct-Multi-Session-Id of the session it know the Acct-Session-Id or Acct-Multi-Session-Id of the session it
is attempting to target, unless it also has access to the accounting is attempting to target, unless it also has access to the accounting
data for that session. data for that session.
Where an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not Where an Acct-Session-Id or Acct-Multi-Session-Id Attribute is not
present in a CoA-Request or Disconnect-Request, it is possible that present in a CoA-Request or Disconnect-Request, it is possible that
the the User-Name or Chargeable-User-Identity attributes will not be the the User-Name or Chargeable-User-Identity attributes will not be
sufficient to uniquely identify the session (e.g. if the same user sufficient to uniquely identify a single session (e.g. if the same
has multiple sessions on the NAS, or if the privacy NAI is used). In user has multiple sessions on the NAS, or if the privacy NAI is
this case, session identification MAY be performed by using one or used). In this case if it is desired to identify a single session,
more of the Called-Station-Id, Calling-Station-Id, NAS-Port and NAS- session identification MAY be performed by using one or more of the
Port-Id attributes. Framed-IP-Address, Framed-IPv6-Prefix/Framed-Interface-Id, Called-
Station-Id, Calling-Station-Id, NAS-Port and NAS-Port-Id attributes.
To address security concerns described in Section 6.2, one or more of To address security concerns described in Section 6.2, one or more of
the NAS-IP-Address or NAS-IPv6-Address Attributes SHOULD be present the NAS-IP-Address or NAS-IPv6-Address Attributes SHOULD be present
in CoA-Request and Disconnect-Request packets; the NAS-Identifier in CoA-Request and Disconnect-Request packets; the NAS-Identifier
Attribute MAY be present. Attribute MAY be present.
A Disconnect-Request MUST contain only NAS and session identification A Disconnect-Request MUST contain only NAS and session identification
attributes. If other attributes are included in a Disconnect- attributes. If other attributes are included in a Disconnect-
Request, implementations MUST send a Disconnect-NAK; an Error-Cause Request, implementations MUST send a Disconnect-NAK; an Error-Cause
Attribute with value "Unsupported Attribute" MAY be included. Attribute with value "Unsupported Attribute" MAY be included.
skipping to change at page 13, line 19 skipping to change at page 13, line 38
If a CoA-Request packet including a Service-Type value of "Authorize If a CoA-Request packet including a Service-Type value of "Authorize
Only" is successfully processed, the NAS MUST respond with a CoA-NAK Only" is successfully processed, the NAS MUST respond with a CoA-NAK
containing a Service-Type Attribute with value "Authorize Only", and containing a Service-Type Attribute with value "Authorize Only", and
an Error-Cause Attribute with value 507 (Request Initiated). The NAS an Error-Cause Attribute with value 507 (Request Initiated). The NAS
then MUST send an Access-Request to the RADIUS server including a then MUST send an Access-Request to the RADIUS server including a
Service-Type Attribute with value "Authorize Only", along with a Service-Type Attribute with value "Authorize Only", along with a
State Attribute. This Access-Request SHOULD contain the NAS State Attribute. This Access-Request SHOULD contain the NAS
identification attributes from the CoA-Request, as well as the identification attributes from the CoA-Request, as well as the
session identification attributes from the CoA-Request permitted in session identification attributes from the CoA-Request permitted in
an Access-Request. As noted in [RFC2869] Section 5.19, a Message- an Access-Request; it also MAY contain other attributes permitted in
Authenticator attribute SHOULD be included in an Access-Request that an Access-Request.
does not contain a User-Password, CHAP-Password, ARAP-Password or
EAP-Message Attribute. The RADIUS server then will respond to the As noted in [RFC2869] Section 5.19, a Message-Authenticator attribute
Access-Request with an Access-Accept to (re-)authorize the session or SHOULD be included in an Access-Request that does not contain a User-
an Access-Reject to refuse to (re-)authorize it. Password, CHAP-Password, ARAP-Password or EAP-Message Attribute. The
RADIUS server then will respond to the Access-Request with an Access-
Accept to (re-)authorize the session or an Access-Reject to refuse to
(re-)authorize it.
3.3. State 3.3. State
The State Attribute is available to be sent by the Dynamic The State Attribute is available to be sent by the Dynamic
Authorization Client to the NAS in a CoA-Request packet and MUST be Authorization Client to the NAS in a CoA-Request packet and MUST be
sent unmodified from the NAS to the Dynamic Authorization Client in a sent unmodified from the NAS to the Dynamic Authorization Client in a
subsequent ACK or NAK packet. subsequent ACK or NAK packet.
[RFC2865] Section 5.44 states: [RFC2865] Section 5.44 states:
skipping to change at page 16, line 26 skipping to change at page 16, line 47
405 Unsupported Service 405 Unsupported Service
406 Unsupported Extension 406 Unsupported Extension
407 Invalid Attribute Value 407 Invalid Attribute Value
501 Administratively Prohibited 501 Administratively Prohibited
502 Request Not Routable (Proxy) 502 Request Not Routable (Proxy)
503 Session Context Not Found 503 Session Context Not Found
504 Session Context Not Removable 504 Session Context Not Removable
505 Other Proxy Processing Error 505 Other Proxy Processing Error
506 Resources Unavailable 506 Resources Unavailable
507 Request Initiated 507 Request Initiated
508 Multiple Session Selection Unsupported
"Residual Session Context Removed" is sent in response to a "Residual Session Context Removed" is sent in response to a
Disconnect-Request if the user session is no longer active, but Disconnect-Request if one or more user session(s) are no longer
residual session context was found and successfully removed. This active, but residual session context was found and successfully
value is only sent within a Disconnect-ACK and MUST NOT be sent removed. This value is only sent within a Disconnect-ACK and MUST
within a CoA-ACK, Disconnect-NAK or CoA-NAK. NOT be sent within a CoA-ACK, Disconnect-NAK or CoA-NAK.
"Invalid EAP Packet (Ignored)" is a non-fatal error that MUST NOT "Invalid EAP Packet (Ignored)" is a non-fatal error that MUST NOT
be sent by implementations of this specification. be sent by implementations of this specification.
"Unsupported Attribute" is a fatal error sent if a Request "Unsupported Attribute" is a fatal error sent if a Request
contains an attribute (such as a Vendor-Specific or EAP-Message contains an attribute (such as a Vendor-Specific or EAP-Message
Attribute) that is not supported. Attribute) that is not supported.
"Missing Attribute" is a fatal error sent if critical attributes "Missing Attribute" is a fatal error sent if critical attributes
(such as NAS or session identification attributes) are missing (such as NAS or session identification attributes) are missing
skipping to change at page 17, line 13 skipping to change at page 17, line 34
EAP- Message Attribute(s)) are not formatted properly. EAP- Message Attribute(s)) are not formatted properly.
"Unsupported Service" is a fatal error sent if a Service-Type "Unsupported Service" is a fatal error sent if a Service-Type
Attribute included with the Request is sent with an invalid or Attribute included with the Request is sent with an invalid or
unsupported value. This error cannot be sent in response to a unsupported value. This error cannot be sent in response to a
Disconnect-Request. Disconnect-Request.
"Unsupported Extension" is a fatal error sent due to lack of "Unsupported Extension" is a fatal error sent due to lack of
support for an extension such as Disconnect and/or CoA packets. support for an extension such as Disconnect and/or CoA packets.
This will typically be sent by a proxy receiving an ICMP port This will typically be sent by a proxy receiving an ICMP port
unreachable message after attempting to forward a CoA or unreachable message after attempting to forward a CoA-Request or
Disconnect-Request to the NAS. Disconnect-Request to the NAS.
"Invalid Attribute Value" is a fatal error sent if a CoA-Request "Invalid Attribute Value" is a fatal error sent if a CoA-Request
or Disconnect-Request contains an attribute with an unsupported or Disconnect-Request contains an attribute with an unsupported
value. value.
"Administratively Prohibited" is a fatal error sent if the NAS is "Administratively Prohibited" is a fatal error sent if the NAS is
configured to prohibit honoring of CoA-Request or Disconnect- configured to prohibit honoring of CoA-Request or Disconnect-
Request packets for the specified session. Request packets for the specified session.
"Request Not Routable" is a fatal error which MAY be sent by a "Request Not Routable" is a fatal error which MAY be sent by a
proxy and MUST NOT be sent by a NAS. It indicates that the proxy proxy and MUST NOT be sent by a NAS. It indicates that the proxy
was unable to determine how to route a CoA or Disconnect-Request was unable to determine how to route a CoA-Request or Disconnect-
to the NAS. For example, this can occur if the required entries Request to the NAS. For example, this can occur if the required
are not present in the proxy's realm routing table. entries are not present in the proxy's realm routing table.
"Session Context Not Found" is a fatal error sent if the session "Session Context Not Found" is a fatal error sent if the session
context identified in the CoA-Request or Disconnect-Request does context identified in the CoA-Request or Disconnect-Request does
not exist on the NAS. not exist on the NAS.
"Session Context Not Removable" is a fatal error sent in response "Session Context Not Removable" is a fatal error sent in response
to a Disconnect-Request if the NAS was able to locate the session to a Disconnect-Request if the NAS was able to locate the session
context, but could not remove it for some reason. It MUST NOT be context, but could not remove it for some reason. It MUST NOT be
sent within a CoA-ACK, CoA-NAK or Disconnect-ACK, only within a sent within a CoA-ACK, CoA-NAK or Disconnect-ACK, only within a
Disconnect-NAK. Disconnect-NAK.
skipping to change at page 17, line 51 skipping to change at page 18, line 24
to a CoA or Disconnect-Request that could not be processed by a to a CoA or Disconnect-Request that could not be processed by a
proxy, for reasons other than routing. proxy, for reasons other than routing.
"Resources Unavailable" is a fatal error sent when a CoA or "Resources Unavailable" is a fatal error sent when a CoA or
Disconnect-Request could not be honored due to lack of available Disconnect-Request could not be honored due to lack of available
NAS resources (memory, non- volatile storage, etc.). NAS resources (memory, non- volatile storage, etc.).
"Request Initiated" is a fatal error sent by a NAS in response to "Request Initiated" is a fatal error sent by a NAS in response to
a CoA-Request including a Service-Type Attribute with a value of a CoA-Request including a Service-Type Attribute with a value of
"Authorize Only". It indicates that the CoA-Request has not been "Authorize Only". It indicates that the CoA-Request has not been
honored, but that the NAS is sending a RADIUS Access-Request honored, but that the NAS is sending one or more RADIUS Access-
including a Service-Type Attribute with value "Authorize Only" to Request(s) including a Service-Type Attribute with value
the RADIUS server. "Authorize Only" to the RADIUS server.
"Multiple Session Selection Unsupported" is a fatal error sent by
a NAS in response to a CoA-Request or Disconnect-Request whose
session identification attributes match multiple sessions, where
the NAS does not support Requests applying to multiple sessions.
3.6. Table of Attributes 3.6. Table of Attributes
The following table provides a guide to which attributes may be found The following table provides a guide to which attributes may be found
in which packets, and in what quantity. in which packets, and in what quantity.
Change-of-Authorization Messages Change-of-Authorization Messages
Request ACK NAK # Attribute Request ACK NAK # Attribute
0-1 0 0 1 User-Name [Note 1] 0-1 0 0 1 User-Name [Note 1]
0-1 0 0 4 NAS-IP-Address [Note 1] 0-1 0 0 4 NAS-IP-Address [Note 1]
0-1 0 0 5 NAS-Port [Note 1] 0-1 0 0 5 NAS-Port [Note 1]
0-1 0 0-1 6 Service-Type 0-1 0 0-1 6 Service-Type
0-1 0 0 7 Framed-Protocol [Note 3] 0-1 0 0 7 Framed-Protocol [Note 3]
0-1 0 0 8 Framed-IP-Address [Note 6] 0-1 0 0 8 Framed-IP-Address [Notes 1,6]
0-1 0 0 9 Framed-IP-Netmask [Note 6] 0-1 0 0 9 Framed-IP-Netmask [Note 3]
0-1 0 0 10 Framed-Routing [Note 3] 0-1 0 0 10 Framed-Routing [Note 3]
0+ 0 0 11 Filter-ID [Note 3] 0+ 0 0 11 Filter-ID [Note 3]
0-1 0 0 12 Framed-MTU [Note 3] 0-1 0 0 12 Framed-MTU [Note 3]
Request ACK NAK # Attribute
Request ACK NAK # Attribute
0+ 0 0 13 Framed-Compression [Note 3] 0+ 0 0 13 Framed-Compression [Note 3]
0+ 0 0 14 Login-IP-Host [Note 3] 0+ 0 0 14 Login-IP-Host [Note 3]
0-1 0 0 15 Login-Service [Note 3] 0-1 0 0 15 Login-Service [Note 3]
0-1 0 0 16 Login-TCP-Port [Note 3] 0-1 0 0 16 Login-TCP-Port [Note 3]
0+ 0 0 18 Reply-Message [Note 2] 0+ 0 0 18 Reply-Message [Note 2]
0-1 0 0 19 Callback-Number [Note 3] 0-1 0 0 19 Callback-Number [Note 3]
0-1 0 0 20 Callback-Id [Note 3] 0-1 0 0 20 Callback-Id [Note 3]
0+ 0 0 22 Framed-Route [Note 3] 0+ 0 0 22 Framed-Route [Note 3]
0-1 0 0 23 Framed-IPX-Network [Note 6] 0-1 0 0 23 Framed-IPX-Network [Note 3]
0-1 0-1 0-1 24 State 0-1 0-1 0-1 24 State
0+ 0 0 25 Class [Note 3] 0+ 0 0 25 Class [Note 3]
0+ 0 0 26 Vendor-Specific [Note 3] 0+ 0 0 26 Vendor-Specific [Note 7]
0-1 0 0 27 Session-Timeout [Note 3] 0-1 0 0 27 Session-Timeout [Note 3]
0-1 0 0 28 Idle-Timeout [Note 3] 0-1 0 0 28 Idle-Timeout [Note 3]
0-1 0 0 29 Termination-Action [Note 3] 0-1 0 0 29 Termination-Action [Note 3]
0-1 0 0 30 Called-Station-Id [Note 1] 0-1 0 0 30 Called-Station-Id [Note 1]
0-1 0 0 31 Calling-Station-Id [Note 1] 0-1 0 0 31 Calling-Station-Id [Note 1]
0-1 0 0 32 NAS-Identifier [Note 1] 0-1 0 0 32 NAS-Identifier [Note 1]
0+ 0+ 0+ 33 Proxy-State 0+ 0+ 0+ 33 Proxy-State
0-1 0 0 34 Login-LAT-Service [Note 3] 0-1 0 0 34 Login-LAT-Service [Note 3]
0-1 0 0 35 Login-LAT-Node [Note 3] 0-1 0 0 35 Login-LAT-Node [Note 3]
0-1 0 0 36 Login-LAT-Group [Note 3] 0-1 0 0 36 Login-LAT-Group [Note 3]
0-1 0 0 37 Framed-AppleTalk-Link [Note 3] 0-1 0 0 37 Framed-AppleTalk-Link [Note 3]
0+ 0 0 38 Framed-AppleTalk-Network [Note 3] 0+ 0 0 38 Framed-AppleTalk-Network [Note 3]
0-1 0 0 39 Framed-AppleTalk-Zone [Note 3] 0-1 0 0 39 Framed-AppleTalk-Zone [Note 3]
0-1 0 0 44 Acct-Session-Id [Note 1] 0-1 0 0 44 Acct-Session-Id [Note 1]
0-1 0 0 50 Acct-Multi-Session-Id [Note 1] 0-1 0 0 50 Acct-Multi-Session-Id [Note 1]
Request ACK NAK # Attribute
Request ACK NAK # Attribute
0-1 0-1 0-1 55 Event-Timestamp 0-1 0-1 0-1 55 Event-Timestamp
0+ 0 0 56 Egress-VLANID [Note 3] 0+ 0 0 56 Egress-VLANID [Note 3]
0-1 0 0 57 Ingress-Filters [Note 3] 0-1 0 0 57 Ingress-Filters [Note 3]
0+ 0 0 58 Egress-VLAN-Name [Note 3] 0+ 0 0 58 Egress-VLAN-Name [Note 3]
0-1 0 0 59 User-Priority-Table [Note 3] 0-1 0 0 59 User-Priority-Table [Note 3]
0-1 0 0 61 NAS-Port-Type [Note 3] 0-1 0 0 61 NAS-Port-Type [Note 3]
0-1 0 0 62 Port-Limit [Note 3] 0-1 0 0 62 Port-Limit [Note 3]
0-1 0 0 63 Login-LAT-Port [Note 3] 0-1 0 0 63 Login-LAT-Port [Note 3]
0+ 0 0 64 Tunnel-Type [Note 5] 0+ 0 0 64 Tunnel-Type [Note 5]
0+ 0 0 65 Tunnel-Medium-Type [Note 5] 0+ 0 0 65 Tunnel-Medium-Type [Note 5]
0+ 0 0 66 Tunnel-Client-Endpoint [Note 5] 0+ 0 0 66 Tunnel-Client-Endpoint [Note 5]
0+ 0 0 67 Tunnel-Server-Endpoint [Note 5] 0+ 0 0 67 Tunnel-Server-Endpoint [Note 5]
0+ 0 0 69 Tunnel-Password [Note 5] 0+ 0 0 69 Tunnel-Password [Note 5]
0-1 0 0 71 ARAP-Features [Note 3] 0-1 0 0 71 ARAP-Features [Note 3]
0-1 0 0 72 ARAP-Zone-Access [Note 3] 0-1 0 0 72 ARAP-Zone-Access [Note 3]
0+ 0 0 78 Configuration-Token [Note 3] 0+ 0 0 78 Configuration-Token [Note 3]
Request ACK NAK # Attribute
Request ACK NAK # Attribute
0+ 0-1 0 79 EAP-Message [Note 2] 0+ 0-1 0 79 EAP-Message [Note 2]
0-1 0-1 0-1 80 Message-Authenticator 0-1 0-1 0-1 80 Message-Authenticator
0+ 0 0 81 Tunnel-Private-Group-ID [Note 5] 0+ 0 0 81 Tunnel-Private-Group-ID [Note 5]
0+ 0 0 82 Tunnel-Assignment-ID [Note 5] 0+ 0 0 82 Tunnel-Assignment-ID [Note 5]
0+ 0 0 83 Tunnel-Preference [Note 5] 0+ 0 0 83 Tunnel-Preference [Note 5]
0-1 0 0 85 Acct-Interim-Interval [Note 3] 0-1 0 0 85 Acct-Interim-Interval [Note 3]
0-1 0 0 87 NAS-Port-Id [Note 1] 0-1 0 0 87 NAS-Port-Id [Note 1]
0-1 0 0 88 Framed-Pool [Note 6] 0-1 0 0 88 Framed-Pool [Note 3]
0-1 0 0 89 Chargeable-User-Identity [Note 1] 0-1 0 0 89 Chargeable-User-Identity [Note 1]
0+ 0 0 90 Tunnel-Client-Auth-ID [Note 5] 0+ 0 0 90 Tunnel-Client-Auth-ID [Note 5]
0+ 0 0 91 Tunnel-Server-Auth-ID [Note 5] 0+ 0 0 91 Tunnel-Server-Auth-ID [Note 5]
0-1 0 0 92 NAS-Filter-Rule [Note 3] 0-1 0 0 92 NAS-Filter-Rule [Note 3]
0 0 0 94 Originating-Line-Info 0 0 0 94 Originating-Line-Info
0-1 0 0 95 NAS-IPv6-Address [Note 1] 0-1 0 0 95 NAS-IPv6-Address [Note 1]
0-1 0 0 96 Framed-Interface-Id [Note 6] 0-1 0 0 96 Framed-Interface-Id [Notes 1,6]
0+ 0 0 97 Framed-IPv6-Prefix [Note 6] 0+ 0 0 97 Framed-IPv6-Prefix [Notes 1,6]
0+ 0 0 98 Login-IPv6-Host [Note 3] 0+ 0 0 98 Login-IPv6-Host [Note 3]
0+ 0 0 99 Framed-IPv6-Route [Note 3] 0+ 0 0 99 Framed-IPv6-Route [Note 3]
0-1 0 0 100 Framed-IPv6-Pool [Note 6] 0-1 0 0 100 Framed-IPv6-Pool [Note 3]
0 0 0+ 101 Error-Cause 0 0 0+ 101 Error-Cause
0+ 0 0 123 Delegated-IPv6-Prefix [Note 6] 0+ 0 0 123 Delegated-IPv6-Prefix [Note 3]
Request ACK NAK # Attribute Request ACK NAK # Attribute
Disconnect Messages Disconnect Messages
Request ACK NAK # Attribute Request ACK NAK # Attribute
0-1 0 0 1 User-Name [Note 1] 0-1 0 0 1 User-Name [Note 1]
0-1 0 0 4 NAS-IP-Address [Note 1] 0-1 0 0 4 NAS-IP-Address [Note 1]
0-1 0 0 5 NAS-Port [Note 1] 0-1 0 0 5 NAS-Port [Note 1]
0 0 0 6 Service-Type 0 0 0 6 Service-Type
0 0 0 8 Framed-IP-Address [Note 6] 0 0 0 8 Framed-IP-Address [Note 1]
0+ 0 0 18 Reply-Message [Note 2] 0+ 0 0 18 Reply-Message [Note 2]
0 0 0 24 State 0 0 0 24 State
0+ 0 0 25 Class [Note 4] 0+ 0 0 25 Class [Note 4]
0+ 0 0 26 Vendor-Specific 0+ 0 0 26 Vendor-Specific [Note 1]
0-1 0 0 30 Called-Station-Id [Note 1] 0-1 0 0 30 Called-Station-Id [Note 1]
0-1 0 0 31 Calling-Station-Id [Note 1] 0-1 0 0 31 Calling-Station-Id [Note 1]
0-1 0 0 32 NAS-Identifier [Note 1] 0-1 0 0 32 NAS-Identifier [Note 1]
0+ 0+ 0+ 33 Proxy-State 0+ 0+ 0+ 33 Proxy-State
0-1 0 0 44 Acct-Session-Id [Note 1] 0-1 0 0 44 Acct-Session-Id [Note 1]
0-1 0-1 0 49 Acct-Terminate-Cause 0-1 0-1 0 49 Acct-Terminate-Cause
0-1 0 0 50 Acct-Multi-Session-Id [Note 1] 0-1 0 0 50 Acct-Multi-Session-Id [Note 1]
0-1 0-1 0-1 55 Event-Timestamp 0-1 0-1 0-1 55 Event-Timestamp
0 0 0 61 NAS-Port-Type 0 0 0 61 NAS-Port-Type
0+ 0-1 0 79 EAP-Message [Note 2] 0+ 0-1 0 79 EAP-Message [Note 2]
Request ACK NAK # Attribute
Request ACK NAK # Attribute
0-1 0-1 0-1 80 Message-Authenticator 0-1 0-1 0-1 80 Message-Authenticator
0-1 0 0 87 NAS-Port-Id [Note 1] 0-1 0 0 87 NAS-Port-Id [Note 1]
0-1 0 0 89 Chargeable-User-Identity [Note 1] 0-1 0 0 89 Chargeable-User-Identity [Note 1]
0-1 0 0 95 NAS-IPv6-Address [Note 1] 0-1 0 0 95 NAS-IPv6-Address [Note 1]
0 0 0 96 Framed-Interface-Id [Note 6] 0 0 0 96 Framed-Interface-Id [Note 1]
0 0 0 97 Framed-IPv6-Prefix [Note 6] 0 0 0 97 Framed-IPv6-Prefix [Note 1]
0 0 0 100 Framed-IPv6-Pool [Note 6]
0 0 0+ 101 Error-Cause 0 0 0+ 101 Error-Cause
Request ACK NAK # Attribute Request ACK NAK # Attribute
The following table defines the meaning of the above table entries. The following table defines the meaning of the above table entries.
0 This attribute MUST NOT be present in packet. 0 This attribute MUST NOT be present in packet.
0+ Zero or more instances of this attribute MAY be present in packet. 0+ Zero or more instances of this attribute MAY be present in packet.
0-1 Zero or one instance of this attribute MAY be present in packet. 0-1 Zero or one instance of this attribute MAY be present in packet.
1 Exactly one instance of this attribute MUST be present in packet. 1 Exactly one instance of this attribute MUST be present in packet.
skipping to change at page 21, line 26 skipping to change at page 22, line 5
a Disconnect-ACK is subsequently sent), the Class Attribute SHOULD be a Disconnect-ACK is subsequently sent), the Class Attribute SHOULD be
sent unmodified by the NAS to the RADIUS accounting server in the sent unmodified by the NAS to the RADIUS accounting server in the
Accounting Stop packet. If the Disconnect-Request is unsuccessful, Accounting Stop packet. If the Disconnect-Request is unsuccessful,
then the Class Attribute is not processed. then the Class Attribute is not processed.
[Note 5] When included within a CoA-Request, these attributes [Note 5] When included within a CoA-Request, these attributes
represent an authorization change request. Where tunnel attribute(s) represent an authorization change request. Where tunnel attribute(s)
are included within a successful CoA-Request, all existing tunnel are included within a successful CoA-Request, all existing tunnel
attributes are removed and replaced by the new attribute(s). attributes are removed and replaced by the new attribute(s).
[Note 6] Where included within a CoA-Request, these attributes [Note 6] Since the Framed-IP-Address, Framed-IPv6-Prefix and Framed-
represent a renumbering request. Since these attributes are not used Interface-Id attributes are used for session identification,
for session identification, they MUST NOT be included within a renumbering cannot be accomplished by including values of these
Disconnect-Request. Note that renumbering may not be possible in all attributes within a CoA-Request. Instead, a CoA-Request including a
situations. For example, in order to change an IP address on receipt Service-Type Attribute with a value of "Authorize Only" is sent; new
of a changed Framed-IP-Address address, IPCP re-negotiation could be values can be supplied in an Access-Accept sent in response to the
required, which is not supported by all PPP implementations. ensuing Access-Request. Note that renumbering will not be possible
in all situations. For example, in order to change an IP address,
IPCP or IPv6CP re-negotiation could be required, which is not
supported by all PPP implementations.
[Note 7] Within CoA-Request packets, Vendor-Specific Attributes
(VSAs) MAY be used for either session identification or authorization
change. However, the same Attribute MUST NOT be used for both
purposes simultaneously.
4. Diameter Considerations 4. Diameter Considerations
Due to differences in handling change-of-authorization requests in Due to differences in handling change-of-authorization requests in
RADIUS and Diameter, it may be difficult or impossible for a RADIUS and Diameter, it may be difficult or impossible for a
Diameter/RADIUS gateway to successfully translate a Diameter Re-Auth- Diameter/RADIUS gateway to successfully translate a Diameter Re-Auth-
Request (RAR) to a CoA-Request and vice versa. For example, since a Request (RAR) to a CoA-Request and vice versa. For example, since a
CoA-Request only initiates an authorization change but does not CoA-Request only initiates an authorization change but does not
initiate re-authentication, a RAR command containing a Re-Auth- initiate re-authentication, a RAR command containing a Re-Auth-
Request-Type AVP with value "AUTHORIZE_AUTHENTICATE" cannot be Request-Type AVP with value "AUTHORIZE_AUTHENTICATE" cannot be
directly translated to a CoA-Request. A Diameter/RADIUS gateway directly translated to a CoA-Request. A Diameter/RADIUS gateway
receiving a CoA-Request containing authorization changes will need to receiving a CoA-Request containing authorization changes will need to
translate this into two Diameter exchanges. First, the translate this into two Diameter exchanges. First, the
Diameter/RADIUS gateway will issue a RAR command including a Session- Diameter/RADIUS gateway will issue a RAR command including a Session-
Id AVP and a Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY". Id AVP and a Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY".
Then the Diameter/RADIUS gateway will respond to the ensuing access Then the Diameter/RADIUS gateway will respond to the ensuing access
request with a response including the authorization attributes request with a response including the authorization attributes
gleaned from the CoA-Request. For the translation to be possible, gleaned from the CoA-Request. To enable translation, the CoA-Request
the CoA-Request MUST include a Acct-Session-Id Attribute. If the SHOULD include a Acct-Session-Id Attribute. If the Diameter client
Diameter client uses the same Session-Id for both authorization and uses the same Session-Id for both authorization and accounting, then
accounting, then the Diameter/RADIUS gateway can copy the contents of the Diameter/RADIUS gateway can copy the contents of the Acct-
the Acct-Session-Id Attribute into the Session-Id AVP; otherwise, it Session-Id Attribute into the Session-Id AVP; otherwise, it will
will need to map the Acct-Session-Id value to an equivalent Session- need to map the Acct-Session-Id value to an equivalent Session-Id for
Id for use within a RAR command. use within a RAR command.
Where an Acct-Session-Id attribute is not present in a CoA-Request or
Disconnect-Request, a Diameter/RADIUS gateway will either need to
determine the appropriate Acct-Session-Id, or if it cannot do so, it
can send a CoA-NAK or Disconnect-NAK in reply, possibly including an
Error-Cause Attribute with value 508 (Multiple Session Identification
Unsupported).
To simplify translation between RADIUS and Diameter, Dynamic To simplify translation between RADIUS and Diameter, Dynamic
Authorization Clients can include a Service-Type Attribute with value Authorization Clients can include a Service-Type Attribute with value
"Authorize Only" within a CoA-Request, as described in Section 3.2. "Authorize Only" within a CoA-Request, as described in Section 3.2.
A Diameter/RADIUS gateway receiving a CoA-Request containing a A Diameter/RADIUS gateway receiving a CoA-Request containing a
Service-Type with value "Authorize Only" translates this to a RAR Service-Type with value "Authorize Only" translates this to a RAR
with Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY". The with Re-Auth-Request-Type AVP with value "AUTHORIZE ONLY". The
received RAA is then translated to a CoA-NAK with a Service-Type received RAA is then translated to a CoA-NAK with a Service-Type
value of "Authorize Only". If the Result-Code AVP in the RAA has a value of "Authorize Only". If the Result-Code AVP in the RAA has a
value in the success category, then an Error-Cause Attribute with value in the success category, then an Error-Cause Attribute with
skipping to change at page 22, line 32 skipping to change at page 23, line 25
Attribute is returned as suggested below. Attribute is returned as suggested below.
Within Diameter, a server can request that a session be aborted by Within Diameter, a server can request that a session be aborted by
sending an Abort-Session-Request (ASR), identifying the session to be sending an Abort-Session-Request (ASR), identifying the session to be
terminated using Session-ID and User-Name AVPs. The ASR command is terminated using Session-ID and User-Name AVPs. The ASR command is
translated to a Disconnect-Request containing Acct-Session-Id and translated to a Disconnect-Request containing Acct-Session-Id and
User-Name attributes. If the Diameter client utilizes the same User-Name attributes. If the Diameter client utilizes the same
Session-Id in both authorization and accounting, then the value of Session-Id in both authorization and accounting, then the value of
the Session-ID AVP may be placed in the Acct-Session-Id attribute; the Session-ID AVP may be placed in the Acct-Session-Id attribute;
otherwise the value of the Session-ID AVP will need to be mapped to otherwise the value of the Session-ID AVP will need to be mapped to
an appropriate Acct-Session-Id value. For a Disconnect-Request to an appropriate Acct-Session-Id value. To enable translation of a
be translatable to an ASR, an Acct-Session-Id attribute MUST be Disconnect-Request to an ASR, an Acct-Session-Id attribute SHOULD be
present. If the Diameter client utilizes the same Session-Id in both present.
If the Diameter client utilizes the same Session-Id in both
authorization and accounting, then the value of the Acct-Session-Id authorization and accounting, then the value of the Acct-Session-Id
may be placed into the Session-ID AVP within the ASR; otherwise the may be placed into the Session-ID AVP within the ASR; otherwise the
value of the Acct-Session-Id will need to be mapped to an appropriate value of the Acct-Session-Id will need to be mapped to an appropriate
Session-ID value. Session-ID value.
An Abort-Session-Answer (ASA) command is sent in response to an ASR An Abort-Session-Answer (ASA) command is sent in response to an ASR
in order to indicate the disposition of the request. A in order to indicate the disposition of the request. A
Diameter/RADIUS gateway receiving a Disconnect-ACK translates this to Diameter/RADIUS gateway receiving a Disconnect-ACK translates this to
an ASA command with a Result-Code AVP of "DIAMETER_SUCCESS". A an ASA command with a Result-Code AVP of "DIAMETER_SUCCESS". A
Disconnect-NAK received from the NAS is translated to an ASA command Disconnect-NAK received from the NAS is translated to an ASA command
skipping to change at page 23, line 43 skipping to change at page 24, line 43
Request is not needed to assist in Diameter/RADIUS translation, and Request is not needed to assist in Diameter/RADIUS translation, and
may make translation more difficult. As a result, as noted in may make translation more difficult. As a result, as noted in
Section 3.2, the Service-Type Attribute MUST NOT be used within a Section 3.2, the Service-Type Attribute MUST NOT be used within a
Disconnect-Request. Disconnect-Request.
5. IANA Considerations 5. IANA Considerations
This document uses the RADIUS [RFC2865] namespace, see This document uses the RADIUS [RFC2865] namespace, see
<http://www.iana.org/assignments/radius-types>. In addition to the <http://www.iana.org/assignments/radius-types>. In addition to the
allocations already made in [RFC3575] and [RFC3576], this allocations already made in [RFC3575] and [RFC3576], this
specification requests allocation of an additional value of the specification requests allocation of additional values of the Error-
Error-Cause Attribute (101): Cause Attribute (101):
# Value # Value
--- ----- --- -----
407 Invalid Attribute Value 407 Invalid Attribute Value
508 Multiple Session Selection Unsupported
6. Security Considerations 6. Security Considerations
6.1. Authorization Issues 6.1. Authorization Issues
Where a NAS is shared by multiple providers, it is undesirable for Where a NAS is shared by multiple providers, it is undesirable for
one provider to be able to send Disconnect-Request or CoA-Requests one provider to be able to send Disconnect-Request or CoA-Requests
affecting the sessions of another provider. affecting the sessions of another provider.
A Dynamic Authorization Server MUST silently discard Disconnect- A Dynamic Authorization Server MUST silently discard Disconnect-
skipping to change at page 24, line 35 skipping to change at page 25, line 35
To perform the RPF check, the Dynamic Authorization Server uses the To perform the RPF check, the Dynamic Authorization Server uses the
session identification attributes included in Disconnect-Request or session identification attributes included in Disconnect-Request or
CoA-Request packets, in order to determine the RADIUS server(s) to CoA-Request packets, in order to determine the RADIUS server(s) to
which an equivalent Access-Request could be routed. If the source which an equivalent Access-Request could be routed. If the source
address of the Disconnect-Request or CoA-Request is within this set, address of the Disconnect-Request or CoA-Request is within this set,
then the CoA-Request or Disconnect-Request is forwarded; otherwise it then the CoA-Request or Disconnect-Request is forwarded; otherwise it
MUST be silently discarded. MUST be silently discarded.
Typically the Dynamic Authorization Server will extract the realm Typically the Dynamic Authorization Server will extract the realm
from the Network Access Identifier [RFC4282] included within the from the Network Access Identifier [RFC4282] included within the
User-Name or Chargeble-User-Identity Attribute, and determine the User-Name or Chargeable-User-Identity Attribute, and determine the
corresponding RADIUS servers in the realm routing tables. If the corresponding RADIUS servers in the realm routing tables. If the
Dynamic Authorization Server maintains long-term session state, it Dynamic Authorization Server maintains long-term session state, it
MAY perform the authorization check based on the session MAY perform the authorization check based on the session
identification attributes in the CoA-Request. The session identification attributes in the CoA-Request. The session
identification attributes can be used to tie a session to a identification attributes can be used to tie a session to a
particular proxy or set of proxies, as with the NAI realm. particular proxy or set of proxies, as with the NAI realm.
Where no proxy is present, the RPF check can only be performed by the Where no proxy is present, the RPF check can only be performed by the
NAS if it maintains its own a realm routing table. If the NAS does NAS if it maintains its own a realm routing table. If the NAS does
not maintain a realm routing table (e.g. it selects forwarding not maintain a realm routing table (e.g. it selects forwarding
skipping to change at page 33, line 21 skipping to change at page 34, line 21
o The term "Dynamic Authorization Client" is used instead of RADIUS o The term "Dynamic Authorization Client" is used instead of RADIUS
server where it applies to the originator of CoA and Disconnect- server where it applies to the originator of CoA and Disconnect-
Request packets. Similarly, the term "Dynamic Authorizatin Server" Request packets. Similarly, the term "Dynamic Authorizatin Server"
is used instead of NAS where it applies to the receiver of CoA and is used instead of NAS where it applies to the receiver of CoA and
Disconnect-Request packets. Definitions of these terms have been Disconnect-Request packets. Definitions of these terms have been
added (Section 1.3). added (Section 1.3).
o Added requirement for duplicate detection on the Dynamic o Added requirement for duplicate detection on the Dynamic
Authorization Server (Section 2.3). Authorization Server (Section 2.3).
o Clarified expected behavior when session identification attributes
match more than one session (Sections 2.3, 3, 3.5, 4).
o Added Chargeable-User-Identity as a session identification o Added Chargeable-User-Identity as a session identification
attribute. Removed Framed-IP-Address, Framed-IPv6-Prefix, Framed- attribute. Removed Framed-IP-Address, Framed-IPv6-Prefix, Framed-
Interface-Id and NAS-Port-Type attributes as session identification Interface-Id and NAS-Port-Type attributes as session identification
attributes. Recommended inclusion of Acct-Session-Id or Acct-Multi- attributes. Recommended inclusion of Acct-Session-Id or Acct-Multi-
Session-Id attributes in an Access-Request (Section 3). Session-Id attributes in an Access-Request (Section 3).
o Added recommendation that an Acct-Session-Id or Acct-Mult-Session- o Added recommendation that an Acct-Session-Id or Acct-Mult-Session-
Id Attribute be included in an Access-Request (Section 3). Id Attribute be included in an Access-Request (Section 3).
o Added details relating to handling of the Proxy-State Attribute o Added details relating to handling of the Proxy-State Attribute
skipping to change at page 33, line 44 skipping to change at page 34, line 47
value "Authorize Only" is optional on both the NAS and Dynamic value "Authorize Only" is optional on both the NAS and Dynamic
Authorization Client (Section 3.2). Authorization Client (Section 3.2).
o Added requirement for inclusion of the State Attribute in CoA- o Added requirement for inclusion of the State Attribute in CoA-
Request packets including a Service-Type Attribute with a value of Request packets including a Service-Type Attribute with a value of
"Authorize Only" (Section 3.3). "Authorize Only" (Section 3.3).
o Added clarification on the calculation of the Message-Authenticator o Added clarification on the calculation of the Message-Authenticator
Attribute (Section 3.4). Attribute (Section 3.4).
o An additional Error-Cause Attribute value (407) is allocated for o Additional Error-Cause Attribute values are allocated for Invalid
Invalid Attribute Value (Sections 3.5, 4). Attribute Value (407) and Multiple Session Identification Unsupported
(508) (Sections 3.5, 4).
o Updated the CoA-Request Attribute Table to include Filter-Rule, o Updated the CoA-Request Attribute Table to include Filter-Rule,
Delegated-IPv6-Prefix, Egress-VLANID, Ingress-Filters, Egress-VLAN- Delegated-IPv6-Prefix, Egress-VLANID, Ingress-Filters, Egress-VLAN-
Name and User-Priority attributes (Section 3.6). Name and User-Priority attributes (Section 3.6).
o Added the Chargeable-User-Identity Attribute to both the CoA- o Added the Chargeable-User-Identity Attribute to both the CoA-
Request and Disconnect-Request Attribute table (Section 3.6). Request and Disconnect-Request Attribute table (Section 3.6).
o Added note on the use of the CoA-Request for renumbering (Section o The use of Vendor-Specific Attributes (VSAs) for session
identification and authorization change has been clarified (Section
3.6).
o Added Note 6 on the use of the CoA-Request for renumbering (Section
3.6). 3.6).
o Use of the Service-Type Attribute within a Disconnect-Request is o Use of the Service-Type Attribute within a Disconnect-Request is
prohibited (Sections 3.2, 3.6). prohibited (Sections 3.2, 3.6).
o Added Diameter Considerations (Section 4). o Added Diameter Considerations (Section 4).
o Changed the text to indicate that the Event-Timestamp Attribute o Changed the text to indicate that the Event-Timestamp Attribute
should not be recalculated on retransmission. The implications for should not be recalculated on retransmission. The implications for
replay and duplicate detection are discussed (Section 6.4). replay and duplicate detection are discussed (Section 6.4).
 End of changes. 55 change blocks. 
143 lines changed or deleted 200 lines changed or added

This html diff was produced by rfcdiff 1.33. The latest version is available from http://tools.ietf.org/tools/rfcdiff/