802.1X Accounting Attribute-Value Pairs - Cisco Catalyst 2975 Software Configuration Manual

Understanding IEEE 802.1x Port-Based Authentication
The switch does not log 802.1x accounting information. Instead, it sends this information to the
RADIUS server, which must be configured to log accounting messages.

802.1x Accounting Attribute-Value Pairs

The information sent to the RADIUS server is represented in the form of Attribute-Value (AV) pairs.
These AV pairs provide data for different applications. (For example, a billing application might require
information that is in the Acct-Input-Octets or the Acct-Output-Octets attributes of a RADIUS packet.)
AV pairs are automatically sent by a switch that is configured for 802.1x accounting. Three types of
RADIUS accounting packets are sent by a switch:
•
•
•
Table 10-3
Table 10-3
Attribute Number
Attribute[1]
Attribute[4]
Attribute[5]
Attribute[8]
Attribute[25]
Attribute[30]
Attribute[31]
Attribute[40]
Attribute[41]
Attribute[42]
Attribute[43]
Attribute[44]
Attribute[45]
Attribute[46]
Attribute[49]
Attribute[61]
1. The Framed-IP-Address AV pair is sent only if a valid Dynamic Host Control Protocol (DHCP) binding
You can view the AV pairs that are being sent by the switch by entering the debug radius accounting
privileged EXEC command. For more information about this command, see the Cisco IOS Debug
Command Reference, Release 12.2:
http://www.cisco.com/en/US/docs/ios/12_2/debug/command/reference/122debug.html
For more information about AV pairs, see RFC 3580, "802.1x Remote Authentication Dial In User Service
(RADIUS) Usage Guidelines."
Catalyst 2975 Switch Software Configuration Guide
10-16
START–sent when a new user session starts
INTERIM–sent during an existing session for updates
STOP–sent when a session terminates
lists the AV pairs and when they are sent are sent by the switch:
Accounting AV Pairs
AV Pair Name
User-Name
NAS-IP-Address
NAS-Port
Framed-IP-Address
Class
Called-Station-ID
Calling-Station-ID
Acct-Status-Type
Acct-Delay-Time
Acct-Input-Octets
Acct-Output-Octets
Acct-Session-ID
Acct-Authentic
Acct-Session-Time
Acct-Terminate-Cause
NAS-Port-Type
exists for the host in the DHCP snooping bindings table.
Chapter 10 Configuring IEEE 802.1x Port-Based Authentication
START INTERIM
Always Always
Always Always
Always Always
1
Never Sometimes
Always Always
Always Always
Always Always
Always Always
Always Always
Never Always
Never Always
Always Always
Always Always
Never Always
Never Never
Always Always
STOP
Always
Always
Always
1
Sometimes
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
Always
OL-19720-02