Radius Attributes - Ruckus Wireless ZoneDirector 1100 User Manual

RADIUS Attributes

Ruckus products communicate with an external RADIUS server as a RADIUS client. Packets from
Ruckus products are called "access-request" or "accounting-request" messages. The RADIUS
server, in turn, sends an "access-challenge", "access-accept" or "access-reject" message in
response to an access-request, and an "accounting-response" message in response to an
accounting-request.
RADIUS Attribute Value Pairs (AVP) carry data in both the request and the response messages.
The RADIUS protocol also allows vendor specific attributes (VSA) to extend the functionality of
the protocol. The following tables list the RADIUS attributes used in these messages between
ZoneDirector and the RADIUS/RADIUS Accounting server based on which type of authentica-
tion is used for the WLAN.
those used in accounting.
Notation "==>" below indicates this value is generated external to AP/ZoneDirector.
• In the case of EAP payload, this is generated by a wireless client and encapsulated in the
radius access-request packet.
• In the case of a "state" attribute, it indicates that an access-request packet is a response
to the last received access-challenge packet by copying the "state" AVP unmodified.
• As for the "class" attribute, it is parsed and stored from an access-accept packet and then
subsequently used in accounting-request packets.
Table 17 lists the attributes used in authentication, and
Configuring Security and Other Services
Using an External AAA Server
Table 18 lists
99