HP FlexNetwork NJ5000 User Manual page 307

Figure 313 RADIUS packet format
0 7
Code
The following describes the fields of a RADIUS packet:
•
The Code field (1 byte long) indicates the type of the RADIUS packet.
Table 105 Main values of the Code field
Code Packet type
1 Access-Request
2 Access-Accept
3 Access-Reject
4 Accounting-Request
5 Accounting-Response
•
The Identifier field (1 byte long) is used to match request packets and response packets and to
detect duplicate request packets. Request and response packets of the same type have the
same identifier.
•
The Length field (2 bytes long) indicates the length of the entire packet, including the Code,
Identifier, Length, Authenticator, and Attribute fields. Bytes beyond this length are considered
padding and are neglected upon reception. If the length of a received packet is less than this
length, the packet is dropped. The value of this field is in the range 20 to 4096.
•
The Authenticator field (16 bytes long) is used to authenticate replies from the RADIUS server
and to encrypt user passwords. There are two types of authenticators: request authenticator
and response authenticator.
•
The Attributes field, variable in length, carries the specific authentication, authorization, and
accounting information that defines the configuration details of the request or response. This
field may contain multiple attributes, each with three sub-fields:
Type—(1 byte long) Type of the attribute. It is in the range 1 to 255. Commonly used
attributes for RADIUS authentication, authorization and accounting are listed in
15
Identifier
Authenticator
Attributes
Description
From the client to the server. A packet of this type carries user
information for the server to authenticate the user. It must contain
the User-Name attribute and can optionally contain the attributes of
NAS-IP-Address, User-Password, and NAS-Port.
From the server to the client. If all attribute values carried in the
Access-Request are acceptable, the authentication succeeds, and
the server sends an Access-Accept response.
From the server to the client. If any attribute value carried in the
Access-Request is unacceptable, the authentication fails, and the
server sends an Access-Reject response.
From the client to the server. A packet of this type carries user
information for the server to start or stop accounting for the user.
The Acct-Status-Type attribute in the packet indicates whether to
start or stop accounting.
From the server to the client. The server sends a packet of this type
to notify the client that it has received the Accounting-Request and
has successfully recorded the accounting information.
295
31
7
Length
Table 106.