Radius Attributes - HP 3600 v2 Series Security Configuration Manual

RFC 2866, RADIUS Accounting
•
RFC 2867, RADIUS Accounting Modifications for Tunnel Protocol Support
•
RFC 2868, RADIUS Attributes for Tunnel Protocol Support
•
• RFC 2869, RADIUS Extensions
RFC 1492, An Access Control Protocol, Sometimes Called TACACS
•

RADIUS attributes

Commonly used standard RADIUS attributes
No. Attribute
1 User-Name
2 User-Password
3 CHAP-Password
4 NAS-IP-Address
5 NAS-Port
6 Service-Type
7 Framed-Protocol
8 Framed-IP-Address
11 Filter-ID
12 Framed-MTU
14 Login-IP-Host
15 Login-Service
18 Reply-Message
26 Vendor-Specific
27 Session-Timeout
28 Idle-Timeout
31 Calling-Station-Id
32 NAS-Identifier
Description
Name of the user to be authenticated.
User password for PAP authentication, present only in Access-Request packets in
PAP authentication mode.
Digest of the user password for CHAP authentication, present only in
Access-Request packets in CHAP authentication mode.
IP address for the server to identify a client. Usually, a client is identified by the IP
address of the access interface on the NAS, namely the NAS IP address. This
attribute is present in only Access-Request packets.
Physical port of the NAS that the user accesses.
Type of service that the user has requested or type of service to be provided.
Encapsulation protocol for framed access.
IP address assigned to the user.
Name of the filter list.
Maximum transmission unit (MTU) for the data link between the user and NAS.
For example, with 802.1X EAP authentication, NAS uses this attribute to notify
the server of the MTU for EAP packets, so as to avoid oversized EAP packets.
IP address of the NAS interface that the user accesses.
Type of the service that the user uses for login.
Text to be displayed to the user, which can be used by the server to indicate, for
example, the reason of the authentication failure.
Vendor specific attribute. A packet can contain one or more such proprietary
attributes, each of which can contain one or more sub-attributes.
Maximum duration of service to be provided to the user before termination of the
session.
Maximum idle time permitted for the user before termination of the session.
User identification that the NAS sends to the server. For the LAN access service
provided by an HP device, this attribute carries the MAC address of the user in
the format HHHH-HHHH-HHHH.
Identification that the NAS uses for indicating itself.
12