Security/Authentication; Configuring Radius-Initiated Disconnect; Radius-Initiated Change Of Authorization - Juniper JUNOSE SOFTWARE 11.2.X - BROADBAND ACCESS CONFIGURATION GUIDE 7-20-2010 Configuration Manual

Security/Authentication

Configuring RADIUS-Initiated Disconnect

RADIUS-Initiated Change of Authorization

Copyright © 2010, Juniper Networks, Inc.
NOTE: To enable the disconnection of L2TP LAC user sessions, the RADIUS
Disconnect-Request message must not include the Acct-Multi-Session-Id (50) attribute.
The Acct-Multi-Session-Id attribute does not apply to LAC L2TP user sessions and
including this attribute causes the disconnect operation to fail.
The RADIUS server (the disconnect client) must calculate the authenticator as specified
for an Accounting-Request message in RFC 2866. The router's RADIUS dynamic-request
server verifies the request using authenticator calculation as specified for an
Accounting-Request message in RFC 2866. A key (secret), as specified in RFC 2865,
must be configured and used in the calculation of the authenticator. The response
authenticator is calculated as specified for an Accounting-Response message in RFC
2866.
To configure RADIUS-initiated disconnect feature, perform the following steps to set up
the RADIUS dynamic-request server that will perform the disconnect operation:
Configure the RADIUS dynamic-request server, and enter RADIUS Configuration
1.
mode.
host1(config)#radius dynamic-request server 10.10.5.10
host1(config-radius)#
Enable the RADIUS-initiated disconnect capability on the RADIUS dynamic-request
2.
server.
host1(config-radius)#subscriber disconnect
Define the secret used in the RADIUS Authenticator field during exchanges between
3.
the RADIUS dynamic-request server and the RADIUS server.
host1(config-radius)#key Secret3Clientkey
(Optional) Specify the UDP port on which the RADIUS dynamic-request server listens
4.
for messages from the RADIUS server. The default is 1700.
host1(config-radius)#udp-port 1770
This section describes the RADIUS dynamic-request server's support for CoA messages.
CoA messages are used by the E Series router's RADIUS-initiated packet mirroring feature,
which is described in the Configuring RADIUS-Based Mirroring chapter in JunosE Policy
Management Configuration Guide, and by Service Manager, which is described in
"Configuring Service Manager" on page 623 of this guide.
Chapter 4: Configuring RADIUS Dynamic-Request Server
235