R3303-HP HSR6800 Routers Security Configuration Guide

17
• RFC 2865, Remote Authentication Dial In User Service (RADIUS)
• RFC 2866, RADIUS Accounting
• RFC 2867, RADIUS Accounting Modifications for Tunnel Protocol Support
• RFC 2868, RADIUS Attributes for Tunnel Protocol Support
• RFC 2869, RADIUS Extensions
• RFC 1492, An Access Control Protocol, Sometimes Called TACACS
RADIUS attributes
This section provides tables of commonly used standard RADIUS attributes and HP proprietary RADIUS
sub-attributes.
Commonly used standard RADIUS attributes
No. Attribute Descri
p
tion
1 User-Name Name of the user to be authenticated.
2 User-Password
User password for PAP authentication, only present in Access-Request
packets when PAP authentication is used.
3 CHAP-Password
Digest of the user password for CHAP authentication, only present in
Access-Request packets when CHAP authentication is used.
4 NAS-IP-Address
IP address for the server to use to identify a client. Usually, a client is
identified by the IP address of its access interface. This attribute is only
present in Access-Request packets.
5 NAS-Port Physical port of the NAS that the user accesses.
6 Service-Type Type of service that the user has requested or type of service to be provided.
7 Framed-Protocol Encapsulation protocol for framed access.
8 Framed-IP-Address IP address assigned to the user.
11 Filter-ID Name of the filter list.
12 Framed-MTU
MTU for the data link between the user and NAS. For example, with 802.1X
EAP authentication, NAS uses this attribute to notify the server of the MTU for
EAP packets, so as to avoid oversized EAP packets.
14 Login-IP-Host IP address of the NAS interface that the user accesses.
15 Login-Service Type of the service that the user uses for login.
18 Reply-Message
Text to be displayed to the user, which can be used by the server to indicate,
for example, the reason of the authentication failure.
26 Vendor-Specific
Vendor specific attribute. A packet can contain one or more such proprietary
attributes, each of which can contain one or more sub-attributes.
27 Session-Timeout Maximum service duration for the user before termination of the session.
28 Idle-Timeout Maximum idle time permitted for the user before termination of the session.
31 Calling-Station-Id
User identification that the NAS sends to the server. For the LAN access
service provided by an HP device, this attribute carries the MAC address of
the user in the format HHHH-HHHH-HHHH.
32 NAS-Identifier Identification that the NAS uses to identify itself to the RADIUS server.