API Guide

Disconnect Messages
Using the Disconnect Messages, the NAS can disconnect AAA and dot1x sessions. NAS can disconnect AAA sessions using
either username or a combination of the username and session id. NAS can disconnect dot1x sessions using NAS-port, or
calling-station ID, or both.
The disconnect messages constitue one message request (DM request) and one of the following two possible responses:
● Disconnect Acknowledgement (DM-Ack) - If the session is disconnected successfully, then NAS sends a DM-Ack.
● Disconnect non-Acknowledgement (DM-Nak) - If the session is not disconnected successfully, then NAS sends a DM-Nak.
Attributes
In Disconnect messsage requests and CoA-Request packets, certain attributes are used to uniquely identify the NAS as well as
user sessions on the NAS.
The combination of NAS and session identification attributes included in a CoA-request or a disconnect-message request must
match at least one session in order for a request to be successful; otherwise, a disconnect-Nak or CoA-Nak is sent. For
disconnect-user operations using DMs, if all NAS identification attributes match, and more than one session matches all of the
session identification attributes, then a CoA-request or a disconnect-message request applies to all matching sessions.
The following tables describe the various types of attributes that identify the NAS and the user sessions:
Table 76. NAS Identification Attributes
Attribute
code
Attribute Description
4 NAS-IP-Address IPv4 address of the NAS.
95 NAS-IPv6–Address IPv6 address of the NAS.
Table 77. Change of Authorization (CoA) Attribute
Attribute
code
Attribute Description
5 NAS-Port Port associated with the session to be processed for EAP or MAB users or the VTY ID
for AAA sessions.
Table 78. Session Identification Attributes
Attribute
code
Attribute Description
31 Calling-Station-Id (MAC
Address)
The link address from which session is connected.
Table 79. Vendor-specific Attributes
Attribute
code
Attribute Description
26 Vendor-
specific
NAS supports the following values for the vendor-specific attributes:
● t=26(vendor-speific);l=length;vendor-identification-attribute;Length=value;data=”cmd=re-
authenticate”
● t=26(vendor-speific);l=length;vendor-identification-
attribute;Length=value;data=”cmd=disable-host-port”
● t=26(vendor-speific);l=length;vendor-identification-
attribute;Length=value;data=”cmd=bounce-host-port”
● t=26(vendor-speific);l=length;vendor-identification-
attribute;Length=value;data=”cmd=terminate-session”
● t=26(vendor-speific);l=length;vendor-identification-
attribute;Length=value;data=”cmd=disconnect-user”
The vendor identification attribute can be one of the following:
● v=9(Cisco);Vendor-Type=1(cisco-av-pair) Length = value
Security 727