Filter
Top Products
532 CHAPTER 38: CONFIGURING AAA AND RADIUS PROTOCOL
Figure 167 RADIUS packet structure
The Identifier field is used to match request packets and response requests. It
varies with the Attribute field and the valid received response packets, but remains
unchanged during retransmission. The Authenticator field (16 bytes) is used to
authenticate the request transmitted by the RADIUS server, and it can also be used
on the password hidden algorithm. There are two kinds of Authenticator packets:
■ Request Authenticator: Adopts 16-byte random code.
■ Response Authenticator: Is the result of performing the MD5 algorithm on
Code, Identifier, Request Authenticator, Length, Attribute and shared-key.
The Code field decides the type of RADIUS packets, as shown in Table 597.
Table 597 The Type of Packets Decided by Code Field
The Attribute field carries special AAA information, and provides the configuration
details of request and response packets in the triplet form of type, length, and
value.
Table 598 lists the explanation of Attribute fields defined by RFC.
Code Packet type Explanation of the packet
1 Access-Request Direction: Client -> Server.
The Client transmits the user information to Server to decide
whether or not to allow the user to access.
The packet must contain User-Name attribute, and may
contain such attributes as NAS-IP-Address, User-Password or
NAS-Port.
2 Access-Accept Direction: Server->Client.
If all the Attribute values in the Access-Request packets are
acceptable (i.e., the authentication is successful), this type of
packet can be transmitted.
3 Access-Reject Direction: Server->Client.
If none of the Attribute values in the Access-Request packet is
acceptable (i.e., the authentication has failed), this type of
packet can be transmitted.
4 Accounting-Request Direction: Client->Server.
Client transmits the user information to Server and request
accounting. The Acct-Status-Type attribute in this packet
differentiates accounting start request and accounting stop
request. The attributes in this packet is almost the same as
those in Access-Request packet.
5 Accounting-Response Direction: Server->Client.
Server informs Client that the Accounting-Request packet is
received and the accounting information is correctly recorded.
The packet includes inbound/outbound bytes,
inbound/outbound packets and session time on the interface.
Code
Identifier Length
Authenticator
Attribute