< Home

RADIUS Attributes

RADIUS attributes are Attribute fields in RADIUS packets, which carry dedicated authentication, authorization, and accounting information. This chapter covers the following sections:

For more information about RADIUS attributes, use the AAA Attribute Query Tool.

Standard RADIUS Attributes

RFC2865, RFC2866, and RFC3576 define standard RADIUS attributes that are supported by all mainstream vendors. For details, see Table 1.

Choose Columns...
Table 1 Standard RADIUS attributes

Attribute No.

Attribute Name

Attribute Type

Description

1

User-Name

string

User name for authentication. The user name format can be user name@domain name, or just user name.

2

User-Password

string

User password for authentication, which is only valid for the Password Authentication Protocol (PAP).

3

CHAP-Password

string

Response value provided by a PPP Challenge-Handshake Authentication Protocol (CHAP) user in response to the challenge.

4

NAS-IP-Address

ipaddr

Internet Protocol (IP) address of the NAS carried in authentication request packets. By default, the attribute value is the source IP address of the authentication request packets sent by the NAS. You can change the attribute value to the specified IP address on the NAS or the IP address of the AP using the radius-attribute nas-ip { ip-address | ap-info } command.

5

NAS-Port

integer
Physical port number of the network access server that is authenticating the user, which is in either of the following formats:
  • new: slot ID (8 bits) + sub-slot ID (4 bits) + port number (8 bits) + Virtual Local Area Network (VLAN) ID (12 bits)
  • old: slot ID (12 bits) + port number (8 bits) + VLAN ID (12 bits)

6

Service-Type

integer
Service type of the user to be authenticated:
  • 2 (Framed): PPP users, 802.1X users, static users, and MAC authentication users (with the fixed user name format)
  • 6 (Administrative): administrator
  • 8 (Authenticate Only): reauthentication only
  • 10 (Call Check): MAC authentication users (with the MAC address as the user name) or MAC address bypass authentication user

7

Framed-Protocol

integer
Encapsulation protocol of Frame services:
  • For a non-management user, the value is fixed as 1.
  • For a management user, the value is fixed as 6.

8

Framed-IP-Address

ipaddr

User IP address.

11

Filter-Id

string

UCL group name, user group name, or IPv4 Access Control List (ACL) ID.

NOTE:

  • When this attribute carries the IPv4 ACL ID, the IPv4 ACL IDs must range from 3000 to 3999 (wired users) or 3000 to 3031 (wireless users).

  • A RADIUS packet cannot carry the user group name, UCL group name, or IPv4 ACL ID simultaneously.

  • If the server simultaneously delivers the user group name carried in the Filter-Id (11) attribute and IPv6 ACL ID carried in the HW-IPv6-Filter-ID (26–251) attribute, only the user group name takes effect.
  • If the server simultaneously delivers the IPv4 ACL ID carried in the Filter-Id (11) attribute and IPv6 ACL ID carried in the HW-IPv6-Filter-ID (26–251) attribute, both the IPv4 and IPv6 ACL IDs take effect.

12

Framed-MTU

integer

Maximum transmission unit (MTU) of the data link between user and NAS. For example, in 802.1X Extensible Authentication Protocol (EAP) authentication, the NAS specifies the maximum length of the EAP packet in this attribute. An EAP packet larger than the link MTU may be lost.

14

Login-IP-Host

ipaddr
Management user IP address:
  • If the value is 0 or 0xFFFFFFFF, the IP address of management user is not checked.
  • If this attribute uses other values, the NAS checks whether the management user IP address is the same as the delivered attribute value.

15

Login-Service

integer
Service to use to connect the user to the login host:
  • 0: Telnet
  • 5: X25-PAD
  • 50: SSH
  • 51: FTP
  • 52: Terminal
NOTE:

An attribute can contain multiple service types.

18

Reply-Message

string
This attribute determines whether a user is authenticated:
  • When an Access-Accept packet is returned, the user is successfully authenticated.
  • When an Access-Reject packet is returned, the user fails authentication.

19

Callback-Number

string

Information sent from the authentication server and to be displayed to a user, such as a mobile number.

24

State

string

This Attribute is available to be sent by the server to the client in an Access-Challenge and MUST be sent unmodified from the client to the server in the new Access-Request reply to that challenge, if any.

25

Class

string

If the RADIUS server sends a RADIUS Access-Accept packet carrying the Class attribute to the NAS, the subsequent RADIUS Accounting-Request packets sent from the NAS must carry the Class attribute with the same value.

26

Vendor-Specific

string

Vendor-specific attribute. For details, see Table 2. A packet can carry one or more private attributes. Each private attribute contains one or more sub-attributes.

27

Session-Timeout

integer

In the Access-Request packet, this attribute indicates the maximum number of seconds a user should be allowed to remain connected.

In the Access-Challenge packet, this attribute indicates the duration for which EAP authentication users are reauthenticated.

When the value of this attribute is 0:
  • If the aaa-author session-timeout invalid-value enable command is not configured, the session-timeout attribute delivered by the server does not take effect and the period for disconnecting or reauthenticating users depends on the device configuration.
  • If the aaa-author session-timeout invalid-value enable command is configured, the session-timeout attribute delivered by the server takes effect and the device does not disconnect or reauthenticate users.
NOTE:

This attribute is only valid for 802.1X, MAC address, Portal, and PPPoE authentication users.

When the RADIUS server delivers only this attribute, the value of attribute 29 Termination-Action is set to 0 (users are forced offline) by default.

28

Idle-Timeout

integer

Maximum number of consecutive seconds of idle connection the user is allowed before termination of the session or prompt.

NOTE:
  • This attribute is only valid for administrators and wireless users.
  • This attribute can be used together with the traffic and direction configured using the idle-cut command in the service scheme view. When no authorization service scheme is configured or this command is not configured in the service scheme, and a user does not produce upstream traffic within the idle-cut period, the user is disconnected.
  • In V200R012C00 and later versions, idle-cut is performed in seconds. In versions earlier than V200R012C00, idle-cut is performed in minutes. When a switch or an AC interconnects with an AP running a version earlier than V200R009C00, the idle-cut period is round up to an integer in seconds; for example, 60s is round up to 1 minute, and values 61s to 119s are round up to 2 minutes.

29

Termination-Action

integer
What action the NAS should take when the specified service is completed:
  • 0: forcible disconnection
  • 1: reauthentication
NOTE:

This attribute is only valid for 802.1X and MAC address authentication users. When the authentication point is deployed on a VLANIF interface, MAC address authenticated users do not support the authorization of Termination-Action=1.

When the RADIUS server delivers only this attribute, the value of attribute 27 Session-Timeout is set to 3600s (for 802.1X authentication users) or 1800s (for MAC address authentication users) by default.

30

Called-Station-Id

string
Number of the NAS:
  • For wired users, it is the NAS MAC address.
  • For wireless users, it is the SSID and MAC address of the AP. You can run the called-station-id wlan-user-format command to set the attribute encapsulation content to the AC's MAC address, AC's IP address, AP name, name of the AP group to which the AP belongs, outer VLAN through which the user goes online, or location information of the AP, and whether to encapsulate the SSID into the RADIUS packet.

31

Calling-Station-Id

string

This Attribute allows the NAS to send in the Access-Request packet the phone number that the call came from, using Automatic Number Identification (ANI) or similar technology.

32

NAS-Identifier

string

String identifying the network access server originating the Access-Request. By default, the attribute value is the host name of the user. You can change the attribute value to the VLAN ID of the user or the MAC address of the AP using the radius-server nas-identifier-format { hostname | vlan-id | ap-info } command.

40

Acct-Status-Type

integer
Accounting-Request type:
  • 1: Accounting-Start packet
  • 2: Accounting-Stop packet
  • 3: Interim-Accounting packet

41

Acct-Delay-Time

integer

Number of seconds the client has been trying to send the accounting packet (excluding the network transmission time).

42

Acct-Input-Octets

integer

Number of bytes in upstream traffic, corresponding to the lower 32 bits in the data structure for storing the upstream traffic. Contents of this attribute and the RADIUS attribute 52 (Acct-Input-Gigawords) compose the upstream traffic.

The traffic unit must be the same as that of the RADIUS server and can be Byte, KByte, MByte, and GByte. To set the traffic unit for each RADIUS server, run the radius-server traffic-unit command. By default, the unit is Byte.

NOTE:

This attribute is only supported by the S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

43

Acct-Output-Octets

integer

Number of bytes in downstream traffic, corresponding to the lower 32 bits in the data structure for storing the downstream traffic. Contents of this attribute and the RADIUS attribute 53 (Acct-Output-Gigawords) compose the downstream traffic.

The traffic unit must be the same as that of the RADIUS server and can be Byte, KByte, MByte, and GByte. To set the traffic unit for each RADIUS server, run the radius-server traffic-unit command. By default, the unit is Byte.

44

Acct-Session-Id

string

Accounting session ID. The Accounting-Start, Interim-Accounting, and Accounting-Stop packets of the same accounting session must have the same session ID.

The format of this attribute is: Host name (7 bits) + Slot ID (2 bits) + Subcard number (1 bit) + Port number (2 bits) + Outer VLAN ID (4 bits) + Inner VLAN ID (5 bits) + Central Processing Unit (CPU) Tick (6 bits) + User ID prefix (2 bits) + User ID (5 bits).

45

Acct-Authentic

integer
User authentication mode:
  • 1: RADIUS authentication
  • 2: Local authentication
  • 3: Other remote authentications

46

Acct-Session-Time

integer

How long (in seconds) the user has received service.

NOTE:

If the administrator modifies the system time after the user goes online, the online time calculated by the device may be incorrect.

47

Acct-Input-Packets

integer

Number of incoming packets.

NOTE:

This attribute is only supported by S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

48

Acct-Output-Packets

integer

Number of outgoing packets.

49

Acct-Terminate-Cause

string
Cause of a terminated session:
  • User-Request (1): The user requests termination of service.
  • Lost Carrier (2): The connection is torn down due to a handshake failure or heartbeat timeout, such as an ARP probe failure or PPP handshake failure.
  • Lost Service (3): The connection initiated by the peer device is torn down.
  • Idle Timeout (4): The idle timer expires.
  • Session Timeout (5): The session times out or the traffic threshold is reached.
  • Admin Reset (6): The administrator forces the user to go offline.
  • Admin Reboot (7): The administrator restarts the NAS.
  • Port Error (8): A port fails.
  • NAS Error (9): The NAS encounters an internal error.
  • NAS Request (10): The NAS ends the session due to resource changes.
  • NAS Reboot (11): The NAS automatically restarts.
  • Port Unneeded (12): The port is Down.
  • Port Preempted (13): The port is preempted.
  • Port Suspended (14): The port is suspended.
  • Service Unavailable (15): The service is unavailable.
  • Callback (16): NAS is terminating the current session to perform a callback for a new session.
  • User Error (17): User authentication fails or times out.
  • Host Request (18): A host sends a request.

52

Acct-Input-Gigawords

integer

Number of times the number of bytes in upstream traffic is greater than 4 GB (2^32), corresponding to the higher 32 bits in the data structure for storing the upstream traffic. Contents of this attribute and the RADIUS attribute 42 (Acct-Input-Octets) compose the upstream traffic.

The traffic unit must be the same as that of the RADIUS server and can be Byte, KByte, MByte, and GByte. To set the traffic unit for each RADIUS server, run the radius-server traffic-unit command. By default, the unit is Byte.

NOTE:

This attribute is only supported by S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

53

Acct-Output-Gigawords

integer

Number of times the number of bytes in downstream traffic is greater than 4 GB (2^32), corresponding to the higher 32 bits in the data structure for storing the downstream traffic. Contents of this attribute and the RADIUS attribute 43 (Acct-Output-Octets) compose the downstream traffic.

The traffic unit must be the same as that of the RADIUS server and can be Byte, KByte, MByte, and GByte. To set the traffic unit for each RADIUS server, run the radius-server traffic-unit command. By default, the unit is Byte.

55

Event-Timestamp

integer

Time when an Accounting-Request packet is generated, represented by is the number of seconds elapsed since 00:00:00 of January 1, 1970.

60

CHAP-Challenge

string

Challenge field in CHAP authentication. This field is generated by the NAS for Message Digest algorithm 5 (MD5) calculation.

61

NAS-Port-Type

integer

NAS port type. The attribute value can be configured in the interface view. By default, the type is Ethernet (15).

64

Tunnel-Type

integer

Protocol type of the tunnel. The value is fixed as 13, indicating VLAN.

65

Tunnel-Medium-Type

integer

Medium type used on the tunnel. The value is fixed as 6, indicating Ethernet.

79

EAP-Message

string

Encapsulates Extended Access Protocol (EAP) packets so that RADIUS supports EAP authentication. When an EAP packet is longer than 253 bytes, the packet is encapsulated into multiple attributes. A RADIUS packet can carry multiple EAP-Message attributes.

80

Message-Authenticator

string

Authenticates and verifies authentication packets to prevent spoofing packets.

81

Tunnel-Private-Group-ID

string

Tunnel private group ID, which is used to deliver user VLAN IDs.

NOTE:

Authorization can be performed using the VLAN ID, VLAN description, VLAN name, and VLAN pool. The order in which authorization takes effect is as follows: VLAN ID > VLAN description > VLAN name > VLAN pool.

To make the VLAN authorization function take effect, ensure the correct access control mode is configured:
  • When the link type is hybrid in untagged mode, the access control mode can be MAC address or interface.
  • When the link type is access or trunk, the access control mode can only be interface.

Both wired and wireless users support the authorization of VLAN pools, and wireless users support the authorization of VLAN pools since V200R013C00

85

Acct-Interim-Interval

integer

Interim accounting interval. The value ranges from 60 to 3932100, in seconds. It is recommended that the interval be at least 600 seconds.

87

NAS-Port-Id

string
Port of the NAS that is authenticating the user. The NAS-Port-Id attribute has the following formats:

  • New:

    For Ethernet access users, the NAS-Port-Id is in the format "slot=xx; subslot=xx; port=xxx; VLAN ID=xxxx", in which "slot" ranges from 0 to 15, "subslot" 0 to 15, "port" 0 to 255, and "VLAN ID" 1 to 4094.

    For ADSL access users, the NAS-Port-Id is in the format "slot=xx; subslot=x; port=x; VPI=xxx; VCI=xxxxx", in which "slot" ranges from 0 to 15, "subslot" 0 to 9, "port" 0 to 9, "VPI" 0 to 255, and "VCI" 0 to 65535.

  • New client-option82: The content of the circuit ID suboption in the Option 82 field is encapsulated into the NAS-Port-Id attribute in a RADIUS packet. The format of the NAS-Port-Id attribute is the same as that of the suboption.

  • Old:

    For Ethernet access users, the NAS-Port-Id is in the format "port number (2 characters) + sub-slot ID (2 bytes) + card number (3 bytes) + VLAN ID (9 characters)."

    For ADSL access users: port number (2 characters) + sub-slot ID (2 bytes) + card number (3 bytes) + VPI (8 characters) + VCI (16 characters). The fields are prefixed with 0s if they contain fewer bytes than specified.

  • Vendor 9: Uses the default format of Cisco for encapsulation.

89

Chargeable-User-Identity

string

Charging ID delivered by the server. To configure a device to support this attribute, run the radius-server support chargeable-user-identity [ not-reject ] command.

95

NAS-IPv6-Address

ipaddr

IPv6 address carried in the authentication request packet sent by the NAS. Both the NAS-IPv6-Address and NAS-IP-Address fields can be included in a packet.

96

Framed-Interface-Id

string

IPv6 interface identifier to be configured for the user.

97

Framed-IPv6-Prefix

ipaddr

IPv6 prefix to be configured for the user.

168

Framed-IPv6-Address

ipaddr

IPv6 address of the user.

195

HW-SecurityStr

string

Security information of users in EAP relay authentication.

Huawei Proprietary RADIUS Attributes

RADIUS is a fully extensible protocol. The No. 26 attribute (Vendor-Specific) defined in RFC2865 can be used to extend RADIUS for implementing functions not supported by standard RADIUS attributes. Table 2 describes Huawei proprietary RADIUS attributes.

Extended RADIUS attributes contain the vendor ID of the device. The vendor ID of Huawei is 2011.

Choose Columns...
Table 2 Huawei proprietary RADIUS attributes

Attribute No.

Attribute Name

Attribute Type

Description

26-1

HW-Input-Peak-Information-Rate

integer

Peak information rate (PIR) at which the user accesses the NAS, which is the maximum rate of traffic that can pass through an interface. The value is a 4-byte integer, in bit/s. The HW-Input-Peak-Information-Rate must be higher than or equal to the HW-Input-Committed-Information-Rate. The default HW-Input-Peak-Information-Rate is equal to the HW-Input-Committed-Information-Rate.

26-2

HW-Input-Committed-Information-Rate

integer

Committed information rate (CIR) at which the user accesses the NAS, which is the allowed average rate of traffic that can pass through an interface. The value is a 4-byte integer, in bit/s.

NOTE:

This attribute must be specified when the rate of packets sent from the user to the NAS is limited.

26-3

HW-Input-Committed-Burst-Size

integer

Committed burst size (CBS) at which the user accesses the NAS, which is the average volume of burst traffic that can pass through an interface. The value is a 4-byte integer, in bit.

26-4

HW-Output-Peak-Information-Rate

integer

Peak information rate at which the NAS connects to the user. The value is a 4-byte integer, in bit/s. The HW-Output-Peak-Information-Rate must be higher than or equal to the HW-Output-Committed-Information-Rate. The default HW-Output-Peak-Information-Rate is equal to the HW-Output-Committed-Information-Rate.

26-5

HW-Output-Committed-Information-Rate

integer

Committed information rate at which the NAS connects to the user. The value is a 4-byte integer, in bit/s.

NOTE:

This attribute must be specified when the rate of packets sent from the NAS to the user is limited.

26-6

HW-Output-Committed-Burst-Size

integer

Committed burst size at which the NAS connects to the user. The value is a 4-byte integer, in bit.

26-15

HW-Remanent-Volume

integer

Remaining traffic. The unit is KB.

26-17

HW-Subscriber-QoS-Profile

string

Name of the QoS profile.

NOTE:

The RADIUS server can only grant this attribute to wired users who go online through the S5720-HI.

When this attribute is authorized to an NAS remotely, ensure that the user queue has been created in the QoS profile using the user-queue { pir pir-value | flow-queue-profile flow-queue-profile-name | flow-mapping-profile flow-mapping-profile-name } * command to implement HQoS.

26-18

HW-UserName-Access-Limit

integer

Maximum number of users who are allowed to access the network using the same user name.

The limit is indicated by a particular numeric value as follows:
  • 0: indicates that no user is allowed to access the network.
  • 0xFFFFFFFF (4294967295): indicates that the number of users who are allowed to access the network using the same user name is not limited.
  • 1: indicates that only one user is allowed to access the network using a particular user name.
  • Other values: indicates a maximum number (specified by the particular value) of users who are allowed to access the network using the same user name.
NOTE:

This attribute can be carried only in Access-Accept packets.

26-26

HW-Connect-ID

integer

Index of a user connection.

26-28

HW-FTP-Directory

string

Initial directory of an FTP user.

26-29

HW-Exec-Privilege

integer

Management user (such as Telnet user) priority, ranging from 0 to 15. The priority that is greater than or equal to 16 is ineffective.

26-31

HW-Qos-Data

string

Name of the QoS profile. The maximum length of the name is 31 bytes. The RADIUS server uses this field to deliver the QoS profile for traffic policing. The QoS profile must exist on the device and traffic policing is configured using the car (QoS profile view) command.

NOTE:

This attribute is only supported by the S5720-EI, S5720-HI, S5730-HI, S5731-H,?S5731S-H, S5731-S, S5731S-S, S6720-HI, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-EI, and S6720S-EI.

26-33

HW-VoiceVlan

integer

Voice VLAN authorization flag. The value 1 indicates that the authorized VLAN is the voice VLAN. This attribute is used with VLAN authorization attributes.

NOTE:

After the authentication mode multi-share command is configured in the authentication profile, authorization voice VLAN will not be supported.

26-35

HW-ProxyRdsPkt

integer
This attribute specifies whether a RADIUS server is a proxy server:
  • If the Access-Accept packet returned by a server carries the HW-Proxy-RDS attribute with value 1, the server is the proxy server.
  • If the Access-Accept packet returned by a server carries the HW-Proxy-RDS attribute with value 0, the server is not the proxy server.

26-59

HW-NAS-Startup-Time-Stamp

integer

NAS start time, represented by the number of seconds elapsed since 00:00:00 of January 1, 1970.

26-60

HW-IP-Host-Address

string

User IP address and MAC address carried in authentication and accounting packets, in the format A.B.C.D hh:hh:hh:hh:hh:hh. The IP address and MAC address are separated by a space.

If the user's IP address is detected to be invalid during authentication, the IP address is set to 255.255.255.255.

26-61

HW-Up-Priority

integer

802.1p priority of upstream packets.

26-62

HW-Down-Priority

integer

802.1p priority of downstream packets.

26-75

HW-Primary-WINS

ipaddr

Primary WINS server address delivered by the RADIUS server after a user is successfully authenticated.

26-76

HW-Second-WINS

ipaddr

Secondary WINS server address delivered by the RADIUS server after a user is successfully authenticated.

26-77

HW-Input-Peak-Burst-Size

integer

Upstream peak rate, in bit/s.

NOTE:

This attribute is only supported by the S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

26-78

HW-Output-Peak-Burst-Size

integer

Downstream peak rate, in bit/s.

26-82

HW-Data-Filter

string

Used by the RADIUS server to deliver IPv4 or IPv6 ACL rules to users. ACL rules can be delivered in two modes: delivering ACL rules through DACL groups and delivering ACL rules. There are old and new attribute formats for ACL rules. Compared with the old attribute format, the new attribute format shortens the length of an ACL rule.

NOTE:

  • A RADIUS packet can carry multiple attributes 26-82. Currently, each attribute can carry only one ACL rule or DACL group.

  • Only wireless users in tunnel forwarding mode and wired users support this attribute. Wireless users in direct forwarding mode can use RADIUS attribute 11 to deliver ACL rules.
  • You can run the display access-user user-id user-id command to check whether this attribute takes effect. If Dynamic ACL desc (Effective) is displayed in the command output, this attribute takes effect. If Dynamic ACL desc (Ineffective) is displayed in the command output, this attribute does not take effect.
  • The name of a DACL group must meet the following requirements; otherwise, ACL authorization and delivery will fail.

    The value is a string of 1 to 64 case-sensitive characters, which cannot contain spaces, / \ : * ? " < > | @ ' % and cannot be set to – and --.

  • After rules in a DACL group are modified, the rules delivered to the device will be modified when users are re-authenticated or new users go online. The rights of online users will also be modified.
  • Only the following switches support DACL groups: S5720-HI, S5730-HI, S5731-H, S5731S-H, S5732-H, S5731-S, S5731S-S, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S.
  • This attribute described through IGMP does not take effect on S5720-HI, S5730-HI, S5731-H, S5731-S, S5731S-S, S5731S-H, S5732-H, S6720-HI, S6730-H, S6730S-H, S6730-S, and S6730S-S.

Directly delivering ACL rules in new attribute format (fields in square brackets are optional)

The attribute format is: $number permit/deny [ protocol ] [ direction ip-address [ port ] ]

The fields are described as follows:
  • $: Start character of each ACL rule.
  • number: Last three digits in an ACL rule number, ranging from 0 to 999. The first two digits of an ACL rule number are fixed to 10. For example, if the value of this field is 12, the ACL rule number is 10012.
  • permit/deny: ACL action. permit indicates that the user access is allowed. deny indicates that the user access is denied.
  • protocol: Protocol type. The value can be tcp, udp, icmp or igmp. ICMP is classified into echo and echo-reply.
  • direction: IP address type. The value can be dst or src. dst indicates a destination IP address and src indicates a source IP address.

  • ip-address: IP address. The value can be any, IPv4 address/mask or IPv6 address/mask.

    IPv4 address/mask: The IPv4 address is in dotted decimal notation. The mask is a hexadecimal number ranging from 0 to 32. The IP address and mask are separated by a slash (/). IPv6 address/mask: The IPv6 address is a hexadecimal number. The mask is a decimal number that ranges from 0 to 128. The IP address and mask are separated by a slash (/).

  • port: Port number. Currently, only one port is supported.

The following examples are the attribute values entered on the server:

$1 permit dst 10.0.239.192/26

$2 permit udp src any 8080

$3 permit icmp echo dst 10.1.1.1/24

$5 deny

Directly delivering ACL rules in old attribute format

The attribute format is acl number key1 key-value1... keyN key-valueN permit/deny.

The fields are described as follows:
  • acl: Keyword, indicating that the ACL rule is delivered.
  • number: ACL rule number. The value ranges from 10000 to 10999.
  • keyM key-valueM(1≤M≤N): Keyword in an ACL rule and its value. The keyword value can be:
    • dest-ip ip-address: Specifies the destination IPv4 address in dotted decimal notation. Or specifies the destination IPv6 address. The value is a hexadecimal number. When the destination IP address is 0.0.0.0, this parameter can be omitted without configuration.
    • dest-ipmask mask: Specifies the destination IPv4 mask. NAC users support only the destination IP mask that is an integer ranging from 1 to 32. VM users support only the destination IP mask that is in dotted decimal notation.

      Or specifies the destination IPv6 mask. The value is an integer that ranges from 0 to 128.

      When IP mask is 0, this parameter can be omitted without configuration.

    • tcp-srcport port: Specifies the source TCP start port number that ranges from 0 to 65535.
    • tcp-srcport-end port: Specifies the source TCP end port number that ranges from 0 to 65535 and must be larger than the start port number.
    • tcp-dstport port: Specifies the destination TCP start port number that ranges from 0 to 65535.
    • tcp-dstport-end port: Specifies the destination TCP end port number that ranges from 0 to 65535 and must be larger than the start port number.
    • udp-srcport port: Specifies the source UDP start port number that ranges from 0 to 65535.
    • udp-srcport-end port: Specifies the source UDP end port number that ranges from 0 to 65535 and must be larger than the start port number.
    • udp-dstport port: Specifies the destination UDP start port number that ranges from 0 to 65535.
    • udp-dstport-end port: Specifies the destination UDP end port number that ranges from 0 to 65535 and must be larger than the start port number.
  • permit/deny: ACL action. permit indicates that the user access is allowed. deny indicates that the user access is denied.

    The following examples are the attribute values entered on the server:

    acl 10005 deny

    acl 10006 tcp-dstport 5080 permit

    acl 10007 dest-ip 10.11.11.2 dest-ipmask 32 permit

    acl 10008 dest-ip 10.11.11.3 dest-ipmask 32 udp-dstport 5070 permit

    acl 10009 dest-ip 11.11.11.2 dest-ipmask 32 udp-dstport 5070 udp-dstport-end 5080 deny

    Delivering ACL rules using DACL groups

    The format of ACL rules in a DACL group can be the new or old format. The new format is recommended. When the device is connected to a Cisco ISE server, an ACL rule starts with the number sign (#).

    The following examples are the attribute values entered on the server:

    $1 dacl-group-name huawei

    $2 permit dst 10.0.239.192/26

    $3 permit udp src any 8080

    $4 deny

26-135

HW-Client-Primary-DNS

ipaddr

Primary DNS address delivered by the RADIUS server after a user is successfully authenticated.

26-136

HW-Client-Secondary-DNS

ipaddr

Secondary DNS address delivered by the RADIUS server after a user is successfully authenticated.

26-138

HW-Domain-Name

string

Name of the domain used for user authentication. This attribute can be the domain name contained in a user name or the name of a forcible domain.

26-141

HW-AP-Information

string

AP's MAC address used for STA authentication, in H-H-H format. H is a 4-digit hexadecimal number.

NOTE:

This attribute is only supported by the S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

26-142

HW-User-Information

string

User security check information delivered by the RADIUS server to an Extensible Authentication Protocol over LAN (EAPoL) user to notify the user of items that require security checks.

26-146

HW-Service-Scheme

string

Service scheme name. A service scheme contains user authorization information and policies.

26-153

HW-Access-Type

integer
User access type carried in the authentication and accounting request packets sent by the RADIUS client to the RADIUS server:
  • 1: Dot1x user
  • 2: MAC address authentication user or MAC address bypass authentication
  • 3: Portal authentication user
  • 4: Static user
  • 6: Management user
  • 7: PPP users

26-155

HW-URL-Flag

integer
This attribute specifies whether a Uniform Resource Locator (URL) is forcibly pushed when it is used with another attribute, for example, HW-Portal-URL:
  • 0: No
  • 1: Yes

26-156

HW-Portal-URL

string

Forcibly pushed URL.

If information delivered by the RADIUS server matches the configured URL template, the URL configured in the template is used. Otherwise, the character string delivered by the RADIUS server is used.

26-157

HW-Terminal-Type

string

Terminal type of a user.

26-158

HW-DHCP-Option

string

DHCP Option, encapsulated in Type-Length-Value (TLV) format. A packet may contain multiple HW-DHCP-Option attributes to carry Option information.

Only Option 82 can be delivered.

26-159

HW-HTTP-UA

string

User-Agent information in Hypertext Transfer Protocol (HTTP) packets.

26-160

HW-UCL-Group

integer

Index of a UCL group.

26-161

HW-Forwarding-VLAN

string

Delivers the Internet Service Provider (ISP) VLAN for user packet forwarding.

NOTE:

This attribute is only supported by the S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

26-162

HW-Forwarding-Interface

string

Outbound interface for forwarding user packets.

NOTE:

This attribute is only supported by the S5730-HI, S5731-H, S5731S-H, S5731-S, S5731S-S, S5732-H, S6730-H, S6730S-H, S6730-S, S6730S-S, S6720-HI, and S5720-HI.

26-163

HW-LLDP

string

LLDP information. A packet can contain multiple HW-LLDP-Info attributes to carry different options.

26-166

HW-Acct-ipv6-Input-Octets

integer

Number of upstream bytes in an IPv6 flow. The unit can be byte, kilobyte, megabyte, or gigabyte.

26-167

HW-Acct-ipv6-Output-Octets

integer

Number of downstream bytes in an IPv6 flow. The unit can be byte, kilobyte, megabyte, or gigabyte.

26-168

HW-Acct-ipv6-Input-Packets

integer

Number of upstream packets in an IPv6 flow.

26-169

HW-Acct-ipv6-Output-Packets

integer

Number of downstream packets in an IPv6 flow.

26-170

HW-Acct-ipv6-Input-Gigawords

integer

This attribute specifies the number of times that more than 4 GB upstream packets are carried in an IPv6 flow. This attribute is usually used with the HW-Acct-ipv6-Input-Octets attribute.

26-171

HW-Acct-ipv6-Output-Gigawords

integer

This attribute specifies the number of times that more than 4 GB downstream packets are carried in an IPv6 flow. This attribute is usually used with the HW-Acct-ipv6-Output-Octets attribute.

26-173

HW-Redirect-ACL

string

Redirection ACL. Redirection is performed for only the users matching the ACL rules. The ACL number or ACL name can be delivered. The ACL name must start with a character.

NOTE:

The value range of acl-number is from 3000 to 3999 for wired users and from 3000 to 3031 for wireless users.

After the authentication mode multi-share command is configured in the authentication profile, authorization redirection ACL will not be supported.

26-178

HW-IPv6-Redirect-ACL

string

Redirection IPv6 ACL. Redirection is performed for only the users matching the ACL rules. The ACL number or ACL name can be delivered. The ACL name must start with a character.

NOTE:
  • Only wired users support the authorization of this attribute.
  • The value range of acl-number is from 3000 to 3999.
  • After the authentication mode multi-share command is configured in the authentication profile, authorization redirection ACL will not be supported.

26-201

HW-User-Extend-Info

string

Extended user information. This attribute is contained in authentication and accounting request packets. A packet can contain multiple HW-User-Extend-Info attributes. The following describes extended user information:

  • User-Position: Service code of the location where a user goes online
  • User-Position-Type: Type of the location where a user goes online
  • AP-Device-Code: AP code
  • AP-POS-X: Longitude of a moving AP
  • AP-POS-Y: Latitude of a moving AP
  • Wifi-Density: Field strength
  • TERMINAL-POS-X: X coordinate of the terminal against AP, in meters
  • TERMINAL-POS-Y: Y coordinate of the terminal against AP, in meters
  • HW-Access-Time: user access time. The value is the number of seconds elapsed since 00:00:00 of January 1, 1970.

This attribute applies only to MAC address authentication and Portal authentication.

26-237

HW-Web-Authen-Info

string

Information sent from the portal server via the device (which transparently transmits the information) to the RADIUS server. For example, a user selects the authentication-free option and time information for next login, based on which the RADIUS server saves the MAC address of the user for a period of time. Upon the next login of the user, the login page is not displayed. Instead, MAC address authentication is preferentially used. This attribute can be used for transparent transmission in complex modes such as EAP.

26-238

HW-Ext-Specific

string
User extended attributes:
  • user-dscp-in: DSCP value of inbound user packets. The value ranges from 0 to 63.
  • user-dscp-out: DSCP value of outbound user packets. The value ranges from 0 to 63.
  • user-command: is used in RADIUS CoA dynamic authorization. The value can be 1, 2, or 3.
    • 1: indicates that user reauthentication will be performed. In this case, you need to set the value of this attribute on the authentication server to user-command=1.
    • 2: indicates that the authentication interface will be disconnected intermittently. In this case, you need to run the undo radius-server authorization hw-ext-specific command bounce-port disable command on the device to configure it to support this attribute, and set the value of this attribute on the authentication server to user-command=2.
    • 3: indicates that the authentication interface will be disabled. In this case, you need to run the undo radius-server authorization hw-ext-specific command down-port disable command on the device to configure it to support this attribute, and set the value of this attribute on the authentication server to user-command=3.
NOTE:

During RADIUS CoA dynamic authorization, when the value of user-command is 1, 2, or 3, other authorization attributes are not supported.

The user-dscp-in and user-dscp-out attributes cannot be authorized to wireless users in direct forwarding mode.

This attribute applies only to NAC users.

26-239

HW-User-Access-Info

string

User description profile information.

26-240

HW-Access-Device-Info

string

The authentication and accounting request packets carry the IP addresses, MAC addresses, and port numbers of access switches in policy association. The format is ip=A.B.C.D;mac=XXXX-XXXX-XXXX;slot=XX;subslot=XXX;port=XXX;vlanid=XXXX.

26-244

HW-Reachable-Detect

string

Server reachability detection information. Authentication packets carrying this attribute are server detection packets.

26-247

HW-Tariff-Input-Octets

string

Number of upstream bytes at the specified tariff level sent to the accounting server. This field is included in the accounting packets. The unit can be byte, kilobyte, megabyte, or gigabyte. The format is Tariff level:Number of upstream bytes. An accounting packet can contain the traffic of at most 8 tariff levels.

26-248

HW-Tariff-Output-Octets

string

Number of downstream bytes at the specified tariff level sent to the accounting server. This field is included in the accounting packets. The unit can be byte, kilobyte, megabyte, or gigabyte. The format is Tariff level:Number of downstream bytes. An accounting packet can contain the traffic of at most 8 tariff levels.

26-249

HW-Tariff-Input-Gigawords

string

Number of times larger the number of upstream bytes at the specified tariff level is than 4G. This field and the HW-Tariff-Input-Octets field specify the number of upstream bytes at the specified tariff level.

26-250

HW-Tariff-Output-Gigawords

string

Number of times larger the number of downstream bytes at the specified tariff level is than 4G. This field and the HW-Tariff-Output-Octets field specify the number of downstream bytes at the specified tariff level.

26-251

HW-IPv6-Filter-ID

string

ID of a user IPv6 ACL. The value range is from 3000 to 3031.

NOTE:
  • If the server simultaneously delivers the user group name carried in the Filter-Id (11) attribute and IPv6 ACL ID carried in the HW-IPv6-Filter-ID (26–251) attribute, only the user group name takes effect.
  • If the server simultaneously delivers the IPv4 ACL ID carried in the Filter-Id (11) attribute and IPv6 ACL ID carried in the HW-IPv6-Filter-ID (26–251) attribute, both the IPv4 and IPv6 ACL IDs take effect.

26-253

HW-Framed-IPv6-Address

ipaddr

IPv6 address to be configured for the user.

26-254

HW-Version

string

Software version of the device.

26-255

HW-Product-ID

string

NAS product name.

Huawei-supported Extended RADIUS Attributes of Other Vendors

Huawei devices support some extended RADIUS attributes of Microsoft, Cisco, and DSL Forum. For details, see Table 3.

Table 3 Huawei-supported extended RADIUS attributes of other vendors

Attribute No.

Attribute Name

Attribute Type

Description

MICROSOFT-16

MS-MPPE-Send-Key

string

This attribute indicates the MPPE sending key.

MICROSOFT-17

MS-MPPE-Recv-Key

string

This attribute indicates the MPPE receiving key.

CISCO-1

Cisco-avpair

string

This attribute indicates the voice VLAN.

DSLFORUM-1

Agent-Circuit-Id

string

This Attribute contains information describing the subscriber agent circuit identifier corresponding to the logical access loop port of the Access Node/DSLAM from which a subscriber's requests are initiated.

DSLFORUM-2

Agent-Remote-Id

string

This attribute contains an operator-specific, statically configured string that uniquely identifies the subscriber on the associated access loop of the Access Node/DSLAM.

RADIUS Attributes Available in Packets

Different RADIUS packets carry different RADIUS attributes.
  • For the RADIUS attributes available in authentication packets, see Table 4.
  • For the RADIUS attributes available in accounting packets, see Table 5.
  • For the RADIUS attributes available in authorization packets, see Table 6.

The following describes the values in the tables:

  • 1: indicates that the attribute must appear once in the packet.
  • 0: indicates that the attribute cannot appear in the packet (it will be discarded if it is contained).
  • 0-1: indicates that the attribute can appear once or does not appear in the packet.
  • 0+: indicates that the attribute may appear multiple times or does not appear in the packet.
Choose Columns...
Table 4 RADIUS attributes available in authentication packets

Attribute No.

Access-Request

Access-Accept

Access-Reject

Access-Challenge

User-Name(1)

1

0-1

0

0

User-Password(2)

0-1

0

0

0

CHAP-Password(3)

0-1

0

0

0

NAS-IP-Address(4)

1

0

0

0

NAS-Port(5)

1

0

0

0

Service-Type(6)

1

0-1

0

0

Framed-Protocol(7)

1

0-1

0

0

Framed-IP-Address(8)

0-1

0-1

0

0

Filter-Id(11)

0

0-1

0

0

Framed-Mtu(12)

0-1

0

0

0

Login-IP-Host(14)

0-1

0-1

0

0

Login-Service(15)

0

0-1

0

0

Reply-Message(18)

0

0-1

0-1

0-1

Callback-Number(19)

0

0-1

0

0

State(24)

0-1

0-1

0

0-1

Class(25)

0

0-1

0

0

Session-Timeout(27)

0

0-1

0-1

0-1

Idle-Timeout(28)

0

0-1

0

0

Termination-Action(29)

0

0-1

0

0-1

Called-Station-Id(30)

0-1

0

0

0

Calling-Station-Id(31)

1

0-1

0

0

NAS-Identifier(32)

1

0

0

0

Acct-Session-id(44)

1

0

0

0

CHAP-Challenge(60)

0-1

0

0

0

NAS-Port-Type(61)

1

0

0

0

Tunnel-Type(64)

0

0-1

0

0

Tunnel-Medium-Type(65)

0

0-1

0

0

EAP-Message(79)

0-1

0-1

0-1

0-1

Message-Authenticator(80)

0-1

0-1

0-1

0-1

Tunnel-Private-Group-ID(81)

0

0-1

0-1

0

Acct-Interim-Interval(85)

0

0-1

0

0

NAS-Port-Id(87)

0-1

0

0

0

Chargeable-User-Identity(89)

0-1

0-1

0

0

NAS-IPv6-Address(95)

0-1

0

0

0

Framed-Interface-Id(96)

0+

0

0

0

Framed-IPv6-Prefix(97)

0+

0

0

0

HW-SecurityStr(195)

0-1

0

0

0

HW-Input-Peak-Information-Rate(26-1)

0

0-1

0

0

HW-Input-Committed-Information-Rate(26-2)

0

0-1

0

0

HW-Input-Committed-Burst-Size(26-3)

0

0-1

0

0

HW-Output-Peak-Information-Rate(26-4)

0

0-1

0

0

HW-Output-Committed-Information-Rate(26-5)

0

0-1

0

0

HW-Output-Committed-Burst-Size(26-6)

0

0-1

0

0

HW-Remanent-Volume(26-15)

0

0-1

0

0

HW-Subscriber-QoS-Profile(26-17)

0

0-1

0

0

HW-UserName-Access-Limit(26-18)

0

0-1

0

0

HW-Connect-ID(26-26)

1

0

0

0

Ftp-directory(26-28)

0

0-1

0

0

HW-Exec-Privilege(26-29)

0

0-1

0

0

HW-Qos-Data(26-31)

0

0-1

0

0

HW-VoiceVlan(26-33)

0

0-1

0

0

HW-ProxyRdsPkt(26-35)

0

0-1

0

0

HW-NAS-Startup-Time-Stamp(26-59)

1

0

0

0

HW-IP-Host-Address(26-60)

1

0

0

0

HW-Up-Priority(26-61)

0

0-1

0

0

HW-Down-Priority(26-62)

0

0-1

0

0

HW-Primary-WINS(26-75)

0

0-1

0

0

HW-Second-WINS(26-76)

0

0-1

0

0

HW-Input-Peak-Burst-Size(26-77)

0

0-1

0

0

HW-Output-Peak-Burst-Size(26-78)

0

0-1

0

0

HW-Data-Filter(26-82)

0

0-1

0-1

0

HW-Client-Primary-DNS(26-135)

0

0-1

0

0

HW-Client-Secondary-DNS(26-136)

0

0-1

0

0

HW-Domain-Name(26-138)

1

0

0

0

HW-AP-Information(26-141)

1

0

0

0

HW-User-Information(26-142)

0

0-1

0

0

HW-Service-Scheme(26-146)

0

0-1

0

0

HW-Access-Type(26-153)

1

0-1

0

0

HW-URL-Flag(26-155)

0

0-1

0

0

HW-Portal-URL(26-156)

0

0-1

0

0

HW-Terminal-Type(26-157)

0-1

0

0

0

HW-DHCP-Option(26-158)

0+

0

0

0

HW-UCL-Group(26-160)

0

0-1

0

0

HW-Forwarding-VLAN(26-161)

0

0-1

0

0

HW-Forwarding-Interface(26-162)

0

0-1

0

0

HW-LLDP(26-163)

0-1

0

0

0

HW-Redirect-ACL(26-173)

0

0-1

0

0

HW-User-Extend-Info(26-201)

0-1

0

0

0

HW-Web-Authen-Info(26-237)

1

0

0

0

HW-Ext-Specific(26-238)

0

0-1

0

0

HW-User-Access-Info(26-239)

1

0

0

0

HW-Access-Device-Info(26-240)

0-1

0

0

0

HW-Reachable-Detect(26-244)

0

0

0

0

HW-Framed-IPv6-Address(26-253)

0-1

0

0

0

HW-Version(26-254)

1

0

0

0

HW-Product-ID(26-255)

1

0

0

0

MS-MPPE-Send-Key(MICROSOFT-16)

0

0-1

0

0

MS-MPPE-Recv-Key(MICROSOFT-17)

0

0-1

0

0

Cisco-avpair(CISCO-1)

0

0-1

0

0

Agent-Circuit-Id(DSLFORUM-1)

0-1

0

0

0

Agent-Remote-Id(DSLFORUM-2)

0-1

0

0

0
Choose Columns...
Table 5 RADIUS attributes available in accounting packets

Attribute No.

Accounting-Request

(Start)

Accounting-Request

(Interim-Update)

Accounting-Request

(Stop)

Accounting-Response

(start)

Accounting-Response (Interim-Update)

Accounting-Response

(Stop)

User-Name(1)

1

1

1

0

0

0

NAS-IP-Address(4)

1

1

1

0

0

0

NAS-Port(5)

1

1

1

0

0

0

Service-Type(6)

1

1

1

0

0

0

Framed-Protocol(7)

1

1

1

0

0

0

Framed-IP-Address(8)

1

1

1

0

0

0

Class(25)

0-1

0-1

0-1

0

0

0

Session-Timeout(27)

0

0

0

0-1

0-1

0

Called-Station-Id(30)

NOTE:

For users who access the network through PPP authentication, this attribute is optional. If the authentication request packet does not carry this attribute, then neither does the accounting request packet.

1

1

1

0

0

0

Calling-Station-Id(31)

1

1

1

0

0

0

NAS-Identifier(32)

1

1

1

0

0

0

Acct-Status-Type(40)

1

1

1

0

0

0

Acct-Delay-Time(41)

0-1

1

1

0

0

0

Acct-Input-Octets(42)

0-1

0-1

0-1

0

0

0

Acct-Session-Id(44)

1

1

1

0

0

0

Acct-Authentic(45)

1

1

1

0

0

0

Acct-Session-Time(46)

0

1

1

0

0

0

Acct-Input-Packets(47)

0-1

0-1

0-1

0

0

0

Acct-Output-Packets(48)

0-1

0-1

0-1

0

0

0

Acct-Terminate-Cause(49)

0

0

1

0

0

0

Acct-Input-Gigawords(52)

0-1

0-1

0-1

0

0

0

Acct-Output-Gigawords(53)

0-1

0-1

0-1

0

0

0

Event-Timestamp(55)

1

1

1

0

0

0

NAS-Port-Type(61)

1

1

1

0

0

0

NAS-Port-Id(87)

1

1

1

0

0

0

Chargeable-User-Identity(89)

0-1

0-1

0-1

0

0

0

NAS-IPv6-Address(95)

0-1

0-1

0-1

0

0

0

HW-Input-Committed-Information-Rate(26-2)

1

1

1

0

0

0

HW-Output-Committed-Information-Rate(26-5)

1

1

1

0

0

0

HW-Connect-ID(26-26)

1

1

1

0

0

0

HW-IP-Host-Address(26-60)

1

1

1

0

0

0

HW-Domain-Name(26-138)

1

1

1

0

0

0

HW-AP-Information(26-141)

0-1

0-1

0-1

0

0

0

HW-User-Information(26-142)

0

0

0

0-1

0-1

0

HW-Access-Type(26-153)

0-1

0-1

0-1

0

0

0

HW-Terminal-Type(26-157)

0-1

0-1

0-1

0

0

0

HW-DHCP-Option(26-158)

0+

0+

0+

0

0

0

HW-HTTP-UA(26-159)

0-1

0-1

0-1

0

0

0

HW-LLDP(26-163)

0-1

0-1

0-1

0

0

0

HW-User-Extend-Info(26-201)

0-1

0-1

0-1

0

0

0

HW-Access-Device-Info(26-240)

0-1

0-1

0-1

0

0

0

HW-Reachable-Detect(26-244)

0

0

0

0

0

0

HW-Tariff-Input-Octets(26-247)

0

0-1

0-1

0

0

0

HW-Tariff-Output-Octets(26-248)

0

0-1

0-1

0

0

0

HW-Tariff-Input-Gigawords(26-249)

0

0-1

0-1

0

0

0

HW-Tariff-Output-Gigawords(26-250)

0

0-1

0-1

0

0

0

HW-Framed-IPv6-Address(26-253)

0-1

0-1

0-1

0

0

0

MS-MPPE-Send-Key(MICROSOFT-16)

0

0

0

0

0

0

MS-MPPE-Recv-Key(MICROSOFT-17)

0

0

0

0

0

0

Cisco-avpair(CISCO-1)

0

0

0

0

0

0

Agent-Circuit-Id(DSLFORUM-1)

0-1

0-1

0-1

0

0

0

Agent-Remote-Id(DSLFORUM-2)

0-1

0-1

0-1

0

0

0
Choose Columns...
Table 6 RADIUS attributes available in CoA/DM packets

Attribute No.

CoA REQUEST

CoA ACK

CoA NAK

DM REQUEST

DM ACK

DM NAK

User-Name(1)

0-1

0-1

0-1

0-1

0-1

0-1

NAS-IP-Address(4)

0-1

0-1

0-1

0-1

0-1

0-1

NAS-Port(5)

0-1

0

0

0-1

0

0

Framed-IP-Address(8)

0-1

0-1

0-1

0-1

0-1

0-1

Filter-Id(11)

0-1

0

0

0

0

0

Session-Timeout(27)

0-1

0

0

0

0

0

Idle-Timeout(28)

0-1

0

0

0

0

0

Termination-Action(29)

0-1

0

0

0

0

0

Calling-Station-Id(31)

0-1

0-1

0-1

0-1

0-1

0-1

NAS-Identifier(32)

0

0-1

0-1

0

0

0

Acct-Session-Id(44)

1

1

1

1

1

1

Tunnel-Type(64)

0-1

0

0

0

0

0

Tunnel-Medium-Type(65)

0-1

0

0

0

0

0

Tunnel-Private-Group-ID(81)

0-1

0

0

0

0

0

Acct-Interim-Interval(85)

0-1

0

0

0

0

0

NAS-Port-Id(87)

0-1

0

0

0-1

0

0

HW-Input-Peak-Information-Rate(26-1)

0-1

0

0

0

0

0

HW-Input-Committed-Information-Rate(26-2)

0-1

0

0

0

0

0

HW-Output-Peak-Information-Rate(26-4)

0-1

0

0

0

0

0

HW-Output-Committed-Information-Rate(26-5)

0-1

0

0

0

0

0

HW-Output-Committed-Burst-Size(26-6)

0-1

0

0

0

0

0

HW-Subscriber-QoS-Profile(26-17)

0-1

0

0

0

0

0

HW-Qos-Data(26-31)

0-1

0

0

0

0

0

HW-Up-Priority(26-61)

0-1

0

0

0

0

0

HW-Down-Priority(26-62)

0-1

0

0

0

0

0

HW-Input-Peak-Burst-Size(26-77)

0-1

0

0

0

0

0

HW-Output-Peak-Burst-Size(26-78)

0-1

0

0

0

0

0

HW-Data-Filter(26-82)

0-1

0

0

0

0

0

HW-Service-Scheme(26-146)

0-1

0

0

0

0

0

HW-URL-Flag(26-155)

0-1

0

0

0

0

0

HW-Portal-URL(26-156)

0-1

0

0

0

0

0

HW-UCL-Group(26-160)

0-1

0

0

0

0

0

HW-Forwarding-VLAN(26-161)

0-1

0

0

0

0

0

HW-Forwarding-Interface(26-162)

0-1

0

0

0

0

0

HW-Redirect-ACL(26-173)

0-1

0

0

0

0

0

HW-Ext-Specific(26-238)

1

0

0

0

0

0

MS-MPPE-Send-Key(MICROSOFT-16)

0

0

0

0

0

0

MS-MPPE-Recv-Key(MICROSOFT-17)

0

0

0

0

0

0

Cisco-avpair(CISCO-1)

0-1

0

0

0

0

0

Agent-Circuit-Id(DSLFORUM-1)

0-1

0

0

0

0

0

Agent-Remote-Id(DSLFORUM-2)

0-1

0

0

0

0

0

RADIUS Attributes Precautions

Dynamic VLAN: If dynamic VLAN delivery is configured on the server, authorization information includes the delivered VLAN attribute. After the device receives the delivered VLAN attribute, it changes the VLAN of the user to the delivered VLAN.

The delivered VLAN does not change or affect the interface configuration. The delivered VLAN, however, takes precedence over the VLAN configured on the interface. That is, the delivered VLAN takes effect after the authentication succeeds, and the configured VLAN takes effect after the user goes offline.

The following standard RADIUS attributes are used for dynamic VLAN delivery:
  • (064) Tunnel-Type (It must be set to VLAN or 13.)
  • (065) Tunnel-Medium-Type (It must be set to 802 or 6.)
  • (081) Tunnel-Private-Group-ID (For devices running versions earlier than V200R012C00, it can be the VLAN ID or VLAN description. For devices running V200R012C00 and later versions, it can be the VLAN ID, VLAN description, VLAN name, or VLAN pool.)

To ensure that the RADIUS server delivers VLAN information correctly, all the three RADIUS attributes must be used. In addition, the Tunnel-Type and Tunnel-Medium-Type attributes must be set to the specified values.

Parent Topic: RADIUS AAA
Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >