1

User-Name

Refers to the user to be authenticated in the Access-Request. The format for IPoE/PPPoE hosts depends on configuration parameters pppoe-access-method, ppp-user-name or user-name-format in the CLI context configure subscriber-mgmt authentication-policy name. The format for ARP-hosts is not configurable and always the host IPv4-address.The RADIUS User-Name specified in an Access-Accept or CoA is reflected in the corresponding accounting messages. The attribute is included in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute user-name.

2

User-Password

The password of the user to be authenticated, or the user's input following an Access-Challenge. For PPPoE users it indirectly maps to the password provided by a PPPoE PAP user in response to the PAP Authenticate-Request. For IPoE/ARP hosts it indirectly maps to a preconfigured password (configure subscriber-mgmt authentication-policy name password password or configure aaa isa-radius-policy name password password).

3

CHAP-Password

Provided by a PPPoE CHAP user in response to the CHAP challenge. The CHAP challenge sent by the NAS to a PPPoE CHAP user is part of the CHAP authentication sequence RFC 1994, PPP Challenge Handshake Authentication Protocol (CHAP), (Challenge, Response, Success, Failure). The user generated CHAP password length is equal to the defined Limits and contains a one byte CHAP-Identifier from the user's CHAP Response followed by the CHAP Response from the user.

4

NAS-IP-Address

The identifying IP Address of the NAS requesting the Authentication or Accounting. Included when the RADIUS server is reachable via IPv4. The address is determined by the routing instance through which the RADIUS server can be reached:

“Management” — The active ipv4 address in the Boot Options File (bof address ipv4-address)

“Base” or “VPRN” — the ipv4 address of the system interface (configure router interface system address address).

The address can be overwritten with the configured source-address (configure aaa radius-server-policy policy-name servers source-address ip-address).

5

NAS-Port

The physical access-circuit on the NAS which is used for the Authentication or Accounting of the user. The format of this attribute is configurable on the NAS as a fixed 32 bit value or a parameterized 32 bit value. The parameters can be a combination of outer-vlan-id(o), inner-vlan-id(i), slot number(s), MDA number(m), port number or lag-id(p), ATM VPI(v) and ATM VCI(c), fixed bit values zero (0) or one (1) but cannot exceed 32 bit. The format can be configured for following applications: configure aaa l2tp-accounting-policy name include-radius-attribute nas-port, configure router l2tp cisco-nas-port, configure service vprn service-id l2tp cisco-nas-port, configure subscriber-mgmt authentication-policy name include-radius-attribute nas-port, configure subscriber-mgmt radius-accounting-policy name include-radius-attribute nas-port.

6

Service-Type

The type of service the PPPoE user has requested, or the type of service to be provided for the PPPoE user. Optional in RADIUS-Accept and CoA. Treated as a session setup failure if different from Framed-User.

7

Framed-Protocol

The framing to be used for framed access in case of PPPoE users. Optional in RADIUS-Accept and CoA. Treated as a session setup failure if different from PPP.

8

Framed-IP-Address

The IPv4 address to be configured for the host via DHCPv4 (radius proxy) or IPCP (PPPoE). Simultaneous returned attributes [88] Framed-Pool and [8] Framed-IP-Address (RADIUS Access-Accept) are handled as host setup failures. Attribute is also used in CoA and Disconnect Message (part of the ESM or AA user identification-key). Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no framed-ip-addr.

9

Framed-IP-Netmask

The IP netmask to be configured for the user when the user is a router to a network. For DHCPv4 users, the attribute maps to DHCPv4 option [1] Subnet mask and is mandatory if [8] Framed-IP-Address is also returned. For PPPoE residential access, the attribute should be set to 255.255.255.255 (also the default value if the attribute is omitted). For PPPoE business access, the attribute maps to PPPoE IPCP option [144] Subnet-Mask only when the user requests this option and if the node parameter configure subscriber-mgmt ppp-policy ppp-policy-name ipcp-subnet-negotiation is set. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no framed-ip-netmask.

18

Reply-Message

Text that may be displayed to the user by a PPPoE client as a success, failure or dialogue message. It is mapped to the message field from the PAP/CHAP authentication replies to the user. Omitting this attribute results in standard reply messages: login ok and login incorrect for PAP, CHAP authentication success and CHAP authentication failure for CHAP. String length greater than the defined Limits are accepted but truncated at this boundary.

22

Framed-Route

Routing information (IPv4 managed route) to be configured on the NAS for a host (dhcp, pppoe, arp) that operates as a router without NAT (so called routed subscriber host). The route included in the Framed-Route attribute is accepted as a managed route only if it's next-hop points to the hosts ip-address or if the next-hop address equals 0.0.0.0 or if the included route is a valid classful network in case the subnet-mask is omitted. If neither is applicable, this specific framed-route attribute is ignored and the host is instantiated without this specific managed route installed. A Framed-Route attribute is also ignored if the SAP does not have anti-spoof configured to nh-mac (the host will be installed as a standalone host without managed route). Number of routes above Limits are silently ignored. Optionally, a metric, tag and/or protocol preference can be specified for the managed route. If the metrics are not specified or specified in a wrong format or specified with out of range values then default values are used for all metrics: metric=0, no tag and preference=0.

If an identical managed route is associated with different routed subscriber hosts in the context of the same IES/VPRN service up to max-ecmp-routes managed routes are installed in the routing table (configured as ecmp max-ecmp-routes in the routing instance). Candidate ECMP Framed-Routes have identical prefix, equal lowest preference and equal lowest metric. The “lowest ip next-hop” is the tie breaker if more candidate ECMP Framed-Routes are available than the configured max-ecmp-routes. Other identical managed routes are shadowed (not installed in the routing table) and an event is logged. An alternative to RADIUS managed routes are managed routes via host dynamic BGP peering.

Valid RADIUS learned managed routes can be included in RADIUS accounting messages with following configuration: configure subscriber-mgmt radius-accounting-policy name include-radius-attribute framed-route. Associated managed routes for an instantiated routed subscriber host are included in RADIUS accounting messages independent of the state of the managed route (Installed, Shadowed or HostInactive).

25

Class

Attribute sent by the RADIUS server to the NAS in an Access-Accept or CoA and is sent unmodified by the NAS to the Accounting server as part of the Accounting-Request packet. Strings with a length longer than the defined Limits are accepted but truncated to this boundary.

27

Session-Timeout

Sets the maximum number of seconds of service to be provided to the user (IPoEv4/PPPoE) before termination of the session. Attribute equals to [26-6527-160] Alc-Relative-Session-Timeout when received in Access-Accept since current session time portion is than zero. Value zero sets the session-timeout to infinite (no session-timeout). The attribute is CoA NAK'd if its value is smaller than the current-session time. Simultaneous received [27] Session-Timeout and [26-6527-160] Alc-Relative-Session-Timeout are treated as a error condition (setup failure if received via Access-Accept and NAK’d if received via CoA). For IPoEv4 radius proxy and CoA create-host scenarios, [27] Session-Timeout is interpreted as lease-time instead of session-time if [26-6527-174] Alc-Lease-Time is omitted.

For wlangw group-interfaces, the interpretation of the Session-Timeout attribute is configured with: configure service ies | vprn service-id subscriber-interface ip-int-name group-interface ip-int-name wlangw ipoe-session radius-session-timeout {backwards-compatible | ignore | absolute}.

28

Idle-Timeout

Sets the maximum number of consecutive seconds of idle connection allowed to the user before termination of the session (IPoE/PPPoE) or a connectivity check is triggered (IPoE). Values outside the allowed Limits are accepted but rounded to these boundaries. A value of zero is treated as an infinite idle-timeout. The idle-timeout handling on the node is implemented via category-maps (configure subscriber-mgmt category-map category-map-name and configure subscriber-mgmt sla-profile sla-profile-name category-map category-map-name).

30

Called-Station-Id

Allows the NAS to send in an Access Request and/or Accounting Request information with respect to the user called. Attribute is omitted in authentication/accounting via: configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute no called-station-id.

Supported applications:

31

Calling-Station-Id

Allows the NAS to send unique information identifying the user who requested the service. This format is driven by configuration (configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute calling-station-id <llid | mac | remote-id | sap-id | sap-string>). The LLID (logical link identifier) is the mapping from a physical to logical identification of a subscriber line and supplied by a RADIUS llid-server. The sap-string maps to configure service ies | vprn service-id subscriber-interface ip-int-name group-interface ip-int-name sap sap-id calling-station-id sap-string. A [31] Calling-Station-Id attribute value longer than the allowed maximum is treated as a setup failure. The attribute is omitted in authentication/accounting via configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute no calling-station-id.

32

NAS-Identifier

A string (configure system name system-name) identifying the NAS originating the Authentication or Accounting requests and sent when nas-identifier is included for the corresponding application: include-radius-attribute nas-identifier in configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting).

44

Acct-Session-Id

A unique identifier that represents the subscriber host or session that is authenticated. This attribute can be used as CoA or Disconnect Message key to target the host or session and is reflected in the accounting messages for this host or session.The attribute is included/excluded based on configure subscriber-mgmt authentication-policy name include-radius-attribute acct-session-id [host | session]. For PPPoE, either the host acct-session-id (default) or the session acct-session-id is included.

60

CHAP-Challenge

The CHAP challenge sent by the NAS to a PPPoE CHAP user as part of the chap authentication sequence RFC 1994 (Challenge, Response, Success, Failure). The generated challenge length for each new pppoe session is by default a random value from 32 to 64 bytes unless configured different under configure subscriber-mgmt ppp-policy ppp-policy-name ppp-chap-challenge-length [8 to 64] or configure service vprn service-id | router l2tp group tunnel-group-name ppp chap-challenge-length [8 to 64] for LNS (the command can also be specified at the tunnel level). The CHAP challenge value is copied into the request-authenticator field of the RADIUS Access-Request message if the minimum and maximum value is configured at exact 16 (RFC 2865, Remote Authentication Dial In User Service (RADIUS), section 2.2, Interoperation with PAP and CHAP). Attribute CHAP-Password is provided by a PPPoE CHAP user in response to the [60] CHAP-challenge.

61

NAS-Port-Type

The type of the physical port of the NAS which is authenticating the user and value automatically determined from subscriber SAP encapsulation. It can be overruled by configuration. Included only if include-radius-attribute nas-port-type is added per application: configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting). Checked for correctness if returned in CoA.

The NAS-Port-Type attribute is always included when the Nas-Port-Id is also included.

85

Acct-Interim-Interval

Indicates the number of seconds between each interim update for this specific session. Attribute values outside the allowed Limits are accepted but are rounded to the minimum or maximum Limit.

87

NAS-Port-Id

A text string which identifies the physical/logical port of the NAS which is authenticating the user and/or reported for accounting. Attribute is also used in CoA and Disconnect Message (part of the user identification-key). The nas-port-id for physical ports usually contains slot/mda/port/vlan|vpi.vlan|vci. The physical port can have an optional prefix-string (max 8 chars) and suffix-string (max 64 chars) added for Authentication and Accounting (configure subscriber-mgmt radius-accounting-policy | authentication-policy name include-radius-attribute nas-port-id [prefix-string string] [suffix circuit-id|remote-id]). For logical access circuits (LNS) the nas-port-id is a fixed concatenation (delimiter #) of routing instance, tunnel-server-endpoint, tunnel-client-endpoint, local-tunnel-id, remote-tunnel-id, local-session-id, remote-session-id and call sequence number.

Included only if include-radius-attribute nas-port-id is added per application: configure subscriber-mgmt authentication-policy (ESM authentication), configure subscriber-mgmt radius-accounting-policy (ESM accounting), configure aaa isa-radius-policy (LSN accounting, WLAN-GW) and configure aaa l2tp-accounting-policy (L2TP accounting). For a capture-sap, the nas-port-id attribute is always included in authentication requests.

88

Framed-Pool

The name of one address pool or the name of a primary and secondary address pool separated with a one character configurable delimiter (configure router/service vprn service-id dhcp local-dhcp-server server-name use-pool-from-client delimiter delimiter) that should be used to assign an address for the user and maps to either:

1) dhcpv4 option [82] vendor-specific-option [9] sub-option [13] dhcpPool if option is enabled on the node (configure service ies/vprn service-id subscriber-interface ip-int-name group-interface ip-int-name dhcp option vendor-specific-option pool-name) or

2) used directly as pool-name in the local configured dhcp server when local-address-assignment is used and client-application is ppp-v4 (configure service ies/vprn service-id subscriber-interface ip-int-name group-interface ip-int-name local-address-assignment). Alternative to [26-2352-36] Ip-Address-Pool-Name and [26-4874-2] ERX-Address-Pool-Name. Framed-Pool names longer than the allowed maximum are treated as host setup failures. Simultaneous returned attributes [88] Framed-Pool and [8] Framed-IP-Address are also handled as host setup failures.

95

NAS-IPv6-Address

The identifying IP Address of the NAS requesting the Authentication or Accounting. Included when the RADIUS server is reachable via IPv6.

The address is determined by the routing instance through which the RADIUS server can be reached:

“Management” — The active ipv6 address in the Boot Options File (bof address ipv6-address).

“Base” or “VPRN” — The ipv6 address of the system interface (configure router interface system ipv6 address ipv6-address).

The address can be overwritten with the configured ipv6-source-address (configure aaa radius-server-policy policy-name servers ipv6-source-address ipv6-address).

97

Framed-IPv6-Prefix

ipv6-prefix/prefix-length to be configured via SLAAC (Router Advertisement) to the WAN side of the user. Any non /64 prefix-length for SLAAC host creation is treated as a session setup failure for this host. This attribute is an alternative to [100] Framed-IPv6-Pool and [26-6527-99] Alc-IPv6-Address, which assigns IPv6 addressing to the wan-side of a host via DHCPv6 IA-NA. Attribute is also used in CoA and Disconnect Message (part of the ESM or AA user identification-key). Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no framed-ipv6-prefix.

99

Framed-IPv6-Route

Routing information (ipv6 managed route) to be configured on the NAS for a v6 wan host (IPoE or PPPoE) that operates as a router. The functionality is comparable with offering multiple PD prefixes for a single host. The route included in the Framed-IPv6-Route attribute is accepted as a managed route only if it's next-hop is a wan-host (DHCPv6 IA-NA or SLAAC) or if the next-hop address equals ::. As a consequence, Framed-IPv6-Routes with explicit configured gateway prefix of a pd-host (DHCPv6 IA-PD) will not be installed. A Framed-Route attribute is also ignored if the SAP does not have anti-spoof configured to nh-mac (the host will be installed as a standalone host without managed route). Number of Routes above Limits are silently ignored. Optionally, a metric, tag and/or protocol preference can be specified for the managed route. If the metrics are not specified or specified in a wrong format or specified with out of range values then default values are used for all metrics: metric=0, no tag and preference=0. If an identical managed route is associated with different routed subscriber hosts in the context of the same IES/VPRN service up to max-ecmp-routes managed routes are installed in the routing table (configured as ecmp max-ecmp-routes in the routing instance). Candidate ECMP Framed-IPv6-Routes have identical prefix, equal lowest preference and equal lowest metric. “lowest ip next-hop” is the tie breaker if more candidate ECMP Framed-IPv6-Routes are available than the configured max-ecmp-routes. Other identical managed routes are shadowed (not installed in the routing table) and an event is logged. Valid RADIUS learned managed routes can be included in RADIUS accounting messages with following configuration: configure subscriber-mgmt radius-accounting-policy name include-radius-attribute framed-ipv6-route. Associated managed routes for an instantiated routed subscriber host are included in RADIUS accounting messages independent of the state of the managed route (Installed, Shadowed or HostInactive).

100

Framed-IPv6-Pool

The name of an assigned pool that should be used to assign an IPv6 address via DHCPv6 (IA-NA) to the WAN side of the user (IPoE, PPPoE). Maps to DHCPv6 vendor-option [17], sub-option [1] wan-pool. Framed-IPv6-Pool names longer than the allowed maximum are treated as host setup failures. This attribute is an alternative to [97] Framed-IPv6-Prefix and [26-6527-99] Alc-IPv6-Address, that also assigns IPv6 addressing to the wan-side of a host via SLAAC or DHCPv6 IA-NA.

101

Error-Cause

The Error-Cause Attribute provides more detail on the cause of the problem if the NAS cannot honor Disconnect-Request or CoA-Request messages for some reason. It may be included within Disconnect-ACK, Disconnect-NAK and CoA-NAK messages. The Error-Causes are divided in 5 blocks. Range [400-499] is used for fatal errors committed by the RADIUS server. Range [500-599] is used for fatal errors occurring on a NAS or RADIUS proxy. Ranges [000-199 reserved], [300-399 reserved] and [200-299 used for successful completion in disconnect-ack/coa-ack] are not implemented.

123

Delegated-IPv6-Prefix

Attribute that carries the Prefix (ipv6-prefix/prefix-length) to be delegated via DHCPv6 (IA-PD) for the LAN side of the user (IPoE, PPPoE). Maps to DHCPv6 option IA-PD [25] sub-option IA-Prefix [26] Prefix. An exact Delegated-prefix-Length [DPL] match with configure service ies | vprn service-id subscriber-interface ip-int-name ipv6 delegated-prefix-length [48 to 64] is required with the received attribute prefix-length unless a variable DPL is configured (configure service ies | vprn service-id subscriber-interface ip-int-name ipv6 delegated-prefix-length variable). In the latter case multiple hosts for the same group-interface having different prefix-length [48 to 64] per host are supported. Simultaneous returned attributes [123] Delegated-IPv6-Prefix and [26-6527-131] Alc-Delegated-IPv6-Pool are handled as host setup failures. Attribute is also used in CoA and Disconnect Message (part of the ESM or AA user identification-key). Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no delegated-ipv6-prefix.

26-2352-1

Client-DNS-Pri

The IPv4 address of the primary DNS server for this subscribers connection and maps to PPPoE IPCP option 129 Primary DNS Server address or DHCPv4 option 6 Domain Server. Is an alternative for 26-4874-4 ERX-Primary-Dns or 26-6527-9 Alc-Primary-Dns.

26-2352-2

Client-DNS-Sec

A IPv4 address of the secondary DNS server for this subscribers connection and maps to 'PPPoE IPCP option 131 Secondary DNS Server address or DHCPv4 option 6 Domain Server. Is an alternative for 26-4874-5 ERX-Secondary-Dns or 26-6527-10 Alc-Secondary-Dns.

26-2352-36

Ip-Address-Pool-Name

The name of an assigned address pool that should be used to assign an address for the user and maps to dhcpv4 option[82] vendor-specific-option [9] sub-option [13] dhcpPool if option is enabled on the node (configure service ies | vprn service-id subscriber-interface ip-int-name group-interface ip-int-name dhcp option vendor-specific-option pool-name). Alternative to [88] Pool-Name and [26-4874-2] ERX-Address-Pool-Name. Framed-Pool names longer than the allowed maximum are treated as host setup failures. Simultaneous returned attributes Pool-Names [8] and Framed-IP-Address are also handled as host setup failures.

26-2352-99

RB-Client-NBNS-Pri

The IPv4 address of the primary NetBios Name Server (NBNS) for this subscribers connection and maps to 'PPPoE IPCP option 130 Primary DNS Server address or DHCPv4 option44 NETBIOS name server. Is an alternative for 26-4874-6 ERX-Primary-Wins or 26-6527-29 Alc-Primary-Nbns.

26-2352-100

RB-Client-NBNS-Sec

The IPv4 address of the secondary NetBios Name Server (NBNS) for this subscribers connection and maps to 'PPPoE IPCP option 132 Primary DNS Server address or DHCPv4 option44 NETBIOS name server. Is an alternative for 26-4874-7 ERX-Secondary-Wins or 26-6527-30 Alc-Secondary-Nbns.

26-3561-1

Agent-Circuit-Id

Information describing the subscriber agent circuit identifier corresponding to the logical access loop port of the Access Node/DSLAM from which a subscriber's requests are initiated. Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute circuit-id.

26-3561-2

Agent-Remote-Id

An operator-specific, statically configured string that uniquely identifies the subscriber on the associated access loop of the Access Node/DSLAM. Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute remote-id.

26-3561-129

Actual-Data-Rate-Upstream

The actual upstream train rate (coded in bits per second) of a subscriber's synchronized DSL link and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-130

Actual-Data-Rate-Downstream

Actual downstream train rate (coded in bits per second) of a subscriber's synchronized DSL link and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-131

Minimum-Data-Rate-Upstream

The subscriber's operator-configured minimum upstream data rate (coded in bits per second) and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-132

Minimum-Data-Rate-Downstream

The subscriber's operator-configured minimum downstream data rate (coded in bits per second) and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-133

Attainable-Data-Rate-Upstream

The subscriber's attainable upstream data rate (coded in bits per second) and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-134

Attainable-Data-Rate-Downstream

The subscriber's attainable downstream data rate (coded in bits per second) and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-135

Maximum-Data-Rate-Upstream

The subscriber's maximum upstream data rate (coded in bits per second), as configured by the operator and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-136

Maximum-Data-Rate-Downstream

The subscriber's maximum downstream data rate (coded in bits per second), as configured by the operator and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-137

Minimum-Data-Rate-Upstream-Low-Power

The subscriber's minimum upstream data rate (coded in bits per second) in low power state, as configured by the operator and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-138

Minimum-Data-Rate-Downstream-Low-Power

The subscriber's minimum downstream data rate (coded in bits per second) in low power state, as configured by the operator and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-139

Maximum-Interleaving-Delay-Upstream

The subscriber's maximum one-way upstream interleaving delay in milliseconds, as configured by the operator and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-140

Actual-Interleaving-Delay-Upstream

The subscriber's actual one-way upstream interleaving delay in milliseconds and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-141

Maximum-Interleaving-Delay-Downstream

The subscriber’s maximum one-way downstream interleaving delay in milliseconds, as configured by the operator and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-142

Actual-Interleaving-Delay-Downstream

The subscriber's actual one-way downstream interleaving delay in milliseconds and maps to values received during PPPoE discovery (tag 0x0105) or DHCP (opt-82). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-3561-144

Access-Loop-Encapsulation

The last mile encapsulation used by the subscriber on the DSL access loop and maps to values received during PPPoE discovery Tags (tag 0x0105) or DHCP Tags (opt-82). Attribute is included/excluded in RADIUS/Accounting-Request based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options. Last mile encapsulation information can be used to adjust automatically the egress aggregate rate for this subscriber. Preconfigured encapsulation types are used if PPP/IPoE access loop information (tags) is not available (configure subscriber-mgmt sub-profile subscriber-profile-name egress encap-offset type type or configure subscriber-mgmt local-user-db local-user-db-name ppp host access-loop encap-offset type). [26-6527-133] Alc-Access-Loop-Encap-Offset when returned in Access-Accept is taken into account (overrules received tags and preconfigured encapsulation types) for ALE adjust (last mile aware shaping) but is not reflected in access-loop-options send to RADIUS. Alc-Access-Loop-Encap from ANCP are currently not taken into account for ALE adjust.

26-3561-254

IWF-Session

The presence of this Attribute indicates that the IWF has been performed with respect to the subscriber's session. IWF is utilized to enable the carriage of PPP over ATM (PPPoA) traffic over PPPoE. The Access Node inserts the PPPoE Tag 0x0105, vendor-id 0x0de9 with sub-option code 0xFE, length field is set to 0x00 into the PPPoE Discovery packets when it is performing an IWF functionality. Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-4874-2

ERX-Address-Pool-Name

The name of an assigned address pool that should be used to assign an address for the user and maps to dhcpv4 option[82] vendor-specific-option [9] sub-option [13] dhcpPool if option is enabled on the node (configure service ies | vprn service-id subscriber-interface ip-int-name group-interface ip-int-name dhcp option vendor-specific-option pool-name). Alternative to [88] Pool-Name and [26-2352-36] Ip-Address-Pool-Name. Framed-Pool names longer than the allowed maximum are treated as host setup failures. Simultaneous returned attributes Pool-Names [8] and Framed-IP-Address are also handled as host setup failures.

26-4874-4

ERX-Primary-Dns

The IPv4 address of the primary DNS server for this subscribers connection and maps to PPPoE IPCP option 129 Primary DNS Server address or DHCPv4 option 6 Domain Server. Is an alternative for 26-2352-1 Client-DNS-Pri or 26-6527-9 Alc-Primary-Dns.

Applicable in proxy scenarios only for IPoE.

26-4874-5

ERX-Secondary-Dns

The IPv4 address of the secondary DNS server for this subscribers connection and maps to PPPoE IPCP option 131 Secondary DNS Server address or DHCPv4 option 6 Domain Server. Is an alternative for 26-2352-2 Client-DNS-Sec or 26-6527-10 Alc-Secondary-Dns.

Applicable in proxy scenarios only for IPoE.

26-4874-6

ERX-Primary-Wins

The IPv4 address of the primary NetBios Name Server (NBNS) for this subscribers connection and maps to PPPoE IPCP option 130 Primary DNS Server address or DHCPv4 option44 NETBIOS name server. Is an alternative for 26-2352-99 RB-Client-NBNS-Pri or 26-6527-29 Alc-Primary-Nbns.

26-4874-7

ERX-Secondary-Wins

The IPv4 address of the secondary NetBios Name Server (NBNS) for this subscribers connection and maps to PPPoE IPCP option 132 Primary DNS Server address or DHCPv4 option44 NETBIOS name server. Is an alternative for 26-2352-100 RB-Client-NBNS-Sec or 26-6527-30 Alc-Secondary-Nbns.

26-4874-47

ERX-Ipv6-Primary-Dns

The IPv6 address of the primary DNSv6 server for this subscribers connection and maps to DNS Recursive Name Server option 23 (RFC 3646) in DHCPv6.Is an alternative for 26-6527-105 Alc-Ipv6-Primary-Dns.

Applicable in proxy scenarios only.

26-4874-48

ERX-Ipv6-Secondary-Dns

The IPv6 address of the secondary DNSv6 server for this subscribers connection and maps to DNS Recursive Name Server option 23 (RFC 3646) in DHCPv6.Is an alternative for 26-6527-106 Alc-Ipv6-Secondary-Dns.

Applicable in proxy scenarios only.

26-6527-9

Alc-Primary-Dns

The IPv4 address of the primary DNS server for this subscribers connection and maps to PPPoE IPCP option 129 Primary DNS Server address or DHCPv4 option 6 Domain Server. Is an alternative for 26-2352-1 Client-DNS-Pri or 26-4874-4 ERX-Primary-Dns.

Applicable in proxy scenarios only for IPoE.

26-6527-10

Alc-Secondary-Dns

The IPv4 address of the secondary DNS server for this subscribers connection and maps to PPPoE IPCP option 131 Secondary DNS Server address or DHCPv4 option 6 Domain Server. Is an alternative for 26-2352-2 Client-DNS-Sec or 26-4874-5 ERX-Secondary-Dns.

Applicable in proxy scenarios only for IPoE.

26-6527-11

Alc-Subsc-ID-Str

A subscriber is a collection of subscriber-hosts (typically represented by IP-MAC combination) and is uniquely identified by a subscriber string. Subscriber-hosts queues/policers belonging to the same subscriber (residing on the same forwarding complex) can be treated under one aggregate scheduling QoS mechanism. Fallback to preconfigured values if attribute is omitted. Attribute values longer than the allowed string value are treated as setup failures. Can be used as key in CoA and Disconnect Message. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no subscriber-id.

26-6527-12

Alc-Subsc-Prof-Str

The subscriber profile is a template which contains settings (accounting, igmp, HQoS,...) which are applicable to all hosts belonging to the same subscriber were [26-6527-12] Alc-Subsc-Prof-Str is the string that maps (configure subscriber-mgmt sub-ident-policy sub-ident-policy-name sub-profile-map) to such an subscriber profile (configure subscriber-mgmt sub-profile subscriber-profile-name). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (string does not map to a policy) are silently ignored and a fallback to preconfigured defaults is done. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no sub-profile.

26-6527-13

Alc-SLA-Prof-Str

The SLA profile is a template which contains settings (filter, QoS, host-limit...) which are applicable to individual hosts were [26-6527-13] Alc-SLA-Prof-Str is the string that maps (configure subscriber-mgmt sub-ident-policy sub-ident-policy-name sla-profile-map) to such a sla profile (configure subscriber-mgmt sla-profile sla-profile-name). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (string does not map to a policy) are silently ignored and a fallback to preconfigured defaults is done. Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no sla-profile.

26-6527-16

Alc-ANCP-Str

Information describing the subscriber agent circuit identifier corresponding to the logical access loop port of the Access Node/DSLAM from which a subscriber's requests are initiated and used to associate the ANCP Circuit-Id (info received via ANCP Port Up and Port Down) with the PPPoE/IPoE Circuit-Id (info received via [26-6527-16] Alc-ANCP-Str and [26-3561-1] Agent-Circuit-Id). A subscriber is ANCP associated when both strings are equal and for associated subscribers the ingress/egress ANCP QoS rules apply (configure subscriber-mgmt ancp ancp-policy policy-name and configure subscriber-mgmt sub-profile ancp ancp-policy policy-name.

26-6527-18

Alc-Default-Router

Maps to dhcp offer/ack message option [3] default-router for a dhcpv4 radius proxy scenario and defines the default gateway for the user. This attribute is silently ignored if the NAS is doing dhcpv4 relay. In the latter case the default-router is part of the dhcpv4 server configuration.

26-6527-27

Alc-Client-Hardware-Addr

MAC address from a user that requests a service and included in CoA, Authentication or Accounting (configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute mac-address).

26-6527-28

Alc-Int-Dest-Id-Str

A string representing an aggregation point (example, Access Node) and interpreted as the intermediate destination id. Subscribers connected to the same aggregation point should get the same int-dest-id string assigned. The int-dest-id is used in mc-ring access redundancy to identify subscribers behind a ring node (configure redundancy multi-chassis peer ip-address mc-ring ring/l3-ring name ring-node ring-node-name). The int-dest-id can be used in QoS to shape the egress traffic of a group of subscribers to an aggregate rate using vports (configure port port-id ethernet access egress vport name host-match dest destination-string) or secondary shapers on HS-MDAv2 (configure port port-id ethernet egress exp-secondary-shaper secondary-shaper-name). For egress policed subscriber traffic, the int-dest-id can be used to select the egress queue-group for forwarding (configure port port-id ethernet access egress queue-group name host-match dest destination-string). Strings longer than the allowed maximum are treated as setup failures.

26-6527-29

Alc-Primary-Nbns

The IPv4 address of the primary NetBios Name Server (NBNS) for this subscribers connection and maps to PPPoE IPCP option 130 Primary DNS Server address or DHCPv4 option44 NETBIOS name server. Is an alternative for 26-2352-99 RB-Client-NBNS-Pri or 26-4874-6 ERX-Primary-Wins.

26-6527-30

Alc-Secondary-Nbns

The IPv4 address of the secondary NetBios Name Server (NBNS) for this subscribers connection and maps to PPPoE IPCP option 132 Primary DNS Server address or DHCPv4 option44 NETBIOS name server. Is an alternative for 26-2352-100 RB-Client-NBNS-Sec or 26-4874-7 ERX-Secondary-Wins.

26-6527-34

Alc-PPPoE-PADO-Delay

Specifies the number in deciseconds that the PPPoE protocol stack on the NAS waits before sending a PADO packet in response to a PADI request. In dual homed topologies, you may want to designate a primary NAS and a backup NAS for handling a particular service request. In such a scenario, you can configure a delay for the backup NAS to allow sufficient time for the primary NAS to respond to the client with a PADO packet. If the primary NAS does not send the PADO packet within this delay period, then the backup NAS sends the PADO packet after the delay period expires. This attribute is only applicable if RADIUS PADI authentication is used (configure subscriber-mgmt authentication-policy name pppoe-access-method padi). Values above the allowed Limits are truncated at the Limits boundary. There is no PADO delay if the attribute is omitted or if the attribute is received with a value of zero.

26-6527-35

Alc-PPPoE-Service-Name

Maps to PADI field PPPoE tags [0x0101] service-name and is sent in the Access-Request if enabled under configure subscriber-mgmt authentication-policy name include-radius-attribute pppoe-service-name. A PPPoE-Service-Name above the allowed maximum length is handled as a PPPoE session setup failure.

26-6527-36

Alc-DHCP-Vendor-Class-Id

Initiated by DHCP clients via option [60] Vendor Class Identifier and reflected in Authentication. (configure subscriber-mgmt authentication-policy name include-radius-attribute dhcp-vendor-class-id or configure aaa isa-radius-policy name auth-include-attributes dhcp-vendor-class-id). DHCP option [60] Vendor Class Identifier can also be used as User-name in RADIUS requests. (configure subscriber-mgmt authentication-policy name user-name-format dhcp-client-vendor-opts).

26-6527-45

Alc-App-Prof-Str

Application Assurance for residential, business or transit-AA subscribers is enabled through the assignment of an application profile as part of either enhanced subscriber management or static configuration. [26-6527-45] Alc-App-Prof-Str is a string that maps (configure subscriber-mgmt sub-ident-policy sub-ident-policy-name app-profile-map) to such an application profile (configure application-assurance group aa-group-id:partition-id policy app-profile app-profile-name). This attribute is used in access-accept (to assign an application profile during esm host creation) and CoA (to change the application profile of a AA-subscriber or to create transit AA-subscriber). Strings longer than the allowed maximum are treated as setup failures. Unreferenced strings (strings not mapping to an application profile) will silently trigger a fallback to preconfigured default values if allowed. If no default value is preconfigured, the subscriber's application profile is silently disabled for esm AA-subscriber; in case of a transit AA-subscriber creation the CoA will be rejected. The change of an application profile to one configured under a different group/partition or the modification of the application profile of a static AA-subscriber is not allowed and will be treated as setup failures.

26-6527-99

Alc-Ipv6-Address

The IPv6 address to be configured to the WAN side of the user (IPoE,PPPoE) via DHCPv6 (IA-NA). Maps to DHCPv6 option IA-NA[3] sub-option IA-Address[5] address. This attribute is an alternative to [97] Framed-IPv6-Prefix and [100] Framed-IPv6-Pool, which also assigns IPv6 addressing to the wan-side of a host via SLAAC or DHCPv6 IA-NA. Attribute is also used in CoA and Disconnect Message (part of the ESM or AA user identification-key).

For data-triggered authentication of an IPv6 UE in Distributed Subscriber Management (DSM) context, this attribute contains the IPv6 address that triggered the request. Inclusion of this attribute is configured under configure aaa isa-radius-policy policy-name auth-include-attributes ipv6-address.

26-6527-102

Alc-ToServer-Dhcp-Options

Send to RADIUS all DHCPv4 options received in a DHCPv4 message triggering authentication. The dhcpv4 options are concatenated in the attribute up to maximum length per attribute (see limits). If more space is needed, an additional attribute is included. If the total dhcp options space requires more than the total maximum length (see limits), then no attributes are included. (configure subscriber-mgmt authentication-policy name include-radius-attribute dhcp-options, or configure aaa isa-radius-policy name auth-include-attributes dhcp-options).

26-6527-103

Alc-ToClient-Dhcp-Options

Copy the content of the attribute value in dhcpv4 options for dhcpv4 messages towards the client. It is not required to send each option in a different VSA; concatenation is allowed. Only the attributes within the defined limits (see limits) are parsed and stored; the remaining attributes are silently ignored.

26-6527-105

Alc-Ipv6-Primary-Dns

The IPv6 address of the primary DNSv6 server for this subscribers connection and maps to DNS Recursive Name Server option 23 (RFC 3646) in DHCPv6. This attribute is an alternative for [26-4874-47] ERX-Ipv6-Primary-Dns.

Applicable in proxy scenarios only.

26-6527-106

Alc-Ipv6-Secondary-Dns

The IPv6 address of the secondary DNSv6 server for this subscribers connection and maps to DNS Recursive Name Server option 23' (RFC 3646) in DHCPv6. This attribute is an alternative for [26-4874-48] ERX-Ipv6-Secondary-Dns.

Applicable in proxy scenarios only.

26-6527-126

Alc-Subscriber-QoS-Override

Used to override queue/policer parameters (CIR, PIR, CBS, MBS) and HQoS parameters (aggregate rate, scheduler rate or root arbiter rate) configured at sla-profile and sub-profile level. Enables per subscriber/host customization. Each set of Alc-Subscriber-QoS-Override attributes in a RADIUS message replaces the set of Alc-Subscriber-QoS-Override attributes from a previous message. Hence the sla-profile and sub-profile QoS configuration is always used as the base config. To undo a previously enabled RADIUS QoS-override and return to the base config, send a CoA with at least one Alc-Subscriber-QoS-Override attribute. The value part of each Alc-Subscriber-QoS-Override attribute must be empty (Example, Alc-Subscriber-QoS-Override += i:q:2:). Wrong formatted attributes or too many attributes (see limits) are treated as a setup failure or result in a CoA NAK.

26-6527-128

Alc-ATM-Ingress-TD-Profile

The ATM Traffic Descriptor override for a PPPoA or PPPoEoA host and refers to the preconfigured traffic description QoS profile applied on the ingress ATM Virtual Circuit (configure qos atm-td-profile traffic-desc-profile-id). All subscriber hosts on a given ATM VC must have same ATM traffic descriptors and this attribute is ignored if it specifies an ATM Traffic Descriptor override while it has already specified another one for another host on the same ATM Virtual Circuit. A preconfigured description profile per ATM Virtual Circuit is used when this attribute is omitted. (configure subscriber-mgmt msap-policy msap-policy-name atm egress/ingress traffic-desc or configure service vprn service-id subscriber-interface ip-int-name group-interface ip-int-name sap sap-id atm egress/ingress traffic-desc). A Traffic Descriptor profile above the Limit is treated as a setup failure. Unreferenced Traffic Descriptor profiles within the Limit, or a Traffic Descriptor profile for a non ATM host are silently ignored.

26-6527-129

Alc-ATM-Egress-TD-Profile

The ATM Traffic Descriptor override for a PPPoA or PPPoEoA host and refers to the preconfigured traffic description QoS profile applied on the egress ATM Virtual Circuit (configure qos atm-td-profile traffic-desc-profile-id). All subscriber hosts on a given ATM VC must have same ATM traffic descriptors and this attribute is ignored if it specifies an ATM Traffic Descriptor override while it has already specified another one for another host on the same ATM Virtual Circuit. A preconfigured description profile per ATM Virtual Circuit is used when this attribute is omitted (configure subscriber-mgmt msap-policy atm egress/ingress traffic-desc or configure service vprn service-id subscriber-interface ip-int-name group-interface ip-int-name sap sap-id atm egress/ingress traffic-desc). A Traffic Descriptor profile above the Limits is treated as a setup failure. Unreferenced Traffic Descriptor profiles within the Limits, or a Traffic Descriptor profile for a non ATM host are silently ignored.

26-6527-131

Alc-Delegated-IPv6-Pool

The name of an assigned pool that should be used to assign an IPv6 prefix via DHCPv6(IA-PD) to the LAN side of the user (IPoE, PPPoE). Maps to DHCPv6 vendor-option[17],sub-option[2] pfx-pool. Alc-Delegated-ipv6-pool names longer than the allowed maximum are treated as host setup failures. Alternative method for [123] Delegated-IPv6-Prefix so simultaneous returned attributes [123] Delegated-IPv6-Prefix and [26-6527-131] Alc-Delegated-IPv6-Pool are handled as host setup failures. The length information [DPL] can be supplied via [26-6527-161] Alc-Delegated-IPv6-Prefix-Length along with the pool name. The [26-6527-161] Alc-Delegated-IPv6-Prefix-Length has priority over other possible sources of DPL. (As a fixed [48 to 64] DPL or variable DPL under configure service ies | vprn service-id subscriber-interface ipv6 delegated-prefix-length or on the dhcpv6 server configure router dhcp6 local-dhcp-server server-name pool pool-name delegated-prefix-length).

26-6527-132

Alc-Access-Loop-Rate-Down

The actual downstream rate (coded in kbits per second) of a PPPoE subscriber's synchronized DSL link and competes with the value received from alternative sources (dsl-forum tags, ludb, ancp). Values outside the Limits are treated as setup failures. Attribute is silently ignored for None-MLPPP sessions or IPoE sessions.

26-6527-133

Alc-Access-Loop-Encap-Offset

The last mile encapsulation representing the subscribers DSL access loop encapsulation and when returned in RADIUS-Accept (PTA or LAC) is taken into account for ALE adjust (last mile aware shaping) but not reflected in [26-3561-144] Access-Loop-Encapsulation (access-loop-options) send to Accounting. For LAC this attributes maps to LTP AVP [3561-144] Access-Loop-Encapsulation.

26-6527-135

Alc-PPP-Force-IPv6CP

Forces IPv6CP negotiation in conditions where no IPv6 related attributes (such as v6 pool, v6 prefix, v6 address, dnsv6) are obtained via authentication (Access Accept, local user database, etc.). Without these IPv6 related attributes, the NAS cannot detect that this is a dual-stack pppoe user and therefore it will not start IPv6CP negotiation.

An attribute value other from 0 (zero) forces IPv6CP negotiation to start when no IPv6 attributes are obtained in authentication.

An attribute value of 0 (zero) is treated the same as not sending the attribute.

26-6527-136

Alc-Onetime-Http-Redirection-Filter-Id

The preconfigured ipv4 filter with http-redirection rules. Via this host specific filter only the first HTTP request from the host will be redirected to a configured URL with specified parameters. There is no HTTP redirection for subsequent HTTP requests. Useful in cases where service providers need to push a web page of advertisement/announcements to broadband users.

26-6527-160

Alc-Relative-Session-Timeout

Sets or resets the IPoE/PPPoE session timeout to a relative value (current session time + newly received Alc-Relative-Session-Timeout). Attribute equals to [27] Session-Timeout if received in Access-Accept since current session time portion is than zero. Value zero sets/resets the session-timeout to infinite (no session-timeout). Simultaneous received [27] Session-Timeout and [26-6527-160] Alc-Relative-Session-Timeout are treated as a setup failure (setup failure if received in Access-Accept or CoA rejected (NAK) with error cause = Invalid Request).

26-6527-161

Alc-Delegated-IPv6-Prefix-Length

Defines the IA-PD length information [DPL] and only applicable together with [26-6527-131] Alc-Delegated-IPv6-Pool (silently ignored if received in RADIUS Accept without Alc-Delegated-IPv6-Pool). Maps to DHCPv6 vendor-option[17], sub-option[3] pfx-len. The [26-6527-161] Alc-Delegated-IPv6-Prefix-Length has priority over other possible sources of DPL. (As a fixed [48 to 64] DPL or variable DPL under configure service ies |vprn service-id subscriber-interface ip-int-name ipv6 delegated-prefix-length or on the dhcpv6 server configure router dhcp6 local-dhcp-server server-name pool pool-name delegated-prefix-length). DPL values outside the limits are treated as setup failures.

26-6527-174

Alc-Lease-Time

Defines the lease-time in seconds for RADIUS proxy and create-host-CoA scenarios only. The [27] Session-Timeout is interpreted and used as IPoE lease-time if [26-6527-174] Alc-lease-Time is omitted. Returning attribute [26-6527-174] Alc-Lease-Time in other scenarios than radius-proxy and create-host-CoA are treated as setup failures.

26-6527-175

Alc-DSL-Line-State

Status of the DSL line obtained via ANCP can be one of three value: SHOWTIME (the modem is ready to transfer data), IDLE (line is idle) or SILENT (line is silent). Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-6527-176

Alc-DSL-Type

Type of the DSL line (ADSL1, ADSL2, ADSL2PLUS, VDSL1, VDSL2, SDSL, other) obtained via ANCP.

Attribute is included/excluded based on configure subscriber-mgmt authentication-policy/radius-accounting-policy name include-radius-attribute access-loop-options.

26-6527-177

Alc-Portal-Url

The URL to which traffic matching the host’s IPv4 filter entry with http-redirect action is redirected to. The URL overrides the configured URL in the redirect filter. Radius overrides must explicitly be enabled: configure filter ip-filter filter-id entry entry-id action http-redirect rdr-url-string allow-radius-override.

26-6527-178

Alc-Ipv6-Portal-Url

The URL to which traffic matching the host’s IPv6 filter entry with http-redirect action is redirected to. The URL overrides the configured URL in the redirect filter. RADIUS overrides must explicitly be enabled: configure filter ipv6-filter filter-id entry entry-id action http-redirect rdr-url-string allow-radius-override.

26-6527-180

Alc-SAP-Session-Index

Per SAP unique PPPoE or IPoE session index that can be included in RADIUS Access Request messages. The lowest free index is assigned to a new PPPoE or IPoE session. Attribute is included or excluded based on configure subscriber-mgmt authentication-policy name include-radius-attribute sap-session-index.

26-6527-181

Alc-SLAAC-IPv6-Pool

A pool name that can be used in local address assignment to assign an IPv6 SLAAC prefix via a Router Advertisement to the WAN side of the IPoE/PPPoE user.

Alc-SLAAC-IPv6-Pool names longer than the allowed maximum are treated as host setup failures. If local-address-assignment is not enabled on the group-interface for ipv6 client-application ppp-slaac, then the PPP session will be terminated. If local-address-assignment is not enabled on the group-interface for ipv6 client-application ipoe-slaac, then the IPoE host will not be instantiated.

26-6527-183

Alc-WPP-Error-Code

This attribute specifies the value of the ErrCode that the system should use in a WPP ACK_AUTH packet. This attribute can only be included in a Radius Access-Reject packet.

26-6527-185

Alc-Onetime-Http-Redirect-Reactivate

An indication to reactivate a onetime http redirect filter for the host.

When received in a RADIUS CoA message, the filter with the value indicated by [26-6527-136] Alc-Onetime-Http-Redirection-Filter-Id is activated.

If [26-6527-136] Alc-Onetime-Http-Redirection-Filter-Id contains the value 0, then the existing onetime http redirect filter id associated with the host is removed.

If no [26-6527-136] Alc-Onetime-Http-Redirection-Filter-Id VSA is provided in the RADIUS CoA message, then the existing onetime http redirect filter id associated with the host is applied.

The value of the [26-6527-185] Alc-Onetime-Http-Redirect-Reactivate VSA is opaque. It is the presence of the VSA in a RADIUS CoA that triggers the action.

26-6527-191

Alc-ToServer-Dhcp6-Options

This attribute contains DHCPv6 client options present in a DHCPv6 Solicit or Request message to be passed to RADIUS in an Access-Request. Up to two attributes are included in the Access-Request message when the length of the DHCPv6 options exceeds the maximum length of a single attribute. No attributes are included if the total length of the DHCPv6 options exceeds 494 bytes (see Limits section).

When the DHCPv6 solicit or request message is encapsulated in a Relay-Forward message, only the inner DHCPv6 client options are copied in the Alc-ToServer-Dhcp6-Options attribute. Options inserted by a Relay Agent are ignored.

Attribute is included/excluded based on configure subscriber-mgmt authentication-policy name include-radius-attribute dhcp6-options.

For DHCPv6 triggered authentication in a Distribute Subscriber Management (DSM) context, this attribute contains the DHCPv6 client options as sent to the WLAN-GW. Inclusion of this attribute is configured via configure aaa isa-radius-policy policy-name auth-include-attributes dhcp6-options.

26-6527-192

Alc-ToClient-Dhcp6-Options

The value of this attribute represents DHCPv6 options encoded in a hexadecimal format. DHCPv6 options originated by Radius are appended to the options already present in the DHCPv6 Advertise and Reply messages towards the client.

Passing the RADIUS obtained DHCPv6 options to the client is supported for both DHCPv6 proxy and relay.

Only the attributes within the defined limits (see limits) are parsed and stored; the remaining attributes are silently ignored.

26-6527-200

Alc-v6-Preferred-Lifetime

IPv6 address/prefix preferred lifetime is the length of time that a valid address/prefix is preferred (i.e., the time until deprecation). When the preferred lifetime expires, the address/prefix becomes deprecated (can still be used in existing communications but should not be used as source in new communications).

This attribute is applicable only when an IPv6 address/prefix is assigned via Radius (DHCPv6 proxy). Overrides the dhcp6 proxy-server preferred-lifetime configuration on the group-interface.

The attribute value is expressed in seconds. Values outside the allowed range (see limits) result in a setup failure.

If for the final determined values from the different sources (ludb, radius, defaults), the following rule is violated:

renew timer <= rebind timer <= preferred lifetime <= valid lifetime

then the default timers are used: renew-timer = 30 min, rebind-timer = 48 min, preferred-lifetime = 1hr, valid-lifetime = 1 day.

Note that only a single value can be specified that applies to both IA-NA address and IA-PD prefix.

26-6527-201

Alc-v6-Valid-Lifetime

IPv6 address/prefix valid lifetime is the length of time an address/prefix remains in the valid state (i.e., the time until invalidation). When the valid lifetime expires, the address/prefix becomes invalid and must no longer be used in communications. Used as DHCPv6 lease time.

This attribute is applicable only when an IPv6 address/prefix is assigned via Radius (DHCPv6 proxy). Overrides the dhcp6 proxy-server valid-lifetime configuration on the group-interface.

The attribute value is expressed in seconds. Values outside the allowed range (see limits) result in a setup failure.

If for the final determined values from the different sources (ludb, radius, defaults), the following rule is violated:

renew timer <= rebind timer <= preferred lifetime <= valid lifetime

then the default timers are used: renew-timer = 30 min, rebind-timer = 48 min, preferred-lifetime = 1hr, valid-lifetime = 1 day.

Note that only a single value can be specified that applies to both IA-NA address and IA-PD prefix.

26-6527-202

Alc-Dhcp6-Renew-Time

The attribute value represents the DHCPv6 lease renew time (T1). T1 is the time at which the client contacts the addressing authority to extend the lifetimes of the DHCPv6 leases (addresses/prefixes).

This attribute is applicable only when an IPv6 address/prefix is assigned via Radius (DHCPv6 proxy). Overrides the dhcp6 proxy-server renew-timer configuration on the group-interface.

The attribute value is expressed in seconds. Values outside the allowed range (see limits) result in a setup failure.

If for the final determined values from the different sources (ludb, radius, defaults), the following rule is violated:

renew timer <= rebind timer <= preferred lifetime <= valid lifetime

then the default timers are used: renew-timer = 30 min, rebind-timer = 48 min, preferred-lifetime = 1hr, valid-lifetime = 1 day.

Note that only a single value can be specified that applies to both IA-NA address and IA-PD prefix.

26-6527-203

Alc-Dhcp6-Rebind-Time

The attribute value represents the DHCPv6 lease rebind time (T2). T2 is the time at which the client contacts any available addressing authority to extend the lifetimes of DHCPv6 leases.

This attribute is applicable only when an IPv6 address/prefix is assigned via Radius (DHCPv6 proxy). Overrides the dhcp6 proxy-server rebind-timer configuration on the group-interface

The attribute value is expressed in seconds. Values outside the allowed range (see limits) result in a setup failure.

If for the final determined values from the different sources (ludb, radius, defaults), the following rule is violated:

renew timer <= rebind timer <= preferred lifetime <= valid lifetime

then the default timers are used: renew-timer = 30 min, rebind-timer = 48 min, preferred-lifetime = 1hr, valid-lifetime = 1 day.

Note that only a single value can be specified that applies to both IA-NA address and IA-PD prefix.

26-6527-217

Alc-UPnP-Sub-Override-Policy

Specifies the UPnP policy to use for this l2aware subscriber. The policy must be configured in configure service upnp upnp-policy policy-name.

Overrides the configured policy in the sub-profile for the subscriber: configure subscriber-mgmt sub-profile name upnp-policy policy-name.

The value “_tmnx_no_override” removes any existing override and installs the upnp-policy configured in the sub-profile instead.

The value “_tmnx_disabled” creates a special override that disables UPnP for this subscriber.

Specifying a non-existing policy results in a host/session setup failure or in a CoA Reject.

All hosts belonging to the subscriber are affected by a UPnP policy override.

Changing the upnp-policy will clear all existing upnp-mappings.

26-6527-228

Alc-Trigger-Acct-Interim

When included in a CoA message an accounting interim update is generated for all accounting modes that have interim-updates enabled. The Alc-Trigger-Acct-Interim attribute with free formatted string value is echoed in the CoA triggered accounting interim update message. The [26-6527-163] Alc-Acct-Triggered- Reason attribute in the interim update is set to 18 (CoA-Triggered).

1

User-Name

string

253 chars

Form depends on authentication method and configuration.

Example: User-Name user1@domain1.com

2

User-Password

string

64 Bytes

Encrypted password

Example: User-Password 4ec1b7bea6f2892fa466b461c6accc00

3

CHAP-Password

octets

16+1 Bytes

Users CHAP identifier 1 followed by the Encrypted password

Example: CHAP-Password 01ef8ddc7237f4adcd991ac4c277d312e9

4

NAS-IP-Address

ipaddr

4 Bytes

# ipv4 address

Example: NAS-IP-Address=192.0.2.1

5

NAS-Port

integer

4 Bytes

nas-port <binary-spec>

<binary-spec> = <bit-specification> <binary-spec>

<bit-specification> = 0 | 1 | <bit-origin>

<bit-origin> = *<number-of-bits><origin>

<number-of-bits> = [1 to 32]

<origin> = o (outer VLAN ID), i (inner VLAN ID), s (slot number), m (MDA number), p (port number or lag-id), v (ATM VPI), c (ATM VCI)

Example: # configured nas-port *12o*10i*3s*2m*5p for SAP 2/2/4:221.7 corresponds to 000011011101 0000000111 010 10 00100

NAS-Port = 231742788

6

Service-Type

integer

2 (mandatory value)

PPPoE and PPPoL2TP hosts only

Example: Service-Type = Framed-User

7

Framed-Protocol

integer

1 (fixed value)

PPPoE and PPPoL2TP hosts only

Example: Service-Type = PPP

8

Framed-IP-Address

ipaddr

4 Bytes

Example: # ip-address 10.11.12.13

Framed-IP-Address 0a0b0c0d

9

Framed-IP-Netmask

ipaddr

4 Bytes

Example: Framed-IP-Netmask = 255.255.255.255 #PPPoE residential

Framed-IP-Netmask = 255.255.255.0 #PPPoE Business with IPCP option 144 support

Framed-IP-Netmask = 255.255.255.0 # IPoE

18

Reply-Message

string

253 chars

Example: Reply-Message MyCustomizedReplyMessage

22

Framed-Route

string

max 16 Framed-Routes attributes

"<ip-prefix>[/<prefix-length>] <space> <gateway-address> [<space> <metric>] [<space> tag <space> <tag-value>] [<space> pref <space> <preference-value>]"

where:

<space> is a white space or blank character

<ip-prefix>[/prefix-length] is the managed route to be associated with the routed subscriber host. The prefix-length is optional and if not specified, a class-full class A,B or C subnet is assumed.

<gateway-address> must be the routed subscriber host IP address. “0.0.0.0” is automatically interpreted as the host IPv4 address.

[<metric>] (Optional) Installed in the routing table as the metric of the managed route. If not specified, metric zero is used. Value = [0 to 65535]

[tag <tag-value>] (Optional) The managed route will be tagged for use in routing policies. If not specified or tag-value=0, then the route is not tagged. Value = [0 to 4294967295]

[pref <preference-value>] (Optional) Installed in the routing table as protocol preference for this managed route. If not specified, preference zero is used. Value = [0 to 255]

Example:

Framed-Route = "192.168.1.0/24 0.0.0.0" where 0.0.0.0 is replaced by host address. Default metrics are used (metric=0, preference=0 and no tag)

Framed-Route = "192.168.1.0 0.0.0.0" where 192.168.1.0 is a class-C network /24 and 0.0.0.0 is replaced host address. Default metrics are used.

Framed-Route = "192.168.1.0/24 192.168.1.1" where 192.168.1.1 is the host address. Default metrics are used.

Framed-Route = "192.168.1.0 0.0.0.0 10 tag 3 pref 100" installs a managed route with metric=10, protocol preference = 100 and tagged with tag=3

25

Class

octets

Up to 6 attributes. Max. value length for each attribute is 253 chars.

Example:

Class += My Class1

Class += MyClass2

27

Session-Timeout

integer

[0 to 2147483647]

seconds

# 0 = infinite (no session-timeout)

# [0 to 2147483647] in seconds

Example: Session-Timeout = 3600

28

Idle-Timeout

integer

[60 to 15552000] seconds

# 0 = infinite (no idle-timeout)

# [60 to 15552000] in seconds

Example: Idle-Timeout = 3600

30

Called-Station-Id

string

64 chars

# LNS: L2TP Called Number AVP21 from LAC

Example: Called-Station-Id = 4441212

31

Calling-Station-Id

string

64 chars

# llid | mac | remote-id | sap-id | sap-string (64 char. string configured at sap-level)

Example: include-radius-attribute calling-station-id sap-id

Calling-Station-Id = 1/1/2:1.1

32

NAS-Identifier

string

32 chars

Example: NAS-Identifier = PE1-Antwerp

44

Acct-Session-Id

string

22 bytes

Internally generated 22 bytes number.

Example:

Acct-Session-Id = 241AFF0000003250B5F750

60

CHAP-Challenge

octets

[8 to 64] Bytes

random length

Example: 20 bytes CHAP-Challenge 0xa9710d2386c3e1771b8a3ea3d4e53f2a1c7024fb

61

NAS-Port-Type

integer

4 Bytes

Values [0 to 255]

Values as defined in rfc-2865 and rfc-4603

For LNS, the value is set to virtual (5)

Example: NAS-Port-Type = PPPoEoQinQ (34)

85

Acct-Interim-Interval

integer

4 Bytes

[300 to 15552000] seconds

Example: # 1 hour interval for interim updates

Acct-Interim-Interval = 3600

87

NAS-Port-Id

string

253 Bytes in Access-Request and Accounting Request messages.

128 Bytes in CoA

Ethernet:

"<prefix> <space> <slot>/<mda>/<port>:<vlan>.<vlan> <space> <suffix>"

ATM:

"<prefix> <space> <slot>/<mda>/<port>:<vpi>.<vci> <space> <suffix>"

LNS:

"LNS rt-<routing instance>

#lip-<tunnel-server-endpoint>

#rip-<tunnel-client-endpoint>

#ltid-<local-tunnel-id>

#rtid-<remote-tunnel-id>

#lsid-<local-session-id>

#rsid-<remote-session-id>

#<call sequence number>"

<prefix>: optional string: 8 chars max

<suffix>: optional string: remote-id (max 64 chars)

| circuit-id (max 64 chars)

Example:

NAS-Port-Id = 1/1/4:501.1001

NAS-Port-Id = LNS rtr-2#lip-3.3.3.3#rip-1.1.1.1#ltid-11381#rtid-1285#lsid-30067#rsid-19151#347

88

Framed-Pool

string

32 chars. per pool name

65 chars. in total (primary pool, delimiter, secondary pool)

Example:

Framed-Pool = "MyPoolname"

Framed-Pool = "Pool-1#Pool-2"

95

NAS-IPv6-Address

ipv6addr

16 Bytes

# ipv6 address

Example: NAS-IPv6-Address = 2001:db8::1

97

Framed-IPv6-Prefix

ipv6prefix

max. 16 Bytes for prefix + 1 byte for length

PPPoE SLAAC wan-host

<ipv6-prefix/prefix-length> with prefix-length 64

Example: Framed-IPv6-Prefix 2021:1:FFF3:1::/64

99

Framed-IPv6-Route

string

max. 16 Framed-IPv6-Route attributes

"<ip-prefix>/<prefix-length> <space> <gateway-address> [<space> <metric>] [<space> tag <space> <tag-value>] [<space> pref <space> <preference-value>]"

where:

<space> is a white space or blank character

<ip-prefix>/<prefix-length> is the managed route to be associated with the routed subscriber host.

<gateway-address> must be the routed subscriber host IP address. “::” and “0:0:0:0:0:0:0:0” are automatically interpreted as the wan-host IPv6 address.

[<metric>] (Optional) Installed in the routing table as the metric of the managed route. If not specified, metric zero is used. Value = [0 to 65535]

[tag <tag-value>] (Optional) The managed route will be tagged for use in routing policies. If not specified or tag-value=0, then the route is not tagged. Value = [0 to 4294967295]

[pref <preference-value>] (Optional) Installed in the routing table as protocol preference for this managed route. If not specified, preference zero is used. Value = [0 to 255]

99 (continued)

Framed-IPv6-Route

string

max. 16 Framed-IPv6-Route attributes

Example:

Framed-IPv6-Route = "5000:0:1::/48 ::" where :: resolves in the wan-host. Default metrics are used (metric=0, preference=0 and no tag)

Framed-IPv6-Route = "5000:0:2::/48 0:0:0:0:0:0:0:0" where 0:0:0:0:0:0:0:0 resolves in the wan-host. Default metrics are used.

Framed-IPv6-Route = "5000:0:3::/48 0::0" where 0::0 resolves in the wan-host. Default metrics are used.

Framed-IPv6-Route = "5000:0:3::/48 2021:1::1" where 2021:1::1 is the wan-host. Default metrics are used.

Framed-IPv6-Route = "5000:0:1::/48 :: 10 tag 3 pref 100" installs a managed route with metric = 10, protocol preference = 100 and tagged with tag = 3

Framed-IPv6-Route = "5000:0:1::/48 :: tag 5" installs a managed route with metric = 0 (default), protocol preference = 0 (default) and tagged with tag = 5

100

Framed-IPv6-Pool

string

32 chars

Example: Framed-IPv6-Pool MyWanPoolnameIANA

101

Error-Cause

octets

4 Bytes

Current supported causes are: Missing Attribute[402], NAS Identification Mismatch[403], Invalid Request[404], Unsupported Service[405], Invalid Attribute Value[407], Administratively Prohibited [501], Session Context Not Found [503], Resources Unavailable[506]

Example: Error-Cause = Invalid Request

123

Delegated-IPv6-Prefix

ipv6prefix

max. 16 Bytes for prefix + 1 Byte for length

<ipv6-prefix/prefix-length> with prefix-length [48 to 64]

Example: Delegated-IPv6-Prefix 2001:DB8:173A:100::/56

26-2352-1

Client-DNS-Pri

ipaddr

4 Bytes

Example: Client-DNS-Pri = 9.1.1.1

26-2352-2

Client-DNS-Sec

ipaddr

4 Bytes

Example: Client-DNS-Sec = 9.1.1.2

26-2352-36

Ip-Address-Pool-Name

string

65 chars

Example: Ip-Address-Pool-Name = Address_Pool_1

26-2352-99

RB-Client-NBNS-Pri

ipaddr

4 Bytes

Example: RB-Client-NBNS-Pri = 9.1.1.1

26-2352-100

RB-Client-NBNS-Sec

ipaddr

4 Bytes

Example: RB-Client-NBNS-Sec = 9.1.1.2

26-3561-1

Agent-Circuit-Id

string

247 chars

format see also RFC4679

# ATM/DSL <Access-Node-Identifier><atm slot/port:vpi.vci>

# Ethernet/DSL <Access-Node-Identifier><eth slot/port[:vlan-id]>

Example: ethernet dslam1 slot 2 port 1 vlan 100 Agent-Circuit-Id = dslam1 eth 2/1:100

26-3561-2

Agent-Remote-Id

string

247 chars

Format see also RFC4679

Example: Agent-Remote-Id = MyRemoteId

26-3561-129

Actual-Data-Rate-Upstream

integer

4294967295 bps

Example: # 1Mbps

Actual-Data-Rate-Upstream = 1000000

26-3561-130

Actual-Data-Rate-Downstream

integer

4294967295 bps

Example: # 5Mbps

Actual-Data-Rate-Downstream = 5000000

26-3561-131

Minimum-Data-Rate-Upstream

integer

4294967295 bps

Example: Minimum-Data-Rate-Upstream = 1000

26-3561-132

Minimum-Data-Rate-Downstream

integer

4294967295 bps

Example: Minimum-Data-Rate-Downstream = 1000

26-3561-133

Attainable-Data-Rate-Upstream

integer

4294967295 bps

Example: Attainable-Data-Rate-Downstream = 1000

26-3561-134

Attainable-Data-Rate-Downstream

integer

4294967295 bps

Example: Minimum-Data-Rate-Upstream = 1000

26-3561-135

Maximum-Data-Rate-Upstream

integer

4294967295 bps

Example: Maximum-Data-Rate-Upstream = 1000

26-3561-136

Maximum-Data-Rate-Downstream

integer

4294967295 bps

Example: Maximum-Data-Rate-Downstream = 1000

26-3561-137

Minimum-Data-Rate-Upstream-Low-Power

integer

4294967295 bps

Example: Minimum-Data-Rate-Upstream-Low-Power = 1000

26-3561-138

Minimum-Data-Rate-Downstream-Low-Power

integer

4294967295 bps

Example: Minimum-Data-Rate-Downstream-Low-Power = 1000

26-3561-139

Maximum-Interleaving-Delay-Upstream

integer

4294967295 milliseconds

Example: Maximum-Interleaving-Delay-Upstream = 10

26-3561-140

Actual-Interleaving-Delay-Upstream

integer

4294967295 milliseconds

Example: Actual-Interleaving-Delay-Upstream = 10

26-3561-141

Maximum-Interleaving-Delay-Downstream

integer

4294967295 milliseconds

Example: Maximum-Interleaving-Delay-Downstream = 10

26-3561-142

Actual-Interleaving-Delay-Downstream

integer

4294967295 milliseconds

Example: Actual-Interleaving-Delay-Downstream = 10

26-3561-144

Access-Loop-Encapsulation

octets

3 Bytes

<Data Link><Encaps-1><Encaps-2>

<Data Link>: AAL5(1), Ethernet(2)

<Encaps 1>: NotAvailable(0), Untagged Ethernet(1), Single-Tagged Ethernet(2)

<Encaps 2>: Not Available(0), PPPoA LLC(1), PPPoA Null(2), IPoA LLC(3), IPoA Null(4), Ethernet over AAL5 LLC w FCS(5), Ethernet over AAL5 LLC w/o FCS(6), Ethernet over AAL5 Null w FCS(7), Ethernet over AAL5 Null w/o FCS(8)

Example: Ethernet, Single-Tagged Ethernet,Ethernet over AAL5 LLC w FCS

Access-Loop-Encapsulation = 020205

26-3561-254

IWF-Session

octets

len 0

Example: IWF-Session

26-4874-2

ERX-Address-Pool-Name

string

65 chars

Example: ERX-Address-Pool-Name = MyPoolname

26-4874-4

ERX-Primary-Dns

ipadress

4 Bytes

Example: ERX-Primary-Dns = 9.1.1.1

26-4874-5

ERX-Secondary-Dns

ipadress

4 Bytes

Example: ERX-Secondary-Dns = 9.1.1.2

26-4874-6

ERX-Primary-Wins

ipadress

4 Bytes

Example: ERX-Primary-Wins = 9.1.1.1

26-4874-7

ERX-Secondary-Wins

ipadress

4 Bytes

Example: ERX-Ipv6-Primary-Dns = 9.1.1.2

26-4874-47

ERX-Ipv6-Primary-Dns

ipv6addr

16 Bytes

Example: ERX-Secondary-Wins = 4000::1:1:1:1

26-4874-48

ERX-Ipv6-Secondary-Dns

ipv6addr

16 Bytes

Example: ERX-Ipv6-Secondary-Dns = 4000::1:1:1:2

26-6527-9

Alc-Primary-Dns

ipaddr

4 Bytes

Example: Alc-Primary-Dns = 9.1.1.1

26-6527-10

Alc-Secondary-Dns

ipaddr

4 Bytes

Example: Alc-Secondary-Dns = 9.1.1.2

26-6527-11

Alc-Subsc-ID-Str

string

32 chars

Example: Alc-Subsc-ID-Str = MySubscriberId

26-6527-12

Alc-Subsc-Prof-Str

string

16 chars

Example: Alc-Subsc-Prof-Str = MySubProfile

26-6527-13

Alc-SLA-Prof-Str

string

16 chars

Example: Alc-SLA-Prof-Str = MySlaProfile

26-6527-16

Alc-ANCP-Str

string

63 chars

format see also RFC4679

# ATM/DSL <Access-Node-Identifier><atm slot/port:vpi.vci>

# Ethernet/DSL <Access-Node-Identifier><eth slot/port[:vlan-id]>

Example: If [26-3561-1] Agent-Circuit-Id = dslam1 eth 2/1:100 then put Alc-ANCP-Str = dslam1 eth 2/1:100

26-6527-18

Alc-Default-Router

ipaddr

4 Bytes

Example: Alc-Default-Router = 185.2.255.254

26-6527-27

Alc-Client-Hardware-Addr

string

6 Bytes

Example: Alc-Client-Hardware-Addr = 00:00:00:00:00:01

26-6527-28

Alc-Int-Dest-Id-Str

string

32 chars

Example: Alc-Int-Dest-Id-Str= AccessNode1

26-6527-29

Alc-Primary-Nbns

ipaddr

4 Bytes

Example: Alc-Primary-Nbns = 9.1.1.1

26-6527-30

Alc-Secondary-Nbns

ipaddr

4 Bytes

Example: Alc-Secondary-Nbns = 9.1.1.2

26-6527-34

Alc-PPPoE-PADO-Delay

integer

[0 to 30] deci-seconds

Example: 3 seconds pado-delay

Alc-PPPoE-PADO-Delay = 30

26-6527-35

Alc-PPPoE-Service-Name

string

247 chars

Example: Alc-PPPoE-Service-Name = MyServiceName

26-6527-36

Alc-DHCP-Vendor-Class-Id

string

247 chars

Example: Alc-DHCP-Vendor-Class-Id = My-DHCP-VendorClassId

26-6527-45

Alc-App-Prof-Str

string

16 bytes

Example: Alc-App-Prof-Str = MyAppProfile

26-6527-99

Alc-Ipv6-Address

ipv6addr

16 Bytes

Example: Alc-Ipv6-Address 2021:1:FFF5::1

26-6527-102

Alc-ToServer-Dhcp-Options

octets

2 attributes

247 Bytes/attribute

494 Bytes total

Example: DHCPv4 Discover , option-60 [Class-identifier-option] = DHCP-VendorClassId ; Agent-Circuit-Id = circuit10;Agent-Remote-Id = remote10

Alc-ToServer-Dhcp-Options = 66313501013c12444843502d56656e646f72436c617373496452150109636972637569743130020872656d6f74653130

26-6527-103

Alc-ToClient-Dhcp-Options

octets

8 attributes

247 Bytes/attribute

494 Bytes total

Example: Insert DHCP Option 121, length=7, 16.192.168 10.1.255.254

# Classless Static Route: 192.168.0.0/16 10.1.255.254

Alc-ToClient-Dhcp-Options = 0x790710C0A80A01FFFE

26-6527-105

Alc-Ipv6-Primary-Dns

ipv6addr

16 Bytes

Example: Alc-Ipv6-Primary-Dns = 4000::1:1:1:2

26-6527-106

Alc-Ipv6-Secondary-Dns

ipv6addr

16 Bytes

Example: Alc-Ipv6-Secondary-Dns = 4000::1:1:1:2

26-6527-126

Alc-Subscriber-

QoS-Override

string

18 attributes

<direction>:<QoS object>:[<id or name>:][<parameter>=value,...]

<direction> = i or I for ingress

<direction> = e or E for egress

<QoS object> = q or Q for queue overrides

<QoS object> = p or P for policer overrides

<QoS object> = r or R for egress aggregate-rate overrides

<QoS object> = a or A for root arbiter overrides

<QoS object> = s or S for scheduler overrides

< id or name> = identifies the QoS object, example queue-id

<parameter>=value,... = a comma separated list of parameters to override with the corresponding value.

[iIeE]:[qQ]:<queue-id>:(pir|cir|mbs|cbs|wrr_weight)

[iIeE]:[pP]:<policer-id>:(pir|cir|mbs|cbs)

[eE]:[rR]:(rate)

[iIeE]:[aA]:root:(rate)

[iIeE]:[sS]:<scheduler-name>:(rate|cir)

pir, cir and rate values must be specified in kilobits per second (kbps)mbs and cbs values must be specified in bytes

Remark: wrr_weight is egress queues [1 to 4] hsmdsv2 only

Example: ingress queue 1 pir,cir,mbs,cbs and egress aggregate rate overrides

Alc-Subscriber-QoS-Override += i:q:1:pir=40000,cir=20000,mbs=32000,cbs=16000,

Alc-Subscriber-QoS-Override += e:r:rate=800000

26-6527-128

Alc-ATM-Ingress-TD-Profile

integer

[1 to 1000] id

Example: Alc-ATM-Ingress-TD-Profile = 10

26-6527-129

Alc-ATM-Egress-TD-Profile

integer

[1 to 1000] id

Example: Alc-ATM-Egress-TD-Profile = 10

26-6527-131

Alc-Delegated-IPv6-Pool

string

32 chars

Example: Alc-Delegated-IPv6-Pool = MyLanPoolnameIAPD

26-6527-132

Alc-Access-Loop-Rate-Down

integer

[1 to 100000] kbps

Example: rate 4Mbps

Alc-Access-Loop-Rate-Down = 4000

26-6527-133

Alc-Access-Loop-Encap-Offset

octets

3 bytes

<Data Link><Encaps-1><Encaps-2>

<Data Link>: AAL5(0), Ethernet(1)

<Encaps 1>: NotAvailable(0), Untagged Ethernet(1), Single-Tagged Ethernet(2)

<Encaps 2>: Not Available(0), PPPoA LLC(1), PPPoA Null(2), IPoA LLC(3), IPoA Null(4), Ethernet over AAL5 LLC w FCS(5), Ethernet over AAL5 LLC w/o FCS(6), Ethernet over AAL5 Null w FCS(7), Ethernet over AAL5 Null w/o FCS(8)

Example: # pppoe-tagged -> 01,02,00

Alc-Access-Loop-Encap-Offset = 0x010200

# pppoeoa-llc -> 00,01,06

Alc-Access-Loop-Encap-Offset = 0x000106

# pppoa-llc -> 00 00 01

Alc-Access-Loop-Encap-Offset = 0x000001

26-6527-135

Alc-PPP-Force-IPv6CP

integer

[0 to 4294967295]

0 : False - start IPv6CP negotiation only when IPv6 attributes are obtained in authentication

>0 : True - also start IPv6CP negotiation when no IPv6 attributes are obtained in authentication

Example: Alc-PPP-Force-IPv6CP = 1

26-6527-136

Alc-Onetime-Http-Redirection-Filter-Id

string

249 Bytes

“Ingr-v4:<number>”

[1 to 65535] = apply this filter-id as one-time-http-redirect-filter

0 = Remove the current redirection filter and replace it with sla-profile ingress filter

Example: Alc-Onetime-Http-Redirection-Filter-Id = Ingr-v4:1000

26-6527-160

Alc-Relative-Session-Timeout

integer

[0 to 2147483647] seconds

0 = infinite (no session-timeout)

[0 to 2147483647] in seconds

Example: Alc-Relative-Session-Timeout = 3600

26-6527-161

Alc-Delegated-IPv6-Prefix-Length

integer

[48 to 64] DPL length

Example: Alc-Delegated-IPv6-Prefix-Length = 48

26-6527-174

Alc-Lease-Time

integer

[0 to 4294967295] seconds

0 : fallback to the default lease-time of 7 days.

The maximum value 4294967295 corresponds with a lease-time > 9999 days (24855d 03h).

[1 to 4294967295] lease-time in seconds

Example: Alc-Lease-Time = 3600

26-6527-175

Alc-DSL-Line-State

integer

4 Bytes

1=showtime, 2-idle, 3=silent

Example:

Alc-DSL-Line-State = SHOWTIME

26-6527-176

Alc-DSL-Type

integer

4 Bytes

0=other, 1=ADSL1, 2=ADSL2, 3=ADSL2PLUS, 4=VDSL1, 5=VDSL2, 6=SDSL

Example:

Alc-DSL-Type = VDSL2

26-6527-177

Alc-Portal-Url

string

247 chars

Example:

Alc-Portal-Url = “http://portal.com/welcome?sub=$SUB”

26-6527-178

Alc-Ipv6-Portal-Url

string

247 chars

Example:

Alc-IPv6-Portal-Url = “http://portal.com/welcome?sub=$SUB”

26-6527-180

Alc-SAP-Session-Index

integer

4 Bytes

Example:

Alc-SAP-Session-Index = 5

26-6527-181

Alc-SLAAC-IPv6-Pool

string

32 chars

Example

Alc-SLAAC-IPv6-Pool = "MySlaacPoolname"

26-6527-183

Alc-WPP-Error-Code

integer

4 Bytes

A non-zero unsigned integer. Valid values are 1, 2 or 4

26-6527-185

Alc-Onetime-Http-Redirect-Reactivate

string

247 chars

The value of the attribute is opaque. Its presence in a RADIUS CoA triggers the action.

26-6527-191

Alc-ToServer-Dhcp6-Options

octets

2 attributes

247 Bytes/

attribute

494 Bytes total

Example, when the DHCPv6 solicit contains following options:

Option : ELAPSED_TIME (8), Length : 2

Time : 0 seconds

Option : CLIENTID (1), Length : 10

LL : HwTyp=0001,LL=005100000002

00030001005100000002

Option : ORO (6), Length : 4

Requested Option : IA_NA (3)

Requested Option : IA_PD (25)

Option : IA_NA (3), Length : 12

IAID : 0

Time1: 0 seconds

Time2: 0 seconds

Option : IA_PD (25), Length : 12

IAID : 1

Time1: 0 seconds

Time2: 0 seconds

Alc-ToServer-Dhcp6-Options = 0x0008000200000001000a0003000100510000000200060004000300190003000c0000000000000000000000000019000c000000010000000000000000

26-6527-192

Alc-ToClient-Dhcp6-Options

octets

8 attributes

247 Bytes/

attribute

494 Bytes total

Example, to insert following option:

Option: Simple Network Time Protocol Server (31)

Length: 32

Value:

SNTP servers address: 2001:db8:cafe:1::1

SNTP servers address: 2001:db8:cafe:2::1

Alc-ToClient-Dhcp6-Options = 0x001F002020010DB8CAFE0001000000000000000120010DB8CAFE00020000000000000001

26-6527-200

Alc-v6-Preferred-Lifetime

integer

[300 to 315446399] seconds

Example:

Alc-v6-Preferred-Lifetime = 3600

26-6527-201

Alc-v6-Valid-Lifetime

integer

[300 to 315446399] seconds

Example:

Alc-v6-Valid-Lifetime = 86400

26-6527-202

Alc-Dhcp6-Renew-Time

integer

[0 to 604800] seconds

Example:

Alc-Dhcp6-Renew-Time = 1800

26-6527-203

Alc-Dhcp6-Rebind-Time

integer

[0 to 1209600] seconds

Example:

Alc-Dhcp6-Rebind-Time = 2880

26-6527-217

Alc-UPnP-Sub-Override-Policy

string

32 chars

UPnP policy name or special values “_tmnx_no_override” or “_tmnx_disabled”.

Example:

Alc-UPnP-Sub-Override-Policy = “my-UPnP-policy”

26-6527-228

Alc-Trigger-Acct-Interim

string

247 chars

Free formatted string that is echoed in the triggered interim update message.

Example:

Alc-Trigger-Acct-Interim = "CoA - Filter update"

1

User-Name

1

0-1

0-1

2

User-Password

0-1

0

0

3

CHAP-Password

0-1

0

0

4

NAS-IP-Address

0-1

0

0

5

NAS-Port

0-1

0

0

6

Service-Type

0-1

0-1

0-1

7

Framed-Protocol

0-1

0-1

0-1

8

Framed-IP-Address

0

0-1

0-1

9

Framed-IP-Netmask

0

0-1

0

18

Reply-Message

0

0-1

0

22

Framed-Route

0

0+

0

25

Class

0

0+

0+

27

Session-Timeout

0

0-1

0-1

28

Idle-Timeout

0

0-1

0-1

30

Called-Station-Id

0-1

0

0-1

31

Calling-Station-Id

0-1

0-1

0-1

32

NAS-Identifier

0-1

0

0

44

Acct-Session-Id

0-1

0

0-1

60

CHAP-Challenge

0-1

0

0

61

NAS-Port-Type

0-1

0

0-1

85

Acct-Interim-Interval

0

0-1

0-1

87

NAS-Port-Id

0-1

0

0-1

88

Framed-Pool

0

0-1

0

95

NAS-IPv6-Address

0-1

0

0

97

Framed-IPv6-Prefix

0

0-1

0-1

99

Framed-IPv6-Route

0

0+

0

100

Framed-IPv6-Pool

0

0-1

0

101

Error-Cause

0

0

0-1

123

Delegated-IPv6-Prefix

0

0-1

0-1

26-2352-1

Client-DNS-Pri

0

0-1

0

26-2352-2

Client-DNS-Sec

0

0-1

0

26-2352-36

Ip-Address-Pool-Name

0

0-1

0

26-2352-99

RB-Client-NBNS-Pri

0

0-1

0

26-2352-100

RB-Client-NBNS-Sec

0

0-1

0

26-3561-1

Agent-Circuit-Id

0-1

0

0

26-3561-2

Agent-Remote-Id

0-1

0

0

26-3561-129

Actual-Data-Rate-Upstream

0-1

0

0

26-3561-130

Actual-Data-Rate-Downstream

0-1

0

0

26-3561-131

Minimum-Data-Rate-Upstream

0-1

0

0

26-3561-132

Minimum-Data-Rate-Downstream

0-1

0

0

26-3561-133

Attainable-Data-Rate-Upstream

0-1

0

0

26-3561-134

Attainable-Data-Rate-Downstream

0-1

0

0

26-3561-135

Maximum-Data-Rate-Upstream

0-1

0

0

26-3561-136

Maximum-Data-Rate-Downstream

0-1

0

0

26-3561-137

Minimum-Data-Rate-Upstream-Low-Power

0-1

0

0

26-3561-138

Minimum-Data-Rate-Downstream-Low-Power

0-1

0

0

26-3561-139

Maximum-Interleaving-Delay-Upstream

0-1

0

0

26-3561-140

Actual-Interleaving-Delay-Upstream

0-1

0

0

26-3561-141

Maximum-Interleaving-Delay-Downstream

0-1

0

0

26-3561-142

Actual-Interleaving-Delay-Downstream

0-1

0

0

26-3561-144

Access-Loop-Encapsulation

0-1

0

0

26-3561-254

IWF-Session

0-1

0-1

0

26-4874-2

ERX-Address-Pool-Name

0

0-1

0

26-4874-4

ERX-Primary-Dns

0

0-1

0

26-4874-5

ERX-Secondary-Dns

0

0-1

0

26-4874-6

ERX-Primary-Wins

0

0-1

0

26-4874-7

ERX-Secondary-Wins

0

0-1

0

26-4874-47

ERX-Ipv6-Primary-Dns

0

0-1

0-1

26-4874-48

ERX-Ipv6-Secondary-Dns

0

0-1

0-1

26-6527-9

Alc-Primary-Dns

0

0-1

0

26-6527-10

Alc-Secondary-Dns

0

0-1

0

26-6527-11

Alc-Subsc-ID-Str

0

0-1

0-1

26-6527-12

Alc-Subsc-Prof-Str

0

0-1

0-1

26-6527-13

Alc-SLA-Prof-Str

0

0-1

0-1

26-6527-16

Alc-ANCP-Str

0

0-1

0-1

26-6527-18

Alc-Default-Router

0

0-1

0

26-6527-27

Alc-Client-Hardware-Addr

0-1

0-1

0-1

26-6527-28

Alc-Int-Dest-Id-Str

0

0-1

0-1

26-6527-29

Alc-Primary-Nbns

0

0-1

0

26-6527-30

Alc-Secondary-Nbns

0

0-1

0

26-6527-34

Alc-PPPoE-PADO-Delay

0

0-1

0

26-6527-35

Alc-PPPoE-Service-Name

0-1

0

0

26-6527-36

Alc-DHCP-Vendor-Class-Id

0-1

0

0

26-6527-45

Alc-App-Prof-Str

0

0-1

0-1

26-6527-99

Alc-Ipv6-Address

0

0-1

0-1

26-6527-102

Alc-ToServer-Dhcp-Options

0+

0

0

26-6527-103

Alc-ToClient-Dhcp-Options

0

0+

0

26-6527-105

Alc-Ipv6-Primary-Dns

0

0-1

0-1

26-6527-106

Alc-Ipv6-Secondary-Dns

0

0-1

0-1

26-6527-126

Alc-Subscriber-QoS-Override

0

0-1

0-1

26-6527-128

Alc-ATM-Ingress-TD-Profile

0

0-1

0

26-6527-129

Alc-ATM-Egress-TD-Profile

0

0-1

0

26-6527-131

Alc-Delegated-IPv6-Pool

0

0-1

0

26-6527-132

Alc-Access-Loop-Rate-Down

0

0-1

0-1

26-6527-133

Alc-Access-Loop-Encap-Offset

0

0-1

0

26-6527-135

Alc-PPP-Force-IPv6CP

0

0-1

0

26-6527-136

Alc-Onetime-Http-Redirection-Filter-Id

0

0-1

0-1

26-6527-160

Alc-Relative-Session-Timeout

0

0-1

0-1

26-6527-161

Alc-Delegated-IPv6-Prefix-Length

0

0-1

0

26-6527-174

Alc-Lease-Time

0

0-1

0

26-6527-175

Alc-DSL-Line-State

0-1

0

0

26-6527-176

Alc-DSL-Type

0-1

0

0

26-6527-177

Alc-Portal-Url

0

0-1

0-1

26-6527-178

Alc-Ipv6-Portal-Url

0

0-1

0-1

26-6527-180

Alc-SAP-Session-Index

0-1

0

0

26-6527-181

Alc-SLAAC-IPv6-Pool

0

0-1

0

26-6527-183

Alc-WPP-Error-Code

0

0

(Access-Reject only)

0

26-6527-185

Alc-Onetime-Http-Redirect-Reactivate

0

0

0-1

26-6527-191

Alc-ToServer-Dhcp6-Options

0+

0

0

26-6527-192

Alc-ToClient-Dhcp6-Options

0

0+

0

26-6527-200

Alc-v6-Preferred-Lifetime

0

0-1

0

26-6527-201

Alc-v6-Valid-Lifetime

0

0-1

0

26-6527-202

Alc-Dhcp6-Renew-Time

0

0-1

0

26-6527-203

Alc-Dhcp6-Rebind-Time

0

0-1

0

26-6527-217

Alc-UPnP-Sub-Override-Policy

0

0-1

0-1

26-6527-228

Alc-Trigger-Acct-Interim

0

0

0-1

26-6527-17

Alc-Retail-Serv-Id

The service ID of the retailer to which this subscriber host belongs. (configure service ies | vprn retail-service-id subscriber-interface retail-interface-name fwd-service wholesale-service-id fwd-subscriber-interface wholesale-interface-name). Returning an IES service ID for an IPoEv4 host is treated as a session setup failure.

This attribute must be included together with NAS-Port-Id and an IP-address/prefix attribute in a CoA targeting a subscriber host in a retail service.

26-6527-31

Alc-MSAP-Serv-Id

The service ID where Managed SAPs are created. (configure service ies/vprn service-id). If this attribute is omitted, use msap defaults created under ludb or capture VPLS. (configure subscriber-mgmt local-user-db local-user-db-name ppp/ipoe host msap-defaults service service-id or configure service vpls service-id sap sap-id msap-defaults service service-id). This omitted attribute without explicit created msap-defaults is treated as a setup failure.

26-6527-32

Alc-MSAP-Policy

Managed sap policy-name used to create Managed SAPs and refers to the CLI context configure subscriber-mgmt msap-policy msap-policy-name). The policy contains similar parameters that would be configured for a regular subscriber SAP. If this attribute is omitted the msap defaults configured in the ludb or capture-sap will be used. (configure subscriber-mgmt local-user-db ppp/ipoe host host-name msap-defaults policy msap-policy-name or configure service vpls service-id sap sap-id msap-defaults policy msap-policy-name).This omitted attribute without explicit created msap-defaults is treated as a setup failure.

26-6527-33

Alc-MSAP-Interface

The group-interface-name where Managed SAPs are created and refers to CLI context configure service ies | vprn service -id subscriber-interface ip-int-name group-interface ip-int-name. If this attribute is omitted the msap defaults configured in the ludb or capture-sap will be used. (configure subscriber-mgmt local-user-db local-user-db-name ppp/ipoe host host-name msap-defaults group-interface ip-int-name or configure service vpls service-id sap sap-id msap-defaults group-interface ip-int-name). Strings above the Limits and an omitted attribute without explicit created msap-defaults are treated as setup failures.

26-6527-17

Alc-Retail-Serv-Id

integer

2147483647 id

Example: Alc-Retail-Serv-Id = 10

26-6527-31

Alc-MSAP-Serv-Id

integer

2147483647 id

Example: Alc-MSAP-Serv-Id = 20

26-6527-32

Alc-MSAP-Policy

string

32 chars

Policy may start with a letter or number

Example: Alc-MSAP-Policy = 1-Policy-business

26-6527-33

Alc-MSAP-Interface

string

32 chars

Interface-name must start with a letter

Example: Alc-MSAP-Interface = group-1

26-6527-17

Alc-Retail-Serv-Id

0

0-1

0-1

26-6527-31

Alc-MSAP-Serv-Id

0

0-1

0

26-6527-32

Alc-MSAP-Policy

0

0-1

0

26-6527-33

Alc-MSAP-Interface

0

0-1

0

64

Tunnel-Type

The tunneling protocol(s) to be used (in the case of a tunnel initiator) or the tunneling protocol in use (in the case of a tunnel terminator). This attribute is mandatory on LAC Access-Accept and needs to be L2TP. The same attribute is included on LNS in the Access-Request and Acct-Request if the CLI RADIUS policy include-radius-attribute tunnel-server-attrs is enabled on a 7750 SR LNS. For L2TP Tunnel/Link Accounting this attribute is always included on LAC and LNS.

65

Tunnel-Medium-Type

The transport medium to use when creating a tunnel for those protocols (such as L2TP) that can operate over multiple transports. This attribute is mandatory on LAC Access-Accept and needs to be IP or 'IPv4.The same attribute is included on LNS in the Access-Request and Acct-Request if the CLI RADIUS policy include-radius-attribute tunnel-server-attrs is enabled on a 7750 SR LNS. For L2TP Tunnel/Link Accounting this attribute is always included on LAC and LNS.

66

Tunnel-Client-Endpoint

The dotted-decimal IP address of the initiator end of the tunnel. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp local-address). If omitted in Access Accept on LAC and no local-address configured, then the address is taken from the interface with name system. This attribute is included on LNS in the Access-Request and Acct-Request only if the CLI RADIUS policy include-radius-attribute tunnel-server-attrs is enabled on a 7750 SR LNS. For L2TP Tunnel/Link Accounting this attribute is always included on LAC and LNS as untagged.

67

Tunnel-Server-Endpoint

The dotted-decimal IP address of the server end of the tunnel is also on the LAC the dest-ip for all L2TP packets for that tunnel.

To support more than 31 tunnels in a single Radius Access-Accept message, multiple Tunnel-Server-Endpoint attributes with the same tag can be inserted. All tunnels specified by Tunnel-Sever-Endpoint attributes with a given tag will use the tunnel parameters specified by the other Tunnel attributes having the same tag value.

69

Tunnel-Password

A shared, salt encrypted, secret used for tunnel authentication and AVP-hiding. The usage of tunnel-authentication is indicated by attribute [26-6527-97] Alc-Tunnel-Challenge and the usage of AVP-hiding is indicated by attribute [26-6527-54] Alc-Tunnel-AVP-Hiding. The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp password). There is no default password. Received passwords longer than the maximum chars limit are truncated at maximum chars limit.

81

Tunnel-Private-Group-ID

The group ID for a particular tunneled session. This RADIUS attribute is copied by a 7750 SR LAC in AVP 37 - Private Group ID (ICCN) and is used by the LAC to indicate that this call is to be associated with a particular customer group. The 7750 SR LNS ignores AVP 37 when received from LAC. The value with tag 0 is used as default for the tunnels where the value is not specified. String lengths above the maximum value are treated as setup failures.

82

Tunnel-Assignment-ID

Indicates to the tunnel initiator the particular tunnel to which a session is to be assigned. Some tunneling protocols, such as PPTP and L2TP, allow for sessions between the same two tunnel endpoints to be multiplexed over the same tunnel and also for a given session to utilize its own dedicated tunnel. Tag-0 Tunnel-Assignment-ID:0 string, has a special meaning and the string becomes the Tunnel-group name that can hold up to maximum 31 tunnels with the name Tunnel-Assignment-ID-[1 to 31] string. A Tunnel-group with the name default_radius_group is created on the LAC when this attribute with tag-0 is omitted. This attribute is not the same as attribute 26-4874-64 ERX-Tunnel-Group or 26-6527-46 Alc-Tunnel-Group since these attributes both refer to a tunnel-group name created in CLI context. When not specified, the default value for Tunnel-Assignment-ID-[1 to 31] string is unnamed. String lengths above the limits are treated as a setup failure.

83

Tunnel-Preference

Indicates the relative preference assigned to each tunnel if more than one set of tunneling attributes is returned by the RADIUS server to the tunnel initiator. 0x0 (zero) being the lowest and 0x0FFFFFF(16777215) being the highest numerical value. The tunnel having the numerically lowest value in the Value field of this Attribute is given the highest preference. Other tunnel selection criteria are used if preference values from different tunnels are equal. Preference 50 is used when attribute is omitted. Values above the Limits wrap around by Freeradius before send to the NAS (start again from zero until the Limits).

90

Tunnel-Client-Auth-ID

Used during the authentication phase of tunnel establishment and copied by the LAC in L2TP SCCRQ AVP 7 Host Name. Reported in L2TP Tunnel/Link accounting when length is different from zero. The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when the attribute is omitted (configure router/service vprn service-id l2tp local-name). The Node system-name is copied in AVP Host Name if this attribute is omitted and no local-name is configured.

91

Tunnel-Server-Auth-ID

Used during the authentication phase of tunnel establishment and reported in L2TP Tunnel/Link accounting when length is different from zero. For authentication the value of this attribute is compared with the value of AVP 7 Host Name from the received LNS SCCRP. Authentication from LAC point of view passes if both attributes are the same. This authentication check is not performed if the RADIUS attribute is omitted.

26-2352-21

Tunnel-Max-sessions

The maximum number of sessions allowed per Tunnel-Group (untagged attribute only). This attribute has the same function as attribute 26-6527-48 Alc-Tunnel-Max-Sessions:0. No sessions are setup above the Limits. Preconfigured values (configure router/service vprn service-id l2tp session-limit) are used when attribute is omitted.

26-4874-33

ERX-Tunnel-Maximum-Sessions

The maximum number of sessions allowed per Tunnel-Group (untagged attribute only).This attribute has the same meaning as attribute 26-6527-48 Alc-Tunnel-Max-Sessions:0. No sessions are setup above the Limits. Preconfigured values (configure router/service vprn service-id l2tp session-limit) are used when attribute is omitted.

26-4874-64

ERX-Tunnel-Group

The name of the tunnel group that refers to the CLI created tunnel-group-name context.(configure router/service vprn service-id l2tp group tunnel-group-name). Any other RADIUS returned L2TP parameter is ignored and other required info to setup the tunnel will have to come from the CLI created context. Strings above the Limits are treated as a setup failure.

26-6527-46

Alc-Tunnel-Group

The tunnel-group-name that refers to the CLI created tunnel-group-name context.(configure router/service vprn service-id l2tp group tunnel-group-name). Any other RADIUS returned L2TP parameter is ignored and other required info to setup the tunnel will have to come from the CLI created context. Strings above the Limits are treated as a setup failure.

26-6527-47

Alc-Tunnel-Algorithm

Describes how new sessions are assigned (weighted-access, weighted-random or existing-first) to one of the set of suitable tunnels that are available or could be made available. A preconfigured algorithm (configure router/service vprn service-id l2tp session-assign-method) is used when this attribute is omitted.

Attribute value existing-first specifies that the first suitable tunnel is used or set up for the first session and re-used for all subsequent sessions.

The weighted-access attribute value (session-assign-method weighted) specifies that the sessions are equally distributed over the available tunnels; new tunnels are set up until the maximum number is reached; the distribution aims at an equal ratio of the actual number of sessions to the maximum number of sessions. When there are multiple tunnels with an equal number of sessions (equal weight), LAC selects the first tunnel from the candidate list.

The weighted-random attribute value enhances the weighted-access algorithm such that when there are multiple tunnels with an equal number of sessions (equal weight), LAC randomly selects a tunnel.

The maximum number of sessions per tunnel is retrieved via attribute 26-6527-48 Alc-Tunnel-Max-Sessions or set to a preconfigured value if Alc-Tunnel-Max-Sessions is omitted. Values outside the limits are treated as a setup failure.

26-6527-48

Alc-Tunnel-Max-Sessions

The maximum number of sessions allowed per Tunnel (if tag is 1 to 31) or per Tunnel-Group (if tag is 0).This attribute has the same meaning as attribute 26-2352-21 Tunnel-Max-sessions and 26-4874-33 ERX-Tunnel-Maximum-Sessions with the only difference that these latter attributes refers to the Tunnel-Group only (untagged attributed). No sessions are setup above the Limits. Preconfigured values (configure router/service vprn service-id l2tp session-limit) are used when attribute is omitted.

26-6527-49

Alc-Tunnel-Idle-Timeout

The period of time in seconds that an established tunnel with no active sessions (Established-Idle) persists before being disconnected. The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp idle-timeout). The tunnel is not disconnected (infinite) without local configured idle-timeout or if the attribute has value -1 (16777215). Values above Limits are treated as setup failures.

26-6527-50

Alc-Tunnel-Hello-Interval

The time interval in seconds between two consecutive tunnel Hello messages. A value of '-1' specifies that the keepalive function is disabled. The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp hello-interval). Values outside Limits are treated as a setup failure.

26-6527-51

Alc-Tunnel-Destruct-Timeout

The time in seconds that operational data of a disconnected tunnel will persist on the node before being removed. Availability of the data after tunnel disconnection allows better troubleshooting. The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp destruct-timeout). Values outside Limits are treated as a setup failure.

26-6527-52

Alc-Tunnel-Max-Retries-Estab

The number of retries allowed for established tunnels before their control connection goes down. An exponential backoff mechanism is used for the retransmission interval: the first retransmission occurs after 1 second, the next after 2 seconds, then 4 seconds up to a maximum interval of 8 seconds (1,2,4,8,8,8,8). The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp max-retries-estab). Values outside Limits are treated as a setup failure.

26-6527-53

Alc-Tunnel-Max-Retries-Not-Estab

The number of retries allowed for unestablished tunnels before their control connection goes down. An exponential backoff mechanism is used for the retransmission interval: the first retransmission occurs after 1 second, the next after 2 seconds, then 4 seconds up to a maximum interval of 8 seconds (1,2,4,8,8,8,8). The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp max-retries-not-estab). Values outside Limits are treated as a setup failure.

26-6527-54

Alc-Tunnel-AVP-Hiding

Identifies the hiding of data in the Attribute Value field of an L2TP AVP. The H bit in the header of each L2TP AVP provides a mechanism to indicate to the receiving peer whether the contents of the AVP are hidden or present in cleartext. This feature can be used to hide sensitive control message data such as user passwords or user IDs. All L2TP AVPs will be passed in cleartext if attribute is omitted and corresponds with the value 'nothing'. The value 'sensitive-only' specifies that the H bit is only set for AVPs containing sensitive information. The value 'all' specifies that the H bit is set for all AVPs where it is allowed. The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp avp-hiding). AVP hiding uses the shared LAC-LNS secret defined in attribute [69] Tunnel-Password or in configuration. If no password is specified, the tunnel setup will fail for values 'sensitive-only' and 'all'. Values outside the Limits are treated as a setup failure.

26-6527-97

Alc-Tunnel-Challenge

Defines if tunnel authentication (challenge-response) is to be used or not. L2TP tunnel-authentication is based on RFC1994 CHAP authentication and requires the shared-secret defined in attribute [69] Tunnel-Password. The value with tag 0 is used as default for the tunnels where the value is not specified. When the attribute is omitted and no [69] Tunnel-Password attribute is specified, a preconfigured value is used (configure router/service vprn service-id l2tp challenge). When the attribute is omitted and a [69] Tunnel-Password attribute is specified, then the value 'always' is used. When the attribute has the value 'always', no [69] Tunnel-Password attribute is specified and no preconfigured value exists for the password, then the tunnel setup fails. Values outside the Limits are treated as a setup failure.

26-6527-100

Alc-Serv-Id

The service ID on the LNS node where the PPP sessions are established (configure service ies/vprn service-id subscriber-interface name group-interface name). Preconfigured values are used if attribute is omitted (configure subscriber-mgmt local-user-db local-user-db-name ppp host host-name interface ip-int-name service-id service-id or configure router/service vprn service-id l2tp group ppp default-group-interface ip-int-name service-id service-id). Values above the Limits or unreferenced are treated as a setup failure.

26-6527-101

Alc-Interface

Refers to the group interface ip-int-name on LNS node only where the PPP sessions are established (configure service ies/vprn service-id subscriber-interface ip-int-name group-interface ip-int-name lns). Preconfigured values are used if the attribute is omitted (configure subscriber-mgmt local-user-db local-user-db-name ppp host host-name interface ip-int-name service-id service-id or configure router/service vprn service-id l2tp group ppp default-group-interface ip-int-name service-id service-id). Alc-interface names longer than the maximum allowed value are treated as session setup failures.

26-6527-104

Alc-Tunnel-Serv-Id

The service-id from which the tunnel should be established, enables the tunnel origin to be in a VPRN (VRF). The default value = Base. Values above the Limits or unreferenced are treated as a setup failure.

26-6527-120

Alc-Tunnel-Rx-Window-Size

Initial receive window size being offered to the remote peer. This attribute is copied in AVP 10 L2TP Receive Window Size. The remote peer may send the specified number of control messages before it must wait for an acknowledgment. The value with tag 0 is used as default for the tunnels where the value is not specified. A preconfigured value is used when attribute is omitted (configure router/service vprn service-id l2tp receive-window-size). Values outside the allowed Limits are treated as a setup failure.

26-6527-144

Alc-Tunnel-Acct-Policy

Refers to a preconfigured L2TP tunnel accounting policy-name (configure aaa l2tp-accounting-policy policy-name). L2TP tunnel accounting (RFC 2867) can collect usage data based either on L2TP tunnel and/or L2TP session and send these accounting data to a RADIUS server. Different RADIUS attributes like [66] Tunnel-Client-Endpoint, [67] Tunnel-Server-Endpoint, [68] Acct-Tunnel-Connection, [82] Tunnel-Assignment-ID could be used to identify the tunnel or session. The value with tag 0 is used as default for the tunnels where the value is not specified. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp radius-accounting-policy). Unreferenced policy-names or policy-names longer than the allowed maximum are treated as host setup failures.

26-6527-204

Alc-Tunnel-DF-bit

This attribute is used on an L2TP LAC only. By default, a LAC does not allow L2TP packet fragmentation by sending L2TP towards the LNS with the Do not Fragment (DF) bit set to 1. This DF bit can be set to 0 to allow downstream routers to fragment the L2TP packets. The LAC itself will not fragment L2TP packets. Packets sent with MTU bigger than the allowed size on the LAC egress port are dropped. This attribute is silently ignored if Radius returns an Alc-Tunnel-Group attribute. In that case, the tunnel level, group level, or as last resort the root level configuration is used instead.

26-6527-214

Alc-Tunnel-Recovery-Method

Sets the L2TP LAC failover recovery-method to be used for this tunnel: mcs or recovery-tunnel (RFC 4951). Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp failover recovery-method).

When tunnel recovery method is set to recovery-tunnel but LNS does not support this capability, then the system automatically falls back to mcs.

Values outside the limits are treated as a setup failure.

26-6527-215

Alc-Tunnel-Recovery-Time

Only applicable when the L2TP LAC failover recovery-method is set to recovery-tunnel. Sets the L2TP LAC failover recovery-time to be negotiated with LNS via L2TP failover extensions (RFC 4951). It indicates to the LNS how long it needs to extend its protocol retry timeout before declaring the control channel down. Preconfigured values are used when attribute is omitted (configure router/service vprn service-id l2tp failover recovery-time).

Values outside the limits are treated as a setup failure.

64

Tunnel-Type

integer

3 (mandatory value)

Mandatory 3=L2TP

Example: Tunnel-Type = L2TP

65

Tunnel-Medium-Type

integer

1 (mandatory value)

Mandatory 1=IP or IPv4

Example: Tunnel-Medium-Type = IP

66

Tunnel-Client-Endpoint

string

Max. length = 15 bytes (untagged) or 16 bytes (tagged)

<tag field><dotted-decimal IP address used on LAC as L2TP src-ip>

If the tag field is greater than 0x1F, it is interpreted as the first byte of the following string field

Example:

# untagged Tunnel-Client-Endpoint = 312e312e312e31

Tunnel-Client-Endpoint = 1.1.1.1

# tagged 0 Tunnel-Client-Endpoint = 00312e312e312e31

Tunnel-Client-Endpoint:0 = 1.1.1.1

# tagged 1 Tunnel-Client-Endpoint = 01312e312e312e31

Tunnel-Client-Endpoint:1 = 1.1.1.1

67

Tunnel-Server-Endpoint

string

Max. length = 15 bytes (untagged) or 16 bytes (tagged)

Max. 451 attributes or limited by Radius message size

<tag field><dotted-decimal IP address used on LAC as L2TP dst-ip>

If Tag field is greater than 0x1F, it is interpreted as the first byte of the following string field

Example: # tagged 1 Tunnel-Server-Endpoint = 01332e332e332e33

Tunnel-Server-Endpoint:1 = 3.3.3.3

69

Tunnel-Password

string

64 chars

Example: Tunnel-Password:1 = password

81

Tunnel-Private-Group-ID

string

32 chars

Example: Tunnel-Private-Group-ID:1 = MyPrivateTunnelGroup

82

Tunnel-Assignment-ID

string

32 chars

Tag 0x00 tunnel-group

Tag 0x01-0x01f individual tunnels within this tunnel-group

Example:

Tunnel-Assignment-ID:0 += LNS-ALU

Tunnel-Assignment-ID:1 += Tunnel-1

Tunnel-Assignment-ID:2 += Tunnel-2

83

Tunnel-Preference

integer

16777215

Default preference 50

Example: Tunnel 1 and 2 same preference and first selected

Tunnel-Preference:1 += 10

Tunnel-Preference:2 += 10

Tunnel-Preference:3 += 20

90

Tunnel-Client-Auth-ID

string

64 chars.

Example: Tunnel-Client-Auth-Id:0 = LAC-Antwerp-1

91

Tunnel-Server-Auth-ID

string

64 chars.

Example: Tunnel-Server-Auth-ID:0 = LNS-Antwerp-1

26-2352-21

Tunnel-Max-sessions

integer

131071

max sessions per group with default=131071

default=131071

Example: Tunnel-Max-sessions:0 = 1000

26-4874-33

ERX-Tunnel-Maximum-Sessions

integer

131071

max sessions per group with default=131071

Example: ERX-Tunnel-Maximum-Sessions:0 = 1000

26-4874-64

ERX-Tunnel-Group

string

32 chars

node preconfigured tunnel-group

Example: ERX-Tunnel-Group:0 = MyCliTunnelGroupName

26-6527-46

Alc-Tunnel-Group

string

32 chars

node preconfigured tunnel-group

Example: Alc-Tunnel-Group = MyCliTunnelGroupName

26-6527-47

Alc-Tunnel-Algorithm

integer

values [1 to 3]

1=weighted-access, 2=existing-first, 3=weighted-random

default=existing-first Example: Alc-Tunnel-Algorithm:0 = weighted-access

26-6527-48

Alc-Tunnel-Max-Sessions

integer

131071

max sessions per group and/or tunnel with default=131071

Example: # 10000 for the group and individual settings per tunnel

Alc-Tunnel-Max-Sessions:0 += 10000

Alc-Tunnel-Max-Sessions:1 += 2000

Alc-Tunnel-Max-Sessions:2 += 1000

26-6527-49

Alc-Tunnel-Idle-Timeout

integer

3600 seconds

infinite = -1 or [0 to 3600] seconds with default= infinite

Example: # don't disconnect tunnel1

Alc-Tunnel-Idle-Timeout :1 += 16777215

# disconnect tunnel2 after 1 minute

Alc-Tunnel-Idle-Timeout :2 += 60

# disconnect tunnel3 immediately

Alc-Tunnel-Idle-Timeout :3 += 0

26-6527-50

Alc-Tunnel-Hello-Interval

integer

[60 to 3600] seconds

no keepalive = -1 or [60 to 3600] seconds with default= 300 seconds

Example: # tunnel 1 keepalive 120 seconds

Alc-Tunnel-Hello-Interval:1 += 120

26-6527-51

Alc-Tunnel-Destruct-Timeout

integer

[60 to 86400] seconds

[60 to 86400] seconds with default= 60 seconds

Example: # tunnel 1 tunnel destruct timer 120 seconds

Alc-Tunnel-Destruct-Timeout:1 += 120

26-6527-52

Alc-Tunnel-Max-Retries-Estab

integer

[2 to 7]

default 5

Example: # retry 2 times for all tunnels in tunnel group

Alc-Tunnel-Max-Retries-Estab:0 = 2

26-6527-53

Alc-Tunnel-Max-Retries-Not-Estab

integer

[2 to 7]

default 5

Example: # retry 2 times for all tunnels in tunnel group

Alc-Tunnel-Max-Retries-Not-Estab:0 = 2

26-6527-54

Alc-Tunnel-AVP-Hiding

integer

values [1 to 3]

1=nothing,2=sensitive-only,3=all; default nothing

1=nothing: All L2TP AVPs in clear text

2=sensitive-only: AVP 11-Challenge, 13-Response,14-Assigned Session ID,21-Called-number,22-Calling-number,26-Initial Received LCP Confreq,27-Last Sent LCP Confreq,28-Last Received LCP Confreq,29-Proxy Authen Type,30-Proxy Authen Name,31-Proxy Authen Challenge,32-Proxy Authen ID,33-Proxy Authen Response

3=all: All AVPs that, according RFC 2661 can be hidden, are hidden.

Example: # Best common practices

Alc-Tunnel-AVP-Hiding:0 = sensitive-only

26-6527-97

Alc-Tunnel-Challenge

integer

values [1 to 2]

1=never, 2=always; default never

Example: Alc-Tunnel-Max-Retries-Estab:0 = always

26-6527-100

Alc-Serv-Id

integer

2147483647 id

Example: Alc-Serv-Id = 100

26-6527-101

Alc-Interface

string

32 chars

Example: Alc-Interface = MyGroupInterface

26-6527-104

Alc-Tunnel-Serv-Id

integer

2147483647 id

default = 'Base' router

Example: # vprn service 100

Alc-Tunnel-Serv-Id = 100

26-6527-120

Alc-Tunnel-Rx-Window-Size

integer

[4 to 1024]

Tag 0 = default when not specified (all tunnels)Tag 1 to 31 = specific tunnel

default 64

Example: Alc-Tunnel-Rx-Window-Size = 1000

26-6527-144

Alc-Tunnel-Acct-Policy

string

32 chars

Example: Alc-Tunnel-Acct-Policy = MyL2TPTunnelPolicy

26-6527-204

Alc-Tunnel-DF-bit

integer

values [0 to 1]

0=clr-lac-data, 1=set-lac-data; default = 1

Example: Alc-Tunnel-DF-bit:0 = clr-lac-data

26-6527-214

Alc-Tunnel-Recovery-Method

integer

values [0 to 1]

0=recovery-tunnel, 1=mcs; default = 0

Example: Alc-Tunnel-Recovery-Method:1 = recovery-tunnel

26-6527-215

Alc-Tunnel-Recovery-Time

integer

[0 to 900] seconds

[0 to 900] in seconds; default = 0

Example: Alc-Tunnel-Recovery-Time = 180

64

Tunnel-Type

0-1

1

0

N

Y

31

65

Tunnel-Medium-Type

0-1

1

0

N

Y

31

66

Tunnel-Client-Endpoint

0-1

0-1

0

N

Y

31

67

Tunnel-Server-Endpoint

0-1

1

0

N

Y

31

69

Tunnel-Password

0

0-1

0

Y

Y

31

81

Tunnel-Private-Group-ID

0-1

0-1

0

N

Y

31

82

Tunnel-Assignment-ID

0

0-1

0

N

Y

31

83

Tunnel-Preference

0

0-1

0

N

Y

31

90

Tunnel-Client-Auth-ID

0-1

0-1

0

N

Y

31

91

Tunnel-Server-Auth-ID

0-1

0-1

0

N

Y

31

26-2352-21

Tunnel-Max-sessions

0

0-1

0

N

N

N/A

26-4874-33

ERX-Tunnel-Maximum-Sessions

0

0-1

0

N

N

N/A

26-4874-64

ERX-Tunnel-Group

0

0-1

0

N

N

N/A

26-6527-46

Alc-Tunnel-Group

0

0-1

0

N

N

N/A

26-6527-47

Alc-Tunnel-Algorithm

0

0-1

0

N

N

N/A

26-6527-48

Alc-Tunnel-Max-Sessions

0

0-1

0

N

Y

31

26-6527-49

Alc-Tunnel-Idle-Timeout

0

0-1

0

N

Y

31

26-6527-50

Alc-Tunnel-Hello-Interval

0

0-1

0

N

Y

31

26-6527-51

Alc-Tunnel-Destruct-Timeout

0

0-1

0

N

Y

31

26-6527-52

Alc-Tunnel-Max-Retries-Estab

0

0-1

0

N

Y

31

26-6527-53

Alc-Tunnel-Max-Retries-Not-Estab

0

0-1

0

N

Y

31

26-6527-54

Alc-Tunnel-AVP-Hiding

0

0-1

0

N

Y

31

26-6527-97

Alc-Tunnel-Challenge

0

0-1

0

N

Y

31

26-6527-100

Alc-Serv-Id

0

0-1

0

N

N

N/A

26-6527-101

Alc-Interface

0

0-1

0

N

N

N/A

26-6527-104

Alc-Tunnel-Serv-Id

0

0-1

0

N

N

N/A

26-6527-120

Alc-Tunnel-Rx-Window-Size

0

0-1

0

N

Y

31

26-6527-144

Alc-Tunnel-Acct-Policy

0

0-1

0

N

Y

31 (untag-ged)

26-6527-204

Alc-Tunnel-DF-bit

0

0-1

0

N

Y

31

26-6527-214

Alc-Tunnel-Recovery-Method

0

0-1

0

N

Y

31

26-6527-215

Alc-Tunnel-Recovery-Time

0

0-1

0

N

Y

31

22

Framed-Route

Routing information (IPv4 managed route) to be configured on the NAS for a host (dhcp, pppoe, arp) that operates as a router without NAT (so called routed subscriber host). The route included in the Framed-Route attribute is accepted as a managed route only if it's next-hop points to the hosts ip-address or if the next-hop address equals 0.0.0.0 or if the included route is a valid classful network in case the subnet-mask is omitted. If neither is applicable, this specific framed-route attribute is ignored and the host is instantiated without this specific managed route installed. A Framed-Route attribute is also ignored if the SAP does not have anti-spoof configured to nh-mac (the host will be installed as a standalone host without managed route). Number of routes above Limits are silently ignored. Optionally, a metric, tag and/or protocol preference can be specified for the managed route. If the metrics are not specified or specified in a wrong format or specified with out of range values then default values are used for all metrics: metric=0, no tag and preference=0. If an identical managed route is associated with different routed subscriber hosts in the context of the same IES/VPRN service up to max-ecmp-routes managed routes are installed in the routing table (configured as ecmp max-ecmp-routes in the routing instance). Candidate ECMP Framed-Routes have identical prefix, equal lowest preference and equal lowest metric. “lowest ip next-hop” is the tie breaker if more candidate ECMP Framed-Routes are available than the configured max-ecmp-routes. Other identical managed routes are shadowed (not installed in the routing table) and an event is logged. An alternative to RADIUS managed routes are managed routes via host dynamic BGP peering.

Valid RADIUS learned managed routes can be included in RADIUS accounting messages with following configuration: configure subscriber-mgmt radius-accounting-policy name include-radius-attribute framed-route. Associated managed routes for an instantiated routed subscriber host are included in RADIUS accounting messages independent of the state of the managed route (Installed, Shadowed or HostInactive).

99

Framed-IPv6-Route

Routing information (ipv6 managed route) to be configured on the NAS for a v6 wan host (IPoE or PPPoE) that operates as a router. The functionality is comparable with offering multiple PD prefixes for a single host. The route included in the Framed-IPv6-Route attribute is accepted as a managed route only if it's next-hop is a wan-host (DHCPv6 IA-NA or SLAAC) or if the next-hop address equals ::. As a consequence, Framed-IPv6-Routes with explicit configured gateway prefix of a pd-host (DHCPv6 IA-PD) will not be installed. A Framed-Route attribute is also ignored if the SAP does not have anti-spoof configured to nh-mac (the host will be installed as a standalone host without managed route). Number of Routes above Limits are silently ignored. Optionally, a metric, tag and/or protocol preference can be specified for the managed route. If the metrics are not specified or specified in a wrong format or specified with out of range values then default values are used for all metrics: metric=0, no tag and preference=0. If an identical managed route is associated with different routed subscriber hosts in the context of the same IES/VPRN service up to max-ecmp-routes managed routes are installed in the routing table (configured as ecmp max-ecmp-routes in the routing instance). Candidate ECMP Framed-IPv6-Routes have identical prefix, equal lowest preference and equal lowest metric. “lowest ip next-hop” is the tie breaker if more candidate ECMP Framed-IPv6-Routes are available than the configured max-ecmp-routes. Other identical managed routes are shadowed (not installed in the routing table) and an event is logged. Valid RADIUS learned managed routes can be included in RADIUS accounting messages with following configuration: configure subscriber-mgmt radius-accounting-policy name include-radius-attribute framed-ipv6-route. Associated managed routes for an instantiated routed subscriber host are included in RADIUS accounting messages independent of the state of the managed route (Installed, Shadowed or HostInactive).

26-6527-55

Alc-BGP-Policy

Refers to a preconfigured policy under configure subscriber-mgmt bgp- peering-policy policy-name. Mandatory attribute for dynamic BGPv4 peering. The referenced policy contains all required parameters to setup the dynamic BGPv4 peer. Peer-AS, MD5 key, Authentication-Keychain and import/export policies can be overridden by optional RADIUS attributes. Dynamic BGPv4 peering related attributes are ignored if the session or host does not terminate in a VPRN. Host setup is successful, but without BGPv4 peering if a non existing policy-name is received or if the SAP anti-spoof type is different from nh-mac. Policy names above the maximum length result in a host setup failure.

26-6527-56

Alc-BGP-Auth-Keychain

Optional attribute for dynamic BGPv4 peering. Refers to the keychain parameters (configure system security keychain keychain-name) used to sign and/or authenticate the BGP protocol stream via the TCP enhanced authentication option (draft-bonica-tcp-auth). Host setup is successful but without BGPv4 peering if a non existing keychain name is received. Keychain names above the maximum length result in a host setup failure. Alternative for [26-6527-57] Alc-BGP-Auth-Key.

26-6527-57

Alc-BGP-Auth-Key

Optional attribute for dynamic BGPv4 peering. Indicates the authentication key used between BGPv4 peers before establishing sessions. Authentication is done using the MD5 message based digest protocol. Authentication keys are truncated at 247 Bytes and are not encrypted.

26-6527-58

Alc-BGP-Export-Policy

Optional attribute for dynamic BGPv4 peering. Refers to a preconfigured BGP export policy (configure router policy-options policy-statement name). The RADIUS received policy is appended to the list of export policies configured in the peering policy (configure subscriber-mgmt bgp-peering-policy policy-name export policy-name) if the number of preconfigured policies are smaller than 15 or replaces the fifteenth policy if the number of preconfigured policies is exactly 15. Host setup is successful but without export policy applied if a non existing policy-name is received. Policy names above the maximum length result in a host setup failure.

26-6527-59

Alc-BGP-Import-Policy

Optional attribute for dynamic BGPv4 peering. Refers to a preconfigured BGP import policy (configure router policy-options policy-statement name). The RADIUS received policy is appended to the peer (if preconfigured policies for peer are smaller than 15) or replaces the fifteenth policy (if preconfigured policies for peer are exact 15). Host setup is successful but without import policy applied if a non existing policy-name is received. Policy names above the maximum length result in a host setup failure.

26-6527-60

Alc-BGP-PeerAS

Optional attribute for dynamic BGPv4 peering. Specifies the Autonomous System number for the remote BGPv4 peer.

26-6527-207

Alc-RIP-Policy

Refers to the preconfigured policy under configure subscriber-mgmt rip-policy policy-name and enables the BNG to listen to RIPv1/v2 messages from the host (master SRRP node only in case of a dual-homed BNG). The referenced policy contains the authentication-type and authentication-key used to establish a RIP neighbor with this host. Host setup is successful, but the RIP message from the host are ignored if a non-existing policy name is received or if the SAP anti-spoof type is different from nh-mac. Policy names above the maximum length result in a host setup failure.

26-6527-208

Alc-BGP-IPv6-Policy

Refers to a preconfigured policy under configure subscriber-mgmt bgp- peering-policy policy-name. Mandatory attribute for dynamic BGPv6 peering. The referenced policy contains all required parameters to setup the dynamic BGPv6 peer. Peer-AS, MD5 key, Authentication-Keychain and import/export policies can be overridden by optional RADIUS attributes. Dynamic BGPv6 peering related attributes are ignored if the session or host does not terminate in a VPRN. Host setup is successful, but without BGPv6 peering if a non-existing policy name is received or if the SAP anti-spoof type is different from nh-mac. Policy names above the maximum length result in a host setup failure.

Note that unlike the ESMv4 case, there is no IPv6 interface address associated with a subscriber interface. The peering address for CPE devices can be any routable IPv6 interface address in the same routing instance as the host (example a loopback interface). This requires multi-hop BGPv6 capability on the CPE.

26-6527-209

Alc-BGP-IPv6-Auth-Keychain

Optional attribute for dynamic BGPv6 peering. Refers to the keychain parameters (configure system security keychain keychain-name) used to sign and/or authenticate the BGPv6 protocol stream via the TCP enhanced authentication option (draft-bonica-tcp-auth). Host setup is successful but without BGPv6 peering if a non existing keychain name is received. Keychain names above the maximum length result in a host setup failure. Alternative for [26-6527-201] Alc-BGP-IPv6-Auth-Key

26-6527-210

Alc-BGP-IPv6-Auth-Key

Optional attribute for dynamic BGPv6 peering. Indicates the authentication key used between BGPv6 peers before establishing sessions. Authentication is done using the MD5 message based digest protocol. Authentication keys are truncated at 247 Bytes and are not encrypted.

26-6527-211

Alc-BGP-IPv6-Export-Policy

Optional attribute for dynamic BGPv6 peering. Refers to a preconfigured BGP export policy (configure router policy-options policy-statement name). The RADIUS received policy is appended to the peer (if preconfigured policies for peer are smaller than 15) or replaces the fifteenth policy (if preconfigured policies for peer are exact 15). Host setup is successful but without export policy applied if a non existing policy name is received. Policy names above the maximum length result in a host setup failure.

26-6527-212

Alc-BGP-IPv6-Import-Policy

Optional attribute for dynamic BGPv6 peering. Refers to a preconfigured BGP import policy (configure router policy-options policy-statement name). The RADIUS received policy is appended to the peer (if preconfigured policies for peer are smaller than 15) or replaces the fifteenth policy (if preconfigured policies for peer are exact 15). Host setup is successful but without import policy applied if a non existing policy name is received. Policy names above the maximum length result in a host setup failure.

26-6527-213

Alc-BGP-IPv6-PeerAS

Optional attribute for dynamic BGPv6 peering. Specifies the Autonomous System number for the remote BGPv6 peer.

22

Framed-Route

string

max. 16 Framed-Route attributes

"<ip-prefix>[/<prefix-length>] <space> <gateway-address> [<space> <metric>] [<space> tag <space> <tag-value>] [<space> pref <space> <preference-value>]”

where:

<space> is a white space or blank character

<ip-prefix>[/prefix-length] is the managed route to be associated with the routed subscriber host. The prefix-length is optional and if not specified, a class-full class A,B or C subnet is assumed.

<gateway-address> must be the routed subscriber host IP address. “0.0.0.0” is automatically interpreted as the host IPv4 address.

[<metric>] (Optional) Installed in the routing table as the metric of the managed route. If not specified, metric zero is used. Value = [0 to 65535]

[tag <tag-value>] (Optional) The managed route will be tagged for use in routing policies. If not specified or tag-value=0, then the route is not tagged. Value = [0 to 4294967295]

[pref <preference-value>] (Optional) Installed in the routing table as protocol preference for this managed route. If not specified, preference zero is used. Value = [0 to 255]

22 (continued)

Framed-Route

string

max. 16 Framed-Route attributes

Example:

Framed-Route = "192.168.1.0/24 0.0.0.0" where 0.0.0.0 is replaced by host address. Default metrics are used (metric=0, preference=0 and no tag)

Framed-Route = "192.168.1.0 0.0.0.0" where 192.168.1.0 is a class-C network /24 and 0.0.0.0 is replaced host address. Default metrics are used.

Framed-Route = "192.168.1.0/24 192.168.1.1" where 192.168.1.1 is the host address. Default metrics are used.

Framed-Route = "192.168.1.0 0.0.0.0 10 tag 3 pref 100" installs a managed route with metric=10, protocol preference = 100 and tagged with tag=3

Framed-Route = "192.168.1.0 0.0.0.0 tag 5" installs a managed route with metric=0 (default), protocol preference = 0 (default) and tagged with tag=5"

99

Framed-IPv6-Route

string

max. 16 Framed-IPv6-Route attributes

<ip-prefix>/<prefix-length> <space> <gateway-address> [<space> <metric>] [<space> tag <space> <tag-value>] [<space> pref <space> <preference-value>]”

where:

<space> is a white space or blank character

<ip-prefix>/<prefix-length> is the managed route to be associated with the routed subscriber host.

<gateway-address> must be the routed subscriber host IP address. “::” and “0:0:0:0:0:0:0:0” are automatically interpreted as the wan-host IPv6 address.

[<metric>] (Optional) Installed in the routing table as the metric of the managed route. If not specified, metric zero is used. Value = [0 to 65535]

[tag <tag-value>] (Optional) The managed route will be tagged for use in routing policies. If not specified or tag-value=0, then the route is not tagged. Value = [0 to 4294967295]

[pref <preference-value>] (Optional) Installed in the routing table as protocol preference for this managed route. If not specified, preference zero is used. Value = [0 to 255]

99 (continued)

Framed-IPv6-Route

string

max. 16 Framed-IPv6-Route attributes

Example:

Framed-IPv6-Route = "5000:0:1::/48 ::" where :: resolves in the wan-host. Default metrics are used (metric=0, preference=0 and no tag)

Framed-IPv6-Route = "5000:0:2::/48 0:0:0:0:0:0:0:0" where 0:0:0:0:0:0:0:0 resolves in the wan-host. Default metrics are used.

Framed-IPv6-Route = "5000:0:3::/48 0::0" where 0::0 resolves in the wan-host. Default metrics are used.

Framed-IPv6-Route = "5000:0:3::/48 2021:1::1" where 2021:1::1 is the wan-host. Default metrics are used.

Framed-IPv6-Route = "5000:0:1::/48 :: 10 tag 3 pref 100" installs a managed route with metric = 10, protocol preference = 100 and tagged with tag = 3

Framed-IPv6-Route = "5000:0:1::/48 :: tag 5" installs a managed route with metric = 0 (default), protocol preference = 0 (default) and tagged with tag = 5

26-6527-55

Alc-BGP-Policy

string

32 chars

Example: Alc-BGP-Policy = MyBGPPolicy

26-6527-56

Alc-BGP-Auth-Keychain

string

32 chars

Example: Alc-BGP-Auth-Keychain = MyKeychainPolicy

26-6527-57

Alc-BGP-Auth-Key

octets

247 Bytes

Example: Alc-BGP-Auth-Key = "SecuredBGP"

26-6527-58

Alc-BGP-Export-Policy

string

32 chars

Example: Alc-BGP-Export-Policy = to_dynamic_bgp_peer

26-6527-59

Alc-BGP-Import-Policy

string

32 chars

Example: Alc-BGP-Import-Policy = from_dynamic_bgp_peer

26-6527-60

Alc-BGP-PeerAS

integer

[1 to 4294967294]

Example: Alc-BGP-PeerAS = 64500

26-6527-207

Alc-RIP-Policy

string

32 chars

Example: Alc-RIP-Policy = MyRIPPolicy

26-6527-208

Alc-BGP-IPv6-Policy

string

32 chars

Example: Alc-BGP-IPv6-Policy = MyBGPPolicy

26-6527-209

Alc-BGP-IPv6-Auth-Keychain

string

32 chars

Example: Alc-BGP-IPv6-Auth-Keychain = MyKeychain

26-6527-210

Alc-BGP-IPv6-Auth-Key

octets

247 Bytes

Example: Alc-BGP-IPv6-Auth-Key = “SecuredBGPv6”

26-6527-211

Alc-BGP-IPv6-Export-Policy

string

32 chars

Example: Alc-BGP-IPv6-Export-Policy = to_dynamic_bgpv6_peer

26-6527-212

Alc-BGP-IPv6-Import-Policy

string

32 chars

Example: Alc-BGP-IPv6-Import-Policy = from_dynamic_bgpv6_peer

26-6527-213

Alc-BGP-IPv6-PeerAS

integer

[1 to 4294967294]

Example: Alc-BGP-IPv6-PeerAS = 64500

22

Framed-Route

0

0+

0

99

Framed-IPv6-Route

0

0+

0

26-6527-55

Alc-BGP-Policy

0

0-1

0

26-6527-56

Alc-BGP-Auth-Keychain

0

0-1

0

26-6527-57

Alc-BGP-Auth-Key

0

0-1

0

26-6527-58

Alc-BGP-Export-Policy

0

0-1

0

26-6527-59

Alc-BGP-Import-Policy

0

0-1

0

26-6527-60

Alc-BGP-PeerAS

0

0-1

0

26-6527-207

Alc-RIP-Policy

0

0-1

0

26-6527-208

Alc-BGP-IPv6-Policy

0

0-1

0

26-6527-209

Alc-BGP-IPv6-Auth-Keychain

0

0-1

0

26-6527-210

Alc-BGP-IPv6-Auth-Key

0

0-1

0

26-6527-211

Alc-BGP-IPv6-Export-Policy

0

0-1

0

26-6527-212

Alc-BGP-IPv6-Import-Policy

0

0-1

0

26-6527-213

Alc-BGP-IPv6-PeerAS

0

0-1

0

26-6527-95

Alc-Credit-Control-CategoryMap

Refers to a preconfigured category-map (configure subscriber-mgmt category-map category-map-name) that holds the credit-type (volume or time) and information for maximum three pre-defined categories (example: category-names data in and out, video+data, etc.), their mappings to individual forwarding queues/policers, out-of-credit-actions and alike. The category-map-name can also be assigned via the ludb, or credit-control-policy if the attribute is omitted. This attribute is ignored if the host has no credit-control-policy defined in its sla-profile instance. Strings with length above the Limits are treated as a setup failure.

26-6527-96

Alc-Credit-Control-Quota

Defines a volume and time quota per category in a pre-defined format. Either volume OR time monitoring is supported and the operational credit-type (volume or time) is taken from the category map if both volume and time-quota in this attribute are non-zero. The operational credit-type becomes time if the volume-quota is zero and volume if the time-quota is zero. The Credit Expired becomes true and the corresponding Out Of Credit Action is triggered if both time and volume-quota are zero in the initial Authentication-Accept or CoA. Value zero for both time and volume-quota in additional Authentication Accepts (triggered by credit refresh or re-authentication) are interpreted as no extra credit granted and does not influence the current available credit, were non-zero values reset the current available credit. For CoA requests both Alc-Credit-Control-CategoryMap and Alc-Credit-Control-Quota attributes needs to be included. For RADIUS-Access Accepts this is not mandatory and either both or one of the two attributes can come from pre-defined values from the node. Volume quota values outside the defined limits are treated as an error condition. Time quota values above the defined limits are accepted and capped at maximum value. If more attributes are present than allowed by the limits, it is treated as a setup failure.

26-6527-95

Alc-Credit-Control-CategoryMap

string

32 chars

Example: Alc-Credit-Control-CategoryMap = MyCatMap

26-6527-96

Alc-Credit-Control-Quota

string

(2^64 - 1) volume value

(2^32 - 1) time value

3 attributes

volume-value volume-units|time-value time- units|category-name

<volume-value>: converted in bytes and stored in 64 bit counter

- value '0' = no volume credit

- value between 1 Byte and (2^64 - 1 / 18446744073709551615) Bytes

<time-value>: converted in seconds and stored in 32 bit counter

- value '0' = no time credit

- value between 1 second and (2^32 - 1 / 4294967295) seconds

<volume-units>:

- in byte (B or units omitted), kilobyte (K or KB), megabyte (M or MB), gigabyte (G or GB)

- a combination (10GB200MB20KB|) of different volume units is not allowed.

<time-units>:

- in seconds (s or units omitted), in minutes (m), in hours (h), in days (d)

- a combination of different time units is allowed with some restrictions: 15m30s is accepted while 15m60s is not.

Example: 500 MByte volume credit for category cat1 and 1 day, 2 hours, 3 minutes and 4 seconds time credit for category cat2

Alc-Credit-Control-Quota += 500MB|0|cat1,

Alc-Credit-Control-Quota += 0|1d2h3m4s|cat2,

26-6527-95

Alc-Credit-Control-CategoryMap

0

0-1

0-1

26-6527-96

Alc-Credit-Control-Quota

0-1

0-1

0-1

92

NAS-Filter-Rule

Subscriber host specific filter entry. The match criteria are automatically extended with the subscriber host ip- or ipv6-address as source (ingress) or destination (egress) ip. They represent a per host customization of a generic filter policy: only traffic from/to the subscriber host will match against these entries. A range of entries must be reserved for subscriber host specific entries in a filter policy: configure filter ip-filter/ipv6-filter filter-id sub-insert-radius

Subscriber host specific filter entries are moved if the subscriber host filter policy is changed (new SLA profile or ip filter policy override) and if the new filter policy contains enough free reserved entries. When the subscriber host session terminates or is disconnected, then the corresponding subscriber host specific filter entries are also deleted. The function of the attribute is identical to [26-6527-159] Alc-Ascend-Data-Filter-Host-Spec but it has a different format. The format used to specify host specific filter entries (NAS-Filter-Rule format or Alc-Ascend-Data-Filter-Host-Spec format) cannot change during the lifetime of the subscriber host.

Mixing formats in a single RADIUS message results in a failure.

26-529-242

Ascend-Data-Filter

A local configured filter policy can be extended with shared dynamic filter entries. A dynamic copy of the base filter (filter associated to the host via sla-profile or host filter override) is made and extended with the set of filter rules per type (ipv4/ipv6) and direction (ingress/egress) in the RADIUS message. If a dynamic copy with the same set of rules already exists, no new copy is made but the existing copy is associated with the host/session. If after host/session disconnection, no hosts/sessions are associated with the dynamic filter copy, then the dynamic copy is removed.

Shared filter entries are moved if the subscriber host filter policy is changed (new SLA profile or ip filter policy override) and if the new filter policy contains enough free reserved entries.

A range of entries must be reserved for shared entries in a filter policy: configure filter ip-filter/ipv6 filter filter-id sub-insert-shared-radius

The function of the attribute is identical to [26-6527-158] Alc-Nas-Filter-Rule-Shared but it has a different format. The format used to specify shared filter entries (Alc-Nas-Filter-Rule-Shared format or Ascend-Data-Filter format) cannot change during the lifetime of the subscriber host.

Mixing formats in a single RADIUS message results in a failure.

Note that shared filter entries should only be used if many hosts share the same set of filter rules that need to be controlled from RADIUS.

26-6527-134

Alc-Subscriber-Filter

Subscriber host preconfigured ip/ipv6 ingress and egress filters to be used instead of the filters defined in the sla-profile. Not relevant fields will be ignored (example, IPv4 filters for an IPv6 host).

Note that the scope of the local preconfigured filter should be set to template for correct operation (configure filter ip-filter/ipv6-filter filter-id scope template). This is not enforced. For a RADIUS CoA message, if the ingress or egress field is missing in the VSA, there will be no change for that direction. For a RADIUS Access-Accept message, if the ingress or egress field is missing in the VSA, then the IP-filters as specified in the sla-profile will be active for that direction Applicable to all dynamic host types, including L2TP LNS but excluding L2TP LAC.

26-6527-158

Alc-Nas-Filter-Rule-Shared

A local configured filter policy can be extended with shared dynamic filter entries. A dynamic copy of the base filter (filter associated to the host via sla-profile or host filter override) is made and extended with the set of filter rules per type (ipv4/ipv6) and direction (ingress/egress) in the RADIUS message. If a dynamic copy with the same set of rules already exists, no new copy is made but the existing copy is associated with the host/session. If after host/session disconnection, no hosts/sessions are associated with the dynamic filter copy, then the dynamic copy is removed. Shared filter entries are moved if the subscriber host filter policy is changed (new SLA profile or ip filter policy override) and if the new filter policy contains enough free reserved entries. A range of entries must be reserved for shared entries in a filter policy: configure filter ip-filter|ipv6-filter filter-id sub-insert-shared-radius The function of the attribute is identical to [26-529-242] Ascend-Data-Filter but it has a different format. The format used to specify shared filter entries (Alc-Nas-Filter-Rule-Shared format or Ascend-Data-Filter format) cannot change during the lifetime of the subscriber host. Mixing formats in a single RADIUS message results in a failure.

Note that shared filter entries should only be used if many hosts share the same set of filter rules that need to be controlled from RADIUS.

26-6527-159

Alc-Ascend-Data-Filter-Host-Spec

Subscriber host specific filter entry. The match criteria is automatically extended with the subscriber host ip- or ipv6-address as source (ingress) or destination (egress) ip. They represent a per host customization of a generic filter policy: only traffic to/from the subscriber host will match against these entries. A range of entries must be reserved for subscriber host specific entries in a filter policy: configure filter ip-filter/ipv6-filter filter-id sub-insert-radius. Subscriber host specific filter entries are moved if the subscriber host filter policy is changed (new SLA profile or ip filter policy override) and if the new filter policy contains enough free reserved entries. When the subscriber host session terminates or is disconnected, then the corresponding subscriber host specific filter entries are also deleted. The function of the attribute is identical to [92] Nas-Filter-Rule but it has a different format. The format used to specify host-specific filter entries (NAS-Filer-Rule format or Alc-Ascend-Data-Filter-Host-Spec format) cannot change during the lifetime of the subscriber host. Mixing formats in a single RADIUS message results in a failure.

92

NAS-Filter-Rule

string

max. 10 attributes per message or max. 10 filter entries per message

The format of a NAS-Filter-Rule is defined in RFC 3588, Diameter Base Protocol, section-4.3, Derived AVP Data Formats. A single filter rule is a string of format <action> <direction> <protocol> from <source> to <destination> <options> Multiple rules should be separated by a NUL (0x00). A NAS-Filter-Rule attribute may contain a partial rule, one rule, or more than one rule. Filter rules may be continued across attribute boundaries.

A RADIUS message with NAS-Filter-Rule attribute value equal to 0x00 or “ “ (a space) removes all host specific filter entries for that host.

See also IP Filter Attribute Details.

Example: Nas-Filter-Rule = permit in ip from any to 10.1.1.1/32

26-529-242

Ascend-Data-Filter

Octets

multiple attributes per RADIUS message allowed.

min. length 22 bytes (IPv4), 46 bytes (IPv6)

max. length: 110 bytes (IPv4), 140 bytes (IPv6)

A string of octets with fixed field lengths (type (ipv4/ipv6), direction (ingress/egress), src-ip, dst-ip, etc. Each attribute represents a single filter entry. See IP Filter Attribute Details for a description of the format.

Example: # permit in ip from any to 10.1.1.1/32

Ascend-Data-Filter = 0x01010100000000000a01010100200000000000000000

26-6527-134

Alc-Subscriber-Filter

string

Max. 1 VSA.

Comma separated list of strings:

Ingr-v4:<number>, Ingr-v6:<number>,Egr-v4:<number>,Egr-v6:<number>

where <number> can be one of:

[1 to 65535] = ignore sla-profile filter; apply this filter-id

0 = ignore sla-profile filter; do not assign a new filter (only allowed if no dynamic subscriber host specific rules are present)

-1 = No change in filter configuration

-2 = Restore sla-profile filter

Example: Alc-Subscriber-Filter = Ingr-v4:20,Egr-v4:101

26-6527-158

Alc-Nas-Filter-Rule-Shared

string

Multiple attributes per RADIUS message allowed.

The format is identical to [92] NAS-Filter-Rule and is defined in RFC 3588 section-4.3. A single filter rule is a string of format <action> <direction> <protocol> from <source> to <destination> <options> Multiple rules should be separated by a NUL (0x00). An Alc-Nas-Filter-Rule-Shared attribute may contain a partial rule, one rule, or more than one rule. Filter rules may be continued across attribute boundaries.

A RADIUS message with Alc-Nas-Filter-Rule-Shared attribute value equal to 0x00 or “ “ (a space) removes the shared filter entries for that host.

See also IP Filter Attribute Details.

Example: Alc-Nas-Filter-Rule-Shared = permit in ip from any to 10.1.1.1/32

26-6527-159

Alc-Ascend-Data-Filter-Host-Spec

octets

max. 10 attributes per message or max. 10 filter entries per message.

min. length 22 bytes (IPv4), 46 bytes (IPv6)

max. length: 110 bytes (IPv4), 140 bytes (IPv6)

A string of octets with fixed field length (type (ipv4/ipv6), direction (ingress/egress), src-ip, dst-ip,...). Each attribute represents a single filter entry. See IP Filter Attribute Details for a description of the format.

Example: # permit in ip from any to 10.1.1.1/32

Alc-Ascend-Data-Filter-Host-Spec = 0x01010100000000000a01010100200000000000000000

92

NAS-Filter-Rule

0

0+

0+

26-529-242

Ascend-Data-Filter

0

0+

0+

26-6527-134

Alc-Subscriber-Filter

0

0-1

0-1

26-6527-158

Alc-Nas-Filter-Rule-Shared

0

0+

0+

26-6527-159

Alc-Ascend-Data-Filter-Host-Spec

0

0+

0+

8

Framed-IP-Address

The IPv4 address to be configured for the host via DHCPv4 (radius proxy) or IPCP (PPPoE). Simultaneous returned attributes [88] Framed-Pool and [8] Framed-IP-Address (RADIUS Access-Accept) are handled as host setup failures. Attribute is also used in CoA and Disconnect Message (part of the ESM or AA user identification-key). Attribute is omitted in accounting via configure subscriber-mgmt radius-accounting-policy name include-radius-attribute no framed-ip-addr.

87

NAS-Port-Id

A text string which identifies the physical port of the NAS (SAP id) where the host is created.

26-6527-14

Alc-Force-Renew

An individual DHCPv4 session is renewed with a CoA with attribute [26-6527-14] Alc-Force-Renew. The NAS initiates the ForceRenew procedure with re-authentication (triggers dhcp Force Renew to client and start re-authentication on dhcp Request received).

26-6527-15

Alc-Create-Host

Used to create an IPv4 host via CoA. Additional mandatory attributes to create such a host are [8] Framed-IP-Address, [87] NAS-Port-Id and [26-6527-27] Alc-Client-Hardware-Addr

26-6527-27

Alc-Client-Hardware-Addr

MAC address from a user that requests a service and included in CoA, Authentication or Accounting (configure subscriber-mgmt authentication-policy/radius-accounting-policy policy-name include-radius-attribute mac-address)

26-6527-98

Alc-Force-Nak

An individual DHCPv4 session is terminated with a CoA with attribute [26-6527-98] Alc-Force-Nak. The NAS initiates the ForceRenew procedure which will be blocked (reply on client DHCP Request with DHCP Nak and send DHCP Release to DHCP server).

8

Framed-IP-Address

ipaddr

4 Bytes

Example: # ip-address 10.11.12.13

Framed-IP-Address 0a0b0c0d

87

NAS-Port-Id

string

253 Bytes

<slot> / <mda> / <port> [ : <qtag1> [. <qtag2>] ]

Example:

NAS-Port-Id = 1/1/4:501.1001

26-6527-14

Alc-Force-Renew

string

no limits

The attribute value is ignored

Example: Alc-Force-Renew = anything

Alc-Force-Renew = 1

26-6527-15

Alc-Create-Host

string

no limits

The attribute value is ignored

Example: Alc-Create-Host = anything

Alc-Create-Host = 1

26-6527-27

Alc-Client-Hardware-Addr

string

6 Bytes

Example: Alc-Client-Hardware-Addr = 00:00:00:00:00:01

26-6527-98

Alc-Force-Nak

string

no limits

The attribute value is ignored

Example: Alc-Force-Nak = anything

Alc-Force-Nak = 1

8

Framed-IP-Address

0

0-1

0-1

87

NAS-Port-Id

0-1

0

0-1

26-6527-14

Alc-Force-Renew

0

0

0-1

26-6527-15

Alc-Create-Host

0

0

0-1

26-6527-27

Alc-Client-Hardware-Addr

0-1

0-1

0

26-6527-98

Alc-Force-Nak

0

0

0-1

26-6527-151

Alc-Sub-Serv-Activate

Activate a subscriber service. The attribute typically contains parameters as input for the Python script that populates the subscriber service data structure (sub_svc). The attribute is ignored if not used in Python.

The parameters can cross an attribute boundary. The concatenation of all Alc-Sub-Serv-Activate attributes with the same tag in a single message is typically used as a unique subscriber service instance identifier (key).

In subscriber service RADIUS accounting messages, the attribute is sent untagged and contains the subscriber service data structure sub_svc.name value used at service activation. Multiple attributes may be present if the total length does not fit a single attribute.

26-6527-152

Alc-Sub-Serv-Deactivate

Deactivate a subscriber service. The attribute typically contains parameters as input for the Python script that populates the subscriber service data structure (sub_svc). The attribute is ignored if not used in Python.

The parameters can cross an attribute boundary. The concatenation of all Alc-Sub-Serv-Deactivate attributes with the same tag in a single message is typically used as the unique subscriber service instance identifier (key).

26-6527-153

Alc-Sub-Serv-Acct-Stats-Type

Enable or disable subscriber service accounting and specify the stats type: volume and time or time only. The attribute is used as input for the Python script that populates the subscriber service data structure (sub_svc.acct_stats_type). The attribute is ignored if not used in Python.

The subscriber service accounting statistics type cannot be changed for an active subscriber service.

26-6527-154

Alc-Sub-Serv-Acct-Interim-Ivl

The interim accounting interval in seconds at which Acct-Interim-Update messages should be generated for subscriber service accounting. The attribute is used as input for the Python script that populates the subscriber service data structure (sub_svc.acct_interval). The attribute is ignored if not used in Python.

sub_svc.acct_interval overrides the local configured update-interval value in the subscriber profile policy. With value = 0, the interim accounting is switched off. The subscriber service accounting interim interval cannot be changed for an active subscriber service.

26-6527-155

Alc-Sub-Serv-Internal

For internal use only

26-6527-151

Alc-Sub-Serv-Activate

string

multiple VSAs per tag per message

Example: Alc-Sub-Serv-Activate:1 = rate-limit;1000;8000

26-6527-152

Alc-Sub-Serv-Deactivate

string

multiple VSAs per tag per message

Example: Alc-Sub-Serv-Deactivate:1 = rate-limit;1000;8000

26-6527-153

Alc-Sub-Serv-Acct-Stats-Type

integer

1 VSA per tag per message

1=off, 2=volume-time, 3=time

Example: Alc-Sub-Serv-Acct-Stats-Type:1 = 2

26-6527-154

Alc-Sub-Serv-Acct-Interim-Ivl

integer

1 VSA per tag per message

[300 to 15552000]

A value of 0 (zero) corresponds with no interim update messages.

A value [1 to 299] seconds is rounded to 300s (min. CLI value) and a value > 15552000 seconds (max. CLI value) is rounded to the max. CLI value.

[300 to 15552000] = override local configured update-interval for this subscriber service

Example: Alc-Sub-Serv-Acct-Interim-Ivl:1 = 3600

26-6527-151

Alc-Sub-Serv-Activate

0

0+

0+

Y

0-31 (untagged)

26-6527-152

Alc-Sub-Serv-Deactivate

0

0+

0+

Y

0-31

26-6527-153

Alc-Sub-Serv-Acct-Stats-Type

0

0+

0+

Y

0-31

26-6527-154

Alc-Sub-Serv-Acct-Interim-Ivl

0

0+

0+

Y

0-31

4

NAS-IP-Address

The identifying IP Address of the NAS requesting Authentication or Accounting. Authentication generated from ISA (for a UE in migrant state) can be configured to use local IP address of RADIUS client on the ISA or the system IP address (on CPM).

config aaa isa-radius-policy name nas-ip-address-origin {isa-ip | system-ip}

When an ESM host exists for the UE (UE is in authenticated state), then the NAS IP in authentication and accounting is the system IP address.

30

Called-Station-Id

If configured for inclusion in authentication and accounting policy (configure aaa isa-radius-policy policy-name auth-include-attributes/acct-include-attributes called-station-id), the called-station-id received from EAP authentication request is transparently forwarded in access-request. If it is contained in the accounting messages received from the APs, it is transparently forwarded in the accounting messages sent from the WLAN-GW. For open SSIDs, [30] Called-Station-Id is not included in authentication or accounting.

Typically the string contains “AP MAC : SSID-name”.

31

Calling-Station-Id

Calling-station-id contains the MAC address of the UE, if it is configured for inclusion in isa-radius-policy (configure aaa isa-radius-policy policy-name auth-include-attributes calling-station-id) for authentication generated from the ISA (for a UE in migrant state), or in authentication and accounting policy for messages generated from the CPM. For CPM generated authentication or accounting, the inclusion of calling-station-id MUST explicitly specify the format of the calling-station-id as MAC: configure subscriber-mgmt authentication-policy | radius-accounting-policy name include-radius-attribute calling-station-id mac.

87

NAS-Port-Id

A text string with format defined by the aggregation type:

GRE or L2TPv3: “tunnel-type rtr-virtual router id#lip-local ip address#rip-remote ip address”

where

tunnel-type = GRE | L2TP,

rtr-virtual router id is the transport service

lip-local ip address is the local tunnel end-point

rip-remote ip address is the remote tunnel end-point

Example: NAS-Port-Id = “GRE rtr-11#lip-50.1.1.1#rip-201.1.1.2”

VLAN: “VLAN svc-svc-id[:vlan[.vlan]]”

where

svc-svc-id is the relative identifier of the internal _tmnx_WlanGwL2ApService Epipe service connecting the WLAN-GW group interface SAP to the MS-ISA.

[:vlan[.vlan]] is the optional dot1q or qinq encapsulation identifying the AP

Example: NAS-Port-Id = “VLAN svc-1:10”

26-3561-1

Agent-Circuit-Id

Agent-circuit-id is transparently taken from the circuit-id in DHCP option-82. Most WIFI access-points insert information describing the AP and SSID that the UE is associated with. Recommended format is an ASCII string containing APs MAC@, SSID name and SSID type (open or secure), with a delimiter between each, as shown in example:

“00:00:00:00:00:01;xfinity-wifi;o”

26-6527-145

Alc-MGW-Interface-Type

This contains the interface type that will be used to determine the type of GTP-C connection, overrides local configuration.

26-6527-146

Alc-Wlan-APN-Name

Specifies the Access Point Name (APN) for which a GTP-C session will be set up. This will be signaled in the GTP-C setup and may be used to determine the IP address of the GGSN/P-GW by performing a DNS query if the [26-10415-5] 3GPP-GGSN-Address attribute is not present. This overrides a locally configured APN.

26-6527-147

Alc-MsIsdn

Contains the MSISDN (telephone number) of the UE, and will be included in GTP-C signaling. When not present the corresponding GTP-C Information Element will not be sent.

26-6527-148

Alc-RSSI

Received Signal Strength Indication. Used in conjunction with the radius-proxy track-accounting feature. When the radius-proxy receives this attribute in an accounting message, it will be copied into the DHCP lease state and echoed by the SROS accounting.

26-6527-149

Alc-Num-Attached-Ues

Number of attached WIFI UEs. The attribute is forwarded by the RADIUS proxy when received in an Access-Request from the AP.

For authentication originated by the WLAN GW, this attribute contains the total number of UEs that are currently attached to this UE’s tunnel. This can be used to detect if this is the first UE on a tunnel (value 1). For non wlan-gw/vRGW UEs this value will be 0. Inclusion can be configured by adding the option wifi-num-attached-ues in configure subscriber-mgmt authentication-policy name include-radius-attribute for ESM, and in configure aaa isa-radius-policy name auth-include-attributes for DSM.

26-6527-172

Alc-Wlan-Portal-Redirect

Used when authenticating migrant hosts. When an access-accept contains this attribute, the host will stay in migrant phase, but will have limited forwarding capabilities. All filtered (not allowed) http-traffic will be redirected to a specified portal URL. This attribute must contain the name of a redirect policy configured under configure subscriber-mgmt http-redirect-policy policy-name which will specify a set of forwarding filters.

It is also allowed to just send an empty Alc- Wlan-Portal-Redirect VSA to force a redirect with the configured policy and url.

26-6527-173

Alc-Wlan-Portal-Url

If a migrant host is redirected, specifies the URL it has to be redirected to, takes precedence over the URL configured in the redirect policy under configure subscriber-mgmt http-redirect-policy policy-name.

26-6527-179

Alc-GTP-Local-Breakout

Specifies if part of the UE traffic is allowed to be locally broken out (such as, NATed and routed), subject to matching an ipv4 filter entry with action gtp-local-breakout, associated with the UE.

26-6527-184

Alc-Wlan-Ue-Creation-Type

When promoting a migrant user, this indicates if the UE should be created on CPM/IOM (as an ESM host) or on ISA (as a DSM host). When this attribute is not present during promote, creation-type CPM/IOM is assumed.

The attribute can be included in an Access-Accept message for a UE that is auto-signed-in (it does not need web redirect to portal), or in a CoA message triggered to remove web redirect for a UE after successful portal authentication.

If Alc-Wlan-Ue-Creation-Type indicates a DSM UE then any IPv6 or GTP related parameters in an Access-Accept or CoA message will be ignored, and the UE will be created as a DSM host.

Alc-Wlan-Ue-Creation-Type cannot be changed mid-session via CoA. A CoA containing Alc-Wlan-Ue-Creation-Type for an existing UE does not result in any change of state, and is NAK’d.

26-6527-186

Alc-Wlan-Dsm-Ot-Http-Redirect-Url

If a one-time redirect is enabled for a distributed subscriber management host, specifies the URL it has to be redirected to. This URL overrides the configured URL under configure service ies/vprn service-id subscriber-interface subscriber-interface-name group-interface group-interface-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt one-time-redirect.

26-6527-187

Alc-Wlan-Dsm-Ip-Filter

Specifies the name of a distributed subscriber management (DSM) ip filter configured under configure subscriber-mgmt wlan-gw distributed-sub-mgmt dsm-ip-filter ip-filter-name. This filter will be applied to the DSM UE. This overrides the value configured under configure service ies/vprn service-id subscriber-interface subscriber-interface-name group-interface group-interface-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt dsm-ip-filter dsm-ip-filter-name.

26-6527-188

Alc-Wlan-Dsm-Ingress-Policer

Specifies the name of a distributed subscriber management (DSM) ingress policer configured under configure subscriber-mgmt wlan-gw distributed-sub-mgmt dsm-policer policer-name. This policer will be applied to the DSM UE. This overrides the value configured under configure service ies/vprn service-id subscriber-interface subscriber-interface-name group-interface group-interface-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt ingress-policer policer-name.

26-6527-189

Alc-Wlan-Dsm-Egress-Policer

Specifies the name of a distributed subscriber management (DSM) egress policer configured under configure subscriber-mgmt wlan-gw distributed-sub-mgmt dsm-policer policer-name. This policer will be applied to the DSM UE. This overrides the value configured under configure service ies/vprn service-id subscriber-interface subscriber-interface-name group-interface group-interface-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt egress-policer policer-name.

26-6527-190

Alc-Wlan-Handover-Ip-Address

IP address provided in RADIUS Access-Accept message to signal handover from LTE or UMTS to WIFI. If this VSA is present, handover indication is set in GTP session creation request to PGW/GGSN.

26-6527-205

Alc-GTP-Default-Bearer-Id

When establishing a GTP connection for a UE, this specifies the bearer id (GTPv2) or NSAPI (GTPv1) that will be used for the data path connection. If not provided, a default value of 5 will be used.

26-6527-206

Alc-Wlan-SSID-VLAN

The VLAN is transparently taken from the UEs Ethernet layer and can be reflected in both authentication and accounting. This is typically added by the Access Point and uniquely identifies an SSID. This is useful when the SSID is not available in the [30] Called-Station-Id (e.g., datatrigger scenarios). When this attribute is configured for inclusion but no vlan is present in the UE payload, the attribute will not be reflected in RADIUS.

26-6527-216

Alc-Datatrig-Lease-Time

Defines the initial lease-time used for data-triggered DHCP relay hosts. If this attribute is not provided or equal to zero, the used lease-time will be 7 days. This lease time will be overridden upon the first renew after data-triggered host-creation.

26-6527-218

Alc-Wlan-Handover-Ipv6-Address

Specifies the current IPv6 address of the UE in a 3GPP to WLAN handover scenario. In GTPv2 this will set the HI bit and signal the IP in the PDN Address Allocation IE. In GTPv1 this is not supported.

26-6527-219

Alc-Egress-Report-Rate-Subtract

This value will be subtracted from the base downlink AMBR value calculated via the report-rate mechanism. This attribute will only be interpreted if report-rate is enabled in the applicable sla-profile: configure subscriber-mgmt sla-profile sla-profile-name egress report-rate.

26-25053-2

Ruckus-Sta-RSSI

Received Signal Strength Indication. Used in conjunction with the radius-proxy track-accounting feature. When the radius-proxy receives this attribute in an accounting message, it will be copied into the DHCP lease state and echoed by the SR OS accounting.

26-10415-1

3GPP-IMSI

This is used to identify the host in a GTP-C connection. If not present and a gtp-c connection is requested, the subscriber-id or username in the EAP-SIM message will be parsed as an IMSI. This should be provided for any GTP-C user.

26-10415-3

3GPP-PDP-Type

Specifies which address type should be requested from the P-GW: ipv4, ipv6 or ipv4v6. If this attribute is not present, the value under configure router | service vprn service-id wlan-gw pdn-type will be used.

26-10415-5

3GPP-GPRS-Negotiated-QoS-Profile

Used to signal the QOS for default bearer or primary PDP context via GTP “QOS IE” in create-PDP-context and "Bearer QOS" in create-session-request

26-10415-7

3GPP-GGSN-Address

For 3G, it represents the GGSN IPv4 address that is used by the GTP control plane for the context establishment on the Gn interface.

For 4G, it represents the P-GW IPv4 address that is used on the S2a or S2b interface for the GTP session establishment.

If not present, the WLAN-GW will send a DNS query based on the APN name derived from [26-6527-146] Alc-Wlan-APN-Name or local configuration.

26-10415-13

3GPP-Charging-Characteristics

Used to signal charging-characteristic IE content.

26-10415-20

3GPP-IMEISV

International Mobile Equipment Id and its Software Version, this will be echoed in the GTP-C setup messages.

26-10415-21

3GPP-RAT-Type

Specifies the value that is signaled in the RAT Type IE during GTPv1/GTPv2 setup. If this attribute is not present, the value under configure subscriber-mgmt wlan-gw mgw-profile profile-name rat-type type will be used.

26-10415-22

3GPP-User-Location-Info

This attribute specifies the location information for a given UE that will be echoed in the ULI IE in GTP-C setup messages. The format and radius-to-GTP mapping is specified in 3GPP specification 29.061. If not present, no user location will be reflected in GTP. Radius servers can use the information from e.g. attributes [30] Called-Station-Id, [26-6527-206] Alc-Wlan-SSID-VLAN and/or [87] NAS-Port-Id to create a corresponding ULI value.

4

NAS-IP-Address

ipaddr

4 Bytes

Example:

NAS-IPAddress = 10.1.1.2

30

Called-Station-Id

string

64 chars.

Example:

Called-Station-Id = “0a-0b-0c-00-00-01 : AirportWifi”

31

Calling-Station-Id

string

64 chars.

Example:

Calling-station-id = 00:00:00:00:00:01

87

NAS-Port-Id

string

253 chars.

L2TP | GRE: “<tunnel-type> rtr-<virtual router id>#lip-<local ip address>#rip-<remote ip address>”

VLAN: “VLAN svc-<svc-id>[:<vlan>[.<vlan>]]”

Example:

NAS-Port-Id = “GRE rtr-11#lip-50.1.1.1#rip-201.1.1.2”

26-3561-1

Agent-Circuit-Id

string

247 chars.

String containing information about the AP and the SSID that the UE is associated with. Recommended format is <AP-MAC>;<SSID-Name>;<SSID-Type>. SSID-Type can be open (‘o’), or secure (‘s’)

Example:

Agent-Circuit-Id = “00:00:00:00:00:01;xfinity-wifi;o”

26-6527-145

Alc-MGW-Interface-Type

integer

values [1 to 3]

Gn(GTPv1)=1; S2a(GTPv2)=2; S2b(GTPv2)=3

default = s2a

Example: Alc-MGW-Interface-Type = 1

26-6527-146

Alc-Wlan-APN-Name

string

100 chars. if both <NI> and <OI> parts are present.

63 chars. if only the <NI> part is present.

The APN Name attribute must be formatted as <NI>[.mnc<MNC>.mcc<MCC>.gprs]. The Operator-ID (OI) part is optional and is automatically derived from the IMSI if it is not present.

The APN FQDN generated for DNS resolution is composed of the Network-ID (<NI>) portion and the Operator-ID (OI) portion (<MCC> and <MNC>) as per 3GPP TS 29.303 and is reformatted as <NI>.apn.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org

Example: Alc-Wlan-APN-Name = wlangw.mnc004.mcc204.gprs

26-6527-147

Alc-MsIsdn

string

9 to 15 digits

Example: Alc-MsIsdn = 13109976224

26-6527-148

Alc-RSSI

integer

32 bit value

Example: Alc-RSSI = 30

26-6527-149

Alc-Num-Attached-Ues

integer

32 bit value

Example: Alc-Num-Attached-Ues = 3

26-6527-172

Alc-Wlan-Portal-Redirect

string

32 chars.

Example: Alc-Wlan-Portal-Redirect = Redirect-policy-1

26-6527-173

Alc-Wlan-Portal-Url

string

253 chars.

Example: Alc-Wlan-Portal-Url = http:// welcome.portal.com

26-6527-179

Alc-GTP-Local-Breakout

integer

values [0 to 1]

values: not-allowed = 0, allowed = 1

Example:

Alc-GTP-Local-Breakout = allowed

26-6527-184

Alc-Wlan-Ue-Creation-Type

integer

values [0 to 1]

values: iom = 0, isa = 1

Any other value is invalid and the corresponding RADIUS message will be dropped.

Example:

Alc-Wlan-Ue-Creation-Type = iom

26-6527-186

Alc-Wlan-Dsm-Ot-Http-Redirect-Url