WLAN gateway

4

NAS-IP-Address

The identifying IP Address of the NAS requesting Authentication or Accounting. Authentication generated from ISA (for a UE in migrant state) can be configured to use local IP address of RADIUS client on the ISA or the system IP address (on CPM).

config aaa isa-radius-policy name nas-ip-address-origin {isa-ip | system-ip}

When an ESM host exists for the UE (UE is in authenticated state), then the NAS IP in authentication and accounting is the system IP address.

30

Called-Station-Id

If configured for inclusion in authentication and accounting policy (configure aaa isa-radius-policy name auth-include-attributes/acct-include-attributes called-station-id), the called-station-id received from EAP authentication request is transparently forwarded in access-request. If it is contained in the accounting messages received from the APs, it is transparently forwarded in the accounting messages sent from the WLAN-GW.

Typically the string contains ‟AP MAC : SSID-name”.

31

Calling-Station-Id

Calling-station-id contains the MAC address of the UE, if it is configured for inclusion in isa-radius-policy (configure aaa isa-radius-policy name auth-include-attributes calling-station-id) for authentication generated from the ISA (for a UE in migrant state), or in authentication and accounting policy for messages generated from the CPM. For CPM generated authentication or accounting, the inclusion of calling-station-id must explicitly specify the format of the calling-station-id as MAC: configure subscriber-mgmt authentication-policy | radius-accounting-policy name include-radius-attribute calling-station-id mac.

87

NAS-Port-Id

A text string with format defined by the aggregation type:

GRE, L2TPv3 or VLAN.

See [87] NAS-Port-Id attribute details for a detailed description of the attribute format.

26.3561.1

Agent-Circuit-Id

Agent-circuit-id is transparently taken from the circuit-id in DHCP option-82. Most WIFI access-points insert information describing the AP and SSID that the UE is associated with. Recommended format is an ASCII string containing APs MAC@, SSID name and SSID type (open or secure), with a delimiter between each, as shown in example:

‟00:00:00:00:00:01;xfinity-wifi;o”

26.6527.148

Alc-RSSI

Received Signal Strength Indication. Used in conjunction with the radius-proxy track-accounting feature. When the radius-proxy receives this attribute in an accounting message, it is copied into the DHCP lease state and echoed by SR OS accounting.

26.6527.149

Alc-Num-Attached-Ues

Number of attached WIFI UEs. The attribute is forwarded by the RADIUS proxy when received in an Access-Request from the AP.

For authentication originated by the WLAN gateway, this attribute contains the total number of UEs that are currently attached to this UE’s tunnel. This can be used to detect if this is the first UE on a tunnel (value 1). For non wlan-gw/vRGW UEs this value is 0. Inclusion can be configured by adding the option wifi-num-attached-ues in configure subscriber-mgmt authentication-policy name include-radius-attribute for ESM, and in configure aaa isa-radius-policy name auth-include-attributes for DSM.

26.6527.172

Alc-Wlan-Portal-Redirect

Used when authenticating migrant hosts. When an access-accept contains this attribute, the host stays in the migrant phase, but has limited forwarding capabilities. All filtered (not allowed) http-traffic is redirected to a specified portal URL. This attribute must contain the name of a redirect policy configured under configure subscriber-mgmt http-redirect-policy policy-name which specifies a set of forwarding filters.

To force a redirect with the configured policy and URL, send an empty Alc- Wlan-Portal-Redirect VSA.

26.6527.173

Alc-Wlan-Portal-Url

If a migrant host is redirected, specifies the URL it has to be redirected to, takes precedence over the URL configured in the redirect policy under configure subscriber-mgmt http-redirect-policy policy-name.

26.6527.184

Alc-Wlan-Ue-Creation-Type

When promoting a migrant user, this indicates if the UE should be created on CPM/IOM (as an ESM host) or on ISA (as a DSM host). When this attribute is not present during promote, creation-type CPM/IOM is assumed.

The attribute can be included in an Access-Accept message for a UE that is auto-signed-in (it does not need web redirect to portal), or in a CoA message triggered to remove web redirect for a UE after successful portal authentication.

If Alc-Wlan-Ue-Creation-Type indicates a DSM UE then any IPv6 or GTP related parameters in an Access-Accept or CoA message is ignored, and the UE is created as a DSM host.

Alc-WLAN-UE-Creation-Type cannot be changed mid-session for a UE in DSM or ESM state.

26.6527.186

Alc-Wlan-Dsm-Ot-Http-Redirect-Url

If a one-time redirect is enabled for a distributed subscriber management host, then this attribute specifies the redirect URL. This URL overrides the configured URL under configure service ies/vprn service-id subscriber-interface ip-int-name group-interface ip-int-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt one-time-redirect.

This attribute is mutual exclusive with Alc-Wlan-Dsm-Http-Redirect-Url (241.26.6527.65). If both attributes are signaled simultaneously this attribute is ignored, otherwise this value removes the redirect URL override.

26.6527.187

Alc-Wlan-Dsm-Ip-Filter

Specifies the name of a distributed subscriber management (DSM) ip filter configured under configure subscriber-mgmt isa-filter dsm-ip-filter-name. This filter is applied to the DSM UE. This overrides the value configured under configure service ies/vprn service-id subscriber-interface ip-int-name group-interface ip-int-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt dsm-ip-filter dsm-ip-filter-name.

26.6527.188

Alc-Wlan-Dsm-Ingress-Policer

Specifies the name of a distributed subscriber management (DSM) ingress policer configured under configure subscriber-mgmt isa-policer policer-name. This policer is applied to the DSM UE. This overrides the value configured under configure service ies/vprn service-id subscriber-interface ip-int-name group-interface ip-int-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt ingress-policer policer-name.

26.6527.189

Alc-Wlan-Dsm-Egress-Policer

Specifies the name of a distributed subscriber management (DSM) egress policer configured under configure subscriber-mgmt isa-policer policer-name. This policer is applied to the DSM UE. This overrides the value configured under configure service ies/vprn service-id subscriber-interface ip-int-name group-interface ip-int-name wlan-gw vlan-tag-ranges range start starting-vlan end ending-vlan distributed-sub-mgmt egress-policer policer-name.

26.6527.190

Alc-Wlan-Handover-Ip-Address

IP address provided in RADIUS Access-Accept message to signal handover from LTE or UMTS to WIFI. If this VSA is present, handover indication is set in GTP session creation request to PGW/GGSN.

26.6527.206

Alc-Wlan-SSID-VLAN

The VLAN is transparently taken from the UEs Ethernet layer and can be reflected in both authentication and accounting. This is typically added by the Access Point and uniquely identifies an SSID. This is useful when the SSID is not available in the [30] Called-Station-Id (for example, datatrigger scenarios). When this attribute is configured for inclusion but no VLAN is present in the UE payload, the attribute is not reflected in RADIUS.

When this attribute is sent in an Access-Accept message for a RADIUS proxy, the VLAN is used to perform SSID validation. If there is already an active UE and there is a mismatch between both VLANs, the UE is removed. If there is no UE present yet, the VLAN is stored and any subsequent data-plane packets (such as, DHCP Discover) is dropped unless the stored VLAN is matched.

26.6527.216

Alc-Datatrig-Lease-Time

Defines the initial lease-time used for data-triggered DHCP relay hosts. If this attribute is not provided or equal to zero, the used lease-time is 7 days. This lease time is overridden upon the first renew after data-triggered host-creation.

26.6527.218

Alc-Wlan-Handover-Ipv6-Address

Specifies the current IPv6 address of the UE in a 3GPP-to-WLAN handover scenario. In GTPv2 this sets the HI bit and signals the IP in the PDN Address Allocation IE. In GTPv1 this is not supported.

26.6527.233

Alc-Tunnel-QoS-Override

Used to override WLAN gateway tunnel HQoS parameters (aggregate rate and scheduler PIR/CIR), and enables per-tunnel customization. This attribute is included in a per-UE RADIUS message, and the value is applied to the tunnel with which the tunnel is currently associated. To remove an override, an empty value should be signaled. When removing an override, the tunnel QoS reverts to the configured values. It is not possible to revert to a previously applied override. It is also not possible to enable QoS using overrides. Tunnel QoS must be enabled on the WLAN gateway for overrides to function.

241.26.6527.6

Alc-Xconnect-Tunnel-Service

Specifies the service in which the control and data traffic for a x-connect UE is tunneled between visited WLAN-GW and home WLAN-GW. X-connect UE is a roaming UE that requires to be anchored on its home WLAN-GW.

241.26.6527.7

Alc-Xconnect-Tunnel-Remote-Ipv6

Specifies the IPv6 destination endpoint of the tunnel between visited WLAN-GW and home WLAN-GW for a x-connect UE.

241.26.6527.8

Alc-Xconnect-Tunnel-Type

Specifies the type of tunnel between visited WLAN-GW and home WLAN-GW for a x-connect UE. Supported tunnel types are L2oGRE and L2TPv3 with IPv6 transport.

241.26.6527.49

Alc-Xconnect-Tunnel-Local-Ipv6

Specifies the IPv6 source used for the tunnel between visited WLAN-GW and home WLAN-GW for a x-connect UE.

241.26.6527.59

Alc-Xconnect-Tunnel-Home-Ipv6

Specifies the x-connect IPv6 gateway address configured on the home WLAN-GW (H-GW). When the host moves to the visited WLAN-GW (V-GW) the RADIUS server can return the IPv6 address in authentication using the [241.26.6527.7] Alc-Xconnect-Tunnel-Remote-Ipv6 attribute. The V-GW can then setup a x-connect tunnel to this H-GW IPv6 address.

Inclusion can be configured by adding the option xconnect-tunnel-home-address in configure subscriber-mgmt authentication-policy name include-radius-attribute for ESM, and in configure aaa isa-radius-policy name auth-include-attributes for DSM.

241.26.6527.65

Alc-Wlan-Dsm-Http-Redirect-Url

Overrides the HTTP redirect URL of an ISA filter action configured under configure subscriber-mgmt isa-filter name entry id action or configure subscriber-mgmt isa-filter name ipv6 entry id action.

This attribute is mutually exclusive with Alc-Wlan-Dsm-Ot-Http-Redirect-Url (26.6527.186). If signaled simultaneously, the one-time redirect is ignored, otherwise this value removes the one-time redirect override.

26.25053.2

Ruckus-Sta-RSSI

Received Signal Strength Indication. Used in conjunction with the radius-proxy track-accounting feature. When the radius-proxy receives this attribute in an accounting message, it is copied into the DHCP lease state and echoed by the SR OS accounting.

4

NAS-IP-Address

ipaddr

4 bytes

For example:

NAS-IPAddress = 10.1.1.2

30

Called-Station-Id

string

64 chars

For example:

Called-Station-Id = ‟0a-0b-0c-00-00-01 : AirportWifi”

31

Calling-Station-Id

string

64 chars

For example:

Calling-station-id = 00:00:00:00:00:01

87

NAS-Port-Id

string

253 chars

See [87] NAS-Port-Id attribute details for a detailed description of the attribute format.

L2TP | GRE: ‟<tunnel-type> rtr-<virtual router id>#lip-<local ip address>#rip-<remote ip address>”

VLAN: ‟VLAN svc-<svc-id>[:<vlan>[.<vlan>]]”

For example:

NAS-Port-Id = ‟GRE rtr-11#lip-192.0.2.1#rip-172.16.1.1”

26.3561.1

Agent-Circuit-Id

string

247 chars

String containing information about the AP and the SSID that the UE is associated with. Recommended format is <AP-MAC>;<SSID-Name>;<SSID-Type>. SSID-Type can be open (‛o’), or secure (‛s’)

For example:

Agent-Circuit-Id = ‟00:00:00:00:00:01;xfinity-wifi;o”

26.6527.148

Alc-RSSI

integer

32 bit value

For example:

Alc-RSSI = 30

26.6527.149

Alc-Num-Attached-Ues

integer

32 bit value

For example:

Alc-Num-Attached-Ues = 3

26.6527.172

Alc-Wlan-Portal-Redirect

string

32 chars

For example:

Alc-Wlan-Portal-Redirect = Redirect-policy-1

26.6527.173

Alc-Wlan-Portal-Url

string

247 chars

For example:

Alc-Wlan-Portal-Url = http:// welcome.portal.com

26.6527.184

Alc-Wlan-Ue-Creation-Type

integer

values

[0 to 1]

values: iom = 0, isa = 1

Any other value is invalid and the corresponding RADIUS message is dropped.

For example:

Alc-Wlan-Ue-Creation-Type = iom

26.6527.186

Alc-Wlan-Dsm-Ot-Http-Redirect-Url

string

247 chars

For example:

Alc-Wlan-Dsm-Ot-Http-Redirect-Url = ‟http://www.mydomain.com/advertisement?mac=$MAC”

26.6527.187

Alc-Wlan-Dsm-Ip-Filter

string

32 chars

If the filter cannot be found, the RADIUS Access-Accept message is dropped or the CoA NAK’d.

For example:

Alc-Wlan-Dsm-Ip-Filter = drop_non_http

26.6527.188

Alc-Wlan-Dsm-Ingress-Policer

string

32 chars

If the policer cannot be found, the RADIUS Access-Accept message is dropped or the CoA NAK’d.

For example:

Alc-Wlan-Dsm-Ingress-Policer = 1 Mb/s

26.6527.189

Alc-Wlan-Dsm-Egress-Policer

string

32 chars

If the policer cannot be found, the RADIUS Access-Accept message is dropped or the CoA NAK’d.

For example:

Alc-Wlan-Dsm-Egress-Policer = 10 Mb/s-limit

26.6527.190

Alc-Wlan-Handover-Ip-Address

ipaddr

4 bytes

For example:

Alc-Wlan-Handover-Ip-Address = 10.1.1.1

26.6527.206

Alc-Wlan-SSID-VLAN

string

247 chars

Textual representation of the vlan. If no vlan-tag was present, this attribute is not included.

For example:

Alc-Wlan-SSID-VLAN = ‟2173”

26.6527.216

Alc-Datatrig-Lease-Time

integer

[0 to 2147483647]

seconds

0: fallback to the default lease-time of 7 days.

[1 to 2147483647] lease-time in seconds

For example:

Alc- Datatrig-Lease-Time = 3600

26.6527.218

Alc-Wlan-Handover-Ipv6-Address

ipv6addr

16 bytes

# IPv6 address

For example:

Alc-Wlan-Handover-Ipv6-Address = 2001:db8::1

26.6527.233

Alc-Tunnel-QoS-Override

string

Up to 4 attributes

<direction>:<QoS object>:[<id or name>:][<parameter>=value,...]

<direction> = e or E for egress

<QoS object> = r or R for egress aggregate-rate overrides

<QoS object> = s or S for scheduler overrides

<id or name> = identifies the QoS object, for example scheduler-name

<parameter>=value,... = a comma-separated list of parameters to override with the corresponding value. All rates and CIRs are in kb/s.

[eE]:[rR]:(rate)

[eE]:[sS]:<scheduler-name>:(rate|cir)

For example:

aggregate rate override to 8 Mb/s

Alc-Tunnel-QoS-Override += e:r:rate=8000

241.26.6527.6

Alc-Xconnect-Tunnel-Service

integer

2147483647

ID

A valid VPRN or IES service ID

For example:

Alc-Xconnect-Tunnel-Service = 20

241.26.6527.7

Alc-Xconnect-Tunnel-Remote-Ipv6

ipv6addr

16 bytes

IPv6 address

For example:

Alc-Xconnect-Tunnel-IPv6 = 2001:db8::1

241.26.6527.8

Alc-Xconnect-Tunnel-Type

integer

Values

[0,1]

0 = l2tpv3

1 = gre

For example:

Alc-Xconnect-Tunnel-Type = 0

241.26.6527.49

Alc-Xconnect-Tunnel-Local-Ipv6

ipv6addr

16 bytes

IPv6 address

For example:

Alc-Xconnect-Tunnel-IPv6 = 2001:db8::1

241.26.6527.59

Alc-Xconnect-Tunnel-Home-Ipv6

ipv6addr

16 bytes

IPv6 address

For example:

Alc-Xconnect-Tunnel-Home-Ipv6 = 2001:db8::1

241.26.6527.65

Alc-Wlan-Dsm-Http-Redirect-Url

string

247 chars

The URL to return in the HTTP Location Header Field. The following variables are automatically replaced:

• $MAC (MAC address of the UE)

• $IP (IP address of the UE)

• $URL (URL of the original HTTP)

For example:

Alc-Wlan-Dsm-Http-Redirect-Url = http://recharge.portal.com?mac=$MAC

26.25053.2

Ruckus-Sta-RSSI

integer

32 bit value

For example:

Ruckus-Sta-RSSI = 28

4

NAS-IP-Address

1

0

0

1

30

Called-Station-Id

0-1

0

0-1

0-1

31

Calling-Station-Id

0-1

0

0-1

0-1

87

NAS-Port-Id

0-1

0

0-1

0-1

26.3561.1

Agent-Circuit-Id

0-1

0

0

0-1

26.6527.148

Alc-RSSI

0

0

0

0-1

26.6527.149

Alc-Num-Attached-Ues

0-1

0

0

0-1

26.6527.172

Alc-Wlan-Portal-Redirect

0

0-1

0

0

26.6527.173

Alc-Wlan-Portal-Url

0

0-1

0

0

26.6527.184

Alc-Wlan-Ue-Creation-Type

0

0-1

0-1

0-1

26.6527.186

Alc-Wlan-Dsm-Ot-Http-Redirect-Url

0

0-1

0-1

0

26.6527.187

Alc-Wlan-Dsm-Ip-Filter

0

0-1

0-1

0

26.6527.188

Alc-Wlan-Dsm-Ingress-Policer

0

0-1

0-1

0

26.6527.189

Alc-Wlan-Dsm-Egress-Policer

0

0-1

0-1

0

26.6527.190

Alc-Wlan-Handover-Ip-Address

0

0-1

0

0

26.6527.206

Alc-Wlan-SSID-VLAN

0-1

0-1

0

0-1

26.6527.216

Alc-Datatrig-Lease-Time

0

0-1

0

0

26.6527.218

Alc-Wlan-Handover-Ipv6-Address

0

0-1

0

0

26.6527.233

Alc-Tunnel-QoS-Override

0

0-1

0-1

0

241.26.6527.6

Alc-Xconnect-Tunnel-Service

0

0-1

0

0-1

241.26.6527.7

Alc-Xconnect-Tunnel-Remote-Ipv6

0

0-1

0

0-1

241.26.6527.8

Alc-Xconnect-Tunnel-Type

0

0-1

0

0-1

241.26.6527.49

Alc-Xconnect-Tunnel-Local-Ipv6

0

0

0

0-1

241.26.6527.59

Alc-Xconnect-Tunnel-Home-Ipv6

0-1

0

0

0-1

26.25053.2

Ruckus-Sta-RSSI

0

0

0

0-1

1

User-Name

1

0

0

2

User-Password

1

0

0

0

4

NAS-IP-Address

0-1

0

0

0

5

NAS-Port

0-1

0

0

0

8

Framed-IP-Address

0-1

0

0

0

25

Class

0

0+

0+

0+

27

Session-Timeout

0

0-1

0-1

0-1

28

Idle-Timeout

0

0-1

0-1

0-1

30

Called-Station-Id

0-1

0

0

0

31

Calling-Station-Id

0-1

0

0

0

32

NAS-Identifier

0-1

0

0

0

44

Acct-Session-Id

0

0

0

61

NAS-Port-Type

0-1

0

0

0

85

Acct-Interim-Interval

0

0

0-1

0-1

87

NAS-Port-Id

0-1

0

0

0

26.3561.1

Agent-Circuit-id

0-1

0

0

0

26.3561.2

Agent-Remote-id

0-1

0

0

0

26.6527.9

Alc-Primary-Dns

0

0-1

0-1

0-1

26.6527.10

Alc-Secondary-Dns

0

0-1

0-1

0-1

26.6527.17

Alc-Retail-Serv-id

0

0-1

0-1

0

26.6527.27

Alc-Client-Hardware-Addr

0-1

0

0

0

26.6527.36

Alc-Dhcp-Vendor-Class-id

0-1

0

0

0

26.6527.45

Alc-App-Prof-Str

0

0-1

0-1

0-1

26.6527.96

Alc-Credit-Control-Quota

0

0

0+

0+

26.6527.99

Alc-Ipv6-Address

0-1

0

0

0

26.6527.102

Alc-ToServer-Dhcp-Options

0+

0

0

0

26.6527.105

Alc-Ipv6-Primary-Dns

0

0-1

0-1

0-1

26.6527.106

Alc-Ipv6-Secondary-Dns

0

0-1

0-1

0-1

26.6527.122

Alc-LI-Action

0

0

0-1

0-1

26.6527.123

Alc-LI-Destination

0

0

0-1

0-1

26.6527.138

Alc-LI-Intercept-Id

0

0

0-1

0-1

26.6527.139

Alc-LI-Session-id

0

0

0-1

0-1

26.6527.172

Alc-Wlan-Portal-Redirect

0

1

0

0

26.6527.173

Alc-Wlan-Portal-Url

0

0-1

0

0

26.6527.182

Alc-AA-Sub-Http-Url-Param

0

0

0-1

0-1

26.6527.184

Alc-Wlan-Ue-Creation-Type

0

0

1

0-1

26.6527.186

Alc-Wlan-Dsm-Ot-Http-Redirect-Url

0

0

0-1

0-1

26.6527.187

Alc-Wlan-Dsm-Ip-Filter

0

0

0-1

0-1

26.6527.188

Alc-Wlan-Dsm-Ingress-Policer

0

0

0-1

0-1

26.6527.189

Alc-Wlan-Dsm-Egress-Policer

0

0

0-1

0-1

26.6527.191

Alc-ToServer-Dhcp6-Options

0+

0

0

0

26.6527.193

Alc-AA-App-Service-Options

0

0-8

0-8

0-8

26.6527.206

Alc-Wlan-SSID-VLAN

0-1

0

0

241.26.6527.59

Alc-Xconnect-Tunnel-Home-Ipv6

0-1

0

0

0

241.26.6527.65

Alc-Wlan-Dsm-Http-Redirect-Url

0

0

0-1

0-1