Mist RADIUS Attributes

Table of Contents:

1. Supported RADIUS Authentication Attributes
   1. IETF Standard Attributes
   2. Supported Vendor-Specific Attributes
2. RADIUS Accounting Attributes
3. Dynamic Authorization Extensions

1.   Supported RADIUS Authentication Attributes

The RADIUS protocol follows client-server architecture and uses the User Datagram Protocol (UDP) as described in RFC 2865. An Access Point sends user information to the RADIUS server in an Access-Request message and after receiving a reply from the server acts according to the returned information.

During authentication the RADIUS server then returns one of three responses to the Access Point:

• Access-Reject – The user is unconditionally denied access to the requested network resource. Failure reasons may include an invalid credentials or an inactive account.
• Access-Challenge – Requests additional information from the user such as a secondary password, PIN, token or card. Access-Challenge is also used in more complex authentication when a secure tunnel is established between the user and the Radius Server such as authentication using Extensible Authentication Protocol (EAP).
• Access-Accept – The user is permitted access. The Access-Request often includes additional configuration information for the user using return attributes.

RADIUS services can be enabled on the Mist Access Points for WLAN user authentication. RADIUS services are required for WLANs implementing 802.1X EAP or MAC based authentication.

1.1         IETF Standard Attributes

The following table outlines the standard authentication attributes that have been implemented in Mist Access Points in accordance with RFC 2865. Additional extensions have also been implemented following the recommendations in RFC 2868 and RFC 2869.

Supported IETF Standard Authentication Attributes

1.1.1      Tunnel-Private-Group-ID

The Tunnel-Private-Group-ID attribute may be forwarded in the Access-Accept to indicate the dynamic VLAN membership of an 802.1X or RADIUS MAC authenticated user.

1.1.2      Filter-Id

The Filter-Id attribute may be forwarded in the Access-Accept and indicates user role client will be associated with. User Groups are used by Mist WxLAN policy framework to assign granular network resource restrictions.

WxLAN Policy example configuration:

1.1.3      NAS-Identifier

The NAS-Identifier attribute is a user-configurable AVP that could be unique per WLAN configuration. All Mist Access Points would send the configured NAS-ID value. Please note that Mist Cloud allows for dynamic payload configuration, such as to send current AP hostname, Site Name or AP MAC address, AP model, using pre-defined variables for example:

{{DEVICE_NAME}}

{{DEVICE_MODEL}}

{{DEVICE_MAC}}

{{SITE_NAME}}

The above configuration would result in AP sending NAS ID that would include AP Hostname as well as Mist Site name in the request:

1.2         Supported Vendor-Specific Attributes

The following table outlines vendor-specific attributes (VSAs) that are supported by Mist Access Points in accordance with RFC 2865.

1.2.1      Airespace-Interface-Name

The Airespace-Interface-Name attribute may be forwarded in the Access-Accept to indicate the dynamic VLAN membership of an 802.1X or RADIUS MAC authenticated user. Returned attribute value is always a string formatted name of the VLAN. VLAN Name to VLAN ID translation must be configured under WLAN using VLAN IDs or Variables.

1.2.2      Airespace-ACL-Name

The Airespace-ACL-Name attribute maybe forwarded in the Access-Accept and indicates user role client will be associated with. User Groups are used by Mist WxLAN policy framework to assign granular network resource restrictions.

WxLAN Policy example configuration:

1.2.3      Aruba-User-Role

The Aruba-User-Role attribute maybe forwarded in the Access-Accept and indicates user role client will be associated with. User Groups are used by Mist WxLAN policy framework to assign granular network resource restrictions.

WxLAN Policy example configuration:

1.2.4      Cisco-AVPair url-redirect

The Cisco-AVPair attribute maybe forwarded in the Access-Accept to indicate to the Mist Access Point that a client needs to be redirected for portal authentication and specify the redirect-URL location. This attribute is typically used for Guest Access integrations with Cisco ISE or Aruba Clearpass RADIUS servers or to enable Posture Redirect functionality for 802.1X/EAP users.

1.2.5      Cisco-AVPair PSK

The Cisco-AVPair attribute may also contain PSK attribute, indicating to the Mist Access Point which passphrase is assigned to a certain client. Note that to provide a PSK value to the AP, two Cisco AVPair attributes must be sent simultaneously, one indicating that PSK will be sent in ASCII format and another AVPair providing the actual Pre-Shared Key value.

1.2.6      Eleven-Authentication-Find-Key

The Eleven-Authentication-Find-Key attribute is used to supply additional information to the supported RADIUS servers to simplify wireless client PSK lookup via RADIUS, removing the need to pre-associate a wireless client MAC with a particular PSK ahead of time. This attribute is a TLV according to the RFC6929 that contains multiple sub-attributes inside.

Example packet capture:

2     RADIUS Accounting Attributes

RADIUS accounting information can be used to track individual user’s network usage for billing purposes as well as be used as a tool for gathering statistic for general network monitoring.

When network access is granted to the user by the Access Point, an Accounting-Request message with the Acct-Status-Type field set to Start is forwarded by the Access Point to the RADIUS server to signal the start of the user’s network access. Start records typically contain the user’s identification, point of attachment and a unique session identifier.

Optionally periodic Accounting-Request messages with the Acct-Status-Type field set to Interim-Update may be sent by the Access Point to the RADIUS server to update it on the status of an active session. Interim records typically convey the current session duration and information on current data usage.

When the user’s session is closed (wireless client disconnects from the AP or roams to the next Access Point), the Access Point forwards an Accounting-Request message with the Acct-Status-Type field set to Stop. This provides information on the final usage in terms of time, packets transferred, data transferred and reason for disconnect and other information related to the user’s network access.

RADIUS Accounting can be enabled / disabled per WLAN. For each WLAN the following accounting configuration is supported:

• Start-Stop – Mist Access Points will forward Accounting-Requests at the start and end of the user sessions. This behavior is enabled by default, as soon as at least one Accounting server is configured under WLAN.

• Start-Interim-Stop – Mist Access Points will forward Accounting-Requests at the start and end of the user sessions as well as periodically during the lifetime of the sessions. In addition to that, Framed-IP-Address attribute will be included in the Accounting messages. Note that Interim-Update interval can also be dynamically overridden by sending Acct-Interim-Interval (85) AVP from the RADIUS server.

The following table outlines the standard RADIUS accounting attributes that have been implemented in the Mist Access Points in accordance with RFC 2866:

IETF Standard Accounting Attributes 

3     Dynamic Authorization Extensions

The RADIUS authentication protocol originally did not support unsolicited messages sent from the RADIUS server to the Access Point. However, there are many instances in which it is desirable for changes to be made to session characteristics without requiring the Access Point to initiate the exchange.

To overcome these limitations several vendors have implemented additional RADIUS extensions support unsolicited messages sent from the RADIUS server to an Access Point. These extensions support Disconnect and Change-of-Authorization (CoA) messages that can be used to terminate an active user session or change the characteristics of an active session.

Disconnect-Request – Causes a user session to be terminated. The Disconnect-Request packet identifies the NAS as well as the user session to be terminated by inclusion of the identification attributes shown in table 3.0.

CoA-Request – Causes session information to by dynamically updated on the Access Point.

The following table outlines the required dynamic authorization attributes for Disconnect and CoA Requests respectively.

3.1     Disconnect-Request

Example packet capture:

Note that if addititional Attributes are sent by the RADIUS server, some will also be evaluated (for example NAS-IP-Address value must match current IP address of the Mist AP, or Acct-Session-Id must match wireless client session ID), while other attributes that are not supported will be ignored (for example Acct-Terminate-Cause). The minimum set of attributes outlined in the table above is sufficient for the Disconnect to work.

3.2     CoA-Request

Example packet capture:

Note that other Attributes if sent by the RADIUS server will also be evaluated (for example NAS-IP-Address value must match current IP address of the Mist AP, or Acct-Session-Id must match wireless client session ID), while attributes that are not supported will be ignored (for example any additional Cisco-AVPair attributes). The minimum set of attributes outlined in the table above is sufficient for the CoA to work.

Note: in case of MAC-Authentication and CoA, subsequent Access-Accept must contain User-Name attribute that would be equal to the wireless client MAC address