Table C-2 RADIUS (IETF) AV Pairs
| No.
|
Attribute
|
Description
|
Cisco IOS Release 11.1
|
Cisco IOS Release 11.2
|
1
|
User-Name
|
Name of the user being authenticated.
|
Yes
|
Yes
|
2
|
User-Password
|
User's password or input following an Access-Challenge. Passwords longer than 16 characters are encrypted using IETF Draft #2 or later specifications.
|
Yes
|
Yes
|
3
|
CHAP-Password
|
PPP1 CHAP2 response to an Access-Challenge.
|
Yes
|
Yes
|
4
|
NAS-IP Address
|
IP address of the NAS that is requesting authentication.
|
Yes
|
Yes
|
5
|
NAS-Port
|
Physical port number of the NAS that is authenticating the user. The NAS-Port value (32 bits) consists of one or two 16-bit values, depending on the setting of the radius-server extended-portnames command. Each 16-bit number is a 5-digit decimal integer interpreted as follows:
- For asynchronous terminal lines, async network interfaces, and virtual async interfaces, the value is 00ttt, where ttt is the line number or async interface unit number.
- For ordinary synchronous network interfaces, the value is 10xxx.
- For channels on a primary rate ISDN3 interface, the value is 2ppcc.
- For channels on a basic rate ISDN interface, the value is 3bb0c.
- For other types of interfaces, the value is 6nnss.
|
Yes
|
Yes
|
6
|
Service-Type
|
Type of service requested or the type of service to be provided:
Framed for known PPP or SLIP4 connection.
Administrative-user for enable command.
Login—Make a connection.
Framed—Start SLIP or PPP.
Administrative User—Start an EXEC or enable ok.
Exec User—Start an EXEC session.
|
Yes
|
Yes
|
7
|
Framed-Protocol
|
Framing to be used for framed access.
|
Yes
|
Yes
|
8
|
Framed-IP-Address
|
Address to be configured for the user.
|
Yes
|
Yes
|
9
|
Framed-IP-Netmask
|
IP netmask to be configured for the user when the user is a router to a network. This attribute-value results in a static route being added for Framed-IP-Address with the mask specified.
|
Yes
|
Yes
|
10
|
Framed-Routing
|
Routing method for the user when the user is a router to a network. Only None and Send and Listen values are supported for this attribute.
|
Yes
|
Yes
|
11
|
Filter-Id
|
Name of the filter list for the user, formatted as follows: %d, %d.in, or %d.out. This attribute is associated with the most recent service-type command. For login and EXEC, use %d or %d.out as the line access list value from 0 to 199. For Framed service, use %d or %d.out as interface output access list and %d.in for input access list. The numbers are self-encoding to the protocol to which they refer.
|
Yes
|
Yes
|
13
|
Framed-Compression
|
Compression protocol used for the link. This attribute results in a "/compress" being added to the PPP or SLIP autocommand generated during EXEC authorization. Not currently implemented for non-EXEC authorization.
|
Yes
|
Yes
|
14
|
Login-IP-Host
|
Host to which the user will connect when the Login-Service attribute is included.
|
Yes
|
Yes
|
15
|
Login-Service
|
Service that should be used to connect the user to the login host.
|
Yes
|
Yes
|
16
|
Login-Port
|
TCP5 port with which the user is to be connected when the Login-Service attribute is also present.
|
Yes
|
Yes
|
17
|
Change-Password
|
Request to change a user's password.
|
No
|
11.2(5)F
|
18
|
Reply-Message
|
Text to be displayed to the user.
|
Yes
|
Yes
|
21
|
Password-Expiration
|
Expiration date for a user's password in the user's file entry.
|
No
|
11.2(5)F
|
22
|
Framed-Route
|
Routing information to be configured for the user on this NAS. The RADIUS RFC6 format (net/bits [router [metric]]) and the old style dotted mask (net mask [router [metric]]) are supported. If the router field is omitted or 0, the peer IP address is used. Metrics are currently ignored.
|
Yes
|
Yes
|
24
|
State
|
Allows State information to be maintained between the NAS and the RADIUS server. This attribute is applicable only to CHAP challenges.
|
Yes
|
Yes
|
26
|
Vendor-Specific
|
Allows vendors to support their own extended attributes unsuitable for general use. The Cisco RADIUS implementation supports one vendor-specific option using the format recommended in the specification. Cisco's vendor-ID is 9, and the supported option has vendor-type 1, cisco-avpair. The value is a string of the format:
protocol:attribute sep value
"Protocol" is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an appropriate AV pair defined in the Cisco TACACS+ specification, and "sep" is "=" for mandatory attributes and "*" for optional attributes. This allows the full set of TACACS+ authorization features to be used for RADIUS. For example:
cisco-avpair= "ip:addr-pool=first"
cisco-avpair= "shell:priv-lvl=15"
The first example causes Cisco's multiple named ip address pools feature to be activated during IP authorization (during PPP's IPCP address assignment). The second example causes a NAS Prompt user to have immediate access to EXEC commands.
|
Yes
|
Yes
|
27
|
Session-Timeout
|
Maximum number of seconds of service to be provided to the user before the session terminates. This attribute value becomes the per-user absolute timeout. This attribute is not valid for PPP sessions.
|
Yes
|
Yes
|
28
|
Idle-Timeout
|
Maximum number of consecutive seconds of idle connection allowed to the user before the session terminates. This attribute value becomes the per-user session-timeout. This attribute is not valid for PPP sessions.
|
Yes
|
Yes
|
34
|
Login-LAT-Service
|
System with which the user is to be connected by LAT. This attribute is only available in the EXEC mode.
|
Yes
|
Yes
|
35
|
Login-LAT-Node
|
Node with which the user is to be automatically connected by LAT7.
|
No
|
No
|
36
|
Login-LAT-Group
|
LAT group codes that this user is authorized to use.
|
No
|
No
|
