Appendix G. Supported RADIUS Attribute/Value Pairs for VoIP operation

Table of Contents

G.1. Authentication request

G.2. Authentication response

G.2.1. Challenge authentication
G.2.2. Accepted authentication (registration)
G.2.3. Accepted authentication (invite)
G.2.4. Rejected authentication

G.3. Accounting Start

G.4. Accounting Interim

G.5. Accounting Stop

G.6. Disconnect

G.7. Change of Authorisation

RADIUS is used to authenticate REGISTRATION requests allowing registration of telephones. It is also used to authenticate INVITE requests and provide call routing information.

RADIUS Accounting is used to provide details of calls in progress.

G.1. Authentication request

Authentication requests are used for REGISTER and INVITE requests that cannot be matched to a local configuration.

The format mostly follows RFC5090. There is an option to send the RADIUS authentication request before receiving authentication data from the requestor, which allows authentication without authentication credentials, but more likely to be used to send a ACCESS_CHALLENGE response to customise the challenge sent to the requestor.

Table G.1. Access-request

AVP	No.	Usage
User-Name	1	Contact URI from request
Message-Authenticator	80	Message signature as per RFC2869
Calling-Station-Id	31	Calling number derived from headers
NAS-IP-Address	4	Requestor IPv4 address if using IPv4
NAS-IPv6-Address	95	Requestor IPv6 address if using IPv6
NAS-Port	5	Requestor UDP port
Digest-Response	103	Digest Response
Digest-Realm	104	Digest Realm
Digest-Nonce	105	Digest Nonce
Digest-Method	108	Digest Method
Digest-URI	109	Digest URI
Digest-QOP	110	Digest QOP
Digest-Algorithm	111	Digest Algorithm
Digest-CNonce	113	Digest CNonce
Digest-Nonce-Count	114	Digest Nonce Count (NC)
Digest-Username	115	Digest Username
Digest-Opaque	116	Digest Opaque

For incoming calls (INVITE) from a recognised carrier only Digest-Username is sent, being @ followed by the configured name of the carrier.
For a call from a telephone (or unidentified connection) before authentication, Digest-Username has the called number (local part of To header), not starting @.
For an authenticated call, the Digest parameters are all present. A username starting @ is not accepted.


F.9. Notes		G.2. Authentication response