| Appendix G. Supported RADIUS Attribute/Value Pairs for L2TP operation | ||
|---|---|---|
 |  | |
| Appendix G. Supported RADIUS Attribute/Value Pairs for L2TP operation | ||
|---|---|---|
| | | |
Table of Contents
RADIUS is used for authentication and accounting of L2TP connections. If no authentication servers are configured then authentication is not performed. If no accounting servers are configured then no accounting is generated. Multiple servers can be configured and they are processed in order. Each can have multiple IP addresses. The IP addresses are tried based on the previous performance (response time, etc). If a server does not respond a number of times as configured then it is blacklisted for a configurable period.
It is possible to configure local configurations which are checked before any RADIUS authentication.
It is possible to configure L2TP so that RADIUS accounting must respond, and if not then the sessions are disconnected.
Table G.1. Access-request
| AVP | No. | Usage |
| Message-Authenticator | 80 | Message signature as per RFC2869 |
| User-Name | 1 | Username from authentication (PAP/CHAP) or proxy authentication received on L2TP |
| Called-Station-Id | 30 | Called number as received on L2TP |
| Calling-Station-Id | 31 | Calling number as received on L2TP |
| Acct-Session-Id | 44 | Unique ID for session as used on all following accounting records |
| NAS-Identifier | 32 | Configured hostname of FireBrick |
| NAS-IP-Address | 4 | NAS IPv4 address if using IPv4 |
| NAS-IPv6-Address | 95 | NAS IPv6 address if using IPv6 |
| NAS-Port | 5 | L2TP session ID |
| NAS-Port-Id | 87 | For PPPoE "port{:vlan}/MAC" |
| Service-Type | 6 | Framed |
| Framed-Protocol | 7 | PPP |
| CHAP-Password | 3 | CHAP ID and response |
| CHAP-Challenge | 60 | CHAP challenge (only present if not the same as RADIUS authenticator) |
| Framed-MTU | 12 | MTU requested by PPP, if one was requested (even if 1500) |
| Connect-Info | 77 | Text Tx speed/Rx speed from L2TP connection if known |
| Tunnel-Client-Endpoint | 66 | Indicates the L2TP tunnel configured name attribute, allowing connections via different L2TP incoming configurations to be identified |
| Proxy-State | 33 | Added to session steering RADIUS requests (i.e. previous RADIUS returned type S tunnel) |
Note that the NAS-IP-Address is normally the local end of the L2TP connection for the incoming connection. However, there is a configuration option to pass the remote end of the L2TP as the NAS-IP-Address as this is often more useful. If the remote Ip is used the NAS-Port is set to the far end L2TP session ID rather than the local end session ID. The NAS-Identified remains the name of the FB6000. This option is separately available for accounting messages.
Note that the Calling-Station-Id is included even if not present in L2TP connection if a cache platform RADIUS request matched the L2TP connection and had a Calling-Station-Id.
| | | |
| F.15. Notes |  | G.2. Authentication response |