-
Cisco IOS Security Configuration Guide, Release 12.2
-
About the Cisco IOS Software Documentation
-
Using Cisco IOS Software
-
Security Overview
- Part 1: Authentication, Authorization, and Accounting (AAA)
- Part 2: Security Server Protocols
- Part 3: Traffic Filtering and Firewalls
- Part 4: IP Security and Encryption
- Part 5: Other Security Features
- Part 6: RADIUS Attributes
- Part 7: Appendixes
-
Index
-
Installation and Configuration for Common Criteria EAL4 Evaluated Cisco IOS IPSec
-
Table Of Contents
Supported RADIUS IETF Attributes
Comprehensive List of RADIUS Attribute Descriptions
RADIUS Attributes Overview
Remote Authentication Dial-In User Service (RADIUS) attributes are used to define specific authentication, authorization, and accounting (AAA) elements in a user profile, which is stored on the RADIUS daemon. This appendix lists the RADIUS attributes currently supported.
In This Appendix
This appendix contains the following sections:
•
Vendor-Proprietary RADIUS Attributes
•
•
RADIUS Attributes Overview
This section contains information important to understanding how RADIUS attributes exchange AAA information between a client and server and includes the following sections:
IETF Attributes Versus VSAs
RADIUS Internet Engineering Task Force (IETF) attributes are the original set of 255 standard attributes that are used to communicate AAA information between a client and a server. Because IETF attributes are standard, the attribute data is predefined and well known; thus all clients and servers who exchange AAA information via IETF attributes must agree on attribute data such as the exact meaning of the attributes and the general bounds of the values for each attribute.
RADIUS vendor-specific attributes (VSAs) derived from one IETF attribute—vendor-specific (attribute 26). Attribute 26 allows a vendor to create an additional 255 attributes however they wish. That is, a vendor can create an attribute that does not match the data of any IETF attribute and encapsulate it behind attribute 26; thus, the newly created attribute is accepted if the user accepts attribute 26.
For more information on VSAs, refer to the section "RADIUS Vendor-Specific Attributes (VSA)" later in this appendix.
RADIUS Packet Format
The data between a RADIUS server and a RADIUS client is exchanged in RADIUS packets. The data fields are transmitted from left to right.
Figure 43 shows the fields within a RADIUS packet.
Note
Figure 43 RADIUS Packet Diagram
Each RADIUS packet contains the following information:
•
–
–
–
–
–
•
•
•
–
–
RADIUS Packet Types
The following list defines the various types of RADIUS packet types that can contain attribute information:
Access-Request—Sent from a client to a RADIUS server. The packet contains information that allows the RADIUS server to determine whether to allow access to a specific network access server (NAS), which will allow access to the user. Any user performing authentication must submit an Access-Request packet. Once an Access-Request packet is received, the RADIUS server must forward a reply.
Access-Accept—Once a RADIUS server receives an Access-Request packet, it must send an Access-Accept packet if all attribute values in the Access-Request packet are acceptable. Access-Accept packets provide the configuration information necessary for the client to provide service to the user.
Access-Reject—Once a RADIUS server receives an Access-Request packet, it must send an Access-Reject packet if any of the attribute values are not acceptable.
Access-Challenge—Once the RADIUS server receives an Access-Accept packet, it can send the client an Access-Challenge packet, which requires a response. If the client does not know how to respond or if the packets are invalid, the RADIUS server discards the packets. If the client responds to the packet, a new Access-Request packet should be sent with the original Access-Request packet.
Accounting-Request—Sent from a client to a RADIUS accounting server, which provides accounting information. If the RADIUS server successfully records the Accounting-Request packet, it must submit an Accounting Response packet.
Accounting-Response—Sent by the RADIUS accounting server to the client to acknowledge that the Accounting-Request has been received and recorded successfully.
RADIUS Files
Understanding the types of files used by RADIUS is important for communicating AAA information from a client to a server. Each file defines a level of authentication or authorization for the user: The dictionary file defines which attributes the user's NAS can implement; the clients file defines which users are allowed to make requests to the RADIUS server; the users files defines which user requests the RADIUS server will authenticate based on security and configuration data.
Dictionary File
A dictionary file provides a list of attributes that are dependent upon which attributes your NAS supports. However, you can add your own set of attributes to your dictionary for custom solutions. It defines attribute values, thereby allowing you to interpret attribute output such as parsing requests. A dictionary file contains the following information:
•
•
•
–
–
–
–
–
When the data type for a particular attribute is an integer, you can optionally expand the integer to equate to some string. The follow sample dictionary includes an integer-based attribute and its corresponding values:
# dictionary sample of integer entry#ATTRIBUTE Service-Type 6 integerVALUE Service-Type Login 1VALUE Service-Type Framed 2VALUE Service-Type Callback-Login 3VALUE Service-Type Callback-Framed 4VALUE Service-Type Outbound 5VALUE Service-Type Administrative 6VALUE Service-Type NAS-Prompt 7VALUE Service-Type Authenticate-Only 8VALUE Service-Type Callback-NAS-Prompt 9VALUE Service-Type Call-Check 10VALUE Service-Type Callback-Administrative 11Clients File
A clients file is important because it contains a list of RADIUS clients that are allowed to send authentication and accounting requests to the RADIUS server. To receive authentication, the name and authentication key the client sends the server must be an exact match with the data contained in clients file.
The following is an example of a clients file. The key, as shown in this example, must be the same as the radius-server key SomeSecret command.
#Client Name Key#---------------- ---------------10.1.2.3:256 testnas01 bananasnas02 MoNkEysnas07.foo.com SomeSecretUsers File
A RADIUS users file contains an entry for each user that the RADIUS server will authenticate; each entry, which is also referred to as a user profile, establishes an attribute the user can access.
The first line in any user profile is always a "user access" line; that is, the server must check the attributes on the first line before it can grant access to the user. The first line contains the name of the user, which can be up to 252 characters, followed by authentication information such as the password of the user.
Additional lines, which are associated with the user access line, indicate the attribute reply that is sent to the requesting client or server. The attributes sent in the reply must be defined in the dictionary file.
When looking at a user file, please note the the data to the left of the equal (=) character is an attribute defined in the dictionary file, and the data to the right of the equal character is the configuration data.
Note
The following is an example of a RADIUS user profile (Merit Daemon format). In this example, the user name is cisco.com, the password is cisco, and the user can access five tunnel attributes.
# This user profile includes RADIUS tunneling attributescisco.com Password="cisco" Service-Type=OutboundTunnel-Type = :1:L2TPTunnel-Medium-Type = :1:IPTunnel-Server-Endpoint = :1:10.0.0.1Tunnel-Password = :1:"welcome"Tunnel-Assignment-ID = :1:"nas"Supporting Documentation
For more information on RADIUS IETF and Vendor-Proprietary Attributes, refer to the following documents:
•
•
Refer to these chapters for information on how RADIUS is used with AAA.
•
–
–
–
–
–
•
RADIUS IETF Attributes
Note
This section contains the following sections:
•
•
Supported RADIUS IETF Attributes
Table 31 lists Cisco-supported IETF RADIUS attributes and the Cisco IOS release in which they are implemented. In cases where the attribute has a security server-specific format, the format is specified.
Refer to Table 32 for a description of each listed attribute.
Note
Table 31 Supported RADIUS IETF Attributes
1
User-Name
yes
yes
yes
yes
yes
yes
yes
yes
2
User-Password
yes
yes
yes
yes
yes
yes
yes
yes
3
CHAP-Password
yes
yes
yes
yes
yes
yes
yes
yes
4
NAS-IP Address
yes
yes
yes
yes
yes
yes
yes
yes
5
NAS-Port
yes
yes
yes
yes
yes
yes
yes
yes
6
Service-Type
yes
yes
yes
yes
yes
yes
yes
yes
7
Framed-Protocol
yes
yes
yes
yes
yes
yes
yes
yes
8
Framed-IP-Address
yes
yes
yes
yes
yes
yes
yes
yes
9
Framed-IP-Netmask
yes
yes
yes
yes
yes
yes
yes
yes
10
Framed-Routing
yes
yes
yes
yes
yes
yes
yes
yes
11
Filter-Id
yes
yes
yes
yes
yes
yes
yes
yes
12
Framed-MTU
yes
yes
yes
yes
yes
yes
yes
yes
13
Framed-Compression
yes
yes
yes
yes
yes
yes
yes
yes
14
Login-IP-Host
yes
yes
yes
yes
yes
yes
yes
yes
15
Login-Service
yes
yes
yes
yes
yes
yes
yes
yes
16
Login-TCP-Port
yes
yes
yes
yes
yes
yes
yes
yes
18
Reply-Message
yes
yes
yes
yes
yes
yes
yes
yes
19
Callback-Number
no
no
no
no
no
no
yes
yes
20
Callback-ID
no
no
no
no
no
no
no
no
22
Framed-Route
yes
yes
yes
yes
yes
yes
yes
yes
23
Framed-IPX-Network
no
no
no
no
no
no
no
no
24
State
yes
yes
yes
yes
yes
yes
yes
yes
25
Class
yes
yes
yes
yes
yes
yes
yes
yes
26
Vendor-Specific
yes
yes
yes
yes
yes
yes
yes
yes
27
Session-Timeout
yes
yes
yes
yes
yes
yes
yes
yes
28
Idle-Timeout
yes
yes
yes
yes
yes
yes
yes
yes
29
Termination-Action
no
no
no
no
no
no
no
no
30
Called-Station-Id
yes
yes
yes
yes
yes
yes
yes
yes
31
Calling-Station-Id
yes
yes
yes
yes
yes
yes
yes
yes
32
NAS-Identifier
no
no
no
no
no
no
no
yes
33
Proxy-State
no
no
no
no
no
no
no
no
34
Login-LAT-Service
yes
yes
yes
yes
yes
yes
yes
yes
35
Login-LAT-Node
no
no
no
no
no
no
no
yes
36
Login-LAT-Group
no
no
no
no
no
no
no
no
37
Framed-AppleTalk-Link
no
no
no
no
no
no
no
no
38
Framed-AppleTalk- Network
no
no
no
no
no
no
no
no
39
Framed-AppleTalk-Zone
no
no
no
no
no
no
no
no
40
Acct-Status-Type
yes
yes
yes
yes
yes
yes
yes
yes
41
Acct-Delay-Time
yes
yes
yes
yes
yes
yes
yes
yes
42
Acct-Input-Octets
yes
yes
yes
yes
yes
yes
yes
yes
43
Acct-Output-Octets
yes
yes
yes
yes
yes
yes
yes
yes
44
Acct-Session-Id
yes
yes
yes
yes
yes
yes
yes
yes
45
Acct-Authentic
yes
yes
yes
yes
yes
yes
yes
yes
46
Acct-Session-Time
yes
yes
yes
yes
yes
yes
yes
yes
47
Acct-Input-Packets
yes
yes
yes
yes
yes
yes
yes
yes
48
Acct-Output-Packets
yes
yes
yes
yes
yes
yes
yes
yes
49
Acct-Terminate-Cause
no
no
no
yes
yes
yes
yes
yes
50
Acct-Multi-Session-Id
no
yes
yes
yes
yes
yes
yes
yes
51
Acct-Link-Count
no
yes
yes
yes
yes
yes
yes
yes
52
Acct-Input-Gigawords
no
no
no
no
no
no
no
no
53
Acct-Output-Gigawords
no
no
no
no
no
no
no
no
55
Event-Timestamp
no
no
no
no
no
no
no
yes
60
CHAP-Challenge
yes
yes
yes
yes
yes
yes
yes
yes
61
NAS-Port-Type
yes
yes
yes
yes
yes
yes
yes
yes
62
Port-Limit
yes
yes
yes
yes
yes
yes
yes
yes
63
Login-LAT-Port
no
no
no
no
no
no
no
no
64
Tunnel-Type1
no
no
no
no
no
no
yes
yes
65
Tunnel-Medium-Type1
no
no
no
no
no
no
yes
yes
66
Tunnel-Client-Endpoint
no
no
no
no
no
no
yes
yes
67
Tunnel-Server-Endpoint1
no
no
no
no
no
no
yes
yes
68
Acct-Tunnel-Connection-ID
no
no
no
no
no
no
yes
yes
69
Tunnel-Password1
no
no
no
no
no
no
yes
yes
70
ARAP-Password
no
no
no
no
no
no
no
no
71
ARAP-Features
no
no
no
no
no
no
no
no
72
ARAP-Zone-Access
no
no
no
no
no
no
no
no
73
ARAP-Security
no
no
no
no
no
no
no
no
74
ARAP-Security-Data
no
no
no
no
no
no
no
no
75
Password-Retry
no
no
no
no
no
no
no
no
76
Prompt
no
no
no
no
no
no
yes
yes
77
Connect-Info
no
no
no
no
no
no
no
yes
78
Configuration-Token
no
no
no
no
no
no
no
no
79
EAP-Message
no
no
no
no
no
no
no
no
80
Message-Authenticator
no
no
no
no
no
no
no
no
81
Tunnel-Private-Group-ID
no
no
no
no
no
no
no
no
82
Tunnel-Assignment-ID1
no
no
no
no
no
no
yes
yes
83
Tunnel-Preference
no
no
no
no
no
no
no
yes
84
ARAP-Challenge-Response
no
no
no
no
no
no
no
no
85
Acct-Interim-Interval
no
no
no
no
no
no
yes
yes
86
Acct-Tunnel-Packets-Lost
no
no
no
no
no
no
no
no
87
NAS-Port-ID
no
no
no
no
no
no
no
no
88
Framed-Pool
no
no
no
no
no
no
no
no
90
Tunnel-Client-Auth-ID2
no
no
no
no
no
no
no
yes
91
Tunnel-Server-Auth-ID
no
no
no
no
no
no
no
yes
200
IETF-Token-Immediate
no
no
no
no
no
no
no
no
1 This RADIUS attribute complies with the following two draft IETF documents: RFC 2868 RADIUS Attributes for Tunnel Protocol Support and RFC 2867 RADIUS Accounting Modifications for Tunnel Protocol Support.
2 This RADIUS attribute complies withRFC 2865 and RFC 2868.
Comprehensive List of RADIUS Attribute Descriptions
Table 32 lists and describes IETF RADIUS attributes. In cases where the attribute has a security server-specific format, the format is specified.
Table 32 RADIUS IETF Attributes
1
User-Name
Indicates the name of the user being authenticated by the RADIUS server.
2
User-Password
Indicates the user's password or the user's input following an Access-Challenge. Passwords longer than 16 characters are encrypted using RFC 2865 specifications.
3
CHAP-Password
Indicates the response value provided by a PPP Challenge-Handshake Authentication Protocol (CHAP) user in response to an Access-Challenge.
4
NAS-IP Address
Specifies the IP address of the network access server that is requesting authentication. The default value is 0.0.0.0/0.
5
NAS-Port
Indicates the physical port number of the network access server that is authenticating the user. The NAS-Port value (32 bits) consists of one or two 16-bit values (depending on the setting of the radius-server extended-portnames command). Each 16-bit number should be viewed as a 5-digit decimal integer for interpretation as follows:
For asynchronous terminal lines, async network interfaces, and virtual async interfaces, the value is 00ttt, where ttt is the line number or async interface unit number.
For ordinary synchronous network interface, the value is 10xxx.
For channels on a primary rate ISDN interface, the value is 2ppcc.
For channels on a basic rate ISDN interface, the value is 3bb0c.
For other types of interfaces, the value is 6nnss.
6
Service-Type
Indicates the type of service requested or the type of service to be provided.
•
Framed for known PPP or SLIP connection.
Administrative-user for enable command.•
Login—Make a connection.
Framed—Start SLIP or PPP.
Administrative User—Start an EXEC or enable ok.Exec User—Start an EXEC session.
Service type is indicated by a particular numeric value as follows:
•
•
•
•
•
•
•
•
•
7
Framed-Protocol
Indicates the framing to be used for framed access. No other framing is allowed.
Framing is indicated by a numeric value as follows:
•
•
•
•
•
8
Framed-IP-Address
Indicates the IP address to be configured for the user, by sending the IP address of a user to the RADIUS server in the access-request. To enable this command, use the radius-server attribute 8 include-in-access-req command in global configuration mode.
9
Framed-IP-Netmask
Indicates the IP netmask to be configured for the user when the user is a router to a network. This attribute value results in a static route being added for Framed-IP-Address with the mask specified.
10
Framed-Routing
Indicates the routing method for the user when the user is a router to a network. Only "None" and "Send and Listen" values are supported for this attribute.
Routing method is indicated by a numeric value as follows:
•
•
•
•
11
Filter-Id
Indicates the name of the filter list for the user and is formatted as follows: %d, %d.in, or %d.out. This attribute is associated with the most recent service-type command. For login and EXEC, use %d or %d.out as the line access list value from 0 to 199. For Framed service, use %d or %d.out as interface output access list, and %d.in for input access list. The numbers are self-encoding to the protocol to which they refer.
12
Framed-MTU
Indicates the maximum transmission unit (MTU) that can be configured for the user when the MTU is not negotiated by PPP or some other means.
13
Framed-Compression
Indicates a compression protocol used for the link. This attribute results in a "/compress" being added to the PPP or SLIP autocommand generated during EXEC authorization. Not currently implemented for non-EXEC authorization.
Compression protocol is indicated by a numeric value as follows:
•
•
•
14
Login-IP-Host
Indicates the host to which the user will connect when the Login-Service attribute is included. (This begins immediately after login.)
15
Login-Service
Indicates the service that should be used to connect the user to the login host.
Service is indicated by a numeric value as follows:
•
•
•
•
•
16
Login-TCP-Port
Defines the TCP port with which the user is to be connected when the Login-Service attribute is also present.
18
Reply-Message
Indicates text that might be displayed to the user via the RADIUS server. You can include this attribute in user files; however, you cannot exceed a maximum of 16 Replyp-Message entries per profile.
19
Callback-Number
Defines a dialing string to be used for callback.
20
Callback-ID
Defines the name (consisting of one or more octets) of a place to be called, to be interpreted by the network access server.
22
Framed-Route
Provides routing information to be configured for the user on this network access server. The RADIUS RFC format (net/bits [router [metric]]) and the old style dotted mask (net mask [router [metric]]) are supported. If the router field is omitted or 0, the peer IP address is used. Metrics are currently ignored. This attribute is access-request packets.
23
Framed-IPX-Network
Defines the IPX network number configured for the user.
24
State
Allows state information to be maintained between the network access server and the RADIUS server. This attribute is applicable only to CHAP challenges.
25
Class
(Accounting) Arbitrary value that the network access server includes in all accounting packets for this user if supplied by the RADIUS server.
26
Vendor-Specific
Allows vendors to support their own extended attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option using the format recommended in the specification. Cisco's vendor-ID is 9, and the supported option has vendor-type 1, which is named "cisco-avpair." The value is a string of the format:
protocol : attribute sep value"Protocol" is a value of the Cisco "protocol" attribute for a particular type of authorization. "Attribute" and "value" are an appropriate AV pair defined in the Cisco TACACS+ specification, and "sep" is "=" for mandatory attributes and "*" for optional attributes. This allows the full set of features available for TACACS+ authorization to also be used for RADIUS. For example:
cisco-avpair= "ip:addr-pool=first"cisco-avpair= "shell:priv-lvl=15"The first example causes Cisco's "multiple named ip address pools" feature to be activated during IP authorization (during PPP's IPCP address assignment). The second example causes a user logging in from a network access server to have immediate access to EXEC commands.
Table 36 lists supported vendor-specific RADIUS attributes (IETF attribute 26). The "TACACS+ Attribute-Value Pairs" appendix provides a complete list of supported TACACS+ attribute-value (AV) pairs that can be used with IETF attribute 26. (RFC 2865)
27
Session-Timeout
Sets the maximum number of seconds of service to be provided to the user before the session terminates. This attribute value becomes the per-user "absolute timeout."
28
Idle-Timeout
Sets the maximum number of consecutive seconds of idle connection allowed to the user before the session terminates. This attribute value becomes the per-user "session-timeout."
29
Termination-Action
Termination is indicated by a numeric value as follows:
•
•
