The RADIUS NAS-IP-Address Attribute Configurability feature allows an arbitrary IP address to be configured and used as RADIUS
attribute 4, NAS-IP-Address, without changing the source IP address in the IP header of the RADIUS packets. This feature may
be used for situations in which service providers are using a cluster of small network access servers (NASs) to simulate a
large NAS to improve scalability. This feature allows the NASs to behave as a single RADIUS client from the perspective of
the RADIUS server.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information,
see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module,
and to see a list of the releases in which each feature is supported, see the feature information table.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature
Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for RADIUS NAS-IP-Address Attribute Configurability
The following requirements are necessary before configuring this feature:
Experience with IP Security (IPSec) and configuring both RADIUS servers and authentication, authorization, and accounting
(AAA) is necessary.
RADIUS server and AAA lists must be configured.
Restrictions for RADIUS NAS-IP-Address Attribute Configurability
The following restrictions apply if a cluster of RADIUS clients are being used to simulate a single RADIUS client for scalability.
Solutions, or workarounds, to the restrictions are also provided.
RADIUS attribute 44, Acct-Session-Id, may overlap among sessions from different NASs.
There are two solutions. Either the radius-server attribute 44 extend-with-addr or radius-server unique-ident command can be used on NAS routers to specify different prepending numbers for different NAS routers.
RADIUS server-based IP address pool for different NASs must be managed.
The solution is to configure different IP address pool profiles for different NASs on the RADIUS server. Different NASs use
different pool usernames to retrieve them.
RADIUS request message for sessions from different NASs must be differentiated.
One of the solutions is to configure different format strings for RADIUS attribute 32, NAS-Identifier, using the radius-server attribute 32 include-in-access-req command on different NASs.
Information About RADIUS NAS-IP-Address Attribute Configurability
To simulate a large NAS RADIUS client using a cluster of small NAS RADIUS clients, as shown in the figure below, a Network
Address Translation (NAT) or Port Address Translation (PAT) device is inserted in a network. The device is placed between
a cluster of NASs and the IP cloud that is connected to a RADIUS server. When RADIUS traffic from different NASs goes through
the NAT or PAT device, the source IP addresses of the RADIUS packets are translated to a single IP address, most likely an
IP address on a loopback interface on the NAT or PAT device. Different User Datagram Protocol (UDP) source ports are assigned
to RADIUS packets from different NASs. When the RADIUS reply comes back from the server, the NAT or PAT device receives it,
uses the destination UDP port to translate the destination IP address back to the IP address of the NAS, and forwards the
reply to the corresponding NAS.
The figure below demonstrates how the source IP addresses of several NASs are translated to a single IP address as they pass
through the NAT or PAT device on the way to the IP cloud.
RADIUS servers normally check the source IP address in the IP header of the RADIUS packets to track the source of the RADIUS
requests and to maintain security. The NAT or PAT solution satisfies these requirements because only a single source IP address
is used even though RADIUS packets come from different NAS routers.
However, when retrieving accounting records from the RADIUS database, some billing systems use RADIUS attribute 4, NAS-IP-Address,
in the accounting records. The value of this attribute is recorded on the NAS routers as their own IP addresses. The NAS routers
are not aware of the NAT or PAT that runs between them and the RADIUS server; therefore, different RADIUS attribute 4 addresses
will be recorded in the accounting records for users from the different NAS routers. These addresses eventually expose different
NAS routers to the RADIUS server and to the corresponding billing systems.
Using the RADIUS NAS-IP-Address Attribute Configurability Feature
The RADIUS NAS-IP-Address Attribute Configurability feature allows you to freely configure an arbitrary IP address as RADIUS
NAS-IP-Address, RADIUS attribute 4. By manually configuring the same IP address, most likely the IP address on the loopback
interface of the NAT or PAT device, for all the routers, you can hide a cluster of NAS routers behind the NAT or PAT device
from the RADIUS server.
How to Configure RADIUS NAS-IP-Address Attribute Configurability
No new or modified RFCs are supported by this feature.
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving
technical issues with Cisco products and technologies.
To receive security and technical information about your products, you can subscribe to various services, such as the Product
Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.
Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.
Feature Information for RADIUS NAS-IP-Address Attribute Configurability
The following table provides release information about the feature or features described in this module. This table lists
only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise,
subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco
Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for RADIUS NAS-IP-Address Attribute Configurability
RADIUS NAS-IP-Address Attribute Configurability
Cisco IOS XE Release 3.9S
This feature allows an arbitrary IP address to be configured and used as RADIUS attribute 4, NAS-IP-Address, without changing
the source IP address in the IP header of the RADIUS packets.
radius-server attribute 4 command was introduced this feature.