RADIUS VSA

RADIUS VSA

A RADIUS VSA is a vendor-specific attribute used in RADIUS implementations that

  • allows vendors to communicate specialized information between a network access server and a RADIUS server

  • enables support for attributes not defined by standard RADIUS specifications, and

  • is included in authentication or accounting packets, or both, according to implementation needs.

The main elements of the VSA are:

  • Type: Identifies the attribute type.

  • Length: Indicates attribute length.

  • String (Data): Contains vendor-specific data, which includes:

    • Vendor ID

    • Vendor type

    • Vendor length

    • Vendor data

Supported modes and attributes

Authentication and accounting requests per WLAN support these VSAs in addition to the existing AAA attributes.

Table 1. Newly supported attributes

Attribute name

Well-known attribute

VSA sub-attribute

Vendor ID

SVR-Zip-Code

26

14

14369

SVR-Device-Type

26

17

14369

SVR-Device-Model-Number

26

18

14369

SVR-Lat-Long

26

19

14369

SVR-Venue-Category

26

20

14369

SVR-Network-Type

26

21

14369

Aggregation-AAA

26

22

14369

BW-Venue-Id

26

7

22472

BW-Venue-TZ

26

8

22472

BW-Class

26

10

22472

BW-Venue-Description

26

11

22472

BW-ISO-Country-Code

26

14

22472

BW-E164-Country-Code

26

15

22472

BW-State-Name

26

16

22472

BW-City-Name

26

17

22472

BW-Area-Code

26

18

22472

BW-User-Group

26

27

22472

BW-Venue-Name

26

29

22472

BW-Operator-Name

26

37

22472

Note

You can use this feature only in FlexConnect central authentication mode with local switching. FlexConnect local authentication mode is not supported. Use this feature for wireless sessions only.

Create an attribute list

Create a custom AAA attribute list for use in policy mapping.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create a AAA attribute list.

Example:

Device(config)# aaa attribute list attribute-list

Step 3

Specify a AAA attribute type.

Example:

Device(config-attr-list)# attribute type attribute-type
Device(config-attr-list)# attribute type BW-City-Name “MUMBAI”

Step 4

(Optional) Specify a AAA attribute type such as the state name.

Example:

Device(config-attr-list)# attribute type BW-State-Name “MAHARASHTRA"

Step 5

(Optional) Specify a AAA attribute type such as the venue name.

Example:

Device(config-attr-list)#attribute type BW-Venue-Name “WANKHEDE”

Step 6

Return to Privileged EXEC mode.

Example:

Device(config-attr-list)# end
After you create the AAA attribute list, you can use it in policy mapping.

What to do next

Create a AAA policy and map the attribute list.

Create a AAA policy and map it to attribute list

Set up an AAA policy to enable secure wireless access control. Associate authentication and accounting attribute lists with the policy.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create a new AAA policy.

Example:

Device(config)# wireless aaa policy aaa-policy

Step 3

Configure VSA authentication attribute list.

Example:

Device(config-aaa-policy)# attrlist authentication authentication-attr-list

Step 4

Configure VSA accounting attribute list.

Example:

Device(config-aaa-policy)# attrlist accounting accounting-attr-list

Step 5

Return to Privileged EXEC mode.

Example:

Device(config-aaa-policy)# end

You have set up the AAA policy and linked it to the specified attribute lists. You can now map it to a WLAN policy profile.

What to do next

To activate the AAA policy, map it to the WLAN policy profile.

Map a AAA policy to WLAN policy profile

Associate a AAA policy with a WLAN policy profile. This enforces authentication and authorization rules on wireless clients.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create a new wireless policy profile.

Example:

Device(config)# wireless profile policy EAP-AKA profile-policy

Step 3

Create a new AAA policy.

Example:

Device(config-wireless-policy)# aaa-policy Verizon-aaa-policy aaa-policy

Step 4

Return to Privileged EXEC mode.

Example:

Device(config-wireless-policy)# end
You have mapped the AAA policy to the WLAN policy profile.

What to do next

Map the WLAN policy profile to a WLAN.

Map the WLAN policy profile to a WLAN

Associate a previously configured WLAN policy profile to a WLAN on a Cisco device.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create a new policy tag.

Example:

Device(config)# wireless tag policy policy-name

Step 3

Map the policy profile to a WLAN.

Example:

Device(config-policy-tag)# wlan wlan-profile-name policy aaa-policy

Step 4

Return to Privileged EXEC mode.

Example:

Device(config-policy-tag)# end
The specified WLAN policy profile is successfully mapped to the WLAN.
Device# configure terminal
Device(config)# wireless tag policy EAP-AKA
Device(config-policy-tag)# wlan EAP-AKA policy EAP-AKA
Device(config-policy-tag)# end