Diameter Network Access Server Application
obsoleted by
- rfc-7155 — Diameter Network Access Server Application
Extracted elements (30)
The Diameter NAS application deliberately includes the RADIUS attribute space (AVP Codes 0-255) to eliminate the need to perform many attribute translations during initial deployments that include legacy RADIUS systems.
Diameter authorization-only requests (no authentication information) cannot be easily translated to RADIUS by a gateway because no equivalent RADIUS capability exists. Adding synthetic authentication to enable translation introduces significant security vulnerabilities.
Diameter reserves AVP Codes 0-255 for RADIUS functions implemented in Diameter; AVPs with codes 256 and greater represent Diameter-only functions that may cause interoperability issues if the request traverses an AAA system supporting only RADIUS.
The RADIUS/Diameter interactions specified in this document (Sections 9.1-9.6) are to be applied to all Diameter applications, not just the NAS application; in this sense, this document extends the Base Diameter protocol.
A NAS MUST reauthenticate and/or reauthorize at the end of the period provided by the Authorization-Lifetime AVP; failure of the reauthentication exchange will terminate the service.
A NAS MUST treat unknown or unsupported Service-Types received in a response as a failure and end the session with a DIAMETER_INVALID_AVP_VALUE Result-Code; if service type is supported but incompatible with the current access mode, the NAS MUST fail to start the session.
A NAS that receives an Abort-Session-Request (ASR) MUST issue an ASA if the session identified is active and MUST disconnect the PPP (or tunneling) session.
Diameter implementations conforming to this specification MUST advertise support by including the value 1 in the Auth-Application-Id of Capabilities-Exchange-Request (CER), AA-Request (AAR), and AA-Answer (AAA) messages.
During reauthentication or reauthorization, the Session-Id AVP in the AAR message MUST be the same as the one present in the original authentication/authorization message.
For multi-round authentication exchanges, the server MUST set the Result-Code AVP to DIAMETER_MULTI_ROUND_AUTH in the AA-Answer; subsequent AAR messages MUST include any State AVPs that were present in the preceding AAA.
If accounting is active, an Accounting STOP_RECORD message MUST be sent upon termination of the session context.
If accounting is active, the application MUST send an Accounting message with Accounting-Record-Type of START_RECORD for a new session; if a session fails to start, EVENT_RECORD MUST be sent with the reason for failure.
If the access client is unable to prompt the user for a response in a multi-round exchange, it MUST treat the AA-Answer containing a Reply-Message AVP as an error and deny access.
If the Accounting-Request was protected by end-to-end security, the corresponding Accounting-Answer (ACA) message MUST also be protected.
In the Accounting-Request (ACR) message, either Acct-Application-Id or Vendor-Specific-Application-Id MUST be present; if the Vendor-Specific-Application-Id grouped AVP is present, it MUST contain an Acct-Application-Id.
The ARAP-Password AVP (AVP Code 70) MUST NOT be present in a message if either the User-Password or CHAP-Auth AVP is present.
The clear-text User-Password (AVP Code 2) MUST NOT be longer than 128 bytes in length; it SHOULD NOT be used in untrusted proxy environments without end-to-end encryption.
The Framed-MTU AVP (AVP Code 12) value MUST be in the range from 64 to 65535.
Upon receipt of an unsolicited Re-Auth-Request (RAR) message, the NAS MUST respond with a Re-Auth-Answer (RAA) message; if the RAR includes authentication, the NAS MUST initiate re-authentication toward the user.
Upon sending or receiving the Session-Termination-Answer (STA), the Diameter Server MUST release all resources for the session indicated by the Session-Id AVP.
When a NAS receives indication that a user's session is being disconnected (e.g., LCP Terminate received) or an administrative command, the NAS MUST issue a Session-Termination-Request (STR) to its Diameter Server.
The AA-Request (AAR) command (Command-Code 265, REQ, PXY) requests authentication and/or authorization for a NAS user; the AA-Answer (AAA) command (Command-Code 265, PXY) returns authorization AVPs or a failure Result-Code.
The CHAP-Auth AVP (AVP Code 402) is a Grouped AVP containing CHAP-Algorithm (mandatory), CHAP-Ident (mandatory), and optionally CHAP-Response. If CHAP-Auth is present, the CHAP-Challenge AVP MUST also be present.
The Tunneling AVP (AVP Code 401) is a Grouped AVP encapsulating tunnel parameters including Tunnel-Type, Tunnel-Medium-Type, Tunnel-Client-Endpoint, Tunnel-Server-Endpoint, and optional Tunnel-Password, Tunnel-Private-Group-Id, and Tunnel-Preference.
This document registers: Command Code 265 (AA-Request/AA-Answer); NAS-specific AVP Codes including NAS-Filter-Rule (400), CHAP-Auth (402), CHAP-Algorithm (403), CHAP-Ident (404), CHAP-Response (405), QoS-Filter-Rule (407); Application Identifier 1 (Diameter NAS Application); and enumeration values for CHAP-Algorithm, Accounting-Auth-Method, and Origin-AAA-Protocol.
Authorization-only requests (Auth-Request-Type set to authorization-only) introduce a significant security vulnerability because service cannot be started based solely on such a response without an access decision; implementers must be aware that no equivalent protection exists in RADIUS.
The User-Password AVP represents sensitive information and relies on Diameter's mandatory IPsec or TLS transport encryption. In untrusted proxy environments, additional end-to-end encryption (e.g., CMS Security) SHOULD be applied to prevent password exposure to intermediate agents.
The Framed-IPv6-Route AVP (AVP Code 99) encodes IPv6 routes as UTF8String: 'IPv6-prefix/length gateway-hex metric(s)', e.g., '2000:0:0:106::/64 2000::106:a00:20ff:fe99:a998 1'; the IPv6 unspecified address '::' means use the user's IP.
The Framed-Route AVP (AVP Code 22) encodes routes as UTF8String: 'destination-prefix[/length] gateway metric(s)', e.g., '192.168.1.0/24 192.168.1.1 1'. Gateway '0.0.0.0' means the user's IP address should be used.
The QoSFilterRule AVP (AVP Code 407) is ASCII-encoded with format 'action dir proto from src to dst [options]'; action is 'tag' (DSCP marking) or 'meter' (Assured Forwarding rate limiting). Unmatched packets are treated as best effort; an access device unable to apply a rule SHOULD NOT terminate the session.