RADIUS Attributes for Virtual LAN and Priority Support
Extracted elements (27)
The Tag Indication values in Egress-VLAN-Name (0x31 for tagged, 0x32 for untagged) were chosen as the ASCII characters '1' and '2' to make them easier for users to enter, unlike the numeric 0x31/0x32 values used in Egress-VLANID.
These attributes provide RADIUS/Diameter support for IEEE 802.1Q VLAN management variables and IEEE 802.1D priority regeneration not covered by RFC 3580's tunnel-attribute-based VLAN assignment, enabling a more complete set of 802.1Q functionality and a wider range of 802.1X configurations.
Egress-VLAN-Name and RFC 3580 tunnel attributes can be used concurrently in the same RADIUS packet; when both are present, the allowed VLAN list is the concatenation of Egress-VLAN-Name and Tunnel-Private-Group-ID (81) attributes. Only tunnel attributes should be used to set the PVID.
In Diameter, RADIUS Access-Request maps to AA-Request or Diameter-EAP-Request; Access-Challenge maps to AA-Answer/Diameter-EAP-Answer with DIAMETER_MULTI_ROUND_AUTH; CoA-Request maps to Re-Auth-Request; Accounting-Request maps to Diameter Accounting-Request.
The Egress-VLANID attribute MAY appear in the same RADIUS packet as RFC 3580 tunnel attributes; however, the Egress-VLANID attribute is not necessary when it would configure the same untagged VLANID already set by the tunnel attributes.
When used in Diameter, these attributes occupy the RADIUS attribute compatibility code space (1-255) as AVPs. No additional Diameter Code values are allocated. Attributes are copied as-is across RADIUS/Diameter gateways except for header, alignment, and padding changes.
A NAS receiving a CoA-Request MUST reply with a CoA-NAK if the request contains an unsupported attribute; it is recommended that an Error-Cause attribute with value 'Unsupported Attribute' (401) be included in the CoA-NAK.
A single User-Priority-Table attribute MAY be included in an Access-Accept or CoA-Request packet; this attribute MUST NOT be sent within an Access-Request, Access-Challenge, Access-Reject, Disconnect-Request, Disconnect-ACK, Disconnect-NAK, CoA-ACK, CoA-NAK, or Accounting-Request.
For the Egress-VLAN-Name String field, RFC 3629 UTF-8 encoded 10646 characters are RECOMMENDED, but a robust implementation SHOULD support the field as undistinguished octets.
If a NAS conforming to this specification receives an Access-Accept packet containing an attribute defined in this document that it cannot apply, it MUST act as though it had received an Access-Reject.
Multiple Egress-VLAN-Name attributes MAY be included within an Access-Request, Access-Accept, CoA-Request, or Accounting-Request packet; this attribute MUST NOT be sent within an Access-Challenge, Access-Reject, Disconnect-Request, Disconnect-ACK, Disconnect-NAK, CoA-ACK, or CoA-NAK.
Multiple Egress-VLANID attributes MAY be included in Access-Request, Access-Accept, CoA-Request, or Accounting-Request packets; this attribute MUST NOT be sent within an Access-Challenge, Access-Reject, Disconnect-Request, Disconnect-ACK, Disconnect-NAK, CoA-ACK, or CoA-NAK.
Only a single Ingress-Filters attribute MAY be sent within an Access-Request, Access-Accept, CoA-Request, or Accounting-Request packet; this attribute MUST NOT be sent within an Access-Challenge, Access-Reject, Disconnect-Request, Disconnect-ACK, Disconnect-NAK, CoA-ACK, or CoA-NAK.
The Pad field in the Egress-VLANID Value is 12 bits in length and MUST be 0 (zero).
To configure an untagged VLAN for both ingress and egress, the tunnel attributes of RFC 3580 MUST be used; the Egress-VLANID attribute configures only the egress VLANID.
The Egress-VLAN-Name attribute (Type 58) identifies an allowed egress VLAN by its administratively assigned name (IEEE 802.1Q clause 12.10.2.1.3) rather than by VLAN-ID. Multiple instances may appear, each adding a named VLAN to the allowed egress list.
The Egress-VLANID attribute (Type 56) represents an allowed IEEE 802 egress VLANID for a port, indicating whether frames on that VLAN are tagged or untagged. Multiple instances may appear in a packet, each adding a VLAN to the allowed egress list.
The Ingress-Filters attribute (Type 57) corresponds to the IEEE 802.1Q per-port Ingress Filter variable. When Enabled, the set of VLANs allowed to ingress a port must match the set allowed to egress.
The User-Priority-Table attribute (Type 59) represents the IEEE 802.1D per-port priority regeneration table, mapping each of the 8 incoming user priorities to a regenerated priority, enabling re-mapping, honoring, or overriding incoming priorities.
Four RADIUS attribute type values were allocated in the IANA 'RADIUS Attribute Types' registry: 56 (Egress-VLANID), 57 (Ingress-Filters), 58 (Egress-VLAN-Name), 59 (User-Priority-Table). No new registries are created.
An attacker gaining control of a RADIUS/Diameter server or proxy can modify the User-Priority-Table attribute, causing degradation of quality of service (by downgrading priority) or denial of service (by raising priority at multiple ports and oversubscribing switch or link capabilities).
The security mechanisms in RADIUS and Diameter prevent spoofing and in-transit modification of packets but do not prevent an authorized server or proxy from inserting attributes with malicious intent.
VLAN attributes sent by a RADIUS/Diameter server or proxy may enable access to unauthorized VLANs. These vulnerabilities can be limited by performing authorization checks at the NAS, such as configuring the NAS to accept only certain VLANIDs from a given server or proxy.
The Egress-VLAN-Name attribute (Type 58) has Length >=4, with a 1-octet Tag Indication field (0x31=tagged/ASCII '1', 0x32=untagged/ASCII '2') followed by a variable-length String containing the IEEE 802.1Q VLAN Name.
The Egress-VLANID attribute (Type 56) has Length 6. Its 4-octet Value contains: Tag Indication (1 octet; 0x31=tagged, 0x32=untagged), Pad (12 bits, must be zero), and VLANID (12 bits, IEEE 802.1Q VID).
The Ingress-Filters attribute (Type 57) has Length 6 and a 4-octet Value field with enumerated values: 1=Enabled, 2=Disabled.
The User-Priority-Table attribute (Type 59) has Length 10 and an 8-octet String field representing a table mapping each of the 8 incoming user priorities (octets 0-7) to a regenerated priority value (0-7).