RADIUS Delegated-IPv6-Prefix Attribute
Extracted elements (13)
The Framed-IPv6-Prefix attribute is not designed to support delegation of IPv6 prefixes for use in the user's network; therefore a separate Delegated-IPv6-Prefix attribute is defined, and both attributes may appear in the same RADIUS packet without conflict.
In Diameter, the attribute's applicability maps as follows: RADIUS Access-Request maps to AA-Request or Diameter-EAP-Request; RADIUS Access-Accept maps to AA-Answer or Diameter-EAP-Answer indicating success; RADIUS Accounting-Request maps to Diameter Accounting-Request.
When used in Diameter, Delegated-IPv6-Prefix uses AVP Code 123 from the RADIUS attribute compatibility space (codes 1–255) with data type OctetString. No translation is required for Diameter/RADIUS gateways beyond header, alignment, and padding changes.
Any bits in the prefix field that are not part of the prefix MUST be zero.
The Delegated-IPv6-Prefix attribute MAY appear in an Accounting-Request packet.
The Delegated-IPv6-Prefix MAY appear in an Access-Accept packet and can appear multiple times. It MAY appear in an Access-Request packet as a hint by the NAS, but the server is not required to honor the hint.
The Delegated-IPv6-Prefix MUST NOT appear in any other RADIUS packets (i.e., not in Access-Reject, Access-Challenge, or other packet types).
Diameter AVP flag rules for Delegated-IPv6-Prefix (Code 123, OctetString): MUST set M flag; MAY set P flag; MUST NOT set V flag; encryption (Encr) is Y (allowed).
The attribute table specifies that Delegated-IPv6-Prefix (attribute 123) may appear zero or more times in Access-Request, Access-Accept, and Accounting-Request packets, and MUST NOT be present in Access-Reject or Access-Challenge packets.
The Delegated-IPv6-Prefix attribute (Type 123) carries an IPv6 prefix to be delegated to the user for use in the user's network, for example via DHCP Prefix Delegation. It differs from Framed-IPv6-Prefix in that it is specifically designed for delegation rather than assignment to the user's interface.
IANA assigned Type value 123 to the Delegated-IPv6-Prefix attribute in the RADIUS Attribute Types registry.
Known RADIUS security vulnerabilities are discussed in RFC 2607, RFC 2865, and RFC 2869. Use of IPsec for securing RADIUS carried over IPv6 is discussed in RFC 3162. Security considerations for Diameter are discussed in RFC 3588.
The Delegated-IPv6-Prefix attribute encoding is: Type (1 byte, value 123), Length (1 byte, 4–20), Reserved (1 byte, always zero), Prefix-Length (1 byte, 0–128), followed by the Prefix field (variable, only as long as needed to hold the prefix bits). Any bits in the prefix field beyond the prefix length MUST be zero.