Remote Authentication Dial-In User Service (RADIUS) Authorization for Network Access Server (NAS) Management
Extracted elements (26)
Management-Policy-Id is designed with a simple, flat namespace (no hierarchy or structure) analogous to the Filter-Id (11) Attribute. Overloading it with multi-part specifiers (e.g., 'Access=remote, Level=7') is SHOULD NOT, because it leads to poor multi-vendor interoperability; a Vendor Specific (26) Attribute is preferred for structured policies.
Management-Privilege-Level (136) is RECOMMENDED for use only with Service-Type NAS-Prompt (7), not Administrative (6). Using it with Administrative may require decreasing the maximum privilege level, which is counterintuitive; it is also NOT RECOMMENDED to combine it with Management-Policy-Id due to undefined overlay behavior.
The term 'Framed Management' is used to describe management protocols other than CLI (e.g., SNMP, NETCONF, Web-based) because they format management information in binary or textual encodings such as HTML, XML, or ASN.1/BER, as opposed to text-based terminal emulation. This distinguishes them from the existing NAS-Prompt and Administrative Service-Type values.
A legacy NAS may not recognize the new management authorization attributes and may silently discard them while still permitting CLI access via NAS-Prompt or Administrative Service-Type, potentially granting users more access rights than intended. RADIUS servers SHOULD ascertain NAS support before including these attributes in Access-Accept messages.
The attributes defined in this document can be used directly as Diameter AVPs from the RADIUS compatibility code space (1-255) with no special translation. Data types map as: Framed-Management-Protocol → Enumerated, Management-Policy-Id → UTF8String, Management-Privilege-Level → Integer; all carry M-bit MUST and P-bit MAY flags.
EAP is NOT RECOMMENDED for use as the authentication mechanism with the remote management protocols described in this document, as the EAP applicability statement indicates it is not intended for use as an application-layer authentication mechanism.
For Dynamic Authorization, the primary session identifiers SHOULD be User-Name (1) and Service-Type (6). A NAS supporting Dynamic Authorization SHOULD maintain additional internal session identifiers (e.g., Acct-Session-Id, NAS-Port) and SHOULD include them in Access-Request messages.
It is RECOMMENDED that the NAS include an appropriately valued Framed-Management-Protocol (133) Attribute in an Access-Request packet indicating the type of management access being requested, and a co-located Service-Type (6) Attribute with value Framed-Management (18).
The management access level in a received Management-Privilege-Level (136) Attribute MUST be applied to the session. If the NAS supports this attribute but the privilege level is unknown, the NAS MUST treat the Access-Accept as an Access-Reject.
The management access policy named in the Management-Policy-Id (135) Attribute, when received in an Access-Accept, MUST be applied to the session. If the NAS supports this attribute but the policy name is unknown or incorrectly formatted, the NAS MUST treat the Access-Accept as an Access-Reject.
Two or more occurrences of the Management-Policy-Id (135) Attribute SHOULD NOT be included in an Access-Accept or CoA-Request, as no precedence relationship is defined and multi-vendor interoperability cannot be guaranteed.
When a NAS receives a Framed-Management-Protocol (133) Attribute in an Access-Accept packet, it MUST deliver that specified form of management access or disconnect the session. If the NAS does not support the provisioned protocol or the user-requested protocol does not match, the NAS MUST treat the Access-Accept as an Access-Reject.
When a NAS receives a Management-Transport-Protection (134) Attribute in an Access-Accept packet, it MUST deliver the management access over a transport with equal or better protection, or disconnect. If the NAS cannot meet the specified protection level, it MUST treat the Access-Accept as an Access-Reject.
A new value of 18 (Framed-Management) is defined for the Service-Type (6) Attribute, indicating that a Framed Management protocol session should be started on the NAS for remote device management.
The Framed-Management-Protocol (133) Attribute indicates the application-layer management protocol to be used for Framed Management access. It MAY be used in both Access-Request and Access-Accept packets and is used in conjunction with Service-Type value Framed-Management (18).
The Management-Policy-Id (135) Attribute carries the name of a pre-provisioned management access policy of local scope. Zero or one instances MAY appear in an Access-Accept packet. The policy name is a simple, unstructured UTF-8 text string with no implicit hierarchy.
The Management-Privilege-Level (136) Attribute carries an integer-valued privilege level for CLI management access. It MAY be used in both Access-Request and Access-Accept packets. Specific access rights conferred by each integer value are implementation-dependent.
The Management-Transport-Protection (134) Attribute specifies the minimum level of protection required for the management transport. Values are: 1=No-Protection, 2=Integrity-Protection, 3=Integrity-Confidentiality-Protection. The protected transport MAY provide greater but MUST NOT provide lower protection than specified.
This document assigns new entries in the RADIUS Attribute Types registry: Service-Type value 18 (Framed-Management); new attribute types Framed-Management-Protocol (133), Management-Transport-Protection (134), Management-Policy-Id (135), and Management-Privilege-Level (136). Additional enumerated values for new attributes require a published specification per RFC 3575.
A NAS that cannot determine the protection state of the remote management connection MUST treat an Access-Accept containing a Management-Transport-Protection Attribute with a value other than No-Protection (1) as an Access-Reject, unless specifically overridden by local policy. Use of No-Protection is NOT RECOMMENDED where secure management is required.
In proxy deployments, sensitive user credentials (e.g., passwords) are likely available in cleartext at each proxy server, since RADIUS passwords are only protected on a hop-by-hop basis. This risk is present whenever password authentication is used for management access across proxy chains.
In RADIUS proxy environments, operators SHOULD use separate RADIUS server lists for management AAA and non-management AAA to prevent upstream proxies from provisioning management access. First-hop proxy servers MAY treat as Access-Reject any Access-Accept that provisions locally unauthorized management access.
Framed-Management-Protocol (Type=133) is encoded as Type (1 octet), Length (1 octet, value 6), and a 4-octet enumerated Value field. Defined values are: 1=SNMP, 2=Web-based, 3=NETCONF, 4=FTP, 5=TFTP, 6=SFTP, 7=RCP, 8=SCP.
Management-Policy-Id (Type=135) is encoded as Type (1 octet), Length (1 octet, >=3), and a variable-length UTF-8 text string. The text content MUST NOT be parsed by the receiver; it is used only for local policy lookup.
Management-Privilege-Level (Type=136) is encoded as Type (1 octet), Length (1 octet, value 6), and a 4-octet integer Value field denoting the management privilege level.
Management-Transport-Protection (Type=134) is encoded as Type (1 octet), Length (1 octet, value 6), and a 4-octet enumerated Value field. Values: 1=No-Protection, 2=Integrity-Protection, 3=Integrity-Confidentiality-Protection.