RADIUS Attributes for IPv6 Access Networks
Extracted elements (20)
A single Framed-IPv6-Address Attribute was introduced instead of reusing the RFC 3162 combination of Framed-Interface-Id and Framed-IPv6-Prefix because the combined form is more natural for PPP IPv6CP than for DHCPv6, and a single address attribute simplifies accounting record processing.
Delegated-IPv6-Prefix-Pool is restricted to DHCPv6-PD prefix pools while Framed-IPv6-Pool is used for SLAAC prefix pools, to avoid ambiguity when both mechanisms operate on the same network.
Framed-IPv6-Address is scoped to DHCPv6-assigned addresses while Framed-IPv6-Prefix and Framed-Interface-Id remain for SLAAC addresses, avoiding ambiguity when both stateful and stateless configuration co-exist on the same network.
Route-IPv6-Information was introduced because Framed-IPv6-Prefix cannot convey more-specific routes and Framed-IPv6-Route does not result in the route being announced in a Router Advertisement; a new Attribute was needed to provision NAS RA route announcements via RFC 4191.
Because the five new Attributes are allocated from the standard RADIUS type space, no special handling is required by Diameter entities wishing to use them.
All five new Attributes MAY be used in Access-Request packets as hints from the NAS to the RADIUS server; the RADIUS server is not required to honor such hints.
Bits in the Route-IPv6-Information Prefix field after the prefix length, if any, are reserved and MUST be initialized to zero.
The Delegated-IPv6-Prefix-Pool Attribute name SHOULD be used to select an IPv6 delegated prefix for the user. If a NAS does not support prefix pools, the NAS MUST ignore this Attribute.
The Stateful-IPv6-Address-Pool Attribute name SHOULD be used to select an IPv6 address for the user. If a NAS does not support address pools, the NAS MUST ignore this Attribute.
When multiple DNS-Server-IPv6-Address Attributes are present in an Access-Accept packet, the addresses SHOULD be copied to DHCPv6 DNS Recursive Name Server Option or IPv6 RA Recursive DNS Server Option in the same order as received.
The Delegated-IPv6-Prefix-Pool Attribute (Type 171, Length at least 3) contains the name of a prefix pool to be used for DHCPv6 Prefix Delegation on the NAS. The String field is not NULL-terminated.
The DNS-Server-IPv6-Address Attribute (Type 169, Length 18) carries the 128-bit IPv6 address of a DNS server. It MAY appear multiple times in Access-Accept packets to convey multiple DNS server addresses to the NAS.
The Framed-IPv6-Address Attribute (Type 168, Length 18) carries a 128-bit IPv6 address assigned to the NAS-facing interface of the RG/host. It MAY appear multiple times in Access-Accept packets and MAY be used as a hint in Access-Request packets.
The Route-IPv6-Information Attribute (Type 170, Length 4–20) specifies an IPv6 prefix and corresponding route to be announced via the Route Information Option (RFC 4191). It contains a Reserved octet, an 8-bit Prefix-Length (0–128), and a variable-length Prefix field (0, 8, or 16 octets).
The Stateful-IPv6-Address-Pool Attribute (Type 172, Length at least 3) contains the name of an address pool to be used for DHCPv6 stateful address assignment on the NAS. The String field is not NULL-terminated.
IANA assigned five new RADIUS Attribute types in the 'Radius Attribute Types' registry: Framed-IPv6-Address (168), DNS-Server-IPv6-Address (169), Route-IPv6-Information (170), Delegated-IPv6-Prefix-Pool (171), and Stateful-IPv6-Address-Pool (172).
Known security vulnerabilities of the RADIUS protocol apply to the Attributes defined in this document. A trust relationship between the NAS and RADIUS server is expected, with communication optionally secured by IPsec or TLS (RFC 6614).
DNS-Server-IPv6-Address wire format: Type (1 octet, value 169), Length (1 octet, value 18), Address (16 octets, 128-bit IPv6 address of a DNS server).
Framed-IPv6-Address wire format: Type (1 octet, value 168), Length (1 octet, value 18), Address (16 octets, 128-bit IPv6 address). Format is identical to the Address field in NAS-IPv6-Address.
Route-IPv6-Information wire format: Type (1 octet, value 170), Length (1 octet, at least 4, no larger than 20), Reserved (1 octet), Prefix-Length (1 octet), Prefix (variable, 0/8/16 octets). Bits in the prefix beyond Prefix-Length MUST be initialized to zero.