Diameter Network Access Server Application
obsoletes
- rfc-4005 — Diameter Network Access Server Application
Extracted elements (28)
All RADIUS/Diameter protocol interaction material was removed from this document. AVP formats and value ranges derived from RADIUS attributes were retained for transition ease, but protocol interaction guidance belongs elsewhere.
The Callback-Id AVP is not roaming-friendly because it assumes the callback identifier is locally configured on the NAS; use of the Callback-Number AVP is therefore RECOMMENDED for portable deployments.
The QoS-Filter-Rule AVP (Code 407) use is NOT RECOMMENDED; the AVPs defined by RFC 5777 SHOULD be used instead, as they provide a more expressive and standardized QoS policy framework.
RFC 7155 obsoletes RFC 4005 and is NOT backward compatible with it. All RADIUS/Diameter protocol interaction material has been removed, and the ACR/ACA command format now explicitly requires Acct-Application-Id and excludes Vendor-Specific-Application-Id.
A NAS MUST reauthenticate and/or reauthorize at the end of the period provided by the Authorization-Lifetime AVP; upon receipt of an unsolicited RAR, the NAS MUST respond with an RAA message.
A NAS MUST treat unknown or unsupported Service-Type AVP values received in a response as a failure and end the session with DIAMETER_INVALID_AVP_VALUE. If the service type is supported but incompatible with current access mode, the NAS MUST fail to start the session.
Diameter nodes conforming to this specification MUST advertise support by including the value one (1) in the Auth-Application-Id of the Capabilities-Exchange-Request (CER) message.
During reauthentication or reauthorization, the Session-Id AVP in the AAR message MUST be the same as the one present in the original authentication/authorization message.
For multi-round authentication, a subsequent AAR MUST include any State AVPs that were present in the prior AAA message; the server MUST set Result-Code to DIAMETER_MULTI_ROUND_AUTH to signal continuation.
If accounting is active, an Accounting STOP_RECORD message MUST be sent upon termination of the session context.
If the Reply-Message AVP is present in an AAA and it is impossible to deliver the text prompt to the user, the Diameter NAS Application client MUST treat the AAA as an error and deny access.
The Acct-Application-Id AVP MUST be present in both the Accounting-Request (ACR) and Accounting-Answer (ACA) messages; the Vendor-Specific-Application-Id AVP is excluded from these messages.
The ARAP-Password AVP MUST NOT be present if either the User-Password or CHAP-Auth AVP is present; only one authentication method may be used per request.
The Auth-Application-Id AVP MUST be set to the value one (1) in AA-Request, Re-Auth-Request, Session-Termination-Request, and Abort-Session-Request messages.
The clear-text User-Password (AVP Code 2) MUST NOT be longer than 128 bytes in length. The User-Password AVP SHOULD NOT be used in untrusted proxy environments without end-to-end encryption.
The coupled accounting model (RFC 6733, Section 9.3) is RECOMMENDED; the Acct-Application-Id AVP in ACR and ACA messages SHOULD be set to one (1).
The Framed-MTU AVP (Code 12, Unsigned32) value MUST be in the range from 64 to 65535.
When a user's session is disconnected, the NAS MUST issue a Session-Termination-Request (STR) to its Diameter server to free server resources. A NAS receiving an ASR MUST issue an ASA and disconnect the session.
The AA-Request (AAR, Command Code 265, REQ+PXY) is used to request authentication and/or authorization for a NAS user; it carries credentials (User-Password, CHAP-Auth), session info (NAS-Port, NAS-IP-Address), and authorization hints (Service-Type, Framed-Protocol).
The CHAP-Auth AVP (AVP Code 402, Grouped) carries PPP CHAP authentication data and contains CHAP-Algorithm, CHAP-Ident, and optionally CHAP-Response. If CHAP-Auth is present, the CHAP-Challenge AVP (Code 60) MUST also be present.
The Diameter NAS Application defines ten command codes: AA-Request/Answer (265), Re-Auth-Request/Answer (258), Session-Termination-Request/Answer (275), Abort-Session-Request/Answer (274), and Accounting-Request/Answer (271). All MUST be supported by conforming implementations.
The Tunneling AVP (Code 401, Grouped) carries VPN tunneling parameters; it groups Tunnel-Type, Tunnel-Medium-Type, Tunnel-Client-Endpoint, Tunnel-Server-Endpoint, Tunnel-Password, Tunnel-Private-Group-Id, Tunnel-Assignment-Id, Tunnel-Preference, Tunnel-Client-Auth-Id, and Tunnel-Server-Auth-Id.
AVP flag rules require that all application-defined AVPs have the M-bit set (Mandatory) and the V-bit (Vendor-Specific) cleared, ensuring consistent handling across Diameter nodes and preventing vendor-specific override of mandatory attributes.
Diameter messages carrying the User-Password AVP represent sensitive information. As required by RFC 6733, messages must be encrypted via IPsec or TLS; in untrusted proxy environments, end-to-end security techniques SHOULD be applied to protect the password.
The ARAP-Challenge-Response AVP uses DES encryption keyed on the user's password to compute the response; if the password is fewer than 8 octets, it is NULL-padded. This legacy mechanism is inherently weak and should be considered in risk assessments.
Session lifecycle: NAS sends AAR to initiate; if DIAMETER_MULTI_ROUND_AUTH is returned, additional AAR/AAA exchanges occur; on success, NAS starts session context and sends START_RECORD; on termination, NAS sends STR and STOP_RECORD.
CHAP-Ident AVP (Code 404) is OctetString containing the 1-octet CHAP identifier. CHAP-Response AVP (Code 405) is OctetString containing the 16-octet authentication data. CHAP-Challenge AVP (Code 60) carries the challenge sent by the NAS.
The QoSFilterRule is an OctetString-derived format using US-ASCII with the syntax: 'action dir proto from src to dst [options]'; actions are 'tag' (set DSCP) or 'meter' (assured forwarding). First matched rule wins; unmatched packets are treated as best effort.