RADIUS Extensions for IP Port Configuration and Reporting
Extracted elements (26)
The IP-Port-Forwarding-Map attribute targets AAA-controlled static NAT mapping and is explicitly complementary to PCP (RFC 6887): PCP targets deployments where the host application controls its own mappings upstream, while this attribute targets deployments where the AAA server authoritatively instructs mappings for subscribers without assuming host participation.
The IP-Port-Local-Id TLV was introduced because some CGN deployments use overlapping private or shared address spaces (RFC 1918, RFC 6598) across different subscribers, making the internal IP address alone insufficient to uniquely identify a host. An additional identifier such as a tunnel ID is required in those deployments.
All numeric TLV value fields (IP-Port-Type, IP-Port-Limit, IP-Port-Int-Port, IP-Port-Ext-Port, IP-Port-Alloc, IP-Port-Range-Start, IP-Port-Range-End) are encoded in 32 bits per RFC 6158 Appendix A.2.1 even when the underlying IPFIX data type is shorter (unsigned8 or unsigned16); unused high-order bits MUST be set to zero.
All three new attributes MUST NOT appear in RADIUS Reject or Challenge packets. IP-Port-Range MUST NOT appear in Access-Accept, Access-Request, or CoA-Request packets; it is restricted exclusively to Accounting-Request.
IP-Port-Forwarding-Map MUST contain both IP-Port-Int-Port and IP-Port-Ext-Port TLVs. If the internal realm uses IPv4, it MUST include IP-Port-Int-IPv4-Addr TLV; if IPv6, it MUST include IP-Port-Int-IPv6-Addr TLV.
Protocols that do not use a port number (e.g., RSVP, ESP) MUST NOT be included in the IP-Port-Type TLV Protocol-Number field.
The IP-Port-Limit-Info Attribute MUST contain the IP-Port-Limit TLV. When IP-Port-Type TLV is absent the limit applies to all IP transport protocols; when IP-Port-Ext-IPv4-Addr TLV is absent the limit applies to all IPv4 addresses managed by the address-sharing device.
The IP-Port-Range Attribute MUST contain the IP-Port-Alloc TLV. For port allocation it MUST also contain both IP-Port-Range-Start and IP-Port-Range-End TLVs; for deallocation these MAY be omitted, and their absence implies all previously allocated ports are now deallocated.
The IP-Port-Local-Id TLV may carry privacy-sensitive identifiers (e.g., MAC addresses). It is RECOMMENDED to use identifiers that do not expose such sensitive information in this field.
IP-Port-Forwarding-Map (Type 241, Extended-Type 7) specifies a static internal-to-external IP port mapping (internal IPv4 or IPv6 address and port to external IPv4 address and port). It MAY appear in Access-Accept, Access-Request, CoA-Request, and Accounting-Request packets.
IP-Port-Limit-Info (Type 241, Extended-Type 5) limits the maximum number of IP source transport ports for a user, optionally scoped to a specific IP transport protocol (IP-Port-Type TLV) and external IPv4 address (IP-Port-Ext-IPv4-Addr TLV). It MAY appear in Access-Accept, Access-Request, CoA-Request, and Accounting-Request packets.
IP-Port-Range (Type 241, Extended-Type 6) reports a contiguous range of IP source transport ports that have been allocated or deallocated for a user by an address-sharing device. It MAY appear only in Accounting-Request packets and MUST NOT appear in any other RADIUS packet.
Three new RADIUS extended-type attributes are defined: IP-Port-Limit-Info (241.5), IP-Port-Range (241.6), and IP-Port-Forwarding-Map (241.7). All are allocated from the RADIUS Extended Type code space per RFC 6929 and carry TLVs with globally unique names.
A new IANA registry 'RADIUS IP Port Configuration and Reporting TLVs' is created with eleven defined TLV values (0 Reserved, 1–11 defined, 12–255 Unassigned). Registration procedure is Standards Action per RFC 5226.
A new IPFIX Information Element sourceTransportPortsLimit (Element ID 458) is registered with data type unsigned16, semantics totalCounter, unit ports, and value range 1–65535. It represents the maximum IP source transport ports assignable to an end user.
Three new RADIUS attributes are registered from the Short Extended Space of RFC 6929: IP-Port-Limit-Info (241.5, type tlv), IP-Port-Range (241.6, type tlv), and IP-Port-Forwarding-Map (241.7, type tlv), at the RADIUS types registry.
All known RADIUS vulnerabilities apply to this specification. When RADIUS packets are sent in the clear, an attacker can manipulate per-user port limits via IP-Port-Limit-Info, exhaust port quotas by injecting IP-Port-Forwarding-Map entries, redirect traffic by altering forwarding maps, or discover user address/port assignments from IP-Port-Range. IPsec or TLS (RFC 6614) is recommended to secure the RADIUS client-server channel.
If there is any error in a RADIUS Accounting-Request packet (e.g., erroneous port range in IP-Port-Range, inconsistent port mapping in IP-Port-Forwarding-Map), the RADIUS server MUST NOT send a response to the client, per RFC 2866.
IP-Port-Alloc TLV (TLV-Type 8, Length 6 octets) carries IPFIX natEvent (IE 230) as unsigned8 right-justified in 32 bits: value 1 = allocation, value 2 = deallocation, value 0 is reserved. It MUST be present in IP-Port-Range (241.6.8).
IP-Port-Ext-IPv4-Addr TLV (TLV-Type 3, Length 6 octets) carries IPFIX IE 225 (postNATSourceIPv4Address) as a 32-bit IPv4 address — the external address after NAT. It is optional in all three parent attributes (241.5.3, 241.6.3, 241.7.3).
IP-Port-Int-IPv4-Addr TLV (TLV-Type 4, Length 6 octets) carries IPFIX IE 8 (sourceIPv4Address) — the internal IPv4 address before NAT. It MUST be present in IP-Port-Forwarding-Map (241.7.4) when the internal realm is IPv4.
IP-Port-Int-IPv6-Addr TLV (TLV-Type 5, Length 18 octets) carries IPFIX IE 27 (sourceIPv6Address) as a 128-bit IPv6 address — the internal address before NAT64. It MUST be present in IP-Port-Forwarding-Map (241.7.5) when the internal realm is IPv6.
IP-Port-Limit TLV (TLV-Type 2, Length 6 octets) carries IPFIX Information Element 458 (sourceTransportPortsLimit) as unsigned16 right-justified in 32 bits. It MUST be present in IP-Port-Limit-Info (identifier 241.5.2) and encodes the maximum port count for the user.
IP-Port-Local-Id TLV (TLV-Type 11, variable length) carries a locally significant string identifier at the customer premise — MAC address, interface ID, VLAN ID, PPP session ID, VRF ID, or IP address/prefix — needed when internal IP address alone is insufficient for unique subscriber identification.
IP-Port-Range-Start (TLV-Type 9) and IP-Port-Range-End (TLV-Type 10) each carry an IPFIX unsigned16 port number (IEs 361 and 362, portRangeStart and portRangeEnd) right-justified in 6-octet TLVs; together they inclusively define a contiguous port range.
IP-Port-Type TLV (TLV-Type 1, Length 6 octets) carries the IANA IP transport protocol number as unsigned8 right-justified in a 32-bit integer; unused bits MUST be set to zero. Identifies the specific transport protocol (TCP, UDP, SCTP, DCCP) to which the parent attribute applies.