RADIUS VSA

Information About RADIUS VSA

The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the network access server and the RADIUS server by using vendor specific attributes (VSA). VSA allow vendors to support their own extended attributes otherwise not suitable for general use. The controller uses these attributes value in authentication or accounting packets, or both based on specified usage format.

VSA contains these three elements:

  • Type

  • Length

  • String (also known as data)

    • Vendor-ID

    • Vendor-Type

    • Vendor-Length

    • Vendor-Data

This feature is supported only in FlexConnect central authentication mode with local switching. FlexConnect local authentication mode is not supported.

This feature is supported only for wireless sessions.

This feature supports the following set of VSAs per WLAN for authentication and accounting requests, in addition to the existing AAA attributes.

Table 1. Newly Supported Attributes

Attribute Name

Well-known Attribute

VSA Sub-attribute

Vendor ID

SVR-Zip-Code

26

14

14369

SVR-Device-Type

26

17

14369

SVR-Device-Model-Number

26

18

14369

SVR-Lat-Long

26

19

14369

SVR-Venue-Category

26

20

14369

SVR-Network-Type

26

21

14369

Aggregation-AAA

26

22

14369

BW-Venue-Id

26

7

22472

BW-Venue-TZ

26

8

22472

BW-Class

26

10

22472

BW-Venue-Description

26

11

22472

BW-ISO-Country-Code

26

14

22472

BW-E164-Country-Code

26

15

22472

BW-State-Name

26

16

22472

BW-City-Name

26

17

22472

BW-Area-Code

26

18

22472

BW-User-Group

26

27

22472

BW-Venue-Name

26

29

22472

BW-Operator-Name

26

37

22472

Create an Attribute List

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

aaa attribute list list

Example:

Device(config)# aaa attribute list TEST

Creates a AAA attribute list.

Step 3

attribute type attribute-type

Example:

Device(config-attr-list)# attribute type BW-City-Name “MUMBAI”

Specifies a AAA attribute type.

Step 4

attribute type attribute-type

Example:

Device(config-attr-list)# attribute type BW-State-Name “MAHARASHTRA

(Optional) Specifies a AAA attribute type.

Step 5

attribute type attribute-type

Example:

Device(config-attr-list)#attribute type BW-Venue-Name “WANKHEDE”

(Optional) Specifies a AAA attribute type.

Step 6

end

Example:

Device(config-attr-list)# end

Returns to Privileged EXEC mode.

What to do next

Create a AAA policy and map the attribute list.

Create a AAA Policy and Map it to Attribute List

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless aaa policy aaa-policy

Example:

Device(config)# wireless aaa policy policy-1

Creates a new AAA policy.

Step 3

attrlist authentication authentication-attr-list

Example:

Device(config-aaa-policy)# attrlist authentication auth-attr-list

Configures VSA authentication attribute list.

Step 4

attrlist accounting accounting-attr-list

Example:

Device(config-aaa-policy)# attrlist accounting acct-attr-list

Configures VSA accounting attribute list.

Step 5

end

Example:

Device(config-aaa-policy)# end

Returns to Privileged EXEC mode.

What to do next

Map the AAA policy to the WLAN policy profile.

Map a AAA Policy to the WLAN Policy Profile

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy profile-policy

Example:

Device(config)# wireless profile policy EAP-AKA

Creates a new wireless policy profile.

Step 3

aaa-policy aaa-policy

Example:

Device(config-wireless-policy)# aaa-policy Verizon-aaa-policy

Creates a new AAA policy.

Step 4

end

Example:

Device(config-wireless-policy)# end

Returns to Privileged EXEC mode.

What to do next

Map the WLAN policy profile to a WLAN.

Map the WLAN Policy Profile to a WLAN

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless tag policy policy-name

Example:

Device(config)# wireless tag policy EAP-AKA

Creates a new policy tag.

Step 3

wlan wlan-profile-name policy aaa-policy

Example:

Device(config-policy-tag)# wlan EAP-AKA policy EAP-AKA

Maps the policy profile to a WLAN.

Step 4

end

Example:

Device(config-policy-tag)# end

Returns to Privileged EXEC mode.