rfc3580.txt

radius服务器

   is transferred between Access Points, accounting packets MAY be sent
   without a corresponding authentication and authorization exchange,




Congdon, et al.              Informational                      [Page 6]

RFC 3580                   IEEE 802.1X RADIUS             September 2003


   provided that Association has occurred.  However, in such a situation
   it is assumed that the Acct-Multi-Session-Id is transferred between
   the Access Points as part of the Inter-Access Point Protocol (IAPP).

   If the Acct-Multi-Session-Id were not unique between Access Points,
   then it is possible that the chosen Acct-Multi-Session-Id will
   overlap with an existing value allocated on that Access Point, and
   the Accounting Server would therefore be unable to distinguish a
   roaming session from a multi-link session.

   As a result, the Acct-Multi-Session-Id attribute is unique among all
   the bridges or Access Points, Supplicants and sessions.  In order to
   provide this uniqueness, it is suggested that the Acct-Multi-
   Session-Id be of the form:

   Original AP MAC Address | Supplicant MAC Address | NTP Timestamp

   Here "|" represents concatenation, the original AP MAC Address is the
   MAC address of the bridge or Access Point at which the session
   started, and the 64-bit NTP timestamp indicates the beginning of the
   original session.  In order to provide for consistency of the Acct-
   Multi-Session-Id between roaming sessions, the Acct-Multi-Session-Id
   may be moved between Access Points as part of IAPP or another handoff
   scheme.

   The use of an Acct-Multi-Session-Id of this form guarantees
   uniqueness among all Access Points, Supplicants and sessions.  Since
   the NTP timestamp does not wrap on reboot, there is no possibility
   that a rebooted Access Point could choose an Acct-Multi-Session-Id
   that could be confused with that of a previous session.

   Since the Acct-Multi-Session-Id is of type String as defined in
   [RFC2866], for use with IEEE 802.1X, it is encoded as an ASCII string
   of Hex digits.  Example:  "00-10-A4-23-19-C0-00-12-B2-
   14-23-DE-AF-23-83-C0-76-B8-44-E8"

2.3.  Acct-Link-Count

   The Acct-Link-Count attribute may be used to account for the number
   of ports that have been aggregated.

3.  RADIUS Authentication

   This section describes how attributes defined in [RFC2865],
   [RFC2867], [RFC2868], [RFC2869], [RFC3162] and [RFC3579] are used in
   IEEE 802.1X authentication.





Congdon, et al.              Informational                      [Page 7]

RFC 3580                   IEEE 802.1X RADIUS             September 2003


3.1.  User-Name

   In IEEE 802.1X, the Supplicant typically provides its identity via an
   EAP-Response/Identity message.  Where available, the Supplicant
   identity is included in the User-Name attribute, and included in the
   RADIUS Access-Request and Access-Reply messages as specified in
   [RFC2865] and [RFC3579].

   Alternatively, as discussed in [RFC3579] Section 2.1., the User-Name
   attribute may contain the Calling-Station-ID value, which is set to
   the Supplicant MAC address.

3.2.  User-Password, CHAP-Password, CHAP-Challenge

   Since IEEE 802.1X does not support PAP or CHAP authentication, the
   User-Password, CHAP-Password or CHAP-Challenge attributes are not
   used by IEEE 802.1X Authenticators acting as RADIUS clients.

3.3.  NAS-IP-Address, NAS-IPv6-Address

   For use with IEEE 802.1X, the NAS-IP-Address contains the IPv4
   address of the bridge or Access Point acting as an Authenticator, and
   the NAS-IPv6-Address contains the IPv6 address.  If the IEEE 802.1X
   Authenticator has more than one interface, it may be desirable to use
   a loopback address for this purpose so that the Authenticator will
   still be reachable even if one of the interfaces were to fail.

3.4.  NAS-Port

   For use with IEEE 802.1X the NAS-Port will contain the port number of
   the bridge, if this is available.  While an Access Point does not
   have physical ports, a unique "association ID" is assigned to every
   mobile Station upon a successful association exchange.  As a result,
   for an Access Point, if the association exchange has been completed
   prior to authentication, the NAS-Port attribute will contain the
   association ID, which is a 16-bit unsigned integer.  Where IEEE
   802.1X authentication occurs prior to association, a unique NAS-Port
   value may not be available.

3.5.  Service-Type

   For use with IEEE 802.1X, the Framed (2), Authenticate Only (8), and
   Call Check (10) values are most commonly used.

   A Service-Type of Framed indicates that appropriate 802 framing
   should be used for the connection.  A Service-Type of Authenticate
   Only (8) indicates that no authorization information needs to be
   returned in the Access-Accept.  As described in [RFC2865], a



Congdon, et al.              Informational                      [Page 8]

RFC 3580                   IEEE 802.1X RADIUS             September 2003


   Service-Type of Call Check is included in an Access-Request packet to
   request that the RADIUS server accept or reject the connection
   attempt, typically based on the Called-Station-ID (set to the bridge
   or Access Point MAC address) or Calling-Station-ID attributes (set to
   the Supplicant MAC address).  As noted in [RFC2865], it is
   recommended that in this case, the User-Name attribute be given the
   value of Calling-Station-Id.

3.6.  Framed-Protocol

   Since there is no value for IEEE 802 media, the Framed-Protocol
   attribute is not used by IEEE 802.1X Authenticators.

3.7.  Framed-IP-Address, Framed-IP-Netmask

   IEEE 802.1X does not provide a mechanism for IP address assignment.
   Therefore the Framed-IP-Address and Framed-IP-Netmask attributes can
   only be used by IEEE 802.1X Authenticators that support IP address
   assignment mechanisms.  Typically this capability is supported by
   layer 3 devices.

3.8.  Framed-Routing

   The Framed-Routing attribute indicates the routing method for the
   Supplicant.  It is therefore only relevant for IEEE 802.1X
   Authenticators that act as layer 3 devices, and cannot be used by a
   bridge or Access Point.

3.9.  Filter-ID

   This attribute indicates the name of the filter list to be applied to
   the Supplicant's session.  For use with an IEEE 802.1X Authenticator,
   it may be used to indicate either layer 2 or layer 3 filters.  Layer
   3 filters are typically only supported on IEEE 802.1X Authenticators
   that act as layer 3 devices.

3.10.  Framed-MTU

   This attribute indicates the maximum size of an IP packet that may be
   transmitted over the wire between the Supplicant and the
   Authenticator.  IEEE 802.1X Authenticators set this to the value
   corresponding to the relevant 802 medium, and include it in the
   RADIUS Access-Request.  The RADIUS server may send an EAP packet as
   large as Framed-MTU minus four (4) octets, taking into account the
   additional overhead for the IEEE 802.1X Version (1), Type (1) and
   Body Length (2) fields.  For EAP over IEEE 802 media, the Framed-MTU
   values (which do not include LLC/SNAP overhead) and maximum frame
   length values (not including the preamble) are as follows:



Congdon, et al.              Informational                      [Page 9]

RFC 3580                   IEEE 802.1X RADIUS             September 2003


                                        Maximum Frame
   Media             Framed-MTU            Length
   =========        ===============     ==============
   Ethernet              1500              1522
   802.3                 1500              1522
   802.4                 8174              8193
   802.5 (4 Mbps)        4528              4550
   802.5 (16 Mbps)      18173             18200
   802.5 (100 Mb/s)     18173             18200
   802.6                 9191              9240
   802.9a                1500              1518
   802.11                2304              2346
   802.12 (Ethernet)     1500              1518
   802.12 (Token Ring)   4502              4528
   FDDI                  4479              4500

   NOTE - the Framed-MTU size for IEEE 802.11 media may change as a
   result of ongoing work being undertaken in the IEEE 802.11 Working
   Group.  Since some 802.11 stations cannot handle an MTU larger than
   1500 octets, it is recommended that RADIUS servers encountering a
   NAS-Port-Type value of 802.11 send EAP packets no larger than 1496
   octets.

3.11.  Framed-Compression

   [IEEE8021X] does not include compression support.  Therefore this
   attribute is not understood by [IEEE8021X] Authenticators.

3.12.  Displayable Messages

   The Reply-Message attribute, defined in section 5.18 of [RFC2865],
   indicates text which may be displayed to the user.  This is similar
   in concept to the EAP Notification Type, defined in [RFC2284].  As
   noted in [RFC3579], Section 2.6.5, when sending a displayable message
   to an [IEEE8021X] Authenticator, displayable messages are best sent
   within EAP-Message/EAP-Request/Notification attribute(s), and not
   within Reply-Message attribute(s).

3.13.  Callback-Number, Callback-ID

   These attributes are not understood by IEEE 802.1X Authenticators.










Congdon, et al.              Informational                     [Page 10]

RFC 3580                   IEEE 802.1X RADIUS             September 2003


3.14.  Framed-Route, Framed-IPv6-Route

   The Framed-Route and Framed-IPv6-Route attributes provide routes that
   are to be configured for the Supplicant.  These attributes are
   therefore only relevant for IEEE 802.1X Authenticators that act as
   layer 3 devices, and cannot be understood by a bridge or Access
   Point.

3.15.  State, Class, Proxy-State

   These attributes are used for the same purposes as described in
   [RFC2865].

3.16.  Vendor-Specific

   Vendor-specific attributes are used for the same purposes as
   described in [RFC2865].  The MS-MPPE-Send-Key and MS-MPPE-Recv-Key
   attributes, described in section 2.4 of [RFC2548], MAY be used to
   encrypt and authenticate the RC4 EAPOL-Key descriptor [IEEE8021X,
   Section 7.6].  Examples of the derivation of the MS-MPPE-Send-Key and
   MS-MPPE-Recv-Key attributes from the master key negotiated by an EAP
   method are given in [RFC2716].  Details of the EAPOL-Key descriptor
   are provided in Section 4.

3.17.  Session-Timeout

   When sent along in an Access-Accept without a Termination-Action
   attribute or with a Termination-Action attribute set to Default, the
   Session-Timeout attribute specifies the maximum number of seconds of
   service provided prior to session termination.

   When sent in an Access-Accept along with a Termination-Action value
   of RADIUS-Request, the Session-Timeout attribute specifies the
   maximum number of seconds of service provided prior to re-
   authentication.  In this case, the Session-Timeout attribute is used
   to load the reAuthPeriod constant within the Reauthentication Timer
   state machine of 802.1X.  When sent with a Termination-Action value
   of RADIUS-Request, a Session-Timeout value of zero indicates the
   desire to perform another authentication (possibly of a different
   type) immediately after the first authentication has successfully
   completed.

   When sent in an Access-Challenge, this attribute represents the
   maximum number of seconds that an IEEE 802.1X Authenticator should
   wait for an EAP-Response before retransmitting.  In this case, the
   Session-Timeout attribute is used to load the suppTimeout constant
   within the backend state machine of IEEE 802.1X.




Congdon, et al.              Informational                     [Page 11]

RFC 3580                   IEEE 802.1X RADIUS             September 2003


3.18.  Idle-Timeout

   The Idle-Timeout attribute is described in [RFC2865].  For IEEE 802
   media other than 802.11 the media are always on.  As a result the
   Idle-Timeout attribute is typically only used with wireless media
   such as IEEE 802.11.  It is possible for a wireless device to wander
   out of range of all Access Points.  In this case, the Idle-Timeout
   attribute indicates the maximum time that a wireless device may
   remain idle.

3.19.  Termination-Action

   This attribute indicates what action should be taken when the service
   is completed.  The value RADIUS-Request (1) indicates that re-
   authentication should occur on expiration of the Session-Time.  The
   value Default (0) indicates that the session should terminate.

3.20.  Called-Station-Id

   For IEEE 802.1X Authenticators, this attribute is used to store the
   bridge or Access Point MAC address in ASCII format (upper case only),
   with octet values separated by a "-".  Example: "00-10-A4-23-19-C0".
   In IEEE 802.11, where the SSID is known, it SHOULD be appended to the
   Access Point MAC address, separated from the MAC address with a ":".
   Example "00-10-A4-23-19-C0:AP1".

3.21.  Calling-Station-Id

   For IEEE 802.1X Authenticators, this attribute is used to store the
   Supplicant MAC address in ASCII format (upper case only), with octet
   values separated by a "-".  Example: "00-10-A4-23-19-C0".

3.22.  NAS-Identifier

   This attribute contains a string identifying the IEEE 802.1X
   Authenticator originating the Access-Request.

3.23.  NAS-Port-Type

   For use with IEEE 802.1X, NAS-Port-Type values of Ethernet (15)