rfc2867.txt

gnu 的radius服务器很好用的

         IPsec in the tunnel mode), this Attribute need not be included
         in accounting packets, since in this case the Tunnel-Reject
         Attribute has the same meaning.

         If this value is used, the following attributes SHOULD also be
         included in the Accounting-Request packet:

            User-Name (1)
            NAS-IP-Address (4)
            Acct-Delay-Time (41)
            Acct-Terminate-Cause (49)
            Event-Timestamp (55)
            Tunnel-Type (64)
            Tunnel-Medium-Type (65)
            Tunnel-Client-Endpoint (66)
            Tunnel-Server-Endpoint (67)
            Acct-Tunnel-Connection (68)










Zorn, et al.                 Informational                      [Page 6]

RFC 2867            RADIUS Tunnel Accounting Support           June 2000


4.  Attributes

4.1.  Acct-Tunnel-Connection

      Description

         This Attribute indicates the identifier assigned to the tunnel
         session.  It SHOULD be included in Accounting-Request packets
         which contain an Acct-Status-Type attribute having the value
         Start, Stop or any of the values described above.  This
         attribute, along with the Tunnel-Client-Endpoint and Tunnel-
         Server-Endpoint attributes [3], may be used to provide a means
         to uniquely identify a tunnel session for auditing purposes.

      A summary of the Acct-Tunnel-Connection Attribute format is shown
      below.  The fields are transmitted from left to right.

       0                   1                   2
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      Type     |    Length     |    String ...
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Type

         68 for Acct-Tunnel-Connection

      Length

         >= 3

      String

         The format of the identifier represented by the String field
         depends upon the value of the Tunnel-Type attribute [3].  For
         example, to fully identify an L2TP tunnel connection, the L2TP
         Tunnel ID and Call ID might be encoded in this field.  The
         exact encoding of this field is implementation dependent.

4.2.  Acct-Tunnel-Packets-Lost

      Description

         This Attribute indicates the number of packets lost on a given
         link.  It SHOULD be included in Accounting-Request packets
         which contain an Acct-Status-Type attribute having the value
         Tunnel-Link-Stop.




Zorn, et al.                 Informational                      [Page 7]

RFC 2867            RADIUS Tunnel Accounting Support           June 2000


      A summary of the Acct-Tunnel-Packets-Lost Attribute format is
      shown below.  The fields are transmitted from left to right.

       0                   1                   2                   3
       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
      |      Type     |    Length     |               Lost
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
                 Lost (cont)          |
      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

      Type

         86 for Acct-Tunnel-Packets-Lost

      Length

         6

      Lost

         The Lost field is 4 octets in length and represents the number
         of packets lost on the link.

5.  Table of Attributes

   The following table provides a guide to which attributes may be found
   in Accounting-Request packets.  No tunnel attributes should be found
   in Accounting-Response packets.

   Request        #       Attribute
     0-1          64      Tunnel-Type
     0-1          65      Tunnel-Medium-Type
     0-1          66      Tunnel-Client-Endpoint
     0-1          67      Tunnel-Server-Endpoint
     0-1          68      Acct-Tunnel-Connection
     0            69      Tunnel-Password
     0-1          81      Tunnel-Private-Group-ID
     0-1          82      Tunnel-Assignment-ID
     0            83      Tunnel-Preference
     0-1          86      Acct-Tunnel-Packets-Lost










Zorn, et al.                 Informational                      [Page 8]

RFC 2867            RADIUS Tunnel Accounting Support           June 2000


   The following table defines the meaning of the above table entries.

   0     This attribute MUST NOT be present in packet.
   0+    Zero or more instances of this attribute MAY be present in
         packet.
   0-1   Zero or one instance of this attribute MAY be present in
         packet.

6.  Security Considerations

   By "sniffing" RADIUS Accounting packets, it might be possible for an
   eavesdropper to perform a passive analysis of tunnel connections.

7.  References

   [1]  Rigney, C., "RADIUS Accounting", RFC 2866, June 2000.

   [2]  Bradner, S., "Key words for use in RFCs to Indicate Requirement
        Levels", BCP 14, RFC 2119, March 1997.

   [3]  Zorn, G., Leifer, D., Rubens, A., Shriver, J., Holdrege, M. and
        I.  Goyret, "RADIUS Attributes for Tunnel Protocol Support", RFC
        2868, June 2000.

   [4]  Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G. and
        B.  Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2661,
        August 1999.

   [5]  Hamzeh, K., Pall, G., Verthein, W., Taarud, J., Little, W. and
        G.  Zorn, "Point-to-Point Tunneling Protocol (PPTP)", RFC 2637,
        July 1999.

8.  Acknowledgments

   Thanks to Aydin Edguer, Ly Loi, Matt Holdrege and Gurdeep Singh Pall
   for salient input and review.















Zorn, et al.                 Informational                      [Page 9]

RFC 2867            RADIUS Tunnel Accounting Support           June 2000


9.  Authors' Addresses

   Questions about this memo can be directed to:

   Glen Zorn
   Cisco Systems, Inc.
   500 108th Avenue N.E., Suite 500
   Bellevue, Washington 98004
   USA

   Phone: [phone]
   FAX:   [phone]
   EMail: [e-mail]


   Dave Mitton
   Nortel Networks
   880 Technology Park Drive
   Billerica, MA 01821

   Phone: [phone]
   Fax:   [phone]
   EMail: [e-mail]


   Bernard Aboba
   Microsoft Corporation
   One Microsoft Way
   Redmond, Washington 98052

   Phone: [phone]
   Fax:   [phone]
   EMail: [e-mail]


















Zorn, et al.                 Informational                     [Page 10]

RFC 2867            RADIUS Tunnel Accounting Support           June 2000


10.  Full Copyright Statement

   Copyright (C) The Internet Society (2000).  All Rights Reserved.

   This document and translations of it may be copied and furnished to
   others, and derivative works that comment on or otherwise explain it
   or assist in its implementation may be prepared, copied, published
   and distributed, in whole or in part, without restriction of any
   kind, provided that the above copyright notice and this paragraph are
   included on all such copies and derivative works.  However, this
   document itself may not be modified in any way, such as by removing
   the copyright notice or references to the Internet Society or other
   Internet organizations, except as needed for the purpose of
   developing Internet standards in which case the procedures for
   copyrights defined in the Internet Standards process must be
   followed, or as required to translate it into languages other than
   English.

   The limited permissions granted above are perpetual and will not be
   revoked by the Internet Society or its successors or assigns.

   This document and the information contained herein is provided on an
   "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
   TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
   BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
   HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
   MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Acknowledgement

   Funding for the RFC Editor function is currently provided by the
   Internet Society.



















Zorn, et al.                 Informational                     [Page 11]