Subject: [AAA-WG]: Proposed resolution of Issue 295: More NASREQ AVPs needed

From: David Spence <[email-masked]>
Date: Fri, 07 Jun 2002 17:15:49 -0400

This is my proposed resolution to issue 295, "More NASREQ AVPs needed".

The original issue statement is a follows:

   Subject: [issue] More NASREQ AVPs needed
   
   Submitter name: David Spence
   Submitter email address: [email-masked]
   Date first submitted: March 4, 2002
   Reference: 
   Document: NASREQ-09
   Comment type: T
   Priority: S
   Section: various
   Rationale/Explanation of issue: 
   
       There are a number of attributes defined in RADIUS RFCs that are
       needed for the correct operation of the Diameter NASREQ application.
       They are:
   
          CODE      NAME                            RFC
          ----      ----                            ----
            29      Termination-Action              2865
            41      Acct-Delay-Time                 2866
            51      Acct-Link-Count                 2866
            55      Event-Timestamp                 2869
            78      Configuration-Token             2869
            85      Acct-Interim-Interval           2869
            87      NAS-Port-Id                     2869
            88      Framed-Pool                     2869
            95      NAS-IPv6-Address                3162
            98      Login-IPv6-Host                 3162
   
       Note: These AVPs were not added to nasreq-09, so this issue requires
       more work in nasreq. 

   Requested change:
   
       Add these attributes to nasreq as Diameter AVPs.

Of the ten AVPs listed above, two of them, Event-Timestamp and 
Acct-Interim-Interval, have since been added to the base protocol.  I 
only had to add references to them.  The following is the proposed text 
for the other eight.  I also expanded the definition of the State AVP to 
bring it into better conformance with RADIUS.  The proposed text for it 
can be found below as well.  This proposed text has been included in an 
interim version of the draft which can be downloaded from:

http://ext.interlinknetworks.com/dspence/draft-ietf-aaa-diameter-nasreq-09-b.txt

The following excerpts are the proposed text for issue 295.

==========

                                            +---------------------+
                                            |    AVP Flag rules   |
                                            |----+-----+----+-----|----+
                   AVP  Section             |    |     |SHLD| MUST|MAY |
   Attribute Name  Code Defined  Value Type |MUST| MAY | NOT|  NOT|Encr|
   -----------------------------------------|----+-----+----+-----|----|
   Acct-Delay-Time   41  8.10    Unsigned32 | M  |  P  |    |  V  | Y  |
   Acct-Link-Count   51  8.11    Unsigned32 | M  |  P  |    |  V  | Y  |
   Configuration-    78  6.12    OctetString| M  |     |    | P,V |    |
     Token                                  |    |     |    |     |    |
   Framed-Pool       88  7.2.5.4 OctetString| M  |  P  |    |  V  | Y  |
   Login-IPv6-Host   98  7.3.2   IPAddress  | M  |  P  |    |  V  | Y  |
   NAS-IPv6-Address  95  2.2.2   IPAddress  | M  |  P  |    |  V  | Y  |
   NAS-Port-Id       87  6.2     UTF8String | M  |  P  |    |  V  | Y  |
   Termination-      29  6.13    Enumerated | M  |  P  |    |  V  | Y  |
     Action                                 |    |     |    |     |    |

==========

   Message Format

      <AA-Request> ::= < Diameter Header: 265, REQ, PXY >
...
                       [ NAS-Port-Id ]
                       [ NAS-IPv6-Address ]
                     * [ Login-IPv6-Host ]

==========

   Message Format

      <AA-Answer> ::= < Diameter Header: 265, PXY >
...
                    * [ Configuration-Token ]
                      [ Acct-Interim-Interval ]
                      [ Termination-Action ]
                      [ Framed-Pool ]
                    * [ Login-IPv6-Host ]

==========

   Message Format

      <Diameter-EAP-Request> ::= < Diameter Header: 268, REQ, PXY >
...
                                 [ NAS-Port-Id ]
                                 [ NAS-IPv6-Address ]

==========

   Message Format

      <Diameter-EAP-Answer> ::= < Diameter Header: 268, PXY >
...
                              * [ Configuration-Token ]
                                [ Acct-Interim-Interval ]
                                [ Termination-Action ]
                                [ Framed-Pool ]

==========

2.2.2  NAS-IPv6-Address AVP

   The NAS-IPv6-Address AVP (AVP Code 95) [37] is of type IPAddress, and
   contains the IPv6 Address of the NAS providing service to the user.
   This AVP SHOULD only be added by a RADIUS/Diameter Translation Agent
   (see Section 9.0).  When this AVP is present, the Origin-Host AVP
   identifies the RADIUS/Diameter Translation Agent rather than the NAS
   providing service to the user.

==========

2.2.4  State AVP

   The State AVP (AVP Code 24) [1] is of type OctetString and has two
   uses in the Diameter NASREQ application.

   The State AVP MAY be sent by a Diameter Server to a NAS in an AA-
   Response command that contains a Result-Code of
   DIAMETER_MULTI_ROUND_AUTH.  If so, the NAS MUST return it unmodified
   in the subsquent AA-Request command.

   The State AVP MAY also be sent by a Diameter Server to a NAS in an
   AA-Response or Diameter-EAP-Response command that also includes a
   Termination-Action AVP with the value of AA-REQUEST.  If the NAS
   performs the Termination-Action by sending a new AA-Request or
   Diameter-EAP-Request command upon termination of the current service,
   it MUST return the State AVP unmodified in the new request command.

   In either usage the NAS MUST NOT interpret the AVP locally.  Usage of
   the State AVP is implementation dependent.

==========

6.2  NAS-Port-Id

   The NAS-Port-Id AVP (AVP Code 87) is of type UTF8String and
   identifies the port of the NAS which is authenticating the user.
   Note that this is using "port" in its sense of a physical connection
   on the NAS, not in the sense of a TCP or UDP port number.

   Either NAS-Port or NAS-Port-ID SHOULD be present in AA-Request and
   Diameter-EAP-Request commands if the NAS differentiates among its
   ports.  NAS-Port-Id is intended for use by NASes which cannot
   conveniently number their ports.

==========

6.12  Configuration-Token AVP

   The Configuration-Token AVP (AVP Code 78) is of type OctetString and
   is sent by a Diameter Server to a Diameter Proxy Agent or Translation
   Agent in an AA-Answer or Diameter-EAP-Answer command to indicate a
   type of user profile to be used.  It should not be sent to a Diameter
   Client (NAS).

   The format of the Data field of this AVP is site specific.

==========

6.13  Termination-Action AVP

   The Termination-Action AVP is of type Enumerated and indicates what
   action the NAS should take when the specified service is completed.
   This AVP SHOULD only be present in authorization responses. The
   following values are supported as listed in [33]:

      DEFAULT                    0
         Upon termination of the authorized service the NAS MUST
         terminate the current session.

      AA-REQUEST                 1
         Upon termination of the authorized service the NAS MAY send a
         new AA-Request (AAR) or Diameter-EAP-Request (DER) command.
         When the authorized service terminates, the NAS SHOULD NOT
         terminate the session or generate a Session-Termination-Request
         (STR) command.  Instead, it SHOULD generate a new AAR or DER
         command which contains the same value of the Session-Id AVP it
         sent in the previous AAR or DER command.  It SHOULD also
         include the State AVP from the previous AA-Answer (AAA) command
         or Diameter-EAP-Answer (DEA) command if it contained one.

         An exception to this rule applies, however, if the authorized
         service terminates due to the expiry of the Session-Timeout
         AVP.  In this case, the NAS MUST terminate the expired session
         and MAY generate a new AAR or DER command with a new Session-
         Id.

   Note: The Termination-Action AVP is typically used for the login
   service (Service-Type = 1 or "Login") or by 802.1x access devices
   (e.g., NAS-Port-Type = 19 or "Wireless - IEEE 802.11").

   When used for the login service, the service typically terminates
   when the login host clears the connection.  The NAS may prompt the
   user for a new connection and issue a new AA-Request.

   When used by 802.1x access devices, the service typically terminates
   due to the expiry of the Session-Timeout AVP.  The access device may
   then reauthenticate the user with a new AA-Request.  The RECOMMENDED
   way to do this in Diameter is to use the Authorization-Lifetime AVP
   rather than the Termination-Action AVP.  However, the Termination-
   Action AVP MAY be used when copied from a RADIUS Access-Accept to a
   Diameter AA-Answer by a Translation Agent.

==========

7.2.5.4  Framed-Pool AVP

   The Framed-Pool AVP (AVP Code 88) is of type OctetString and contains
   the name of an assigned address pool that SHOULD be used to assign an
   address for the user.  If a NAS does not support multiple address
   pools, the NAS SHOULD ignore this AVP.  Address pools are usually
   used for IP addresses, but can be used for other protocols if the NAS
   supports pools for those protocols.

   Although specified as type OctetString for compatibility with RADIUS
   [32], the encoding of the Data field SHOULD also conform to the rules
   for the UTF8String Data Format.

==========

7.3.2  Login-IPv6-Host AVP

   The Login-IPv6-Host AVP (AVP Code 98) [37] is of type IPAddress and
   contains the IPv6 address of a host with which to connect the user
   when the Login-Service AVP is included.  It MAY be used in an AA-
   Request command as a hint to the Diameter Server that a specific host
   is desired, but the Diameter Server is not required to honor the hint
   in the AA-Answer.

   Two addresses have special significance:
   0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF and 0. The value
   0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF indicates that the NAS SHOULD
   allow the user to select an address.  The value 0 indicates that the
   NAS SHOULD select a host to connect the user to.

==========

8.10 Acct-Delay-Time

   The Acct-Delay-Time AVP (AVP Code 41) is of type Unsigned32 and
   indicates the number of seconds during which the Diameter client has
   been trying to send the Accounting-Request (ACR) which contains it.
   The accounting server may subtract this value from the time the ACR
   arrives at the server to calculate the approximate time of the event
   that caused the ACR to be generated.

   This AVP is not used for retransmissions at the transport level (TCP
   or SCTP).  Rather, it may be used when an ACR command cannot be
   transmitted because there is no appropriate peer to transmit it to or
   was rejected because it could not be delivered to its destination.
   In these cases, the command MAY be buffered and transmitted some time
   later when an appropriate peer-connection is available or after
   sufficient time has passed that the destination-host may be reachable
   and operational.  If the ACR is resent in this way the Acct-Delay-
   Time AVP SHOULD be included.  The value of this AVP indicates the
   number of seconds that elapsed between the time of the first attempt
   at transmission and the current attempt at transmission.

==========

8.11 Acct-Link-Count

   The Acct-Link-Count AVP (AVP Code 51) is of type Unsigned32 and
   indicates the number of links which are known to have been in a given
   multilink session at the time the accounting record is generated.
   This AVP MAY be included in Accounting-Requests for any session which
   may be part of a multilink service.

   The Acct-Link-Count AVP may be used to make it easier for an
   accounting server to know when it has all the records for a given
   multilink service.  When the number of Accounting-Requests received
   with Accounting-Record-Type = STOP_RECORD and the same Acct-Multi-
   Session-Id and unique Session-Id's equals the largest value of Acct-
   Link-Count seen in those Accounting-Requests, all STOP_RECORD
   Accounting-Requests for that multilink service have been received.

   The following example showing eight Accounting-Requests illustrates
   how the Acct-Link-Count AVP is used.  In the table below, only the
   relevant AVPs are shown although additional AVPs containing
   accounting information will also be present in the Accounting-
   Requests.

      Acct-Multi-                   Accounting-     Acct-
      Session-Id     Session-Id     Record-Type     Link-Count
      --------------------------------------------------------
        "...10"        "...10"      START_RECORD        1
        "...10"        "...11"      START_RECORD        2
        "...10"        "...11"      STOP_RECORD         2
        "...10"        "...12"      START_RECORD        3
        "...10"        "...13"      START_RECORD        4
        "...10"        "...12"      STOP_RECORD         4
        "...10"        "...13"      STOP_RECORD         4
        "...10"        "...10"      STOP_RECORD         4

==========

                                 +-----------------------+
                                 |      Command-Code     |
                                 |-----+-----+-----+-----+
   Attribute Name                | AAR | AAA | DER | DEA |
   ------------------------------|-----+-----+-----+-----|
   Acct-Interim-Interval         | 0   | 0-1 | 0   | 0-1 |
   Configuration-Token           | 0   | 0+  | 0   | 0+  |
   Framed-Pool                   | 0   | 0-1 | 0   | 0-1 |
   Login-IPv6-Host               | 0+  | 0+  | 0   | 0   |
   NAS-IPv6-Address              | 0-1 | 0   | 0-1 | 0   |
   NAS-Port-Id                   | 0-1 | 0   | 0-1 | 0   |
   Termination-Action            | 0   | 0-1 | 0   | 0-1 |

==========

10.2.1  Framed Access
...

                                          +-----------+
                                          |  Command  |
                                          |    Code   |
                                          |-----+-----+
   Attribute Name                         | ACR | ACA |
   ---------------------------------------|-----+-----+
   Acct-Delay-Time                        | 0-1 | 0-1 |
   Acct-Interim-Interval                  | 0-1 | 0-1 |
   Acct-Link-Count                        | 0-1 | 0-1 |
   Event-Timestamp                        | 0-1 | 0-1 |
   Framed-Pool                            | 0-1 | 0-1 |
   NAS-IPv6-Address                       | 0-1 | 0-1 |
   NAS-Port-Id                            | 0-1 | 0-1 |
   Termination-Action                     | 0-1 | 0-1 |

==========

10.2.2  Non-Framed Access
...
                                          +-----------+
                                          |  Command  |
                                          |    Code   |
                                          |-----+-----+
   Attribute Name                         | ACR | ACA |
   ---------------------------------------|-----+-----+
   Acct-Delay-Time                        | 0-1 | 0-1 |
   Acct-Interim-Interval                  | 0-1 | 0-1 |
   Event-Timestamp                        | 0-1 | 0-1 |
   Login-IPv6-Host                        | 0+  | 0+  |
   NAS-IPv6-Address                       | 0-1 | 0-1 |
   NAS-Port-Id                            | 0-1 | 0-1 |
   Termination-Action                     | 0-1 | 0-1 |

==========

-- 
David Spence                            email: [email-masked]
Interlink Networks, Inc.                phone: +1 734 821 1203
775 Technology Drive, Suite 200         fax:   +1 734 821 1235
Ann Arbor, MI 48108           
U.S.A.