RADIUS Session Attributes

The RADIUS attributes defining the session are returned in the RADIUS response frame. RADIUS attributes are used to configure the user on the system. Attributes explicitly supported by RS that may be included in the RADIUS response frame are:

• Idle-Timeout – If no frames are seen from this MAC address, for the number of seconds configured, the session will be terminated.
• Session-Timeout – The session is terminated after the number of seconds configured.
• Filter-ID - Defines the policy profile (role) and CLI management privilege level, just as it would for any other local authentication agent.
• Tunnel-Group-Id – Specifies the VLAN ID for this session.
  

  Note

  Numerous attributes may be supported by the RADIUS client for general RADIUS protocol support. Such attributes are beyond the scope of this document. This RS implementation does not interfere with normal RADIUS client attribute support. The list above indicates attributes actually used by this RADIUS-Snooping application once authentication is successfully completed.
  

  RADIUS-Snooping Overview

  

RADIUS-Snooping Overview illustrates the RADIUS request frame and RADIUS response frame paths. As the RADIUS request frame from the RADIUS client edge device transits the distribution-tier switch, it is snooped. An RS session is created on the distribution-tier switch, if:

• RADIUS snooping is enabled on the switch
• RADIUS-Snooping is enabled on the port
• The RADIUS client edge device and RADIUS server combination are defined in the RADIUS snooping flow table

When the RADIUS server receives the request, the authenticating device is first validated. After validating the authenticating device, the server authenticates the user session itself based on passed username and password attributes. If that succeeds an access accept message containing RADIUS attributes is sent back to the client, otherwise an access reject message is sent back. As the RADIUS response frame transits the distribution-tier switch, the RADIUS attributes contained in the response frame are applied to this session, if an RS session was created for this client server combination and the session has not timed out.

RADIUS-Snooping agent accounting is supported and defaults to disabled. To use RADIUS-Snooping accounting, RADIUS accounting must be enabled using the set radius accounting command. RADIUS-Snooping agent accounting can be enabled using the set radius-snooping accounting command.