Bay Networks Bay Dial VPN, Configuration And Troubleshooting Manual

Page: 85 / 186

Configuring TMS Using Local RADIUS
115623B Rev. 00 BayStream Multiservice Software Version 7.2 6-5
Handling Access Messages
When it receives an incoming call, the NAS issues a standard access-request
message to the RADIUS server. The server determines that this is a tunnel user by
processing the Username and Called-Number attributes. If no match for the
domain or user name in the TMS database, the server returns an access-reject
message to the NAS.
If the server finds a match in its TMS database, it returns an access-accept
message. This message contains the following attributes for the RADIUS
message:
• User name -- the original contents of the user field
• Tunnel-type -- DVS or L2TP (required); for Dial VPN, this must be DVS.
• Tunnel-media-type -- IP
• Tunnel-server-endpoint --the server address and outbound line identifier
• Authentication-server -- the remote authentication server(s) for this user
• Accounting-server -- the remote accounting server(s) for this user
Using RADIUS Accounting
The NAS logs the tunnel-bound link sessions to the local provider’s RADIUS
server. This information does reflect the usage of the NAS ports, but it is different
from the customer (that is, the user’s home network) information, in that it may
not reflect link aggregation, and it is not based on remote user information.
The gateway generates its own accounting information, based on the traffic seen at
the gateway and reports this data to the customer’s RADIUS server.
The server that authenticates the tunnel also tracks resource usage through the
accounting messages it receives. The RADIUS client also preserves the Class
attribute and sends it in accounting start and stop messages to identify allocated
sessions. The user session’s authorization information flows from the customer
RADIUS server return message. The local tunnel client does not have the
validated user indentification until after the tunnel is formed.