Cambium Networks PMP 450 AP, Configuration Manual

Page: 330 / 649

Chapter 1: Configuration Configuring a RADIUS server
Page
1-302
RADIUS Change of Authorization and Disconnect Message
Prior to this feature, SM will get configuration parameters from a RADIUS server during
authentication process. This feature allows an administrator to control configuration
parameters in the SM while SM is in session. The configuration changes in SM are done using
RADIUS Change of Authorization method (RFC 3576) on the existing RADIUS authentication
framework for AP and SM. A typical use case could be changing the QOS parameters after a
certain amount of bandwidth usage by a SM.
Figure 52 RADIUS CoA configuration for AP
The RADIUS CoA feature enables initiating a bi-directional communication from the RADIUS
server(s) to the AP and SM.
The AP listens on UDP port 3799 and accepts CoA requests from the configured RADIUS
servers. This CoA request should contain SM MAC address in ‘User-Name’ attribute as
identifier and all other attributes which control the SM config parameters. For security
reasons, a timestamp also needs to be added as ‘Event-Timestamp’ attribute. Hence the time
should also be synchronized between the RADIUS server(s) and the AP to fit within a window
of 300 seconds.
Once the configuration changes are applied on the SM, CoA-ACK message is sent back to
RADIUS server. If the validation fails, the AP sends a CoA-NACK response to the RADIUS
server with proper error code.
A Disconnect-Message is sent by the RADIUS server to NAS in order to terminate a user
session on a NAS and discard all associated session context. It is used when the
authentication AAA server wants to disconnect the user after the session has been accepted
by the RADIUS.
In response of Disconnect-Request from RADIUS server, the NAS sends a Disconnect-ACK if
all associated session context is discarded, or a Disconnect-NACK, if the NAS is unable to
disconnect the session.