39
Configuring the RADIUS session-control feature
About RADIUS session-control
Enable this feature for the RADIUS server to dynamically change the user authorization information
or forcibly disconnect users by using session-control packets. This task enables the device to
receive RADIUS session-control packets on UDP port 1812.
To verify the session-control packets sent from a RADIUS server, specify the RADIUS server as a
session-control client to the device.
Restrictions and guidelines
When you configure the RADIUS session-control feature, follow these restrictions and guidelines:
•
The RADIUS session-control feature can only work with RADIUS servers running on IMC.
•
The session-control client configuration takes effect only when the session-control feature is
enabled.
•
The IP, VPN instance, and shared key settings of a session-control client must be the same as
the corresponding settings of the RADIUS server.
Procedure
To configure the RADIUS session-control feature:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable the session-control
feature.
radius session-control enable
By default, the session-control
feature is disabled.
3.
Specify a session-control
client.
radius session-control client
{
ip
ipv4-address
|
ipv6
ipv6-address
} [
key
{
cipher
|
simple
}
string
|
vpn-instance
vpn-instance-name
] *
By default, no session-control
clients are specified.
Configuring the RADIUS DAS feature
About RADIUS DAE server
Dynamic Authorization Extensions (DAE) to RADIUS, defined in RFC 5176, can log off online users,
change their authorization information, or shut down and then bring up their access interfaces. DAE
uses the client/server model.
In a RADIUS network, the RADIUS server typically acts as the DAE client (DAC) and the NAS acts
as the DAE server (DAS).
When the RADIUS DAS feature is enabled, the NAS performs the following operations:
1.
Listens to the default or specified UDP port to receive DAE requests.
2.
Logs off online users that match the criteria in the requests, changes their authorization
information, or shuts down and then brings up their access interfaces.
3.
Sends DAE responses to the DAC.
DAE defines the following types of packets:
•
Disconnect Messages (DMs)
—The DAC sends DM requests to the DAS to log off specific
online users.
•
Change of Authorization Messages (CoA Messages)
—The DAC sends CoA requests to the
DAS for the following purposes:
