Juniper JUNOSE 11.0.X MULTICAST ROUTING, Configuration Manual

Page: 281 / 788

Qualifications for Change of Authorization
To complete the change of authorization for a user, the CoA-Request must contain
one of the following RADIUS attributes or pairs of attributes. AAA services handle
the actual request.
■
User-Name [attribute 1] with Virtual-Router [attribute 26–1] to identify the user
per virtual router context
■
Framed-IP-Address [attribute 8] with Virtual-Router [attribute 26–1] to identify
the address per virtual router context
■
Calling-Station-ID [attribute 31]
■
Acct-Session-ID [attribute 44] (mandatory for all CoA requests, except when the
request is for packet mirroring)
■
Nas-Port-ID [attribute 5]
NOTE: The Calling-Station-ID attribute is valid only for the tunneled subscribers and
on the LNS. Additionally, the Calling-Station-ID and Nas-Port-ID attributes are valid
only if there is no RADIUS override setting.
Security/Authentication
For change-of-authorization operations, the RADIUS server calculates the authenticator
as specified for an Accounting-Request message in RFC 2866. The RADIUS
dynamic-request server verifies the request using authenticator calculation as specified
for an Accounting-Request in RFC 2866. A key (secret), as specified in RFC 2865,
must be configured and used in the calculation of the authenticator. The response
authenticator is calculated as specified for an Accounting-Response message in RFC
2866.
Configuring RADIUS-Initiated Change of Authorization
To configure the RADIUS dynamic-request change of authorization feature, perform
the following steps to set up the RADIUS dynamic-request server that will perform
the CoA operation:
1.
Configure the RADIUS dynamic-request server, and enter RADIUS Configuration
mode.
host1(config)# radius dynamic-request server 10.10.5.10
2.
Enable the CoA capability on the RADIUS dynamic-request server.
host1(config-radius)# authorization change
3.
Define the key (secret) used in the RADIUS Authenticator field during exchanges
between the RADIUS dynamic-request server and the RADIUS server.
host1(config-radius)# key Secret21Clientkey
Configuring RADIUS-Initiated Change of Authorization
■ 241
Chapter 4: Configuring RADIUS Dynamic-Request Server