Ruckus Wireless ZoneDirector 3000, User Manual, Page: 161 / 430

Using an External AAA Server
RADIUS / RADIUS Accounting
ZoneDirector 9.8 User Guide, 800-70599-001 Rev B
161
RADIUS Attributes
Ruckus products communicate with an external RADIUS server as a RADIUS client.
Packets from Ruckus products are called “access-request” or “accounting-request”
messages. The RADIUS server, in turn, sends an “access-challenge“, “access-
accept” or “access-reject” message in response to an access-request, and an
“accounting-response” message in response to an accounting-request.
RADIUS Attribute Value Pairs (AVP) carry data in both the request and the response
messages. The RADIUS protocol also allows vendor specific attributes (VSA) to
extend the functionality of the protocol. The following tables list the RADIUS
attributes used in these messages between ZoneDirector and the RADIUS/RADIUS
Accounting server based on which type of authentication is used for the WLAN.
Table 93 lists the attributes used in authentication, and Table 16 lists those used in
accounting.
ZoneDirector will terminate a user session if it receives a Change of Authorization-
Disconnect Message (COA-DM) from the RADIUS server. The COA-DM message
may be used when a client changes service levels. For instance, a new user may
initially connect to a free, low-rate service on one WLAN. When they purchase
access on a higher-rate service, RADIUS will send a COA-DM message to ZoneDi-
rector, causing the user to re-connect to an alternative WLAN. COA-DM may also
be used to remove a client if a user exceeds their total bandwidth allowance or time
on the network.
Notation “==>” below indicates this value is generated external to AP/ZoneDirector.
• In the case of EAP payload, this is generated by a wireless client and encapsu-
lated in the RADIUS access-request packet.
• In the case of a “state” attribute, it indicates that an access-request packet is a
response to the last received access-challenge packet by copying the “state”
AVP unmodified.
• As for the “class” attribute, it is parsed and stored from an access-accept packet
and then subsequently used in accounting-request packets.