Chapter 29: Security
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
842
Service-type Attribute
The CER supports the inclusion of the Service-type attribute in an Access-Accept packet.
The C4/c CMTS uses the Service-Type attribute in the Access-Accept packet to assign the user’s CER CLI access level to
either level 1, which is mapped to attribute value NAS Prompt, or to level 15, which is mapped to attribute value
Administrative.
CLI access levels of 2-14 cannot be assigned when authentication is performed by RADIUS.
If the optional Service-Type attribute is omitted from the Access-Accept packet, then the RADIUS client of the C4/c CMTS
uses a CLI access level of 1 for a successful Login authentication and a value of 15 for a successful Enable authentication.
Any other value of the Service-Type attribute would be treated as an authentication failure
Access-Challenge
The C4/c CMTS supports the Access-Challenge packet. An Access-Challenge packet is sent to the user attempting to login
whenever a RADIUS server has been configured to make such a response. The C4/c CMTS includes one or more of the
following attributes (shown below in boldface) in the Access-Challenge packet:
One or more Reply-Messages - When part of an Access-Challenge packet, the Reply-Message attribute usually describes
the actual challenge or the user required action response. The C4/c CMTS will display all Reply-Message attributes (up to 8)
at the originating terminal line.
A single State attribute, or none - The State attribute is sent by the RADIUS Server to the NAS client (the C4/c CMTS in this
case). The client will include the State attribute unchanged in the Access-Request reply packet.
An Idle-Timeout - The Idle-Timeout attribute can be sent to the client by the RADIUS server in an Access-Accept as well as
in an Access-Challenge. If a RADIUS server returns an Idle-Timeout attribute in an Access-Challenge packet, the value of
this attribute overrides the current idle timeout value associated with the originating line.
A Session-Timeout - The Session-Timeout attribute can be sent to the client by the RADIUS server in Access-Accept or
Access-Challenge messages. If a RADIUS server returns a Session-Timeout attribute in an Access-Challenge packet, the
value of this attribute overrides the current session timeout value associated with the originating line.
Prompt - Prompt is an attribute defined in RFC2869 that can be included only in Access-Challenge packets. It indicates
whether the NAS client (the C4/c CMTS) should echo or not user’s input as it is entered. Depending on the attribute value