AAA Authorization AAA authorization limits the services available to a user. When AAA authorization is enabled, the device uses information retrieved from the user’s profile, which is in the local user database or on the security server, to configure the user’s session. The user is granted access to a requested service only if the information in the user profile allows it. RADIUS Accounting The AAA accounting feature tracks the services that users are using and the amount of network resources that they are consuming. When you enable AAA accounting, the device reports user activity to the RADIUS security server in the form of accounting records.
Each accounting record contains accounting attribute-value (AV) pairs and is stored on the security server. You can then analyze the data for network management, client billing, or auditing. Vendor-Specific RADIUS Attributes The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information between the device and the RADIUS server by using the vendor-specific attribute (attribute 26). Vendor-specific attributes (VSAs) allow vendors to support their own extended attributes not suitable for general use. The Cisco RADIUS implementation supports one vendor-specific option by using the format recommended in the specification.
Cisco’s vendor-ID is 9, and the supported option has vendor-type 1, which is named cisco-avpair . The value is a string with this format: protocol : attribute sep value * Protocol is a value of the Cisco protocol attribute for a particular type of authorization. Attribute and value are an appropriate attributevalue (AV) pair defined in the Cisco TACACS+ specification, and sep is = for mandatory attributes and is * for optional attributes. The full set of features available for TACACS+ authorization can then be used for RADIUS.
For example, the following AV pair causes Cisco’s “multiple named IP address pools” feature to be activated during IP authorization (during PPP’s Internet Protocol Control Protocol (IPCP) address assignment): cisco-avpair= ”ip:addr-pool=first“ If you insert an “*”, the AV pair “ip:addr-pool=first” becomes optional. Note that any AV pair can be made optional: cisco-avpair= ”ip:addr-pool*first“ The following example shows how to cause a user logging in from a network access server to have immediate access to EXEC commands: cisco-avpair= ”shell:priv-lvl=15“ Other vendors have their own unique vendor-IDs, options, and associated VSAs.
For more information about vendor-IDs and VSAs, see RFC 2138, “Remote Authentication Dial-In User Service (RADIUS).” Attribute 26 contains the following three elements: • Type • Length • String (also known as data) Configuring RADIUS AAA Authorization Configuring RADIUS 13