Understanding RADIUS standard and vendor-specific attributes (VSA)

The radius server communicate certain set of parameters to the NAS (Network Access Server) aka - gateway/controller during the authentication phase. These attributes are divided into two categories - Standard RADIUS attributes and Vendor Specific Attributes (VSA).

The standard attributes are defined in the RADIUS RFC 2865 and RFC 2867 and others. The standard attributes are available by default in any RADIUS implementation. All NAS gateways have to support these attributes in order to comply with RADIUS specifications.

The Vendor Specific Attributes (VSA) are defined by respective vendor and are optional for RADIUS implementation. They are usually added by adding dictionary for the vendor. The VSA are used to pass special attributes from RADIUS to NAS during the authentication process. Please refer to the vendor's documentation to understand the VSA supported by the respective vendor.

 

RADIUS attributes can be added either at group or user level. When added to the group, all the users belonging to the group automatically inherit the attributes defined to the group. Administrator can override these attributes by defining them at the user level.

To add attributes to the group, navigate to Authentication -> Group section.

Next click on the edit button under the operation column.

Next click on the RADIUS button on the top. The page to configure RADIUS attributes is loaded.

 

The top part of the page allows you to add Standard RADIUS attributes. Click on the "Add New" button to add a new attribute. The configured attributes are displayed in the tabular format. Please keep the default operator (:= or +=) unless you understand the technical details of configuring these attributes.

The image below shows how to configure the standard attributes.

You can add multiple attributes by select the attribute and entering the corresponding values. Please refer to the RFC documentation for more details on the attributes.

Repeat the above process for the Vendor Specific attributes. WiFiLAN automatically selects the right vendor based on your hotspot. However, it is possible to change the vendor using the "Change Vendor" button.

The above process can be repeated to configure the RADIUS attributes for specific user.

Have more questions? Submit a request

0 Comments

Please sign in to leave a comment.