Contents

RADIUS Attribute 8 Framed-IP-Address in Access Requests

The RADIUS Attribute 8 (Framed-IP-Address) in Access Requests feature makes it possible for a network access server (NAS) to provide the RADIUS server with a hint of the user IP address in advance of user authentication. An application can be run on the RADIUS server to use this hint and build a table (map) of user names and IP addresses. With the RADIUS server, service applications can begin preparing user login information to have available in advance of a successful user authentication with the RADIUS server.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for RADIUS Attribute 8 Framed-IP-Address in Access Requests

Sending RADIUS attribute 8 in the RADIUS access requests assumes that the login host has been configured to request its IP address from the NAS server. It also assumes that the login host has been configured to accept an IP address from the NAS.

The NAS must be configured with a pool of network addresses on the interface supporting the login hosts.

Information About RADIUS Attribute 8 Framed-IP-Address in Access Requests

When a network device dials in to a NAS that is configured for RADIUS authentication, the NAS begins the process of contacting the RADIUS server in preparation for user authentication. Typically, the IP address of the dial-in host is not communicated to the RADIUS server until after successful user authentication. Communicating the device IP address to the server in the RADIUS access request allows other applications to begin to take advantage of that information.

As the NAS is setting up communication with the RADIUS server, the NAS assigns an IP address to the dial-in host from a pool of IP addresses configured at the specific interface. The NAS sends the IP address of the dial-in host to the RADIUS server as attribute 8. At that time, the NAS sends other user information, such as the user name, to the RADIUS server.

After the RADIUS server receives the user information from the NAS, it has two options:

  • If the user profile on the RADIUS server already includes attribute 8, the RADIUS server can override the IP address sent by the NAS with the IP address defined as attribute 8 in the user profile. The address defined in the user profile is returned to the NAS.

  • If the user profile does not include attribute 8, the RADIUS server can accept attribute 8 from the NAS, and the same address is returned to the NAS.

The address returned by the RADIUS server is saved in memory on the NAS for the life of the session. If the NAS is configured for RADIUS accounting, the accounting start packet sent to the RADIUS server includes the same IP address as in attribute 8. All subsequent accounting packets, updates (if configured), and stop packets will also include the same IP address provided in attribute 8.

However, the RADIUS attribute 8 (Framed-IP-Address) is not included in the accounting start packets in the following two conditions. In both these conditions, use the aaa accounting delay-start extended-time delay-value command to delay the Internet Protocol Control Protocol version 6 (IPCPv6) address negotiation using the configured delay value. During the delay the IPCPv4 address is posted and the framed IPv4 address is added to the accounting “start” packet.

  • If the user is a dual-stack (IPv4/IPv6) subscriber.

  • If the IP address is coming from a local pool and not from the RADIUS server.

How to Configure RADIUS Attribute 8 Framed-IP-Address in Access Requests

Configuring RADIUS Attribute 8 in Access Requests

To send RADIUS attribute 8 in the access request, perform the following steps:

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    radius-server attribute 8 include-in-access-req


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 radius-server attribute 8 include-in-access-req


    Example:
    Router(config)# radius-server attribute 8 include-in-access-req
     

    Sends RADIUS attribute 8 in access-request packets.

     

    Verifying RADIUS Attribute 8 in Access Requests

    To verify that RADIUS attribute 8 is being sent in access requests, perform the following steps. Attribute 8 should be present in all PPP access requests.

    SUMMARY STEPS

      1.    enable

      2.    more system:running-config

      3.    debug radius


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Router> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.

       
      Step 2 more system:running-config


      Example:
      Router# more system:running-config
       

      Displays the contents of the current running configuration file. (Note that the more system:running-config command has replaced the show running-config command.)

       
      Step 3 debug radius


      Example:
      Router# debug radius
       

      Displays information associated with RADIUS. The output of this command shows whether attribute 8 is being sent in access requests.

       

      Configuration Examples for RADIUS Attribute 8 Framed-IP-Address in Access Requests

      NAS Configuration That Sends the IP Address of the Dial-in Host to the RADIUS Server in the RADIUS Access Request

      The following example shows a NAS configuration that sends the IP address of the dial-in host to the RADIUS server in the RADIUS access request. The NAS is configured for RADIUS authentication, authorization, and accounting (AAA). A pool of IP addresses (async1-pool) has been configured and applied at interface Async1.

      aaa new-model
aaa authentication login default group radius
aaa authentication ppp default group radius
aaa authorization network default group radius 
aaa accounting network default start-stop group radius
!
ip address-pool local
!
interface Async1
 peer default ip address pool async1-pool
!
ip local pool async1-pool 209.165.200.225 209.165.200.229
!
radius-server host 172.31.71.146 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server attribute 8 include-in-access-req
radius-server key radhost<xxx>: Example

      Additional References

      The following sections provide references related to the RADIUS Attribute 8 (Framed-IP-Address) in Access Requests feature.

      Related Documents

      Related Topic

      Document Title

      Configuring authentication and configuring RADIUS

      “ Configuring Authentication ” and “Configuring RADIUS ” chapters, Cisco Security Configuration Guide

      RFC 2138 (RADIUS)

      RFC 2138 , Remote Authentication Dial In User Service (RADIUS)

      Standards

      Standard

      Title

      No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

      --

      MIBs

      MIB

      MIBs Link

      No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

      To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

      http:/​/​www.cisco.com/​go/​mibs

      RFCs

      RFC

      Title

      No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

      --

      Technical Assistance

      Description

      Link

      The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

      To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

      Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

      http:/​/​www.cisco.com/​techsupport

      Feature Information for RADIUS Attribute 8 Framed-IP-Address in Access Requests

      The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Table 1 Feature Information for RADIUS Attribute 8 (Framed-IP-Address) in Access Requests

      Feature Name

      Releases

      Feature Information

      RADIUS Attribute 8 (Framed-IP-Address) in Access Requests

      12.2(11)T 12.2(28)SB 12.2(33)SRC

      The RADIUS Attribute 8 (Framed-IP-Address) in Access Requests feature makes it possible for a network access server (NAS) to provide the RADIUS server with a hint of the user IP address in advance of user authentication. An application can be run on the RADIUS server to use this hint and build a table (map) of user names and IP addresses. With the RADIUS server, service applications can begin preparing user login information to have available in advance of a successful user authentication with the RADIUS server.

      The following commands were introduced or modified: radius-server attribute 8 include-in-access-req.

      RADIUS Attribute 8 Framed-IP-Address in Access Requests

      RADIUS Attribute 8 Framed-IP-Address in Access Requests

      The RADIUS Attribute 8 (Framed-IP-Address) in Access Requests feature makes it possible for a network access server (NAS) to provide the RADIUS server with a hint of the user IP address in advance of user authentication. An application can be run on the RADIUS server to use this hint and build a table (map) of user names and IP addresses. With the RADIUS server, service applications can begin preparing user login information to have available in advance of a successful user authentication with the RADIUS server.

      Finding Feature Information

      Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

      Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

      Prerequisites for RADIUS Attribute 8 Framed-IP-Address in Access Requests

      Sending RADIUS attribute 8 in the RADIUS access requests assumes that the login host has been configured to request its IP address from the NAS server. It also assumes that the login host has been configured to accept an IP address from the NAS.

      The NAS must be configured with a pool of network addresses on the interface supporting the login hosts.

      Information About RADIUS Attribute 8 Framed-IP-Address in Access Requests

      When a network device dials in to a NAS that is configured for RADIUS authentication, the NAS begins the process of contacting the RADIUS server in preparation for user authentication. Typically, the IP address of the dial-in host is not communicated to the RADIUS server until after successful user authentication. Communicating the device IP address to the server in the RADIUS access request allows other applications to begin to take advantage of that information.

      As the NAS is setting up communication with the RADIUS server, the NAS assigns an IP address to the dial-in host from a pool of IP addresses configured at the specific interface. The NAS sends the IP address of the dial-in host to the RADIUS server as attribute 8. At that time, the NAS sends other user information, such as the user name, to the RADIUS server.

      After the RADIUS server receives the user information from the NAS, it has two options:

      • If the user profile on the RADIUS server already includes attribute 8, the RADIUS server can override the IP address sent by the NAS with the IP address defined as attribute 8 in the user profile. The address defined in the user profile is returned to the NAS.

      • If the user profile does not include attribute 8, the RADIUS server can accept attribute 8 from the NAS, and the same address is returned to the NAS.

      The address returned by the RADIUS server is saved in memory on the NAS for the life of the session. If the NAS is configured for RADIUS accounting, the accounting start packet sent to the RADIUS server includes the same IP address as in attribute 8. All subsequent accounting packets, updates (if configured), and stop packets will also include the same IP address provided in attribute 8.

      However, the RADIUS attribute 8 (Framed-IP-Address) is not included in the accounting start packets in the following two conditions. In both these conditions, use the aaa accounting delay-start extended-time delay-value command to delay the Internet Protocol Control Protocol version 6 (IPCPv6) address negotiation using the configured delay value. During the delay the IPCPv4 address is posted and the framed IPv4 address is added to the accounting “start” packet.

      • If the user is a dual-stack (IPv4/IPv6) subscriber.

      • If the IP address is coming from a local pool and not from the RADIUS server.

      How to Configure RADIUS Attribute 8 Framed-IP-Address in Access Requests

      Configuring RADIUS Attribute 8 in Access Requests

      To send RADIUS attribute 8 in the access request, perform the following steps:

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    radius-server attribute 8 include-in-access-req


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example:
        Router> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.

         
        Step 2 configure terminal


        Example:
        Router# configure terminal
         

        Enters global configuration mode.

         
        Step 3 radius-server attribute 8 include-in-access-req


        Example:
        Router(config)# radius-server attribute 8 include-in-access-req
         

        Sends RADIUS attribute 8 in access-request packets.

         

        Verifying RADIUS Attribute 8 in Access Requests

        To verify that RADIUS attribute 8 is being sent in access requests, perform the following steps. Attribute 8 should be present in all PPP access requests.

        SUMMARY STEPS

          1.    enable

          2.    more system:running-config

          3.    debug radius


        DETAILED STEPS
           Command or ActionPurpose
          Step 1 enable


          Example:
          Router> enable
           

          Enables privileged EXEC mode.

          • Enter your password if prompted.

           
          Step 2 more system:running-config


          Example:
          Router# more system:running-config
           

          Displays the contents of the current running configuration file. (Note that the more system:running-config command has replaced the show running-config command.)

           
          Step 3 debug radius


          Example:
          Router# debug radius
           

          Displays information associated with RADIUS. The output of this command shows whether attribute 8 is being sent in access requests.

           

          Configuration Examples for RADIUS Attribute 8 Framed-IP-Address in Access Requests

          NAS Configuration That Sends the IP Address of the Dial-in Host to the RADIUS Server in the RADIUS Access Request

          The following example shows a NAS configuration that sends the IP address of the dial-in host to the RADIUS server in the RADIUS access request. The NAS is configured for RADIUS authentication, authorization, and accounting (AAA). A pool of IP addresses (async1-pool) has been configured and applied at interface Async1.

          aaa new-model
aaa authentication login default group radius
aaa authentication ppp default group radius
aaa authorization network default group radius 
aaa accounting network default start-stop group radius
!
ip address-pool local
!
interface Async1
 peer default ip address pool async1-pool
!
ip local pool async1-pool 209.165.200.225 209.165.200.229
!
radius-server host 172.31.71.146 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server attribute 8 include-in-access-req
radius-server key radhost<xxx>: Example

          Additional References

          The following sections provide references related to the RADIUS Attribute 8 (Framed-IP-Address) in Access Requests feature.

          Related Documents

          Related Topic

          Document Title

          Configuring authentication and configuring RADIUS

          “ Configuring Authentication ” and “Configuring RADIUS ” chapters, Cisco Security Configuration Guide

          RFC 2138 (RADIUS)

          RFC 2138 , Remote Authentication Dial In User Service (RADIUS)

          Standards

          Standard

          Title

          No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

          --

          MIBs

          MIB

          MIBs Link

          No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

          To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

          http:/​/​www.cisco.com/​go/​mibs

          RFCs

          RFC

          Title

          No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

          --

          Technical Assistance

          Description

          Link

          The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

          To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

          Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

          http:/​/​www.cisco.com/​techsupport

          Feature Information for RADIUS Attribute 8 Framed-IP-Address in Access Requests

          The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

          Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

          Table 1 Feature Information for RADIUS Attribute 8 (Framed-IP-Address) in Access Requests

          Feature Name

          Releases

          Feature Information

          RADIUS Attribute 8 (Framed-IP-Address) in Access Requests

          12.2(11)T 12.2(28)SB 12.2(33)SRC

          The RADIUS Attribute 8 (Framed-IP-Address) in Access Requests feature makes it possible for a network access server (NAS) to provide the RADIUS server with a hint of the user IP address in advance of user authentication. An application can be run on the RADIUS server to use this hint and build a table (map) of user names and IP addresses. With the RADIUS server, service applications can begin preparing user login information to have available in advance of a successful user authentication with the RADIUS server.

          The following commands were introduced or modified: radius-server attribute 8 include-in-access-req.