RADIUS and IPv6
updated by
- rfc-8044 — Data Types in RADIUS
Extracted elements (23)
Framed-IPv6-Prefix implicitly plumbs a route on the NAS for the assigned prefix, so a separate Framed-IPv6-Route attribute for the same prefix is not necessary when Framed-IPv6-Prefix is used.
Where RADIUS runs over IPsec with certificate-based authentication, it may be desirable to avoid management of RADIUS shared secrets entirely, leveraging the improved scalability of public key infrastructure instead.
A NAS sending a RADIUS Access-Request may not know a priori whether the host will use IPv4, IPv6, or both (e.g., IPv6CP occurs after LCP in PPP, so address assignment happens after RADIUS authentication). IPv6 attributes MAY be sent alongside IPv4 attributes in the same RADIUS message.
For Framed-IPv6-Route, whenever the gateway address is the IPv6 unspecified address, the IP address of the user SHOULD be used as the gateway address.
If a NAS does not support multiple prefix pools, the NAS MUST ignore the Framed-IPv6-Pool attribute.
If the Interface-Identifier IPv6CP option has been successfully negotiated, the Framed-Interface-Id attribute MUST be included in an Access-Request packet as a hint to the server that the NAS would prefer that value.
NAS-IPv6-Address and/or NAS-IP-Address MAY be present in an Access-Request packet; however, if neither attribute is present then NAS-Identifier MUST be present.
The Framed-IPv6-Route Text field MUST NOT affect operation of the protocol. It SHOULD contain a destination prefix optionally followed by a slash and decimal length specifier, a gateway address, and one or more metrics.
The NAS SHOULD only allocate addresses and prefixes that the client can actually use; for example, no IPv4 address reservation is needed for IPv6-only hosts, and no IPv6 prefix allocation is needed for IPv4-only or 6to4 hosts.
The Reserved field in Framed-IPv6-Prefix MUST be present and is always set to zero.
Where RADIUS is run over IPsec ESP with a non-null transform, the shared secret between the NAS and the RADIUS server MAY NOT be configured. In this case, a shared secret of zero length MUST be assumed.
Framed-Interface-Id (Type 96) indicates the IPv6 interface identifier to be configured for the user. It MAY be used in Access-Accept packets and has a fixed length of 10 octets (2 octets header + 8 octets interface ID).
Framed-IPv6-Pool (Type 100) contains the name of an assigned IPv6 prefix pool to be used for prefix assignment. If the NAS does not support multiple prefix pools, it MUST ignore this attribute.
Framed-IPv6-Prefix (Type 97) indicates an IPv6 prefix and corresponding route to be configured for the user. It MAY appear multiple times in Access-Accept packets and MAY appear as a hint in Access-Request packets.
Framed-IPv6-Route (Type 99) provides IPv6 routing information to be configured on the NAS for the user. It is used in Access-Accept packets, can appear multiple times, and its Text field is human-readable but MUST NOT affect protocol operation.
Login-IPv6-Host (Type 98) indicates the system to connect the user to when Login-Service is included. The all-ones value (0xFFFF...FFFF) means the NAS SHOULD allow the user to select a host; the zero value means the NAS SHOULD select a host.
NAS-IPv6-Address (Type 95) is a RADIUS attribute indicating the identifying IPv6 address of the NAS requesting user authentication. It is only used in Access-Request packets and has a fixed length of 18 octets (2 octets header + 16 octets address).
This document assigns six new RADIUS attribute type numbers: 95 (NAS-IPv6-Address), 96 (Framed-Interface-Id), 97 (Framed-IPv6-Prefix), 98 (Login-IPv6-Host), 99 (Framed-IPv6-Route), and 100 (Framed-IPv6-Pool).
Since IPsec is mandatory to implement for IPv6, RADIUS implementations supporting IPv6 are expected to typically run over IPsec. Only IPsec ESP with a non-null transform provides security services sufficient to substitute for RADIUS application-layer security (shared secret confidentiality and integrity); IPsec AH or ESP null still requires a RADIUS shared secret.
Framed-Interface-Id attribute: Type=96, Length=10, Interface-Id field is 8 octets encoding the IPv6 interface identifier.
Framed-IPv6-Prefix attribute: Type=97, Length at least 4 and no larger than 20, with a Reserved octet (always zero), a Prefix-Length octet (0–128 bits), and a Prefix field up to 16 octets. Bits outside Prefix-Length must be zero.
Login-IPv6-Host attribute: Type=98, Length=18, Address field is 16 octets. Special values: all-ones allows user-selected host; zero means NAS-selected host.
NAS-IPv6-Address attribute: Type=95, Length=18, Address field is 16 octets encoding the NAS's IPv6 address.