Subscriber authorization attributes

The main data, in addition to the key point, i.e. whether the user is authorized or not, needed to the fastPCRF to form the response to the Access-Request properly, are the following:

• Subscriber IP address
• User policing profile
• User profiles according to the fastDPI services
• Services that are activated for the particular user
• User type: how many IP addresses are assigned to the user, whether it one or more than one
• User login is one of the following attributes: User-Name, CUI or VasExperts-UserName

The Stingray Service Gateway supports both IPv4 and IPv6 subscriber addressing. In case of IPv4 subscribers, the response should contain the Framed-IP-Address attribute specifying the IPv4 address, but this address has to match the one specified in the Access-Request. If the Framed-IP-Address values in the request and response differ, this is considered an error.

The following attributes are supported in the Access-Accept/Reject for IPv6 subscribers:

• Framed-IPv6-Address specifies the subscriber IPv6 address. The attribute value within response has to match the corresponding value within request.
• Framed-IPv6-Prefix specifies the IPv6 subscriber subnet prefix. Prefix size, as well as its value within the response have to match the ones within the request.
• Framed-IPv6-Pool is the pool name. It is optional attribute. If this attribute is specified in the response, it will be sent in all the Accounting-Request packets.

In case of IPv6, the response has to contain one of the Framed-IPv6-Address or Framed-IPv6-Prefix attributes (or both). However, the SSG interprets Framed-IPv6-Address attribute as a subnet prefix without taking into account the least significant bits of the address (remember that the SSG currently can handle only equal sized prefixes, specifying by the ipv6_subnetwork parameter).

The dual stack subscribers are also supported: the Access-Request is always sent using either IPv4 or IPv6 address, but the response can contain both addresses in the Framed-IP-Address and Framed-IPv6-Address/Framed-IPv6-Prefix attributes. This means that the subscriber is assigned both an IPv4 address and an IPv6 prefix. At the same time, such a subscriber is not considered by default a multi-bind subscriber: the SSG implies that each subscriber, even single-binded, can be bound to the pair: IPv4 address and IPv6-prefix.

The policing profile and the list of activated services are sent in the [26] Vendor-Specific attribute contained in the responses.

VENDOR          VasExperts                   43823
BEGIN-VENDOR    VasExperts
ATTRIBUTE       VasExperts-Policing-Profile  1  string
ATTRIBUTE       VasExperts-Service-Profile   2  string
ATTRIBUTE	VasExperts-Enable-Service    3  string
ATTRIBUTE	VasExperts-Multi-IP-User     4  integer
ATTRIBUTE	VasExperts-UserName	     5  string
ATTRIBUTE       VasExperts-Restrict-User     7  byte или integer
END-VENDOR      VasExperts

The response to an Access-Accept must contain no more than one of this attribute.

1. Preconfigured policing
   A string attribute specifying the policing profile name for the user.
   VasExperts-Policing-Profile = "50Mbps"
2. Policing with absolute values transfer
   VasExperts-Policing-Profile = "BV##100000#100000#+++-++++"
   here:
   • BV --- By Value
   • ##100000 --- Internet-to-subscriber limit in Kbps
   • #100000 --- Subscriber-to-Internet limit in Kbps
   • #+++-++++ --- cs0 … cs7, rate(cs3)=0, cs3 is blocked, other classes are allowed at root speed with borrowing (HTB algorithm).

A string option specifying the profile name for a specific fastDPI service. Used format:

service_id:profile_name

Here:

• service_id – is the number representing the fastDPI service identifier
• profile_name – is the string representing the profile name according to the service

Example 1, activating the NAT (11) service with the “cgnat” profile:

VasExperts-Service-Profile="11:cgnat"

Example 2, connecting the Allow List and Captive Portal, HTTP redirect (service 16) specifying page parameters for redirect "http://info.com" and allowed list of IP addresses "/var/lib/dpi/ip_list.bin":

VasExperts-Service-Profile = "16:BV##/var/lib/dpi/ip_list.bin#http://info.com"

A string parameter that specifies whether to activate/disable a specific service not requiring any profile. String format :

service_id:flag

here:

• service_id – the number, the fastDPI service identifier
• flag – the flag indicating the activating/disabling of the service. The valid values are:
• 1, on, enabled – corresponds to activated service
• 0, off, disabled – corresponds to disabled service

The example of the service to be activated: 5:on

The example of the service to be disabled: 5:off

You should use this attribute in order to disable the service in CoA. For example, to disable service 5 you should specify: VasExperts-Enable-Service="5:off". Whereas to activate the service 5 with my_white_list profile you should specify: VasExperts-Service-Profile="5:my_white_list"

By default, the activation of the service 4 "black-list" is managed by the global fastDPI configuration. Service 4 is usually globally activated in order to comply with the federal law.

This attribute shows whether there are many IP addresses assigned for this subscriber or only just one. This attribute can be presented either by a byte or by a 32-bit number. A value of 1 means that several IP addresses can be assigned to this subscriber (corporate client), value 0 corresponds to only one IP-address. If the VasExperts-Multi-IP-User attribute is not presented in the PDU, it is considered that only one IP address is assigned to the subscriber.

If the VasExperts-Multi-IP-User=1 attribute is set to the user so the features (active services and policing) are applied to all subscribers IP addresses and the key is a subscriber login. Note that the Stingray SG authorizes each subscriber IP address: for example, if 10 IP addresses are associated with the subscriber, an Access-Request authorization request will be sent for each of the addresses. It is expected that the response to each IP address of a multi-IP subscriber will contain the same set of active services and the same profiles. The response to the authorization of each of the 10 IP-addresses mentioned above will be applied to the subscriber login, so all the IP addresses within this login will be assigned the same set of services along with the same policing.

The subscriber name (login).

This attribute is introduced for some billing systems that aren't able to response with the User-Name attribute within the Access-Accept/Reject response, but are able to response with any VSA attribute.

The attribute to identify the subscriber is blocked.

For the SSG the Access-Accept response means that the subscriber is not blocked, but for blocked subscribers Access-Reject containing special subscriber attributes specifying some restrictions have to be responded. But some implementations of radius clients do not have the ability to return the Access-Reject containing subscriber attributes. For such implementations the VasExperts-Restrict-User attribute is provided :

• value 0 - means that the subscriber is not blocked
• value 1 - means that the subscriber is blocked

In case of the VasExperts-Restrict-User=1 the SSG handles the Access-Accept as Accept-Reject.

The attribute indicating enabling/disabling local interconnect for the subscriber.

This attribute corresponds to L2 BRAS. By default, if the local interconnect is enabled, L2 BRAS interconnects any two local subscribers. You can disable interconnect using this attribute: VasExperts-Enable-Interconnect=0. So a packet from one local subscriber to another will be dropped if the local interconnect is disabled at least for one of the subscribers.

By default, VasExperts-Enable-Interconnect=1 and if bras_terminate_local=1 is set in fastdpi.conf, then interconnect is allowed. This attribute can be used to disable interconnect for a specific subscriber by specifying VasExperts-Enable-Interconnect=0.

In addition to the mentioned above VSA attributes the Stingray Service Gateway supports the following standard Radius-attributes within the Access-Accept/Access-Reject. All of them are optional.

It specifies the duration of the subscriber authorization, in seconds. At the expiry of this time the SSG will send a second request for Access-Request to authorize.

By default, the session duration is specified in the fastdpi.conf using the auth_expired_timeout option (in minutes).

Specifies the time interval for updating Accounting statistics (in seconds) for the subscriber. Interim interval is specified by default in the fastpcrf.conf using the radius_acct_interim_interval option.

Specifies the interval over which the accounting data is unchanged, when it expires the accounting session is considered to be closed caused by the subscriber inactivity. Idle timeout is set by default by the fastpcrf.conf radius_acct_idle_timeout option. A way to determine the subscriber inactivity is specified by the acct_check_idle_mode option defined in the fastpcrf.conf. The description of the parameters can be found in the section FastPCRF settings.

This attribute will be added to all Accounting-Request PDUs if it is set. The SSG does not analyze the value of this attribute.

Access-Reject peculiarities