L3-connected BRAS authorizes Users using the FastPCRF component.

The locality of the User IP address is defined under the two following mandatory conditions:

1. The element of the user IP addresses numbered list should belong to the local Autonomous Systems (AS) list specified in the aslocal.bin file. It has to be filled with information on private IP addresses ranges being used in the Provider local network. Any number within the 64512 - 65534 range should be used as the Autonomous System (AS) number.
2. The local autonomous system item within the numbered list should be listed in the asnum.dscp file. You should specify the numbers of local Autonomous Systems (AS) in this file because they will be used in the authorization procedure. Authorization will be performed for all the Autonomous System (AS) IP addresses marked as local in the asnum.dscp file.

An example demonstrating how to enable authorization and specify the list of fastpcrf servers in the fastdpi.conf configuration file is shown below:

enable_auth=1
auth_servers=127.0.0.1%lo:29002;192.168.10.5%eth1:29002

The format of the single server record looks like this: ip%dev:port, here ip is the server IP address, dev is the local device used to establish a connection, port is the tcp port. FastDPI establish connection with first available fastpcrf server from the list.

To do so you should add the following entry in the fastdpi.conf configuration file:

udr=1

You can specify the following additional authorization parameters in the fastdpi.conf file:

auth_expired_timeout - authorization lifetime, in minutes. This parameter will be applied only if there is no Session-Timeout attribute in the Access-Accept or Access-Reject RADIUS responses. It specifies the session lifetime. Once that period expires, a second authorization request will be sent. The default value is 60.

auth_resend_timeout - timeout to resend authorization requests to the FastPCRF, in seconds. If FastDPI did not receive a response from the FastPCRF during this time, the authorization request will be repeated. The default value is 60.

auth_pcrf_reconnect - timeout for reconnecting to the FastPCRF, seconds. The default value is 1.

auth_trace - enables authorization tracing.

auth_trace_ip - a list of IP addresses to authorize. It can contain at most two IP addresses. It does not have a default value. When configuring, authorization is performed only for the specified IP addresses.

To authorize IPv6 addresses you should enable IPv6 support. Actually, the VAS Experts DPI authorizes not an individual IPv6 address, but a whole subnet with a given prefix length (default is /64). For example, if there are packets from addresses 2001:1::1 and 2001:1::10, then only one of these addresses will be sent for authorization, and the returned authorization parameters will be applied to all the addresses from the 2001:1::/64 subnet.