RFC 2867 (rfc2867) - Page 2 of 11

RADIUS Accounting Modifications for Tunnel Protocol Support

Alternative Format: Original Text Document
< Previous
Next >
RFC 2867            RADIUS Tunnel Accounting Support           June 2000


   In order to collect usage data regarding tunneling, new RADIUS
   attributes are needed; this document defines these attributes.  In
   addition, several new values for the Acct-Status-Type attribute are
   proposed.  Specific recommendations for, and examples of, the
   application of this attribute for the L2TP protocol can be found in
   RFC 2809.

2.  Implementation Notes

   Compulsory tunneling may be part of a package of services provided by
   one entity to another.  For example, a corporation might contract
   with an ISP to provide remote intranet access to its employees via
   compulsory tunneling.  In this case, the integration of RADIUS and
   tunnel protocols allows the ISP and the corporation to synchronize
   their accounting activities so that each side receives a record of
   the user's resource consumption.  This provides the corporation with
   the means to audit ISP bills.

   In auditing, the User-Name, Acct-Tunnel-Connection, Tunnel-Client-
   Endpoint and Tunnel-Server-Endpoint attributes are typically used to
   uniquely identify the call, allowing the Accounting-Request sent by
   the NAS to be reconciled with the corresponding Accounting-Request
   sent by the tunnel server.

   When implementing RADIUS accounting for L2TP/PPTP tunneling, the
   Call-Serial-Number SHOULD be used in the Acct-Tunnel-Connection
   attribute.  In L2TP, the Call-Serial-Number is a 32-bit field and in
   PPTP it is a 16-bit field.  In PPTP the combination of IP Address and
   Call-Serial-Number SHOULD be unique, but this is not required.  In
   addition, no method for determining the Call-Serial-Number is
   specified, which leaves open the possibility of wrapping after a
   reboot.

   Note that a 16-bit Call-Serial-Number is not sufficient to
   distinguish a given call from all other calls over an extended time
   period.  For example, if the Call-Serial-Number is assigned
   monotonically, the NAS in question has 96 ports which are continually
   busy and the average call is of 20 minutes duration, then a 16-bit
   Call-Serial-Number will wrap within 65536/(96 * 3 calls/hour * 24
   hours/day) = 9.48 days.

3.  New Acct-Status-Type Values

3.1.  Tunnel-Start

      Value

         9



Zorn, et al.                 Informational
< Previous
Next >