Policy Server Guides › Policy Server Configuration Guide › Using the Policy Server as a RADIUS Server › Responses in RADIUS Policy Domains › How Password Services Work › Define Multiple Instances of an Attribute

Define Multiple Instances of an Attribute

You can define multiple instances of a vendor-specific attribute for the same Agent type. When you define multiple instances of a vendor-specific attribute, you can send a different value to the NAS device for each instance of the attribute. For example, for a Cisco Agent, you could define the following vendor-specific attributes, all using the same identifier (26):

• Cisco-AVpair
• Account-Info
• Command-Code

The settings that define the number of times an attribute can be used within a response are located on the Modify Agent Type Attribute pane of the Administrative UI.

To configure the attribute to be used multiple times, the Access Accept value must be set to Zero or Many.

The type of attribute that you define must match the vendor type of the Agent returning the response. For example, a vendor-specific Cisco attribute can only be returned by a Cisco Agent.

When the response is returned by the Agent, the packet structure of the response reflects the type of RADIUS Agent that sent the response. For example, the packet structure of a response returned by a Cisco Agent would include the vendor ID and the length of the string.

To define an attribute for an Agent type

1. Log into the Administrative UI.
2. Click Infrastructure, Agent Type, Modify Agent Type.

   The Modify Agent Type pane opens.

3. Specify search criteria, and click Search.

   A list of Agent types that match the search criteria opens.

4. Select an Agent type, and click Select.

   The Modify Agent Type: Name pane opens.

5. Click Create Agent Type Attribute on the Agent Type Attributes group box.

   The Create Agent Type Attribute pane opens.

6. Verify that Create a new object is selected, and click OK.

   The Create Agent Type Attribute: Name pane opens.

7. Type the name and a description of the Agent type in the fields on the General group box.
8. Select RADIUS, RADIUS Extended, or Vendor Specific from the RADIUS Type list.
9. Select the type of data that the attribute contains from the Data Type list.
10. Type one of the following attribute identifiers in the Identifier field:
    • Generic RADIUS

      The attribute identifier is defined in the RADIUS protocol specification. Although it is possible to overwrite the identifier of a Generic RADIUS attribute, you should generally retain the pre-defined Generic RADIUS attribute definitions, which match the RADIUS specification (RFC 2138).

      Example: To create an attribute for the Callback-Id variable, type 20 in the Identifier field.

    • RADIUS Extended

      The attribute identifier is defined in the vendor documentation.

      Example: To create an attribute for the Ascend-Callback attribute, type 246 in the Identifier field.

    • Vendor Specific

      The attribute identifier is 26.

      Example: To create an attribute for a Cisco Agent that enables the Agent to use TACACS+, type 26 in the Identifier field.

    Note: For more information about attribute identifiers, see your RADIUS vendor documentation.

11. Select a RADIUS code for each field on the RADIUS Behavior group box. The RADIUS codes are:

    Not allowed

    Attribute cannot be used in a response.

    Zero or One

    One instance or no instances of the attribute can be returned in the same response. If this value is selected, and you use the attribute in a response, the attribute will be removed from the Attribute list after you have used the attribute in a response.

    Zero or Many

    Multiple instances or no instances of the attribute can be returned in the same response.

    One and Only One

    One instance of the attribute must be returned in a response. If this value is selected, and you use the attribute in a response, the attribute will be removed from the Attribute list after you have used the attribute in a response.

    The fields on the RADIUS group box are:

    Access Request

    Provides information used to determine whether or not a user is allowed access to a specific NAS. The Access Request packets also provide information for any special services requested for that user.

    Access Accept

    Provides specific configuration information necessary to begin delivery of service to the user.

    Note: You must set the Access Accept value to Zero or One, Zero or Many, or One and Only One in order to use the attribute in a response.

    Access Reject

    Sends information if any value of the received Attributes is not acceptable. This code is often used for reply messages.

    Access Challenge

    Sends information if the NAS device has been configured for challenge/response.

    Accounting Request

    Describes the type of service being delivered and the user to whom it is being delivered.

    Accounting Response

    Sends information if the Accounting Request was recorded successfully. A RADIUS Accounting-Response is not required to have any attributes in it.

12. If the data type is number, click Create on the Values group box.
13. Type the symbolic name of the attribute in the Symbolic Name field, type the actual numeric value of the attribute in the Numeric Value field, and click OK.

    The Modify Agent Type Attribute pane reopens, and the attribute name-value pair is added to the Values group box.

    Note: To create multiple attribute name-value pairs, repeat steps 12 and 13. By mapping symbolic names to values, you only need to remember names.

14. Click Submit.

    The Modify Agent Type pane reopens, and the Agent type attribute is added to the Agent Type Attributes group box.

15. Click Submit.

    The Modify Agent Type task is submitted for processing.

    Note: When the task is complete and you create a response for this Agent type, you can select the Agent type attribute that you just added to the Agent type from an attribute list.

Modify Existing Attributes

You can modify attributes that you created and attributes that have been pre-defined for a RADIUS Agent. For example, you can modify the pre-defined Ascend-PPP-Address attribute for the Ascend Agent type.

Note: When you modify an existing attribute, the attribute is not updated dynamically in responses that already use the attribute. If an attribute is used in a response, you must recreate the response using the updated attribute.

All RADIUS Agent types have been pre-configured to use the generic RADIUS attributes, as defined in RFC 2138. These attributes are available to be used by each RADIUS Agent type.

Important! If you overwrite a generic attribute or define a new attribute in the Generic RADIUS Agent, the change is applied to all RADIUS Agents. For example, if you modify the Filter ID attribute in the Generic RADIUS Agent, the modification is also made to all of the other RADIUS Agent types, such as Cisco, Shiva, Livingston, Ascend, and Checkpoint.

To modify agent type attributes

1. Log into the Administrative UI.
2. Select Agents from the Infrastructure tab.
3. Click Modify Agent Type.
4. Click Search.
5. Select an Agent type and click Select.

   The Modify Agent Type pane opens.

6. Modify the Agent Type values by clicking the Edit button on the left of the attribute
7. Click Submit to save the changes.

More Information:

Define Multiple Instances of an Attribute