Policy Server Guides › Policy Server Configuration Guide › Using the Policy Server as a RADIUS Server › Responses in RADIUS Policy Domains › Create Attributes for Agent Types › Define Multiple Instances of an Attribute

Define Multiple Instances of an Attribute

You can define multiple instances of a vendor-specific attribute for the same Agent type. When you define multiple instances of a vendor-specific attribute, you can send a different value to the NAS device for each instance of the attribute. For example, for a Cisco Agent, you could define the following vendor-specific attributes, all using the same identifier (26):

• Cisco-AVpair
• Account-Info
• Command-Code

The settings that define the number of times an attribute can be used within a response are located on the Modify Agent Type Attribute pane of the Administrative UI.

To configure the attribute to be used multiple times, the Access Accept value must be set to Zero or Many.

The type of attribute that you define must match the vendor type of the Agent returning the response. For example, a vendor-specific Cisco attribute can only be returned by a Cisco Agent.

When the response is returned by the Agent, the packet structure of the response reflects the type of RADIUS Agent that sent the response. For example, the packet structure of a response returned by a Cisco Agent would include the vendor ID and the length of the string.

To define an attribute for an Agent type

1. Log into the Administrative UI.
2. Click Infrastructure, Agent Type, Modify Agent Type.

   The Modify Agent Type pane opens.

3. Specify search criteria, and click Search.

   A list of Agent types that match the search criteria opens.

4. Select an Agent type, and click Select.

   The Modify Agent Type: Name pane opens.

5. Click Create Agent Type Attribute on the Agent Type Attributes group box.

   The Create Agent Type Attribute pane opens.

6. Verify that Create a new object is selected, and click OK.

   The Create Agent Type Attribute: Name pane opens.

7. Type the name and a description of the Agent type in the fields on the General group box.
8. Select RADIUS, RADIUS Extended, or Vendor Specific from the RADIUS Type list.
9. Select the type of data that the attribute contains from the Data Type list.
10. Type one of the following attribute identifiers in the Identifier field:
    • Generic RADIUS

      The attribute identifier is defined in the RADIUS protocol specification. Although it is possible to overwrite the identifier of a Generic RADIUS attribute, you should generally retain the pre-defined Generic RADIUS attribute definitions, which match the RADIUS specification (RFC 2138).

      Example: To create an attribute for the Callback-Id variable, type 20 in the Identifier field.

    • RADIUS Extended

      The attribute identifier is defined in the vendor documentation.

      Example: To create an attribute for the Ascend-Callback attribute, type 246 in the Identifier field.

    • Vendor Specific

      The attribute identifier is 26.

      Example: To create an attribute for a Cisco Agent that enables the Agent to use TACACS+, type 26 in the Identifier field.

    Note: For more information about attribute identifiers, see your RADIUS vendor documentation.

11. Select a RADIUS code for each field on the RADIUS Behavior group box. The RADIUS codes are:
    • Not allowed

      Attribute cannot be used in a response.

    • Zero or One

      One instance or no instances of the attribute can be returned in the same response. If this value is selected, and you use the attribute in a response, the attribute will be removed from the Attribute list after you have used the attribute in a response.

    • Zero or Many

      Multiple instances or no instances of the attribute can be returned in the same response.

    • One and Only One

      One instance of the attribute must be returned in a response. If this value is selected, and you use the attribute in a response, the attribute will be removed from the Attribute list after you have used the attribute in a response.

    The fields on the RADIUS group box are:

    • Access Request

      Provides information used to determine whether or not a user is allowed access to a specific NAS. The Access Request packets also provide information for any special services requested for that user.

    • Access Accept

      Provides specific configuration information necessary to begin delivery of service to the user.

      Note: You must set the Access Accept value to Zero or One, Zero or Many, or One and Only One in order to use the attribute in a response.

    • Access Reject

      Sends information if any value of the received Attributes is not acceptable. This code is often used for reply messages.

    • Access Challenge

      Sends information if the NAS device has been configured for challenge/response.

    • Accounting Request

      Describes the type of service being delivered and the user to whom it is being delivered.

    • Accounting Response

      Sends information if the Accounting Request was recorded successfully. A RADIUS Accounting-Response is not required to have any attributes in it.

12. If the data type is number, click Create on the Values group box.
13. Type the symbolic name of the attribute in the Symbolic Name field, type the actual numeric value of the attribute in the Numeric Value field, and click OK.

    The Modify Agent Type Attribute pane reopens, and the attribute name-value pair is added to the Values group box.

    Note: To create multiple attribute name-value pairs, repeat steps 12 and 13. By mapping symbolic names to values, you only need to remember names.

14. Click Submit.

    The Modify Agent Type pane reopens, and the Agent type attribute is added to the Agent Type Attributes group box.

15. Click Submit.

    The Modify Agent Type task is submitted for processing.

    Note: When the task is complete and you create a response for this Agent type, you can select the Agent type attribute that you just added to the Agent type from an attribute list.