RADIUS, AAA and accounting

Theoretical foundations and architecture

Subscriber session orchestration on BNGs relies on the RADIUS protocol (RFC 2865 / RFC 2866). The AAA cycle includes: 1. Authentication: the BNG sends the server an Access-Request. For PPPoE it carries a User-Name and a password (PAP is hidden by XOR with MD5, CHAP is sent as CHAP-Password and CHAP-Challenge); for IPoE it carries the MAC or the Circuit-ID/Remote-ID learned from DHCP Option 82 (mapped to attributes such as Calling-Station-Id, Agent-Circuit-Id or NAS-Port-Id; Option 82 itself is not embedded in the packet). The server replies with Access-Accept, Access-Reject or Access-Challenge. 2. Authorization: Access-Accept carries standard attributes (Framed-IP-Address - a single address, Framed-Pool - a pool name, Session-Timeout, Acct-Interim-Interval, Filter-Id) and Vendor-Specific Attributes (VSAs): the VRF name (for example Cisco-AVPair ip:vrf-id=), the rate profile (Huawei-Input/Output-Average-Rate, Mikrotik-Rate-Limit) and ACLs. Session-Timeout limits the session length, not an address lease. 3. Accounting: the BNG sends Accounting-Request messages to UDP 1813: Start at login, Interim-Update (typically every 5-15 minutes) with byte and packet counters, and Stop at logout; billing is built on them. With RADIUS CoA and Disconnect (RFC 5176, UDP 3799) billing can change a subscriber's rate or terminate the session (Disconnect-Request) without rebooting the modem, provided the BNG can find the session from the attributes sent.

RADIUS roles and transport

The BNG is the RADIUS client (NAS, Network Access Server), and the billing/AAA server is the RADIUS server. Authentication and authorisation use UDP 1812 (legacy port 1645), accounting uses UDP 1813 (1646), and change of authorisation and disconnect (CoA/Disconnect, RFC 5176) use UDP 3799 from the server to the NAS (Cisco defaults to 1700, which is changed manually). The server identifies the client by the source IP of the packet and the shared secret, so a source interface (normally a Loopback) is fixed on the BNG; otherwise, if the outgoing interface changes, the server silently drops the requests. Packet format: Code (1 byte), Identifier (1), Length (2), Authenticator (16), then TLV attributes (Type, Length, Value). Codes: 1 Access-Request, 2 Access-Accept, 3 Access-Reject, 11 Access-Challenge, 4/5 Accounting-Request/Response, 40/41/42 Disconnect-Request/ACK/NAK, 43/44/45 CoA-Request/ACK/NAK.

Authentication and packet protection

The Request Authenticator is 16 random bytes. The PAP password (User-Password, attribute 2) is hidden by XOR with MD5(secret + Request Authenticator) in 16-byte blocks; the Response Authenticator in an Access-Accept = MD5(Code + ID + Length + Request Authenticator + attributes + secret), which lets the client verify that the answer came from the owner of the secret. For CHAP the BNG sends CHAP-Password (3) and CHAP-Challenge (60), the server computes the MD5 itself and compares, so the password must be stored reversibly on the server. The MD5 basis is considered weak: the BlastRADIUS attack (CVE-2024-3596) allows a response to be forged if the request has no Message-Authenticator (attribute 80, HMAC-MD5). Protection: Message-Authenticator in all Access-Requests, IP-based access restrictions, long secrets and, where possible, RADIUS over TLS (RadSec, RFC 6614, TCP 2083). For IPoE MAC authentication the MAC is often placed in User-Name and User-Password, and the client MAC in Calling-Station-Id (31).

Authorization: Access-Accept attributes

An Access-Accept carries the session profile. Standard attributes: Framed-IP-Address (8), Framed-IP-Netmask (9), Framed-Pool (88), Framed-MTU (12), Session-Timeout (27), Idle-Timeout (28), Acct-Interim-Interval (85, RFC 2869), Filter-Id (11), Class (25), Framed-IPv6-Prefix (97), Delegated-IPv6-Prefix (123), Framed-IPv6-Pool (100). Everything else is Vendor-Specific (26): Cisco-AVPair (vendor 9, type 1) with strings such as ip:vrf-id=..., ip:addr-pool=...; Huawei (vendor 2011) - Huawei-Input/Output-Average-Rate and Peak-Rate (bit/s), Huawei-Domain-Name; Juniper/ERX (vendor 4874) - Virtual-Router (VR/routing instance name), Ingress/Egress-Policy-Name; MikroTik (vendor 14988) - Mikrotik-Rate-Limit (rx/tx, for example 50M/100M), Mikrotik-Address-List. The VRF attribute decides into which MPLS core VRF the BNG puts the subscriber /32; if the name is wrong, the session comes up in the global table or is rejected by the BNG. The same profile can be stored in RADIUS and distributed per vendor (the server selects the VSA by NAS-Identifier or a dictionary).

Accounting: Start, Interim, Stop

An Accounting-Request carries Acct-Status-Type (40): 1 Start (after the address is assigned), 3 Interim-Update (periodic, the interval is set by Acct-Interim-Interval or a local setting, typically 5-15 min), 2 Stop, 7/8 Accounting-On/Off (NAS reboot). Identifiers: Acct-Session-Id (44) is unique within a session, Acct-Multi-Session-Id (50) links the sessions of a dual-stack subscriber. Counters: Acct-Input/Output-Octets (42/43) with Gigawords (52/53) for volumes above 4 GB, Acct-Input/Output-Packets (47/48), Acct-Session-Time (46), Acct-Terminate-Cause (49: 1 User-Request, 2 Lost-Carrier, 4 Idle-Timeout, 5 Session-Timeout, 6 Admin-Reset). If the accounting server is unreachable, the NAS buffers Stop packets (configurable); otherwise billing receives "hanging" sessions that are closed only manually or by the Interim timeout. A BNG reboot without Accounting-On/Off is another source of ghost sessions.

CoA and Disconnect

A CoA-Request (code 43) changes the attributes of a live session: a new speed, a move to the walled garden, an ACL change, a redirect; the NAS answers with CoA-ACK/NAK (44/45), and the reason for a refusal is Error-Cause (101), for example 503 "Session Context Not Found". A Disconnect-Request (40) closes a session (on zero balance or on a subscriber's request). The session on the NAS is found by Acct-Session-Id, User-Name, Framed-IP-Address or Calling-Station-Id; the attributes must match or the answer is NAK. The NAS must accept packets only from a trusted server (client ... server-key) and port 3799 must be open along the path (including in the management VRF).