PDF user manual for CopperEdge 150

&RQILJXULQJ5DGLXV6HUYHUVIRU&RSSHU(GJHRadius servers and their software are available in a number ofdifferent versions and implementations. Because setup andconfiguration procedures may vary, consult the documentationfor whichever type you are using for full configuration particulars.Similarly, while the CopperEdge Radius Client uses all the applicableRadius attributes as documented in RFC-2138 andRFC-2139, certain CopperEdge-specific parameters must firstbe translated so the server can interpret and deal with them appropriately:1. Radius Attribute NAS-Identifier may be omitted in thepacket if the CopperEdge SystemName object is empty.2. The value of Radius Attribute Filter-Id substitutes forthe CopperEdge Context and Privilege attributes(objects). Filter-Id attribute should contain the stringsContext=HH (with HH a hexadecimal value) andPrivilege=DD (with DD a decimal value) as describedbelow. The syntax of the Filter-Id string is importantbecause the CopperEdge unit must extract the valuesof HH and DD to properly complete the login process.Two Filter-Id strings are expected in an Access_Acceptpacket.The filter ID values for the CopperEdge Contextattributes can be found on the previous page.1 2 7 (Valid numeric values in the Context string can generally be combinedto enable the same operator record to be used in multiple contexts.For example, decimal 12 (Hex 0c) enables both Telnet (04) and Serial(08) contexts. But to distinguish SNMP sessions from normaloperator logins, and to prevent an operator from logging in using onlythe community string, SNMP user records must specify a Context ofSNMP only. If an SNMP user has a login context value indicatinganything other than SNMP, authentication will be rejected by theCopperEdge unit even if accepted by the RADIUS server.The filter ID values for the CopperEdge Privilegeattributes can be found on the previous page.The Radius Reply-Message attribute may be configuredwith a text string (up to 128 characters) to serve as anerror message in case an attempted login is denied(Access Reject). This string accompanies theAccess_Reject packet, and is entered in theCopperEdge Event Log.&RSSHU(GJH,QVWDOODWLRQDQG2SHUDWLQJ*XLGH