Skip to main content

RADIUS Attributes Reference

Complete reference of RADIUS attributes used by AthenaBNG.

Standard Attributes​

Authentication​

AttributeTypeDescription
User-NameStringSubscriber username (PPPoE) or MAC address (DHCP)
User-PasswordStringSubscriber password (PAP)
Calling-Station-IdStringCaller ID (MAC address for DHCP)
NAS-IdentifierStringBNG identifier (e.g., "AthenaBNG")
NAS-Port-IdStringCircuit ID (VLAN interface name)
NAS-PortIntegerNAS port number
NAS-IP-AddressIP AddressBNG management IP

Authorization​

AttributeTypeDescription
Framed-IP-AddressIP AddressAssigned IP address
Framed-IP-NetmaskIP AddressSubnet mask (usually 255.255.255.255 for /32)
Framed-RouteStringStatic route (e.g., "0.0.0.0/0 0.0.0.0")
Session-TimeoutIntegerSession timeout in seconds
Idle-TimeoutIntegerIdle timeout in seconds
Service-TypeIntegerService type (2 = Framed-User)

IPv6 (Dual-Stack)​

Attribute#RFCTypeDescription
Framed-IPv6-Prefix97RFC 3162IPv6 PrefixOn-link WAN prefix for the CE (typically a /64), advertised via RA/SLAAC
Delegated-IPv6-Prefix123RFC 4818IPv6 PrefixPrefix delegated to the CE's LANs (e.g. a /56), handed out via DHCPv6 IA_PD

Both are encoded as reserved(1) | prefix-length(1) | prefix octets (left-aligned, zero-padded). They are the sole source of a subscriber's IPv6 — there is no local IPv6 pool. Returning neither yields an IPv4-only session (fail-closed). See IPv6 / Dual-Stack for the full model.

Accounting​

AttributeTypeDescription
Acct-Session-IdStringSession ID (format: abng-<epoch>-<id>)
Acct-Status-TypeIntegerStart (1), Stop (2), Interim-Update (3)
Acct-Input-OctetsIntegerBytes received
Acct-Output-OctetsIntegerBytes sent
Acct-Input-PacketsIntegerPackets received
Acct-Output-PacketsIntegerPackets sent
Acct-Session-TimeIntegerSession duration in seconds
Acct-Terminate-CauseIntegerTermination reason
Event-TimestampIntegerEvent timestamp (Unix epoch)

Athena VSA (Vendor-Specific Attributes)​

Athena VSAs are defined in /opt/athena-bng/contrib/radius/dictionary.athena (vendor ID 60001). The dictionary must be loaded by your RADIUS server so it can parse and return these attributes (Athena-RAD ships it; see Dictionary Installation).

The complete attribute set:

#AttributeTypeDescription
1Athena-Rate-DownStringDownload rate (see rate string format)
2Athena-Rate-UpStringUpload rate (see rate string format)
3Athena-Cake-ProfileStringCAKE shaping profile name
4Athena-VLAN-StackStringVLAN stack descriptor
5Athena-Overhead-ProfileStringOverhead profile name (e.g., "pppoe_ethernet")
6Athena-Session-PriorityIntegerSession priority
7Athena-CGNAT-BypassIntegerBypass CGNAT (1 = yes, 0 = no)
8Athena-IPv6-PD-PrefixStringIPv6 prefix for delegation
9Athena-QoS-Burst-DownStringDownload burst allowance
10Athena-QoS-Burst-UpStringUpload burst allowance

Rate string format​

Athena-Rate-Down and Athena-Rate-Up carry the per-subscriber speed plan. The BNG parses them and applies per-subscriber CAKE shaping. Accepted forms (case-insensitive):

  • A unit-suffixed value: gbit/gbps/g, mbit/mbps/m, kbit/kbps/k, or bit/bps — e.g. "250mbit", "1gbit", "500kbit". Fractional values such as "1.5gbit" are accepted.
  • A plain integer, interpreted as bits per second — e.g. "250000000".
Unmetered by default

A subscriber whose Access-Accept (or DHCP authorization) returns no Athena-Rate-Down/Athena-Rate-Up is left UNMETERED — no CAKE shaping is applied. (Earlier releases defaulted the DHCP/IPoE path to 25/10 Mbps; that is no longer the case.) Return both attributes to apply a speed plan.

These attributes are honored for both DHCP/IPoE (MAC authentication, via abng-dhcpd's RADIUS client) and PPPoE (via accel-ppp). For PPPoE, accel-ppp writes the reply attributes to a radattr file (the pppd-compat radattr-prefix) and the ip-up hook forwards the rate to abngd.

Example Responses​

PPPoE Authentication​

Access-Accept
    User-Name = "user1"
    Framed-IP-Address = 203.0.113.10
    Framed-IP-Netmask = 255.255.255.255
    Framed-Route = "0.0.0.0/0 0.0.0.0"
    Session-Timeout = 3600
    Athena-Rate-Down = "100mbit"
    Athena-Rate-Up = "40mbit"

PPPoE Authentication (Dual-Stack)​

Access-Accept
    User-Name = "user1"
    Framed-IP-Address = 203.0.113.10
    Framed-IP-Netmask = 255.255.255.255
    Framed-IPv6-Prefix = 2001:df4:2040:1234::/64
    Delegated-IPv6-Prefix = 2001:df4:2040:1200::/56
    Session-Timeout = 3600
    Athena-Rate-Down = "100mbit"
    Athena-Rate-Up = "40mbit"

DHCP/IPoE Authentication​

Access-Accept
    User-Name = "aa:bb:cc:dd:ee:ff"
    Calling-Station-Id = "aa:bb:cc:dd:ee:ff"
    Framed-IP-Address = 203.0.113.20
    Framed-IP-Netmask = 255.255.255.255
    Session-Timeout = 3600
    Athena-Rate-Down = "50mbit"
    Athena-Rate-Up = "20mbit"

Accounting Start​

Accounting-Request
    Acct-Status-Type = Start
    Acct-Session-Id = "abng-1709312400-1"
    User-Name = "user1"
    Framed-IP-Address = 203.0.113.10
    NAS-Port-Id = "eth1.111.500.100"
    NAS-Identifier = "AthenaBNG"
    Event-Timestamp = 1709312400

Accounting Stop​

Accounting-Request
    Acct-Status-Type = Stop
    Acct-Session-Id = "abng-1709312400-1"
    User-Name = "user1"
    Acct-Session-Time = 3600
    Acct-Input-Octets = 1234567890
    Acct-Output-Octets = 987654321
    Acct-Terminate-Cause = User-Request

Attribute Codes​

Acct-Terminate-Cause​

CodeMeaning
1User-Request
2Lost-Carrier
3Lost-Service
4Idle-Timeout
5Session-Timeout
6Admin-Reset
7Admin-Reboot
8Port-Error
9NAS-Error
10NAS-Request
11NAS-Reboot
12Port-Unneeded
13Port-Preempted
14Port-Suspended
15Service-Unavailable
16Callback
17User-Error
18Host-Request

Dictionary Installation​

Install Athena VSA dictionary on RADIUS server:

sudo cp /opt/athena-bng/contrib/radius/dictionary.athena /etc/freeradius/3.0/
echo '$INCLUDE dictionary.athena' | sudo tee -a /etc/freeradius/3.0/dictionary
sudo systemctl restart freeradius

Testing​

Test with radtest​

radtest user1 password123 10.255.0.10 1812 my-secret

Test with radclient​

echo "User-Name = user1, User-Password = password123" | \
  radclient -x 10.255.0.10:1812 auth my-secret

Next Steps​