Vendor-specific attributes
Vendor-specific attributes (VSA) are defined by remote-access server vendors, usually hardware vendors, to customize how RADIUS works on their servers.
The vendor-specific attributes are necessary if you want to give users permission for more than one type of access. The VSAs may be used in combination with RADIUS-defined attributes.
VSAs are optional, but if the NAS hardware requires additional attributes to be configured in order to function properly, you must add the VSAs to the dictionary file.
VSAs can also be used for further authorization. Along with User-Name and Password, you can use VSAs for authorization. On the server side, the user authorization policy file contains the list of attributes to be checked in the Access-Request packet for a particular user. If the packet does not contain the attributes listed in the users file, then an access_reject is sent back to NAS. VSAs can also be used as an attribute=value pair list in the user_id.policy file.
The following is a sample VSA section taken from the dictionary:
########################################################################
# #
# This section contains examples of dictionary translations for #
# parsing vendor specific attributes (vsa). The example below is for #
# "Cisco." Before defining an Attribute/Value pair for a #
# vendor a "VENDOR" definition is needed. #
# #
# Example: #
# #
# VENDOR Cisco 9 #
# #
# VENDOR: This specifies that the Attributes after this entry are #
# specific to Cisco. #
# Cisco : Denotes the Vendor name #
# 9 : Vendor Id defined in the "Assigned Numbers" RFC #
# #
########################################################################
#VENDOR Cisco 9
#ATTRIBUTE Cisco-AVPair 1 string
#ATTRIBUTE Cisco-NAS-Port 2 string
#ATTRIBUTE Cisco-Disconnect-Cause 195 integer
#
#----------------Cisco-Disconnect-Cause---------------------------------#
#
#VALUE Cisco-Disconnect-Cause Unknown 2
#VALUE Cisco-Disconnect-Cause CLID-Authentication-Failure 4
#VALUE Cisco-Disconnect-Cause No-Carrier 10
#VALUE Cisco-Disconnect-Cause Lost-Carrier 11
#VALUE Cisco-Disconnect-Cause No-Detected-Result-Codes 12
#VALUE Cisco-Disconnect-Cause User-Ends-Session 20
#VALUE Cisco-Disconnect-Cause Idle-Timeout 21
#VALUE Cisco-Disconnect-Cause Exit-Telnet-Session 22
#VALUE Cisco-Disconnect-Cause No-Remote-IP-Addr 23