RADIUS-Initiated Change of Authorization (CoA) Overview

The AAA Service Framework uses CoA messages to dynamically modify active subscriber sessions. For example, RADIUS attributes in CoA messages might instruct the framework to create, modify, or terminate a subscriber service.

CoA Messages

Dynamic request support enables the router to receive and process unsolicited CoA messages from external RADIUS servers. RADIUS-initiated CoA messages use the following codes in request and response messages:

• CoA-Request (43)
• CoA-ACK (44)
• CoA-NAK (45)

Qualifications for Change of Authorization

To complete the change of authorization for a user, the CoA-Request must contain the two RADIUS attributes shown in the following list to uniquely identify subscribers. The request must also include the appropriate VSA shown in the following list to perform the required operation. The AAA Service Framework handles the actual request.

• User-Name [attribute 1]
• Acct-Session-ID [attribute 44]
• Activate-Service [VSA 26–65]
• Deactivate-Service [VSA 26–66]

Note: If only the User-Name attribute is included in the CoA-Request, the router uses the first match for the username.

Message Exchange

The RADIUS server and the AAA Service Framework on the router exchange messages using UDP. The CoA-Request message sent by the RADIUS server has the same format as the Disconnect-Request packet that is sent for a disconnect operation.

The response is either a CoA-ACK or a CoA-NAK message:

• If the AAA Service Framework successfully changes the authorization, the response is a RADIUS-formatted packet with a CoA-ACK message, and the data filter is applied to the session.
• If AAA Service Framework is unsuccessful, the request is malformed, or attributes are missing, the response is a RADIUS-formatted packet with a CoA-NAK message.

Note: The AAA Service Framework processes one dynamic request at a time per subscriber. If the framework receives a second dynamic request (either another CoA or a Disconnect-Request) while processing a previous requrest for the same subscriber, the framework responds with a CoA-NAK message.