#

# Reference to RADIUS Attributes

This chapter discusses RADIUS attributes found in user profiles. Each listing provides information in the following format:

## Attribute Name

Description: The Description text explains the attribute.

Usage: The Usage text explains the values you can specify for the attribute.

Example: The Example text presents an example of how to use the attribute.

Dependencies: The Dependencies text tells you what other information you need in order to specify the proper value for the attribute.

See Also: The See Also text points you to related information.

## Acct-Authentic (45)

Description: The Acct-Authentic attribute specifies the method the MAX used to authenticate a call, or indicates whether the MAX accepted the call without authentication.

The MAX sends Acct-Authentic in an Accounting-Request packet under these conditions:

- At the start of a session (when Acct-Status-Type=Start)

- At the end of an authenticated session (Acct-Status-Type=Stop) when the Auth parameter is not set to RADIUS/LOGOUT

Usage: Acct-Authentic does not appear in a user profile It can have either of the following values:

- RADIUS (1)

  This value indicates that RADIUS authenticated the incoming call. RADIUS is the default.

- Local (2)

  This value indicates that the MAX authenticated the call using a local Connection profile, TACACS profile, or TACACS+ profile, or that the MAX accepted the call without authentication.

## Acct-Delay-Time (41)

Description: The Acct-Delay-Time attribute specifies how many seconds the MAX has been trying to send this Accounting packet.

The MAX sends Acct-Delay-Time in an Accounting-Request packet under these conditions:

- At the start of a session (when Acct-Status-Type=Start)

- At the end of a session or when a session fails to authenticate (Acct-Status-Type=Stop) and the Auth parameter is not set to RADIUS/LOGOUT

Usage: Acct-Delay-Time does not appear in a user profile. Its default value is 0 (zero).

## Acct-Input-Octets (42)

Description: The Acct-Input-Octets attribute specifies how many octets the MAX has received during the session.

Usage: The MAX sends Acct-Input-Octets in an Accounting-Request packet at the end of a session (Acct-Status-Type=Stop) when both of these conditions are true:

- The session has been authenticated.

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Acct-Input-Octets does not appear in a user profile. Its default value is 0 (zero).

## Acct-Input-packets (47)

Description: The Acct-Input-packets attribute specifies how many packets the MAX has received during the session. The MAX sends Acct-Input-packets in an Accounting-Request packet at the end of a session (Acct-Status-Type=Stop) when all of these conditions are true:

- The session has been authenticated.

- The Auth parameter is not set to RADIUS/LOGOUT.

- A framed protocol is in use.

Usage: Acct-Input-packets does not appear in a user profile. Its default value is (zero).

## Acct-Output-Octets (43)

Description: The Acct-Output-Octets attribute specifies how many octets the MAX has sent during the session.

The MAX sends Acct-Output-Octets in an Accounting-Request packet at the end of a session
(Acct-Status-Type=Stop) when both of these conditions are true:

- The session has been authenticated.

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Acct-Output-Octets does not appear in a user profile. Its default value is (zero).

## Acct-Output-packets (48)

Description: The Acct-Output-packets attribute specifies how many packets the MAX has sent during the session. The MAX sends Acct-Output-packets in an Accounting-Request packet at the end of a session (Acct-Status-Type=Stop) when all of these conditions are true:

- The Auth parameter is not set to RADIUS/LOGOUT.

- The session is authenticated.

- A framed protocol is in use.

Usage: Acct-Output-packets does not appear in a user profile. Its default value is (zero).

## Acct-Session-Id (44)

Description: The Acct-Session-Id attribute specifies a unique numeric string for the bridging, routing, or terminal server session specified in the Accounting-Request packet. The string is a random number containing up to seven digits. RADIUS correlates the Accounting Start packet and Accounting Stop packet using Acct-Session-Id.

The MAX sends Acct-Session-Id under these conditions:

- At the start of a session (when Acct-Status-Type=Start)

- At the end of a session or when a session failed to authenticate (Acct-Status-Type=Stop) and the Auth parameter is not set to RADIUS/LOGOUT

Usage: Acct-Session-Id does not appear in a user profile. Its value can range from 1 to 2,137,383,647. For every session, RADIUS generates a unique session ID, thereby preventing the same session ID from applying to more than one session.

Dependencies: Keep this additional information in mind:

- When an SNMP accounting session and a RADIUS accounting session have the same ID, they are identical.

  However, SNMP records all calls, while RADIUS records only those calls that result in a successful login or authentication.

- Using the Acct-ID Base parameter in the Ethernet\>Mod Config\>Accounting menu, you can specify whether the numeric base of the Acct-Session-Id attribute is 10 or 16.

  This parameter controls how the MAX presents Acct-Session-Id attribute to the accounting server. For more information, see the MAX Reference Guide.

## Acct-Session-Time (46)

Description: The Acct-Session-Time attribute specifies how many seconds the session has been online.

The MAX sends Acct-Session-Time in an Accounting-Request packet at the end of a session (Acct-Status-Type=Stop) when both of these conditions are true:

- The session has been authenticated.

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Acct-Session-Time does not appear in a user profile. Its default value is 0 (zero).

## Acct-Status-Type (40)

Description: The Acct-Status-Type attribute specifies whether the Accounting packet the MAX sends to the RADIUS server is the beginning (Start) or end (Stop) of a bridging, routing, or terminal server session, or to indicate whether and when RADIUS accounting is enabled or disabled. The Accounting-Request packet contains these attributes and values:

- NAS-Identifier (4) with the IP address of the MAX

- Acct-Status-Type (40) with the value7

- Acct-Delay-Time(41) with the number of seconds the MAX has been trying to send the packet without receiving an acknowledgment from the accounting server.

The attribute has four possible values:

- 1 (Start)

- 2 (Stop)

- 7 (Accounting-On)

- 8 (Accounting-Off)

The MAX sends Acct-Status-Type under these conditions:

- At the start of a session (when Acct-Status-Type=Start)

- At the end of a session or when a session fails to authenticate (when Acct-Status-Type=Stop), and only if the Auth parameter is not set to RADIUS/LOGOUT

- You boot the MAX and Acct=RADIUS in the Ethernet > Mod Config > Accounting menu (Acct-Status-Type=Accounting-On.

- You set the Acct parameter RADIUS and save the configuration while the MAX is running (Acct-Status-Type=Accounting-On).

  When Acct-Status-Type=Accounting-On, the MAX retransmits the request until it receives an Accounting-Response packet from the RADIUS accounting server, or until the MAX reaches a limit of ten retries for each accounting server it attempts to reach.

- You reset the MAX.

- You set Acct to either None or TACACS+ and save the configuration while the MAX is running (Accounting-Off).

- You change the setting of the Auth parameter in the Ethernet > Mod Config > Auth menu from RADIUS to RADIUS/LOGOUT (Accounting-Off).

- When Auth=RADIUS/LOGOUT, Acct is set to N/A, and RADIUS accounting is disabled (Accounting-Off).

  When Acct-Status-Type=Accounting-Off, the MAX retransmits the request until it receives an Accounting-Response packet from RADIUS, or until the MAX reaches a limit of ten retries for each accounting server it attempts to reach. If the MAX is being reset, it sends only one Accounting-Request packet, and does not retransmit the request. The MAX does not send an Accounting-Request packet in response to a power failure.

Usage: Acct-Status-Type does not appear in a user profile.

## Ascend-Add-Seconds (240)

Description: The Ascend-Add-Seconds attribute specifies the number of seconds that average line utilization (ALU) for transmitted data must exceed the threshold indicated by the Ascend-Target-Util attribute before the MAX begins adding bandwidth to a session. The MAX determines the ALU for a session by using the algorithm specified by the Ascend-History-Weigh-Type attribute.

When utilization exceeds the threshold for a period of time greater than the value of the Ascend-Add-Seconds attribute, the MAX attempts to add the number of channels specified by the Ascend-Inc-Channel-Count attribute. Using the Ascend-Add-Seconds attribute prevents the system from continually adding bandwidth, and can slow down the process of allocating bandwidth.

Usage: Specify a number between 1 and 300. The default value is 5.

Dependencies: Keep this additional information in mind:

- Additional channels must be available, and the number of channels the MAX adds cannot exceed the amount the Ascend-Maximum-Channels attribute specifies.

- Ascend-Add-Seconds and Ascend-Remove-Seconds have little or no effect on a system with a high Ascend-Seconds-Of-History value.

  If the value of Ascend-Seconds-Of-History is low, the Ascend-Add-Seconds and Ascend-Remove-Seconds attributes provide an alternative way to ensure that spikes must persist for a certain period of time before the system responds.

See Also: Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-Appletalk-Peer-Mode (117)

Description: Specifies whether the connection is for a single dial-in station or for a router.

Usage: Specify one of the following values:

- Appletalk-Peer-Router (0) specifies that the caller is an AppleTalk router, such as an Ascend Pipeline unit.

- Appletalk-Peer-Dialin specifies that the caller is a dial-in AppleTalk client, such as a single Macintosh dialing in over a modem.

Dependencies: Ascend-Route-Appletalk must be set to Ascend-Route-Appletalk-Yes.

Example: The following example shows a RADIUS user profile for a routed connection:

    pipe50  Password="pipe50"

            User-Service = Framed-User,

            Framed-Protocol = PPP,

            Ascend-Appletalk-Peer-Mode = Appletalk-Peer-Router,

            Ascend-Route-Appletalk = Route-Appletalk-Yes,

            Ascend-Idle-Limit = 0

The following is an example of a RADIUS user profile for a dial-in connection:

    mac1    Password = "mac1"

            User-Service = Framed-User,

            Framed-Protocol = PPP,

            Ascend-Appletalk-Peer-Mode = Appletalk-Peer-Dialin,

            Ascend-Route-Appletalk = Route-Appletalk-Yes,

            Ascend-Idle-Limit = 0

Dependencies: Ascend-Route-Appletalk must be set to Yes.

See Also: Ascend-Appletalk-Peer-Mode (117), Ascend-Appletalk-Route (116)

## Ascend-Appletalk-Route (116)

Description: Defines a static AppleTalk route in a RADIUS pseudo-user profile.

Usage: Create a pseudo-user profile with the first line in the following format:

    appleroute-num Password="ascend',
    user-service=Dialout-Framed-User

where num is a number in a series starting at 1. Then enter one or more static AppleTalk route specifications in the following format:

    Ascend-Appletalk-Route="net_start net_end zone_name
    profile_name"

#### Argument | #### Description
--- | ---
net_start | The lower limit of the network range for this network. A network range is a range of network numbers set into the port descriptor of the router port and then transmitted through RTMP to the other nodes of the network. Each of the numbers within a network range can represent up to 253 devices. The default is blank.
net_end | The upper limit of the network range for this network. This range defines the networks available for packets routed using the static route. Specify a number between 1 and 65199. If there are other AppleTalk routers on the network, you must configure the network ranges to be identical to the ranges specified on the other routers.
zone_name | The name of the AppleTalk zone associated with this network. A zone is a multicast address containing a subset of the AppleTalk nodes on an internet. Each node belongs to only one zone, but a particular extended network can contain nodes belonging to any number of zones. Zones provide departmental or other groupings of network entities that a user can easily understand. In the Ascend AppleTalk router, zone names are case-insensitive. However, because some routers regard zone names as case-sensitive, the spelling of zone names should be consistent when you configure multiple connections or routers. You can use up to 33 alphanumeric characters. The default is blank.
profile_name | The outgoing RADIUS user profile that the route uses. The default is blank.

Each static route must appear in a user profile. User profile entries for Appletalk static routes are identified by the special name `appleroute-#` and have the following format:

    appleroute-# Password = "ascend" User-Service =
    Dialout-Framed-User

    	Address 1

    	Address 2

    	...

    	Address n

`Address` n is the actual route associated with this entry.

An example of a static route with the associated connection profiles is:

    appleroute-1    Password = "ascend" User-Service =
    Dialout-Framed-User Ascend-Appletalk-Route = "20 25 testzone1
    pipe50"

    pipe50  Password = "ascend" User-Service = Dialout-Framed-User,

            User-Service = Framed-User,

            Framed-Protocol = MPP,

            Ascend-Appletalk-Peer-Mode = Appletalk-Peer-Router,

            Ascend-Route-Appletalk = Route-Appletalk-Yes,

            Ascend-Dialout-Allowed = Dialout-Allowed,

            Ascend-Dial-Number = "83272",

            Ascend-Send-Auth = Send-Auth-PAP,

            Ascend-Send-Passwd = "MAX"

Dependencies: Ascend-Route-Appletalk must be set to Yes.

See Also: Ascend-Appletalk-Peer-Mode (117)

## Ascend-Ara-PW (181)

Description: The Ascend-Ara-PW attribute specifies the password of the incoming caller over an AppleTalk Remote Access (ARA) connection. The ARA software in the MAX uses DES to encrypt and decrypt the password.

Usage: Specify an alphanumeric text string containing up to 20 characters. The default value is null. The password you enter for this attribute must be identical to the password you enter in the first line of the user profile. The MAX requires both entries.

Example: This example sets up a TCP connection through ARA with a dynamic IP address assignment:

    Emma Password="pwd"

              Framed-Protocol=ARA,

              Ascend-Ara-PW="pwd",

              Ascend-Route-IP=Route-IP-Yes,

              Ascend-Assign-IP-Pool=1

See Also: Password (2)

## Ascend-Assign-IP-Client (144)

Description: In the Radipa-Hosts pseudo-user profile, the Ascend-Assign-IP-Client attribute specifies the IP address of an Ascend unit that can use global IP address pools.

Usage: Specify an IP address in dotted-decimal notation. The default value is 0.0.0.0. You can specify multiple instances of this attribute. At present, the MAX does not use the list of radipad client units.

Dependencies: If no Ascend-Assign-IP-Client attribute is present, the list of client units defaults to those present in the RADIUS clients file.

See Also: Ascend-Assign-IP-Global-Pool (146)
Ascend-Assign-IP-Server (145)

## Ascend-Assign-IP-Global-Pool (146)

Description: In a RADIUS user profile requiring dynamic addressing for dial-in users, the Ascend-Assign-IP-Global-Pool attribute specifies the global address pool from which RADIUS should assign each user an address.

Usage: Specify the name of the pseudo-user profile containing global IP pool definitions. The Ascend unit tries to allocate an address from the pools in order, and chooses an address from the pool with the first available IP address.

Dependencies: Do not set the Framed-Address attribute in the user profile. If you do, the MAX will require the caller to use the static IP address the attribute specifies.

See Also: Ascend-Assign-IP-Client (144)
Ascend-Assign-IP-Server (145)
Framed-Address (8)

## Ascend-Assign-IP-Pool (218)

Description: In a user profile, the Ascend-Assign-IP-Pool attribute specifies the MAX-specific address pool from which RADIUS assigns the user an IP address.

A dynamic address comes from the pool of addresses set by the Pool #n Start and Pool #n Count parameters, by the Ascend-IP-Pool-Definition attribute, or both. An IP address pool you set up in RADIUS overrides an IP address pool you set up in the MAX configuration interface only if you designate the two pools by the same number.

If you need to define more than ten pools of addresses, you must use the RADIUS attribute Ascend-IP-Pool-Definition to configure the IP address pools.

Usage: Specify an integer corresponding to an address pool. The default value is 1. If you set Ascend-Assign-IP-Pool=0, RADIUS chooses an address from any pool that has one available.

Example: In this example, the user requests an address from pool #2:

Emma Password="m2dan", User-Service=Framed-User

Framed-Protocol=PPP,

Ascend-Route-IP=Route-IP-Yes,

Ascend-Metric=2,

Framed-Routing=None,

         Ascend-Assign-IP-Pool=2

See Also: Ascend-IP-Pool-Definition (217)

## Ascend-Assign-IP-Server (145)

Description: In the Radipa-Hosts pseudo-user profile, the Ascend-Assign-IP-Server attribute specifies the IP address of the host running radipad.

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0.0.0. Only one instance of this attribute can appear in the profile. The default value is a placeholder only. You must specify a valid IP address for radipad to work.

See Also: Ascend-Assign-IP-Client (144)
Ascend-Assign-IP-Global-Pool (146)

## Ascend-Authen-Alias (203)

Description: The Ascend-Authen-Alias attribute sets the MAX unit's login name during PPP authentication.

When the MAX places an outgoing call, it identifies itself by a login name and password. The login name is either its system name (as specified by the Name parameter in the System profile) or the value you specify for the Ascend-Authen-Alias attribute.

Usage: Specify a text string containing up to 16 characters. The default is the value of the Name parameter in the System profile.

Example: This example uses the Ascend-Authen-Alias attribute in an outgoing profile:

    Homer-Out Password="Ascend", User-Service=Dialout-Framed-User

            User-Name="Homer",

            Ascend-Authen-Alias="myMAXcallingU",

            Ascend-Send-Auth=Send-Auth-PAP,

            Ascend-Send-Secret="passwrd1",

            Ascend-Dial-Number="31",

            Framed-Protocol=PPP,

            Framed-Address=10.0.100.1,

            Framed-Netmask=255.255.255.0,

            Ascend-Metric=2,

            Framed-Routing=None,

            Framed-Route="10.5.0.0/24 10.0.100.1 1",

            Ascend-Idle-Limit=30

## Ascend-backup (176)

Description: The Ascend-backup attribute specifies the name of a backup profile for a nailed-up link when the physical connection fails on loss of a T1 line or WAN Serial port. The MAX automatically diverts traffic to the backup connection. When the primary connection comes back online, traffic again uses the primary connection.

When you use the backup connection, the MAX does not move routes to the backup profile. Therefore, the IP routes that appear in the terminal server display may be incorrect, although statistical counts reflect the change.

Usage: Specify the name of the profile that you want to act as the backup. The backup connection can be switched or nailed up. The default value is null.

Dependencies: Keep this additional information in mind:

- The Ascend-backup attribute applies to nailed-up connections only (Ascend-Call-Type=Nailed or Nailed/Mpp).

- Do not create nested backup connections.

- Attributes that you define for the primary profile do not automatically apply to the backup profile.

  For example, if you set the primary profile to filter Telnet packets, you must set the backup profile to filter Telnet packets as well. Outgoing Frame Relay packets are the only packets that follow the primary profile definitions. All other packets follow the backup profile definitions.

- If you configure a RADIUS user profile for Frame Relay and for backup, the MAX brings up the backup connection when any one of the DLCIs becomes unusable.

- Do not use the Ascend-backup attribute to provide alternative lines for getting to a single destination.

## Ascend-BACP-Enable (134)

Description: The Ascend-BACP-Enable attribute specifies whether Bandwidth Allocation Control Protocol (BACP) is enabled for the link.

BACP is the Internet standard protocol equivalent to the Ascend MP+ bandwidth allocation protocol. BACP functions similarly to MP+ and uses the same attributes as MP+.

Usage: You can specify one of these settings:

- BACP-No (0) disables BACP for the link.

  The default value is BACP-No.

- BACP-Yes (1) enables BACP for the link.

## Ascend-Base-Channel-Count (172)

Description: The Ascend-Base-Channel-Count attribute specifies the initial number of channels the MAX sets up when originating calls for a PPP, MP+, MP, or Combinet multichannel link.

Usage: The maximum number of channels you can specify depends upon the nature of the link:

- For a PPP link, the maximum number of channels is always 1.

- For an MP+ or MP link, you can specify any value up to the number of channels available, but the device at the remote end of the link must also support MP+ or MP.

- For a Combinet link, you can specify up to two channels.

The default value is 1.

Dependencies: The Ascend-Base-Channel-Count attribute does not apply when all channels of the link are nailed up (Ascend-Call-Type=Nailed).

For optimum MP+ performance, both sides of a connection must set these values to the same number:

- The base channel count, as specified by Base Ch Count (in the Connection profile) or Ascend-Base-Channel-Count (in RADIUS)

- The minimum channel count, as specified by Min Ch Count (in the Answer profile or Connection profile) or Ascend-Minimum-Channels (in RADIUS)

- The maximum channel count, as specified by Max Ch Count (in the Answer profile or Connection profile) or Ascend-Maximum-Channels (in RADIUS)

See Also: Ascend-Add-Seconds (240)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-Billing-Number (249)

Description: The Ascend-Billing-Number attribute specifies a billing number for charges you incur on the line. If you do not enter a billing number, the telephone company assigns charges to the telephone number associated with the line.

Your carrier determines the billing number, and uses it to sort your bill. If you have several departments, and each department has its own Ascend-Billing-Number, your carrier can separate and tally each department's usage.

Usage: Specify a telephone number. You can indicate up to ten characters, and you must limit those characters to the following:

    1234567890()[]!z-*# |

Dependencies: The MAX uses the Ascend-Billing-Number attribute differently depending on the type of line you use:

- For a T1 line, the MAX appends the value specified in the Ascend-Billing-Number attribute to the end of each phone number it dials for the call.

- Ascend-Billing-Number for outgoing calls on an ISDN BRI line applies only to installations in Australia.

- For a T1 PRI line, the MAX uses the Ascend-Billing-Number rather than the phone number ID to identify itself to the answering party.

  The Id Auth parameter enables you to require a device to authenticate incoming calls by checking the calling party's phone number. The device performs Calling Line ID (CLID) authentication before answering an incoming call. The calling party's phone number must match the Calling # parameter or the Caller-Id attribute. If the MAX cannot authenticate the call when CLID authentication is required, it rejects the call.

  If the calling party uses the Ascend-Billing-Number attribute instead of its phone number as its ID, the CLID the answering side uses is not the true phone number of the caller. This situation presents a security breach if you use Id Auth.

  Further, be aware that if you specify a value for the Ascend-Billing-Number attribute, there is no guarantee that the phone company will send it to the answering device.

See Also: Caller-Id (31)

## Ascend-Bridge (230)

Description: The Ascend-Bridge attribute enables or disables protocol-independent bridging for the user profile.

Usage: You can specify one of these values:

- Bridge-No (0)

  This setting disables bridging for the link. Bridge-No is the default.

- Bridge-Yes (1)

  This setting enables bridging for the link.

Example: This user profile specifies an IPX bridging link:

MAX1 Password="m2dan", User-Service=Framed-User

Framed-Protocol=PPP,

Ascend-Route-IPX=Route-IPX-No,

Ascend-Bridge=Bridge-Yes,

         Ascend-Handle-IPX=Handle-IPX-Client,

Ascend-Netware-timeout=30

See Also: Ascend-Bridge-Address (168)

## Ascend-Bridge-Address (168)

Description: The Ascend-Bridge-Address attribute specifies the IP address and associated MAC address of a device on a remote LAN to which the MAX can form a bridging connection.

Usage: The Ascend-Bridge-Address attribute has this format:

    Ascend-Bridge-Address="MAC_address profile_name IP_address"

Table 9-1 describes Ascend-Bridge-Address arguments.

Table 9-1. Ascend-Bridge-Address arguments

#### Argument

#### Description

MAC_address

Specifies a MAC address in standard 12-digit hexadecimal format (yyyyyyyyyyyy) or in colon-separated format (yy:yy:yy:yy:yy:yy). If the leading digit of a colon-separated pair is 0 (zero), you do not need to enter it. That is, :y`` is the same as :0y.

The default value is 000000000000.

profile_name

Specifies the name of the dialout profile the MAX uses to bring up the connection. You can specify either a Connection profile or a RADIUS user profile. The MAX looks for a local profile first.

IP_address

Specifies an IP address in dotted decimal notation. The default value is 0.0.0.0.

When your MAX receives an ARP request for one of the IP addresses you specify, the MAX replies with the corresponding MAC address and uses the specified profile to bring up a connection to that address. Because the MAX replies to these ARP requests as if the IP devices were local, you must have user profiles that bridge IP packets to each device.

Dependencies: Each bridge entry must appear in a pseudo-user profile. You create a pseudo-user to store information that the MAX can query-in this case, in order to store bridging information. For a unit-specific bridge entry, specify the first line of a pseudo-user profile in this format:

    Bridge-unit_name-num Password="Ascend", User-Service=

    Dialout-Framed-User

unit_name is the system name of the MAX-that is, the name specified by the Name parameter in the System profile. num is a number in a sequential series, starting at 1.

In each pseudo-user profile, you specify one or more Ascend-Bridge-Address attributes. Whenever you power on or reset the MAX, or when you select the Upd Rem Cfg command from the Sys Diag menu, RADIUS adds bridging entries to the bridge table in this way:

1. RADIUS looks for profiles having the format Bridge-unit_name-num, where unit_name`` is the system name and num is a number in a sequential series, starting with 1.

2. RADIUS loads the data to create the bridging tables.

Example: This example creates two bridging table entries.

    Bridge-Ascend-1 Password="Ascend", User-Service=Dialout-Framed-User

           Ascend-Bridge-Address="2:2:3:10:11:12 Prof1 1.2.3.4 1",

           Ascend-Bridge-Address="2:2:3:13:14:15 Prof2 5.6.7.8 2"

See Also: Ascend-Bridge (230)

## Ascend-Call-Attempt-Limit (123)

Description: Specifies how many unsuccessful dial-in attempts can occur before the MAX blocks further connection attempts.

Usage: Specify an integer. The default is 0 (zero), which disables call blocking.

Example: `Ascend-Call-Attempt-Limit=10`

See Also: Ascend-Call-Block-Duration (124).

## Ascend-Call-Block-Duration (124)

Description: Specifies the period (in seconds) during which the MAX will refuse connection attempts after the Ascend-Call-Attempt-Limit has been reached. When the timer expires, the MAX will accept further dial-in attempts, up to the limit specified by Ascend-Call-Attempt-Limit.

Usage: Specify an integer. The default is 0 (zero).

Example: `Ascend-Call-Block-Duration=60`

Dependencies: For Ascend-Call-Block-Duration to apply, you must set Ascend-Call-Attempt-Limit to a non-zero value.

See Also: Ascend-Call-Attempt-Limit (123).

## Ascend-Call-By-Call (250)

Description: The Ascend-Call-By-Call attribute specifies the T1 PRI service that the MAX uses when placing a PPP call.

Usage: Specify a number corresponding to the type of service the MAX uses. The default value is 6. Table 9-2 lists the services available for each service provider.

Table 9-2. Ascend-Call-By-Call setting

#### Number | #### AT&T | #### Sprint | #### MCI
--- | --- | --- | ---
0 | Disable call-by-call service. | Reserved | N/A
1 | SDN (including GSDN) | Private | VNET/Vision
2 | Megacom 800 | Inwatts | 800
3 | Megacom | Outwatts | PRISM1, PRISM II, WATS
4 | N/A | FX | 900
5 | N/A | Tie Trunk | DAL
6 | ACCUNET Switched Digital Services | N/A | N/A
7 | Long Distance Service (including AT&T World Connect) | N/A | N/A
8 | International 800 (I800) | N/A | N/A
16 | AT&T MultiQuest | N/A | N/A

## Ascend-Call-Filter (243)

Description: The Ascend-Call-Filter attribute defines a call filter.

Unlike the Filter profiles in the MAX configuration interface, RADIUS filters are part of the outgoing or incoming RADIUS user profile. The MAX uses a RADIUS filter only when the MAX places or answers a call with a RADIUS profile that includes the filter specification.

Usage: Filter entries apply on a first-match basis. Therefore, the order in you specify filter entries is significant. If you make changes to a filter in a RADIUS user profile, the changes do not take effect until a call uses that profile.

### IP call filter entries

Use the following format for an IP call filter entry:

    Ascend-Call-Filter="ip dir action

    [dstip dest_ipaddr\subnet_mask][srcip src_ipaddr\subnet_mask]

    [proto [dstport cmp value] [srcport cmp value] [est]]"

Note: A filter definition cannot contain newlines. The syntax appears on multiple lines for printing purposes only.

Table 9-3 describes each element of the syntax.

Table 9-3. IP call filter syntax elements

#### Keyword or argument | #### Description
--- | ---
ip | Indicates an IP filter.
dir | Indicates filter direction. You can specify in (to filter packets coming into the MAX) or out (to filter packets going out of the MAX).
action | Indicates what action the MAX should take with a packet that matches the filter. You can specify either forward`` or drop.
dstip dest_ipaddr | dstip`` is a keyword indicating destination IP address. The filter applies to packets whose destination address matches the value of dest_ipaddr. If a subnet mask portion of the address is present, the MAX compares only the masked bits. If you set dest_ipaddr`` to 0.0.0.0, or if this keyword and its IP address specification are not present, the filter matches all IP packets.
srcip src_ipaddr | srcip`` is a keyword indicating source IP address. The filter applies to packets whose source address matches the value of src_ipaddr. If a subnet mask portion of the address is present, the MAX compares only the masked bits. If you set src_ipaddr`` to 0.0.0.0, or if this keyword and its IP address specification are not present, the filter matches all IP packets.
proto | Indicates a protocol that you can specify as a name or a number. The filter applies to packets whose protocol field matches this value.The supported names and numbers are icmp (1), tcp (6), udp (17), and ospf (89). If you set proto to 0 (zero), the filter matches any protocol.
dstport cmp value | dstport`` is a keyword indicating destination port. This argument is valid only when the protocol is tcp (6) or udp (17). If you do not specify a destination port, the filter matches any port. cmp`` is an argument indicating how to compare the specified value to the actual destination port. It can have the value <, =, >, or !=. value can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
srcport cmp value | srcport`` is a keyword indicating source port. It is valid only when the protocol is tcp (6) or udp (17). If you do not specify a source port, the filter matches any port. cmp`` is an argument indicating how to compare the specified value to the actual source port. It can have the value <, =, >, or !=. value`` can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
est | If you set this argument to 1, the filter matches a packet only if a TCP session is already established. It is valid only when the proto`` specification is tcp (6).

None of the keywords are case sensitive.

#### IPX call filter entries

Use the following format for an IPX call filter entry:

    Ascend-Call-Filter="ipx <dir> <action>

       [srcipxnet <srcipxnet> srcipxnode <srcipxnode>

       [srcipxsoc <cmp> <value> ]]

       [dstipxnet <dstipxnet> dstipxnode <dstipxnode>

       [dstipxsoc <cmp> <value> ]]

Note: A filter definition cannot contain newlines. The syntax is shown on multiple lines for documentation purposes only.

Table 9-8 lists each keyword and argument.

Table 9-4. IPX filter syntax elements

#### Syntax element | #### Description
--- | ---
ipx | Designates an IPX filter.
`<dir>` | Indicates filter direction. You can specify "in" (to filter packets coming into the MAX) or "out" (to filter packets going out of the MAX).
`<action>` | Indicates the action the MAX should take with a packet that matches the filter. You can specify either "forward" or "drop".
srcipxnet | Designates that a source IPX network number appears after this keyword.
<srcipxnet> | Specifies the source IPX network number-the unique internal network number assigned to the NetWare server. You must specify the network number in hexadecimal format. Specifying 0x or 0X is optional.
srcipxnode | Designates that a source IPX node number appears after this keyword.
<srcipxnode> | Specifies the source IPX node number-the node number of the NetWare server. A valid IPX node number must accompany the IPX network number. You must specify the node number in hexadecimal format. Specifying 0x or 0X is optional. The IPX node number 0xffffffffffff is allowed and matches all IPX packets with the same node number.
srcipxsoc | Designates that a source IPX socket number specification appears after this keyword.
`<cmp>` | Indicates how to compare the socket number specified by <value> to the actual socket number in the packet. The <cmp> argument can have the value <, =, >, or !=.
`<value>` | Specifies the socket number of the NetWare server. Following the srcipxsoc keyword, the <value> argument specifies the source socket number; following the dstipxsoc keyword, the <value> argument specifies the destination socket number. You must specify the socket number in hexadecimal format. Specifying 0x or 0X is optional.
dstipxnet | Designates that a destination IPX network number appears after this keyword.
`<dstipxnet>` | Specifies the destination IPX network number-the unique internal network number assigned to the NetWare server. You must specify the network number in hexadecimal format. Specifying 0x or 0X is optional.
dstipxnode | Designates that a destination IPX node number appears after this keyword.
`<dstipxnode>` | Specifies the destination IPX node number-the node number of the NetWare server. A valid IPX node number must accompany the IPX network number. You must specify the node number in hexadecimal format. Specifying 0x or 0X is optional. The IPX node number 0xffffffffffff is allowed and matches all IPX packets with the same node number.
dstipxsoc | Designates that a source IPX socket number specification appears after this keyword.

### Generic call filter entries

Use the following format for a generic call filter entry:

    Ascend-Call-Filter="generic dir action offset mask value
    compare [more]"

Note: A filter definition cannot contain newlines. The syntax appears on multiple lines for printing purposes only.

Table 9-5 describes each element of the syntax. None of the keywords are case sensitive.

Table 9-5. Generic call filter syntax elements

#### Keyword or argument | #### Description
--- | ---
generic | Indicates a generic filter.
dir | Indicates filter direction. You can specify in (to filter packets coming into the MAX) or out (to filter packets going out of the MAX).
action | Indicates what action the MAX should take with a packet that matches the filter. You can specify either forward`` or drop.
offset | Indicates the number of bytes masked from the start of the packet. The byte position specified by offset`` is called the byte-offset. Starting at the position specified by offset, the MAX applies the value of the mask`` argument. A mask hides the part of a number that appears behind the binary zeroes in the mask. For example, if you set mask to ffff0000 in hexadecimal format, the filter uses only the first 16 binary digits in the comparison, since f=1111 in binary format. The unit then compares the unmasked portion of the packet with the value specified by the value`` argument.
mask | Indicates which bits to compare in a segment of the packet. The mask cannot exceed 6 bytes (12 hexadecimal digits). A one-bit in the mask indicates a bit to compare. A zero-bit indicates a bit to ignore. The length of the mask specifies the length of the comparison.
value | Indicates the value to compare to the packet contents at the specified offset in the packet. The length of the value must be the same as the length of the mask. Otherwise, the MAX ignores the filter.
compare | Indicates how the MAX compares a packet's contents to the value specified by value. You can specify == (for Equal) or != (for NotEqual). The default value is Equal.
more | If present, specifies whether the MAX applies the next filter definition in the profile to the current packet before deciding whether to forward or drop the packet. The dir`` and action`` values for the next entry must be the same as the dir`` and action`` values for the current entry. Otherwise, the MAX ignores the more`` flag.

Example: These are examples of IP call filter entries:

    Ascend-Call-Filter="ip in drop"

    Ascend-Call-Filter="ip out forward tcp"

    Ascend-Call-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip
    10.0.200.25/16 dstport!=telnet"

    Ascend-Call-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip
    10.0.200.25/16 icmp"

These are examples of generic call filter entries:

    Ascend-Call-Filter="generic in drop 0 ffff 0080"

    Ascend-Call-Filter="generic in drop 0 ffff != 0080 more"

    Ascend-Call-Filter="generic in drop 16 ff aa"

See Also: Ascend-Data-Filter (242)

## Ascend-Call-Type (177)

Description: The Ascend-Call-Type attribute specifies the type of nailed-up connection in use.

Usage: You can specify one of these values:

- Nailed (1)

  This setting indicates a link that consists entirely of nailed-up channels. Nailed (1) is the default.

- Nailed/Mpp (2)

  This setting indicates a link that consists of both nailed-up and switched channels. The MAX establishes this connection whenever any of its nailed-up or switched channels are linked end-to-end. If a Nailed/Mpp link is down and the nailed-up channels are down, the link cannot re-establish itself until the MAX brings up one or more of the nailed-up channels, or dials one or more switched channels.

  Typically, the MAX dials a call when it receives a packet whose destination is the unit at the remote end of the Nailed/Mpp connection. The packet initiating the switched call must come from the caller side of the connection.

  If a failed channel is in the group specified by the Ascend-Group attribute, the MAX replaces that channel with a switched channel, even if the call is online with more than the minimum number of channels. The MAX replaces failed nailed-up channels with switched channels, regardless of the Min Ch Count setting.

- Perm/Switched (3)

  This setting indicates a permanent switched connection-an outbound call that attempts to remain up at all times. If the unit or central switch resets, or if the link goes down, the permanent switched connection attempts to restore the link at ten-second intervals.

  Use this setting if your telephone company charges for each incoming and outgoing connection attempt, but does not charge for connection time on local calls. Ascend's regular bandwidth-on-demand feature conserves connection time but causes many connection attempts. A permanent switched connection performs the opposite function-it conserves connection attempts but causes a long connection time.

  For the answering device at the remote end of the permanent switched connection, we recommend that you configure the Connection profile to answer calls but not to originate them. If the remote device initiates a call, the MAX simply does not answer it. This situation could result in repeated charges for calls that have no purpose. To keep the remote device from originating calls, set AnsOrig=Ans Only for that device.

Dependencies: The MAX adds or subtracts switched channels on a Nailed/Mpp connection as the settings on either side of the connection require. Each side makes its calculations based on the traffic it receives at that side. If the two sides of the connection disagree on the number of channels needed, the side requesting the greater number prevails.

The DO Hangup command works only from the caller side of the connection when you choose Nailed/Mpp.

## Ascend-Callback (246)

Description: The Ascend-Callback attribute enables or disables callback. Callback occurs when the MAX answers a call and verifies a name and password against a user profile. If
Ascend-Callback=Yes, the MAX hangs up and dials back to the caller using these values:

- The phone number specified by Ascend-Dial-Number

- The password specified by Ascend-Send-Secret or Ascend-Send-Passwd

- Any other relevant attributes in the user profile that authenticated the call

Note: If you set up a RADIUS user profile for callback and CLID-only authentication, the MAX never answers the call. The caller can therefore avoid billing charges.

Usage: You can specify one of these values:

- Callback-No (0)

  This value indicates that the MAX answers in the normal manner after authentication.

- Callback-Yes (1)

  This value indicates that the MAX hangs up and calls back the caller after authentication.

Dependencies: The Ascend-Callback attribute applies only to incoming calls and should not appear in dial-out user profiles (when User-Service=Dialout-Framed-User).

## Ascend-Callback-Delay (108)

Description: Callback is a feature in which Host A calls Host B, Host B disconnects the call, and then dials back to Host A. On switch types in Japan and Germany, the switch holds onto the DISCONNECT message from Host B to Host A. Since the disconnect has not been delivered, the return call is not accepted because Host A still has the connection up. The Ascend-Callback-Delay attribute allows you to specify a time delay until the DISCONNECT message has been delivered and to configure the callback delay on a per connection basis.

Usage: Specify a value from 0 to 60, indicating the number of seconds for the time delay.

Example: Ascend-Callback-Delay=3

## Ascend-Calling-Subaddress (107)

Description: Specifies the ISDN subaddress that the MAX sends to RADIUS during CLID authentication. The value of Ascend-Calling-Subaddress appears in Access-Request and Accounting Start packets.

Usage: Specify a subaddress. The default is null.

See Also: Caller-ID (31).

## Ascend-CBCP-Enable (112)

Description: Specifies how the MAX responds to requests by callers to support CBCP.

Note: Make sure you set CBCP Enable=Yes in the Ethernet > Answer > PPP Options menu.

Usage: Specify one of the following settings:

- CBCP-Enabled (0)-Specifies that the MAX will positively acknowledge, during LCP negotiations, support for CBCP.

- CBCP-Not-Enabled (1)-Specifies that the MAX will reject any request to support CBCP.

See Also: Ascend-CBCP-Mode, Ascend-CBCP-Trunk-Group

## Ascend-CBCP-Mode (113)

Description: Specifies what method of callback the MAX offers the incoming caller.

Note: Make sure you set CBCP Enable=Yes in the Ethernet > Answer > PPP Options menu.

Usage: Specify one of the following values:

- CBCP-No-Callback (1)-Applies for Windows NT or Windows 95 clients who must not be called back. Because CBCP has been negotiated initially, the Windows clients must have validation from the MAX that no callback is used for this connection.

- CBCP-User-Callback (2)-Specifies that the caller will supply the number the MAX uses for the callback.

- CBCP-Profile-Callback (3)-Specifies that the MAX will use the number in Ascend-Dial-Number for the callback

- CBCP-User-Or-No (7)-Specifies that the caller has the option of either supplying the number to dial or specifying that no callback is used for the call. If no callback is chosen, the call will not be disconnected by the MAX.

Dependencies: Ascend-CBCP-Mode applies only if CBCP is successfully negotiated for a connection.

See Also: Ascend-CBCP-Enable, Ascend-CBCP-Trunk-Group

## Ascend-CBCP-Trunk-Group (115)

Description: Assigns the callback to a MAX trunk group. This attribute is used only when the caller is specifying the phone number the MAX uses for the callback. The value in Ascend-CBCP-Trunk-Group is prepended to the caller-supplied number when the MAX calls back.

Note: Make sure you set CBCP Enable=Yes in the Ethernet > Answer > PPP Options menu.

Usage: You can specify a number between 4 and 9, inclusive. The default is 9.

Dependencies: Ascend-CBCP-Trunk-Group applies only if CBCP is negotiated for a connection.

See Also: Ascend-CBCP-Enable, Ascend-CBCP-Mode

## Ascend-Client-Gateway (132)

Description: The Ascend-Client-Gateway attribute specifies the default route for IP packets coming from the user on this connection.

Usage: Specify the IP address of the next hop router in dotted decimal notation. The default value is 0.0.0.0. If you accept this value, the Ascend unit routes packets as specified in the routing table, using the system-wide default route if it cannot find a more specific route.

The Ascend unit must have a direct route to the address you specify. The direct route can take place via a profile or an Ethernet connection. If the Ascend unit does not have a direct route, it drops the packets on the connection. When you diagnose routing problems with a profile using this feature, an error in a per-user gateway address is not apparent from inspection of the global routing table.

Example: If you specify Ascend-Client-Gateway=10.0.0.3 in the RADIUS user profile
Berkeley, IP packets from the user with destinations through the default route goes through the router at 10.0.0.3.

## Ascend-Connect-Progress (196)

Description: The Ascend-Connect-Progress attribute specifies the state of the connection before it disconnects.

The MAX includes Ascend-Connect-Progress in an Accounting-Request packet when both of these conditions are true:

- The session has ended or has failed to authenticate (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Connect-Progress can have any one of values specified in Table 9-6

Table 9-6. Ascend-Connect-Progress codes

#### Code | #### Explanation
--- | ---
0 | No progress.
1 | Not applicable.
2 | The progress of the call is unknown.
10 | The call is up.
30 | The modem is up.
31 | The modem is waiting for DCD.
32 | The modem is waiting for result codes.
40 | The terminal server session has started up.
41 | The MAX is establishing the TCP connection.
42 | The MAX is establishing the immediate Telnet connection.
43 | The MAX has established a raw TCP session with the host. This code does not imply that the user has logged into the host.
44 | The MAX has established an immediate Telnet connection with the host. This code does not imply that the user has logged into the host.
45 | The MAX is establishing an Rlogin session.
46 | The MAX has established an Rlogin session with the host. This code does not imply that the user has logged into the host.
60 | The LAN session is up.
61 | LCP negotiations are allowed.
62 | CCP negotiations are allowed.
63 | IPNCP negotiations are allowed.
64 | Bridging NCP negotiations are allowed.
65 | LCP is in the Open state.
66 | CCP is in the Open state.
67 | IPNCP is in the Open state.
68 | Bridging NCP is in the Open state.
69 | LCP is in the Initial state.
70 | LCP is in the Starting state.
71 | LCP is in the Closed state.
72 | LCP is in the Stopped state.
73 | LCP is in the Closing state.
74 | LCP is in the Stopping state.
75 | LCP is in the Request Sent state.
76 | LCP is in the ACK Received state.
77 | LCP is in the ACK Sent state.
80 | IPXNCP is in the Open state.
90 | V.110 is up.
91 | V.110 is in the Open state.
92 | V.110 is in the Carrier state.
93 | V.110 is in the Reset state.
94 | V.110 is in the Closed state.

.

## Ascend-Data-Filter (242)

Description: The Ascend-Data-Filter attribute defines a data filter.

Unlike the Filter profiles in the MAX configuration interface, RADIUS filters are part of the outgoing or incoming RADIUS user profile. The MAX uses a RADIUS filter only when the MAX places or answers a call with a RADIUS profile that includes the filter specification.

Usage: Filter entries apply on a first-match basis. Therefore, the order in you specify filter entries is significant. If you make changes to a filter in a RADIUS user profile, the changes do not take effect until a call uses that profile.

### IP data filter entries

Use the following format for an IP data filter entry:

    Ascend-Data-Filter="ip dir action

    [dstip dest_ipaddr\subnet_mask][srcip src_ipaddr\subnet_mask]

    [proto [dstport cmp value] [srcport cmp value] [est]]"

Note: A filter definition cannot contain newlines. The syntax appears on multiple lines for printing purposes only.

Table 9-7 describes each element of the syntax.

Table 9-7. IP data filter syntax elements

#### Keyword or argument | #### Description
--- | ---
ip | Indicates an IP filter.
dir | Indicates filter direction. You can specify in (to filter packets coming into the MAX) or out (to filter packets going out of the MAX).
action | Indicates what action the MAX should take with a packet that matches the filter. You can specify either forward`` or drop.
dstip dest_ipaddr | dstip`` is a keyword indicating destination IP address. The filter applies to packets whose destination address matches the value of dest_ipaddr. If a subnet mask portion of the address is present, the MAX compares only the masked bits. If you set dest_ipaddr`` to 0.0.0.0, or if this keyword and its IP address specification are not present, the filter matches all IP packets.
srcip src_ipaddr | srcip`` is a keyword indicating source IP address. The filter applies to packets whose source address matches the value of src_ipaddr. If a subnet mask portion of the address is present, the MAX compares only the masked bits. If you set src_ipaddr`` to 0.0.0.0, or if this keyword and its IP address specification are not present, the filter matches all IP packets.
proto | Indicates a protocol that you can specify as a name or a number. The filter applies to packets whose protocol field matches this value.The supported names and numbers are icmp (1), tcp (6), udp (17), and ospf (89). If you set proto to 0 (zero), the filter matches any protocol.
dstport cmp value | dstport`` is a keyword indicating destination port. This argument is valid only when the protocol is tcp (6) or udp (17). If you do not specify a destination port, the filter matches any port. cmp`` is an argument indicating how to compare the specified value to the actual destination port. It can have the value <, =, >, or !=. value can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
srcport cmp value | srcport`` is a keyword indicating source port. It is valid only when the protocol is tcp (6) or udp (17). If you do not specify a source port, the filter matches any port. cmp`` is an argument indicating how to compare the specified value to the actual source port. It can have the value <, =, >, or !=. value`` can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
est | If you set this argument to 1, the filter matches a packet only if a TCP session is already established. It is valid only when the proto`` specification is tcp (6).

None of the keywords are case sensitive.

### IPX data filter entries

Use the following format for an IPX data filter entry:

    Ascend-Data-Filter="ipx <dir> <action>

       [srcipxnet <srcipxnet> srcipxnode <srcipxnode>

       [srcipxsoc <cmp> <value> ]]

       [dstipxnet <dstipxnet> dstipxnode <dstipxnode>

       [dstipxsoc <cmp> <value> ]]

Note: A filter definition cannot contain newlines. The syntax is shown on multiple lines for documentation purposes only.

Table 9-8 lists each keyword and argument.

Table 9-8. IPX filter syntax elements

#### Syntax element | #### Description
--- | ---
ipx | Designates an IPX filter.
`<dir>` | Indicates filter direction. You can specify "in" (to filter packets coming into the MAX) or "out" (to filter packets going out of the MAX).
`<action>` | Indicates the action the MAX should take with a packet that matches the filter. You can specify either "forward" or "drop".
srcipxnet | Designates that a source IPX network number appears after this keyword.
<srcipxnet> | Specifies the source IPX network number-the unique internal network number assigned to the NetWare server. You must specify the network number in hexadecimal format. Specifying 0x or 0X is optional.
srcipxnode | Designates that a source IPX node number appears after this keyword.
<srcipxnode> | Specifies the source IPX node number-the node number of the NetWare server. A valid IPX node number must accompany the IPX network number. You must specify the node number in hexadecimal format. Specifying 0x or 0X is optional. The IPX node number 0xffffffffffff is allowed and matches all IPX packets with the same node number.
srcipxsoc | Designates that a source IPX socket number specification appears after this keyword.
`<cmp>` | Indicates how to compare the socket number specified by <value> to the actual socket number in the packet. The <cmp> argument can have the value <, =, >, or !=.
`<value>` | Specifies the socket number of the NetWare server. Following the srcipxsoc keyword, the <value> argument specifies the source socket number; following the dstipxsoc keyword, the <value> argument specifies the destination socket number. You must specify the socket number in hexadecimal format. Specifying 0x or 0X is optional.
dstipxnet | Designates that a destination IPX network number appears after this keyword.
`<dstipxnet>` | Specifies the destination IPX network number-the unique internal network number assigned to the NetWare server. You must specify the network number in hexadecimal format. Specifying 0x or 0X is optional.
dstipxnode | Designates that a destination IPX node number appears after this keyword.
`<dstipxnode>` | Specifies the destination IPX node number-the node number of the NetWare server. A valid IPX node number must accompany the IPX network number. You must specify the node number in hexadecimal format. Specifying 0x or 0X is optional. The IPX node number 0xffffffffffff is allowed and matches all IPX packets with the same node number.
dstipxsoc | Designates that a source IPX socket number specification appears after this keyword.

### Generic data filter entries

Use the following format for a generic data filter entry:

    Ascend-Data-Filter="generic dir action offset mask value
    compare [more]"

Note: A filter definition cannot contain newlines. The syntax appears on multiple lines for printing purposes only.

Table 9-9 describes each element of the syntax. None of the keywords are case sensitive.

Table 9-9. Generic data filter syntax elements

#### Keyword or argument | #### Description
--- | ---
generic | Indicates a generic filter.
dir | Indicates filter direction. You can specify in (to filter packets coming into the MAX) or out (to filter packets going out of the MAX).
action | Indicates what action the MAX should take with a packet that matches the filter. You can specify either forward`` or drop.
offset | Indicates the number of bytes masked from the start of the packet. The byte position specified by offset`` is called the byte-offset. Starting at the position specified by offset, the MAX applies the value of the mask`` argument. A mask hides the part of a number that appears behind the binary zeroes in the mask. For example, if you set mask to ffff0000 in hexadecimal format, the filter uses only the first 16 binary digits in the comparison, since f=1111 in binary format. The unit then compares the unmasked portion of the packet with the value specified by the value`` argument.
mask | Indicates which bits to compare in a segment of the packet. The mask cannot exceed 6 bytes (12 hexadecimal digits). A one-bit in the mask indicates a bit to compare. A zero-bit indicates a bit to ignore. The length of the mask specifies the length of the comparison.
value | Indicates the value to compare to the packet contents at the specified offset in the packet. The length of the value must be the same as the length of the mask. Otherwise, the MAX ignores the filter.
compare | Indicates how the MAX compares a packet's contents to the value specified by value. You can specify == (for Equal) or != (for NotEqual). The default value is Equal.
more | If present, specifies whether the MAX applies the next filter definition in the profile to the current packet before deciding whether to forward or drop the packet. The dir`` and action`` values for the next entry must be the same as the dir`` and action`` values for the current entry. Otherwise, the MAX ignores the more`` flag.

Example: These are examples of IP data filter entries:

    Ascend-Data-Filter="ip in drop"

    Ascend-Data-Filter="ip out forward tcp"

    Ascend-Data-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip
    10.0.200.25/16 dstport!=telnet"

    Ascend-Data-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip
    10.0.200.25/16 icmp"

These are examples of generic data filter entries:

    Ascend-Data-Filter="generic in drop 0 ffff 0080"

    Ascend-Data-Filter="generic in drop 0 ffff != 0080 more"

    Ascend-Data-Filter="generic in drop 16 ff aa"

See Also: Ascend-Call-Filter (243)

## Ascend-Data-Rate (197)

Description: The Ascend-Data-Rate attribute specifies the receive baud rate of the connection in bits per second.

The MAX includes Ascend-Data-Rate in an Accounting-Request packet when both of these conditions are true:

- The session has ended or has failed to authenticate (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Data-Rate does not appear in a user profile. Its default value is 0 (zero).

## Ascend-Data-Svc (247)

Description: The Ascend-Data-Svc attribute specifies the type of data service the link uses for outgoing calls.

Usage: The data service you specify must be available end-to-end. You can set the Ascend-Data-Svc attribute to one of the values listed in

Table 9-10. Ascend-Data-Svc settings

#### Setting | #### Description
--- | ---
Switched-Voice-Bearer (0) | This value applies only to calls made over an ISDN BRI or T1 PRI line. When you specify this setting, the MAX enables the network to place an end-to-end digital voice call for transporting data when a switched data service is not available.
Switched-56KR (1) | The call contains restricted data, guaranteeing that the data the MAX transmits meets the density restrictions of D4-framed T1 lines. D4 specifies the D4 format, also known as the Superframe format, for framing data at the physical layer. This format consists of 12 consecutive frames, separated by framing bits. The call connects to the Switched-56 data service. The only services available to lines using inband signaling (T1 access lines containing one or more switched channels, and Switched-56 lines) are Switched-56K and Switched-56KR.
Switched-64K (2) | The call contains any type of data and connects to the Switched-64 data service.
Switched-64KR (3) | The call contains restricted data and connects to the Switched-64 data service.
Switched-56K (4) | The call contains any type of data and connects to the Switched-56 data service. The only services available to lines using inband signaling (T1 access lines containing one or more switched channels, and Switched-56 lines) are Switched-56K and Switched- 56KR. For most T1 PRI lines, select Switched-56K.
Nailed-56KR (1) | The call contains restricted data and connects to the Nailed-56 data service.
Nailed-64K (2) | The call contains any type of data and connects to the Nailed-64 data service.
Switched-384KR | The call contains restricted data, and connects to MultiRate or GloBanD data services at 384 kbps.
Switched-384K | The call contains any type of data and connects to the Switched-384 data service. This AT&T data service does not require MultiRate or GloBanD.
Switched-1536K | The call contains any type of data and connects to the Switched-1536 data service at 1536 kbps. This setting is valid only for a MAX that supports ISDN D-channel signaling, and that connects to two or more T1 PRI lines using Non-Facility Associated Signaling (NFAS).
Switched-1536KR | The call contains restricted data, and connects to the Switched-1536 data service at 1536 kbps. This setting is valid only for a MAX that supports ISDN D-channel signaling, and that connects to two or more T1 PRI lines using Non-Facility Associated Signaling (NFAS).
Switched-128K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-192K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-256K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-320K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-384K-MR | This value is available on a T1 PRI line with the MultiRate data service.
Switched-448K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-512K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-576K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-640K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-704K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-768K | This value is available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-832K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-896K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-960K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1024K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1088K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1152K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1216K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1280K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1344K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1408K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1472K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1600K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1664K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1728K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1792K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1856K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-1920K | This value is available on a T1 PRI line with MultiRate or GloBanD data
Switched-inherited | This setting applies to calls placed by a device connected to a local ISDN BRI line supplied by a Host/BRI module. The call connects with the data service as requested by the caller on the local ISDN BRI line.
Switched-restricted-bearer-x30 | This setting specifies the 56-kbps X.30 switched data service available from DPNSS and DASS 2 switches.
Switched-clear-bearer-v110 | This setting specifies the 64-kbps V.110 switched data service available from DPNSS and DASS 2 switches.
Switched-restricted-64-x30 | This setting specifies the 64-kbps X.30 switched data service available from DPNSS and DASS 2 switches. For most DASS 2 and DPNSS installations, select Switched-restricted-64-x30.
Switched-clear-56-v110 | This setting specifies the 56-kbps V.110 switched data service available from DPNSS and DASS 2 switches.
Switched-modem | This setting places an outgoing call on any available digital modem. If no digital modems are available, the MAX does not place the call. The data rate depends upon the quality of the connections between modems and the types of modems in use. The Switched-modem setting requires that your MAX have digital modems. Modem applies only for PPP, MP+, and X.25/PAD calls. Currently, the MAX does not support multichannel modem calls. When you need to set up a dial-out profile in RADIUS for the MAX 4000, MAX 2000, MAX 1800, or Pipeline 400, set Ascend-Data-Svc=Switched-modem.
Switched-atmodem | This setting applies only to the MAX 200 and is equivalent to

Table 9-10.

Dependencies: Keep this additional information in mind:

- You can determine the base bandwidth of a call by multiplying the value of the Ascend-Base-Channel-Count attribute by the value of the Ascend-Data-Svc attribute.

- Either party can request a data service that is unavailable.

  In this case, the MAX cannot connect the call.

## Ascend-DBA-Monitor (171)

Description: The Ascend-DBA-Monitor attribute specifies how the Ascend calling unit monitors the traffic on an MP+ call. The Ascend unit can use this information to add or subtract bandwidth as necessary.

Usage: You can specify one of these values:

- DBA-Transmit (0)

  This setting indicates that the MAX adds or subtracts bandwidth based on the amount of data it transmits.

  DBA-Transmit is the default.

- DBA-Transmit-Recv (1)

  This setting indicates that the MAX adds or subtracts bandwidth based on the amount of data it transmits and receives.

- DBA-None (2)

  This setting indicates that the MAX does not monitor traffic over the link.

Dependencies: Keep this additional information in mind:

- The MAX supports Ascend-DBA-Monitor only on MP+ calls.

- If both sides of the link have Ascend-DBA-Monitor set to DBA-None, Dynamic Bandwidth Allocation is disabled.

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-Dec-Channel-Count (237)

Description: The Ascend-Dec-Channel-Count attribute specifies the number of channels the MAX removes when bandwidth changes either manually or automatically during a call.

Usage: Specify a number between 1 and 32. The default value is 1.

Dependencies: Keep this additional information in mind:

- Ascend-Dec-Channel-Count does not apply if all channels of a link are nailed up
  (Ascend-Call-Type=Nailed).

- Ascend-Dec-Channel-Count applies only when the link is using MP+ encapsulation (Framed-Protocol=MPP).

- You cannot clear a call by decrementing channels.

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-DHCP-Maximum-Leases

Description: The Ascend-DHCP-Maximum-Leases attribute specifies the maximum number of dynamic addresses the MAX can assign to Network Address Translation (NAT) for LAN clients using this connection.

Usage: Specify a value between 1 and 254. The default is 4.

See Also: Ascend-DHCP-Pool-Number (148)
Ascend-DHCP-Reply (147)

## Ascend-DHCP-Pool-Number (148)

Description: The Ascend-DHCP-Pool-Number attribute indicates the address pool from which the MAX assigns a dynamic IP address to the Dynamic Host Configuration Protocol (DHCP) client.

Usage: Specify an integer between 1 and the number of address pools defined on the MAX. The default value is 0 (zero), which specifies that the MAX uses the first defined IP address pool.

Dependencies: When the DHCP client requests an address, the MAX allocates an IP address from one of its IP address pools and assigns it to the client for 30 minutes. The client must renew the IP address assignment after the 30-minute period expires.

In its local memory, the MAX keeps track of all the IP addresses it has assigned. Therefore, it loses the entries for current, unexpired IP address assignments when you reset it. If a client holds an unexpired IP address assignment when you reset the MAX, the MAX may assign the same address to a new client. These duplicate IP addresses cause network problems until the first assignment expires or one of the clients reboots.

See Also: Ascend-DHCP-Maximum-Leases
Ascend-DHCP-Reply (147)

## Ascend-DHCP-Reply (147)

Description: The Ascend-DHCP-Reply attribute specifies whether the MAX processes DHCP packets and acts as a DHCP server on this connection.

Usage: You can specify one of these settings:

- DHCP-Reply-Yes indicates that the MAX processes DHCP packets.

  - For a bridged connection, the MAX responds to all DHCP requests.

  - For a non-bridged connection, the MAX responds only to Network Address Translation (NAT) for LAN DHCP packets.

- DHCP-Reply-No indicates that the MAX does not process DHCP packets, but routes or bridges DHCP packets as any other packet.

  The default value is DHCP-Reply-No.

See Also: Ascend-DHCP-Maximum-Leases
Ascend-DHCP-Pool-Number (148)

## Ascend-Dialout-Allowed (131)

Description: The Ascend-Dialout-Allowed attribute specifies whether the user associated with an outgoing RADIUS user profile can dial out using one of the MAX unit's digital modems.

Usage: You can specify one of these settings:

- Dialout-Not-Allowed (0) indicates that the RADIUS user profile does not allow modem dialout.

  The default value is Dialout-Not Allowed.

- Dialout-Allowed (1) indicates that the RADIUS user profile allows modem dialout.

## Ascend-Dial-Number (227)

Description: The Ascend-Dial-Number attribute specifies the phone number the MAX dials to reach the bridge, router, or node at the remote end of the link.

Usage: Specify a telephone number. You can enter up to 21 characters, and you must limit those characters to the following:

    1234567890()[]!z-*#|

The MAX sends only the numeric characters to place a call. The default value is null.

If Use Trunk Grps=Yes in the System\>Sys Config menu, the first digits in the Ascend-Dial-Number attribute have the meanings listed in Table 9-11.

Table 9-11. Ascend-Dial-Number digits

#### Digit

#### Explanation

First digit is between 4 and 9.

The MAX places the call over the corresponding trunk group listed in the Ch n Trnk Grp, B1 Trnk Grp, or B2 Trnk Grp parameters in the Line profile.

If Dial Plan=Trunk Grp, the digits following the first digit constitute an ordinary phone number.

If Dial Plan=Extended, the next two digits specify the Dial Plan profile containing the parameters the MAX uses when making the call. These parameters constitute the extended dial plan. An ordinary phone number follows these two digits.

First digit is 3.

The MAX places the call to a destination listed in a Destination profile. In this case, the second and third digits indicate the number of the Destination profile.

First digit is 2.

The MAX places the call between host ports on the same MAX, or between Terminal Equipment (TEs) on a local ISDN BRI line on the same MAX. The first type of call is a port-to-port call. The latter type of call is a TE-to-TE call. In a port-to-port call, the second digit indicates the slot of an AIM/6 module. In a TE-to-TE call, the second digit indicates the slot of a Host/BRI module.

If you enter 0 (zero) for the second digit, the call connects to any available AIM port and ignores the third digit. If you enter a nonzero value for the second digit, the third digit selects the AIM port (for a port-to-port call) or a local ISDN BRI port (for a TE-to-TE call).

If you enter 0 (zero) for the third digit, the call connects to any available AIM port or local ISDN BRI line in the module selected by the second digit.

## Ascend-Disconnect-Cause (195)

Description: The Ascend-Disconnect-Cause attribute specifies the reason a connection was taken offline.

The MAX includes Ascend-Disconnect-Cause in an Accounting-Request packet when both of these conditions are true:

- The session has ended or has failed to authenticate (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Disconnect-Cause can return any of the values listed in Table 9-12.

Table 9-12. Ascend-Disconnect-Cause codes

#### Code | #### Description
--- | ---
0 | No reason.
1 | The event was not a disconnect.
2 | The reason for the disconnect is unknown. This code can appear when the remote connection goes down.
3 | The call has disconnected.
4 | CLID authentication has failed.
These codes can appear if a disconnect occurs during the initial modem connection.
10 | The modem never detected DCD.
11 | The modem detected DCD, but became inactive.
12 | The result codes could not be parsed.
These codes are related to immediate Telnet and raw TCP disconnects during a terminal server session.
20 | The user exited normally from the terminal server.
21 | The user exited from the terminal server because the idle timer expired.
22 | The user exited normally from a Telnet session.
23 | The user could not switch to SLIP or PPP because the remote host had no IP address or because the dynamic pool could not assign one.
24 | The user exited normally from a raw TCP session.
25 | The login process ended because the user failed to enter a correct password after three attempts.
26 | The raw TCP option is not enabled.
27 | The login process ended because the user typed Ctrl-C.
28 | The terminal server session has ended.
29 | The user closed the virtual connection
30 | The virtual connection has ended.
31 | The user exited normally from an Rlogin session
32 | The user selected an invalid Rlogin option.
33 | The MAX has insufficient resources for the terminal server session.
These codes concern PPP connections.
40 | PPP LCP negotiation timed out while waiting for a response from a peer.
41 | There was a failure to converge on PPP LCP negotiations.
42 | PPP PAP authentication failed.
43 | PPP CHAP authentication failed.
44 | Authentication failed from the remote server.
45 | The peer sent a PPP Terminate Request.
46 | LCP got a close request from the upper layer while LCP was in an open state.
47 | LCP closed because no NCPs were open.
48 | LCP closed because it could not determine to which MP bundle it should add the user.
49 | LCP closed because the MAX could not add any more channels to an MP session.
These codes are related to immediate Telnet and raw TCP disconnects, and contain more specific information than the Telnet and TCP codes listed earlier in this table.
50 | The Raw TCP or Telnet internal session tables are full.
51 | Internal resources are full.
52 | The IP address for the Telnet host is invalid.
53 | The MAX could not resolve the hostname.
54 | The MAX detected a bad or missing port number.
The TCP stack can return these disconnect codes during an immediate Telnet or raw TCP session.
60 | The host reset the TCP connection.
61 | The host refused the TCP connection.
62 | The TCP connection timed out.
63 | A foreign host closed the TCP connection.
64 | The TCP network was unreachable.
65 | The TCP host was unreachable.
66 | The TCP network was administratively unreachable.
67 | The TCP host was administratively unreachable.
68 | The TCP port was unreachable.
These are additional disconnect codes.
100 | The session timed out because there was no activity on a PPP link.
101 | The session failed for security reasons.
102 | The session ended for callback.
120 | One end refused the call because the protocol was disabled or unsupported.
150 | RADIUS requested the disconnect.
160 | The allowed retries for V.110 synchronization have been exceeded.
170 | PPP authentication has timed out.
180 | The call disconnected as the result of a local hangup.
185 | The call disconnected because the remote end hung up.
190 | The call disconnected because the T1 line that carried it was quiesced.
195 | The call disconnected because the call duration exceeded the maximum amount of time allowed by the Max Call Mins or Max DS0 Mins parameter on the MAX.

## Ascend-Dsl-CIR-Recv-Limit (100)

Description: Specifies the maximum data rate (in k-bits per second) to be received across the connection. You can use this setting to limit bandwidth for a connection according to the rate charged for the account.

Usage: Specify a number from 0 to 64000. The default is 0 (zero), which disables the data-rate limit feature. If the value you specify is larger than the actual bandwidth provided by the line, the connection behaves as though the data rate limit were disabled, except that additional computations are performed unnecessarily.

Dependencies: The system activates configurable receive data-rate limits only for connections that use CAP-RADSL, SDSL, and unchannelized DS3 cards. If you specify a value for a connection that does not use these cards, the system ignores the settings.

See Also: Ascend-Dsl-CIR-Recv-Limit (100).

## Ascend-Dsl-CIR-Xmit-Limit (101)

Description: Specifies the maximum data rate (in k-bits per second) to be transmitted across the connection. You can use this setting to limit bandwidth for a connection according to the rate charged for the account.

Usage: Specify a number from 0 to 64000. The default is 0 (zero), which disables the data-rate limit feature. If the value you specify is larger than the actual bandwidth provided by the line, the connection behaves as though the data rate limit were disabled, except that additional computations are performed unnecessarily.

Dependencies: The system activates configurable transmit data-rate limits only for connections that use CAP-RADSL, SDSL, and unchannelized DS3 cards. If you specify a value for a connection that does not use these cards, the system ignores the settings.

See Also: Ascend-Dsl-CIR-Xmit-Limit (101).

## Ascend-Event-Type (150)

Description: The Ascend-Event-Type attribute indicates a coldstart notification, informing the accounting server that the MAX has started up, or a session event, informing the authentication server that a session has begun.

In a coldstart notification, the MAX sends values for NAS-Identifier, Ascend-Event-Type, and Ascend-Number-Sessions in an Ascend-Event-Request packet (code 33). The RADIUS accounting server must send back an Ascend-Event-Response packet (code 34) with the correct identifier to the MAX.

In a session event, the MAX sends values for Password, NAS-Identifier, Ascend-Event-Type, and Ascend-Number-Sessions in an Ascend-Event-Request packet (code 33) when Auth=RADIUS/LOGOUT in Ethernet > Mod Config > Auth. The authentication server must send back an Ascend-Event-Response packet (code 34) with the correct identifier to the MAX.

Usage: For a coldstart notification, Ascend-Event-Type=Ascend-Coldstart (1). For a session event, Ascend-Event-Type=Ascend-Session-Event (2)

See Also: Ascend-Number-Sessions (202)
NAS-Identifier (4)

## Ascend-Expect-Callback (149)

Description: The Ascend-Expect-Callback attribute specifies whether a user dialing out should expect the remote end to call back.

When the remote device is set to call back (Ascend-Callback=Callback-Yes or Callback=Yes) and CLID authentication is not required, the remote device answers the call, verifies a name and password against a user profile, hangs up, and dials back to the caller using these values:

- The phone number specified by Ascend-Dial-Number

- The password specified by Ascend-Send-Secret or Ascend-Send-Passwd

- Any other relevant attributes in the user profile that authenticated the call

If the remote RADIUS user profile is set up for callback, and the remote unit requires CLID-only authentication (Id Auth=Require), the remote device never answers the call. The caller can therefore avoid billing charges. However, a problem can also occur. To the caller, it appears as though the call never got through at all. This is a special problem for Ping and Telnet, because these processes continuously try to open a connection and reject any callback.

When you set Ascend-Expect-Callback=Expect-Callback-Yes, calls that dial out and do not connect (for any reason) appear on a list that disallows any further calls to that destination for 90 seconds. This delay gives the remote device an opportunity to complete the callback.

Usage: You can specify one of these values:

- Expect-Callback-No (0) indicates that the caller does not wait for a callback after placing a call that does not connect.

- Expect-Callback-Yes (1) indicates that the caller waits 90 seconds after placing a call that does not connect before attempting to place another call to the same number.

See Also: Ascend-Callback (246)

## Ascend-First-Dest (189)

Description: The Ascend-First-Dest attribute records the destination IP address of the first packet the MAX receives on a link after RADIUS authenticates the connection.

The MAX includes Ascend-First-Dest in an Accounting-Request packet when all of these conditions are true:

- The session has been authenticated.

- The session has ended (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-First-Dest does not appear in a user profile and has no default value.

Dependencies: This attribute only applies if the session routes IP.

## Ascend-Force-56 (248)

Description: The Ascend-Force-56 attribute specifies whether the MAX uses only the 56-kbps portion of a channel, even when all 64 kbps appear to be available:

Usage: You can specify one of these values:

- Force-56-No

  This setting indicates that the MAX should use the entire 64 kbps (when available). Force-56-No is the default.

- Force-56-Yes

  This setting specifies that the MAX should use only the 56-kbps portion of a channel.

  Set Ascend-Force-56=Force=56-Yes when you place calls to European or Pacific Rim countries from within North America and the complete path cannot distinguish between the Switched-56 and Switched-64 data services. This feature is not required if you are placing calls only within North America.

## Ascend-FR-Circuit-Name (156)

Description: The Ascend-FR-Circuit-Name attribute specifies the Permanent Virtual Connection (PVC) for which the user profile is an endpoint. A circuit specification defines two DLCI endpoints of a PVC, with one endpoint specified in each RADIUS user profile or Connection profile.

Usage: Specify a text string containing up to 15 characters. The default value is null.

Dependencies: Keep this additional information in mind:

- You can specify Ascend-FR-Circuit-Name only when Framed-Protocol=FR-CIR.

- The MAX requires two profiles for a single PVC.

  You can use two RADIUS user profiles, two Connection profiles, or one RADIUS user profile and one Connection profile. The two DLCIs can use the same Frame Relay profile or different ones.

- The MAX switches pairs of links with matching Ascend-FR-Circuit-Name attributes to each other.

  Therefore, make sure that you specify the exact same name for Ascend-FR-Circuit-Name (in RADIUS) or Circuit (in a Connection profile) for the profiles that supply the endpoints of the PVC.

See Also: Ascend-FR-Direct (219)

## Ascend-FR-DCE-N392 (162)

Description: The Ascend-FR-DCE-N392 attribute specifies the number of errors during Ascend-FR-DCE-N393-monitored events that cause the network side to declare the user side's procedures inactive.

Usage: Specify an integer between 1 and 10. The default value is 3.

Dependencies: Keep this additional information in mind:

- Set Ascend-FR-DCE-N392 to a value less than Ascend-FR-DCE-N393.

- Ascend-FR-DCE-N392 does not apply if Ascend-FR-Type=Ascend-FR-DTE.

See Also: Ascend-FR-DCE-N393 (164)
Ascend-FR-Type (159)

## Ascend-FR-DCE-N393 (164)

Description: The Ascend-FR-DCE-N393 attribute indicates the DCE-monitored event count. The MAX always considers a link active if the value of Ascend-FR-DCE-N393 is not reached.

Usage: Specify a number between 1 and 10. The default value is 4.

Dependencies: This attribute does not apply if Ascend-FR-Type=Ascend-FR-DTE.

See Also: Ascend-FR-Type (159)

## Ascend-FR-Direct (219)

Description: The Ascend-FR-Direct attribute specifies whether the MAX uses a redirect connection for Frame Relay packets.

When the MAX receives IP packets from a caller that has a redirect specified in its local Connection profile or RADIUS user profile, it simply forwards the data stream out to the Frame Relay switch using the specified DLCI, effectively passing on the responsibility of routing those packets to a later hop on the Frame Relay network. The MAX never examines the destination address of redirect packets. This feature enables you to accept traffic from one link and send all traffic to a predetermined destination, eliminating any user concerns over security.

Usage: You can specify one of these values:

- FR-Direct-No (0) indicates that the MAX does not use a redirect connection.

  FR-Direct-No is the default.

- FR-Direct-Yes (1) indicates that the MAX uses a redirect connection.

See Also: Ascend-FR-Direct-DLCI (221)
Ascend-FR-DLCI (179)

## Ascend-FR-Direct-DLCI (221)

Description: The Ascend-FR-Direct-DLCI attribute specifies the Data Link Connection Indicator (DLCI) for the user profile in a Frame Relay redirect connection. The DLCI identifies the user profile to the Frame Relay switch as a logical link on a physical circuit.

Usage: Specify an integer between 16 and 991. The default value is 16. Many redirect connections can use the same DLCI.

Dependencies: Ascend-FR-Direct-DLCI applies only if Ascend-FR-Direct=FR-Direct-Yes.

Example: This portion of a user profile shows a redirect connection that uses DLCI 21 and the Frame Relay profile called Montgomery.

    Permconn-MAX-1 Password="Ascend", User-Service=Dialout-Framed-User

            User-Name="Matt",

            Ascend-FR-Direct=FR-Direct-Yes,

            Ascend-FR-Direct-Profile="Montgomery",

            Ascend-FR-Direct-DLCI=21,

            Metric=2,

            ...

See Also: Ascend-FR-Direct (219)
Ascend-FR-Direct-Profile (220)

## Ascend-FR-Direct-Profile (220)

Description: The Ascend-FR-Direct-Profile attribute specifies the name of the Frame Relay profile that carries the redirect connection.

Usage: Indicate the name of a Frame Relay profile that connects to the Frame Relay switch handling the Data Link Connection Indicator (DLCI) specified by Ascend-FR-Direct-DLCI. You can specify up to 15 alphanumeric characters. The default value is null. Make sure that you enter the name exactly as it appears in the Name parameter of the Frame Relay profile.

Dependencies: Ascend-FR-Direct-Profile applies only if Ascend-FR-Direct=FR-Direct-Yes.

Example: This portion of a user profile shows a redirect connection that uses DLCI 21 and the Frame Relay profile called Montgomery.

    Permconn-MAX-1 Password="Ascend", User-Service=Dialout-Framed-User

            User-Name="Matt",

            Ascend-FR-Direct=FR-Direct-Yes,

            Ascend-FR-Direct-Profile="Montgomery",

            Ascend-FR-Direct-DLCI=21,

            Metric=2,

            ...

See Also: Ascend-FR-Direct (219)
Ascend-FR-Direct-DLCI (221)

## Ascend-FR-DLCI (179)

Description: The Ascend-FR-DLCI attribute specifies the Data Link Connection Indicator (DLCI) for the user profile in a Frame Relay gateway connection. The DLCI identifies the user profile to the Frame Relay switch as a logical link on a physical circuit.

Usage: Specify an integer between 16 and 991. The default value is 16. You must assign each gateway connection its own DLCI.

Dependencies: Ascend-FR-DLCI applies only if Ascend-FR-Direct=FR-Direct-No.

Example: This portion of a user profile shows a gateway connection that uses DLCI 21 and the Frame Relay profile called Florence.

    Permconn-MAX-1 Password="Ascend", User-Service=Dialout-Framed-User

            User-Name="Matt",

    Ascend-FR-Direct=FR-Direct-No,

    Ascend-FR-Profile-Name="Florence",

    Ascend-FR-DLCI=21,

    Metric=2,

    ...

See Also: Ascend-FR-Direct (219)
Ascend-FR-Profile-Name (180)

## Ascend-FR-DTE-N392 (163)

Description: The Ascend-FR-DTE-N392 attribute specifies the number of errors during Ascend-FR-DTE-N393-monitored events that cause the user side to declare the network side's procedures inactive.

Usage: Specify an integer between 1 and 10. The default value is 3.

Dependencies: Keep this additional information in mind:

- Set Ascend-FR-DTE-N392 to a value less than Ascend-FR-DTE-N393.

- Ascend-FR-DTE-N392 does not apply if Ascend-FR-Type=Ascend-FR-DCE.

See Also: Ascend-FR-DTE-N393 (165)
Ascend-FR-Type (159)

## Ascend-FR-DTE-N393 (165)

Description: The Ascend-FR-DTE-N393 attribute indicates the DTE-monitored event count. The MAX always considers a link active if the value of Ascend-FR-DTE-N393 is not reached.

Usage: Specify a number between 1 and 10. The default value is 4.

Dependencies: This attribute does not apply if Ascend-FR-Type=Ascend-FR-DCE.

See Also: Ascend-FR-Type (159)

## Ascend-FR-Link-Mgt (160)

Description: In a Frame Relay profile, the Ascend-FR-Link Mgt attribute specifies the link management protocol in use between the MAX and the Frame Relay switch.

Usage: You can specify one of these values:

- Ascend-FR-No-Link-Mgt (0)

  This setting indicates no link management, and is the default. The MAX always considers a link active if no link management functions are performed.

- Ascend-FR-T1-617D (1)

  This setting indicates T1.617 Annex D link management.

- Ascend-FR-Q-933A (2)

  This setting indicates Q.933 Annex A link management.

## Ascend-FR-LinkUp (157)

Description: In a Frame Relay profile, the Ascend-FR-LinkUp attribute specifies whether the Frame Relay link comes up automatically.

Usage: You can specify one of these values:

- Ascend-LinkUp-Default (0)

  This setting indicates that the datalink does not come up unless a DLCI brings it up, and shuts down after the last DLCI has been removed. This value is the default.

- Ascend-LinkUp-AlwaysUp (1)

  This setting indicates that the datalink comes up automatically and stays up even when the last DLCI has been removed.

Dependencies: You can start and drop Frame Relay connections by using the DO DIAL and DO HANGUP commands. DO DIAL brings up a connection. DO HANGUP closes the link and any DLCIs on it. If Ascend-FR-LinkUp=Ascend-LinkUp-AlwaysUp, DO HANGUP brings the link down, but the link automatically restarts. A restart also occurs if a DLCI brings up the datalink.

## Ascend-FR-N391 (161)

Description: In a Frame Relay profile, the Ascend-FR-N391 attribute specifies the interval in seconds at which the MAX requests a Full Status Report.

If you configure the Frame Relay link for link management, it regularly request updates on the status of the link. The Frame Relay unit at the other end of the link must respond to these requests. Otherwise, the MAX considers the link inactive. Furthermore, if the response to these requests indicates a DLCI failure, the MAX considers the link inactive.

Usage: Specify an integer between 1 and 255. The default value is 6.

Dependencies: This attribute does not apply if Ascend-FR-Type=Ascend-FR-DCE.

See Also: Ascend-FR-Type (159)

## Ascend-FR-Nailed-Grp (158)

Description: The Ascend-FR-Nailed-Grp attribute associates a group of nailed-up channels with the Frame Relay profile.

Usage: Specify a number between 1 and the maximum number of nailed-up channels that your MAX allows. The default value is 1.

Dependencies: Do not associate a group with more than one active Frame Relay profile.

## Ascend-FR-Profile-Name (180)

Description: The Ascend-FR-Profile-Name attribute specifies the name of the Frame Relay profile that carries the gateway connection.

Usage: Indicate the name of a Frame Relay profile that connects to the Frame Relay switch handling the Data Link Connection Indicator (DLCI) specified by Ascend-FR-DLCI. You can specify up to 15 alphanumeric characters. The default value is null. Make sure that you enter the name exactly as it appears in the Name parameter of the Frame Relay profile.

Dependencies: Ascend-FR-Profile-Name applies only if Ascend-FR-Direct=FR-Direct-No.

Example: This portion of a user profile shows a gateway connection that uses DLCI 21 and the Frame Relay profile called Florence.

    Permconn-MAX-1 Password="Ascend", User-Service=Dialout-Framed-User

            User-Name="Matt",

            Ascend-FR-Direct=FR-Direct-No,

            Ascend-FR-Profile-Name="Florence",

            Ascend-FR-DLCI=21,

            Metric=2,

            ...

See Also: Ascend-FR-Direct (219)
Ascend-FR-DLCI (179)

## Ascend-FR-Link-Status-DLCI (106)

Description: Specifies the DLCI to use for link management on the Frame Relay datalink.

Usage: Accept the default of 0 (zero) or specify DLCI 1023.

See Also: Ascend-FR-Link-Mgt (160).

## Ascend-FR-T391 (166)

Description: The Ascend-FR-T391 attribute indicates the Link Integrity Verification polling timer.

Usage: You can specify a number of seconds between 5 and 30. The default value is 10.

Dependencies: This attribute does not apply if Ascend-FR-Type=Ascend-FR-DCE.

See Also: Ascend-FR-Type (159)

## Ascend-FR-T392 (167)

Description: The Ascend-FR-T392 attribute indicates the timer for the verification of the polling cycle- the length of time the unit should wait between Status Enquiry messages. The MAX records an error if it does not receive a Status Enquiry within the number seconds this attribute specifies.

Usage: Specify a number of seconds between 5 and 30. The default value is 10.

Dependencies: This attribute does not apply if Ascend-FR-Type=Ascend-FR-DTE.

See Also: Ascend-FR-Type (159)

## Ascend-FR-Type (159)

Description: The Ascend-FR-Type attribute specifies the type of Frame Relay connection the Frame Relay profile uses.

Usage: You can specify one of these values:

- Ascend-FR-DTE (0)

  This setting indicates a UNI-DTE interface (the default). When you specify this value, the MAX acts as a DTE that can connect to a Frame Relay switch.

- Ascend-FR-DCE (1)

  This setting indicates a UNI-DCE interface. When you specify this value, the MAX acts as a DCE that can connect to a Frame Relay DTE unit-that is, to the user's Customer Premises Equipment (CPE).

- Ascend-FR-NNI (2)

  This setting indicates an NNI interface. When you specify this value, the MAX can connect to another NNI unit (a Frame Relay switch).

## Ascend-FT1-Caller (175)

Description: The Ascend-FT1-Caller attribute specifies whether the MAX initiates an FT1-AIM or an FT1-B&O call, or whether it waits for the remote end to initiate these types of calls.

Usage: You can specify one of these values:

- FT1-No (0) specifies that the MAX waits for the remote end to initiate the call.

  FT1-No is the default.

- FT1-Yes (1) specifies that the MAX initiates the call.

  If you choose this setting, the MAX dials to bring online any switched circuits that are part of the call.

Dependencies: Keep this additional information in mind:

- If the remote end has set Ascend-FT1-Caller=FT1-No in a RADIUS user profile (or FT1 Caller=No in a Connection profile), set Ascend-FT1-Caller=FT1-Yes for the local MAX.

- If the remote end has set Ascend-FT1-Caller=FT1-Yes in a RADIUS user profile (or FT1 Caller=Yes in a Connection profile), set Ascend-FT1-Caller=FT1-No for the local MAX.

## Ascend-Group (178)

Description: The Ascend-Group attribute points to the nailed-up channels the profile's WAN link uses.

If you set the Ascend-Group attribute to a value that matches the settings of a Ch n Prt/Grp, B1 Prt/Grp, or B2 Prt/Grp parameter in a Line profile, the MAX uses the specified channels for this profile's link across the WAN. Similarly, if Ascend-Group has the same value as Nailed Grp in the Serial WAN profile, the MAX uses the serial WAN circuit for this profile's link.

Usage: Your usage depends upon the value you specify for the Ascend-Call-Type attribute:

- If you set Ascend-Call-Type=Nailed, you can specify a number between 1 and 60 for Ascend-Group.

  The default value is 1.

- If you set Ascend-Call-Type=Nailed/Mpp, you can use the Ascend-Group attribute to assign multiple nailed-up groups to the profile.

  Specify a single number, or specify a list of numbers between 1 and 60, separated by commas. Do not include spaces. The default value is 1.

Dependencies: Keep this additional information in mind:

- The Ascend-Group attribute does not apply if the link consists entirely of switched channels.

- If you add channels for the Ascend-Group attribute, the MAX adds the additional channels to any online connection that uses the group.

- Do not duplicate group numbers in active profiles-that is, choose a value for Ascend-Group that no active Connection profile, Call profile, Frame Relay profile, or RADIUS user profile is using.

- Although you can assign multiple groups to a user profile, do not mix the Serial WAN circuit with nailed-up BRI or T1/E1 channels.

Example: If Ascend-Call-Type=Nailed/Mpp, setting the Ascend-Group attribute to "1,3,5,7" assigns four nailed-up groups to the profile.

## Ascend-Handle-IPX (222)

Description: The Ascend-Handle-IPX attribute specifies how the MAX handles NCP watchdog requests on behalf of IPX clients during IPX bridging.

Usage: You can specify one of these values:

- Handle-IPX-None (0)

  This setting indicates that special IPX behavior does not take place. Choose this setting when the LAN on each side of the bridge has one or more IPX servers.

  Handle-IPX-None is the default.

- Handle-IPX-Client (1)

  This setting indicates that the MAX discards Routing Information Protocol (RIP) and Service Advertising Protocol (SAP) periodic broadcasts at its WAN interface, but forwards RIP and SAP queries.

  The WAN interface is the port on the MAX that connects to a WAN line. RIP and SAP queries enable a client workstation to locate a NetWare server across the network. Choose Handle-IPX-Client when both these conditions are true:

  - The local LAN has IPX clients but no servers.

  - The MAX is acting as a bridge to another LAN containing only IPX servers, or a combination of IPX servers and clients.

- Handle-IPX-Server (2)

  This setting indicates that the MAX discards all Routing Information Protocol (RIP) and Service Advertising Protocol (SAP) periodic broadcasts and queries at its WAN interface.

  This mode enables the MAX to bring down calls during idle periods without breaking
  client/server or peer-to-peer connections.

  Ordinarily, when a NetWare server does not receive a reply to the watchdog session
  keepalive packets it sends to a client, it closes the connection. When you specify Handle-IPX-Server, however, the MAX replies to NCP watchdog requests on behalf of clients on the other side of the bridge. In other words, the MAX tricks the server watchdog process into believing that the link is still active. This process is called watchdog spoofing.

  Choose this setting when both these conditions are true:

  - The MAX is acting as a bridge to a remote LAN with IPX clients, but no servers.

  - The local LAN contains only IPX servers, or a combination of IPX clients and
    servers.

Dependencies: Keep this additional information in mind:

- If you specify Ascend-Handle-IPX=Handle-IPX-Server, you must also specify a value for the Ascend-Netware-timeout attribute, indicating the maximum length of idle time during which the MAX performs watchdog spoofing for NetWare connections.

- If the connection does not bridge (Ascend-Bridge=Bridge-No), the Ascend-Handle-IPX attribute does not apply.

- If the MAX on one LAN sets Ascend-Handle-IPX=Handle-IPX-Server, and the LAN on the other side of the connection has only NetWare clients, the MAX on the client-only LAN should set Ascend-Handle IPX=Handle-IPX-Client.

  If both LANs contain servers, both sides of the connection should set Ascend-Handle- IPX=Handle-IPX-None.

- Although Ascend-Handle-IPX does not apply if Ascend-Bridge=Bridge-No, the MAX automatically performs watchdog spoofing just as though you had set Ascend-Handle-IPX=Handle-IPX-Server.

  However, the MAX does not filter as though you had set Ascend-Handle-IPX=Handle-IPX-Server.

Example: This user profile specifies an IPX bridging link in which the local Ethernet supports NetWare clients, and the remote network supports both NetWare servers and clients:

MAX1 Password="m2dan", User-Service=Framed-User

Framed-Protocol=PPP,

Ascend-Route-IPX=Route-IPX-No,

Ascend-Bridge=Bridge-Yes,

         Ascend-Handle-IPX=Handle-IPX-Client,

Ascend-Netware-timeout=30

See Also: Ascend-Bridge (230)
Ascend-Netware-timeout (223)

## Ascend-History-Weigh-Type (239)

Description: The Ascend-History-Weigh-Type attribute specifies which Dynamic Bandwidth Allocation (DBA) algorithm to use for calculating average line utilization (ALU) of transmitted data. DBA enables you to specify that the MAX uses ALU as the basis for automatically adding or subtracting bandwidth from a switched connection without terminating the link.

Usage: Figure 9-1 illustrates the differences among the algorithms you can choose.

Figure 9-1. Bandwidth algorithms for MP+ calls

- History-Constant (0) gives equal weight to all samples taken during the historical time period specified by Ascend-Seconds-Of History.

  When you select this option, older historical samples have as much impact on the decision to change bandwidth allocation as more recent samples.

- History-Linear (1) gives more weight to recent samples of bandwidth usage than to older samples taken during the historical period specified by Ascend-Seconds-Of-History.

  The weighting grows at a linear rate.

- History-Quadratic (2) gives more weight to recent samples of bandwidth usage than to older samples taken during the historical period specified by Ascend-Seconds-Of-History.

  The weighting grows at a quadratic rate. History-Quadratic is the default.

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-Home-Agent-IP-Addr

Description: Indicates the IP address of the home agent used for this mobile ATMP client in a RADIUS Stop record.

Example: The following is an example of a RADIUS accounting STOP record that includes the Ascend-Home-Agent-IP-Addr attribute:

    Mon Apr 21 02:41:38 1997

    User-Name = "JacobP75"

    NAS-Identifier = 1.1.1.1

    NAS-Port = 10105

    Acct-Status-Type = Stop

    Acct-Delay-Time = 0

    Acct-Session-Id = "111111111"

    Acct-Authentic = RADIUS

    Acct-Session-Time = 0

    Acct-Input-Octets = 215

    Acct-Output-Octets = 208

    Acct-Input-Packets = 10

    Acct-Output-Packets = 10

    Ascend-Disconnect-Cause = 1

    Ascend-Connect-Progress = 60

    Ascend-Data-Rate = 56000

    Ascend-PreSession-Time = 1

    Ascend-Pre-Input-Octets = 215

    Ascend-Pre-Output-Octets = 208

    Ascend-Pre-Input-Packets = 10

    Ascend-Pre-Output-Packets = 10

    Framed-Protocol = PPP

    Framed-Address = 2.2.2.2

    Tunneling-Protocol = ATMP

    Ascend-Home-Agent-IP-Addr = 3.3.3.3

    Ascend-Home-Agent-UDP-Port = 5150

    Ascend-Home-Network-Name = homenet

Dependencies: Accounting-Request packets, generated by the foreign agent, send the Ascend-Home-Agent-IP-Addr attribute at the end of a session, under the following conditions:

- The Accounting-Request packet includes Acct-Status-Type=Stop.

- The session was authenticated and encapsulated by means of Ascend Tunnel Management Protocol (ATMP).

## Ascend-Home-Agent-Password (184)

Description: In a mobile node's RADIUS user profile, the Ascend-Home-Agent-Password attribute specifies the password that the foreign agent sends to the home agent in order to authenticate itself during Ascend Tunnel Management Protocol (ATMP) operation. This password must match the value of the Password parameter in Ethernet > Mod Config > ATMP Options menu for the home agent. All mobile nodes accessing a single home agent must specify the same password.

The RADIUS server passes the attributes in the mobile node's RADIUS user profile to the foreign agent. The foreign agent sends these attributes when connecting with the home agent.

A mobile node can also connect directly to the home agent. An ATMP-based RADIUS profile that is local to the home agent enables the mobile node to bypass a foreign agent connection, but does not preclude a foreign agent. If both the home agent and the foreign agent have local RADIUS profiles for the mobile node, the node can choose between a direct connection or a tunneled connection through the foreign agent.

Usage: Specify a text string containing up to 20 characters. The default value is null.

Example: The following RADIUS profile authenticates a mobile NetWare client that connects directly to the home agent. In this example, the home agent is in gateway mode. It forwards packets from the mobile node across a nailed-up WAN link to the home IPX network.

    Mobile-IPX Password="unit"

         User-Service=Framed-User,

         Ascend-Route-IPX=Route-IPX-Yes,

         Framed-Protocol=PPP,

         Ascend-IPX-Peer-Mode=IPX-Peer-Dialin,

         Framed-IPX-Network=40000000,

         Ascend-IPX-Node-Addr=12345678,

         Ascend-Primary-Home-Agent="max1.home.com:6001",

         Ascend-Secondary-Home-Agent="max2.home.com:6001",

         Ascend-Home-Network-Name="Dave's MAX",

         Ascend-Home-Agent-Password="Pipeline"

See Also: Ascend-Home-Agent-UDP-Port (186)
Ascend-Home-Network-Name (185)
Ascend-Primary-Home-Agent (129)
Ascend-Secondary-Home-Agent (130)

## Ascend-Home-Agent-UDP-Port (186)

Description: In a mobile node's RADIUS user profile, the Ascend-Home-Agent-UDP-Port attribute specifies the UDP port number on the home agent to which the foreign agent directs Ascend Tunnel Management Protocol (ATMP) messages.

Usage: Specify a UDP port number between 0 and 65535. The default value is 5150.

Dependencies: If you specify a value for the udp_port argument of Ascend-Primary-Home-Agent or Ascend-Secondary-Home-Agent, or if you accept the default of 5150 for udp_port, you need not specify the Ascend-Home-Agent-UDP-Port attribute.

See Also: Ascend-Home-Agent-Password (184)
Ascend-Home-Network-Name (185)
Ascend-Primary-Home-Agent (129)
Ascend-Secondary-Home-Agent (130)

## Ascend-Home-Network-Name (185)

Description: In a mobile node's RADIUS user profile, the Ascend-Home-Network-Name attribute specifies the name of the Connection profile on which the home agent sends all packets it receives from the mobile node during Ascend Tunnel Management Protocol (ATMP) operation.

The RADIUS server passes the attributes in the mobile node's RADIUS user profile to the foreign agent. The foreign agent sends these attributes when connecting with the home agent.

A mobile node can also connect directly to the home agent. An ATMP-based RADIUS profile that is local to the home agent enables the mobile node to bypass a foreign agent connection, but does not preclude a foreign agent. If both the home agent and the foreign agent have local RADIUS profiles for the mobile node, the node can choose between a direct connection or a tunneled connection through the foreign agent.

Usage: Specify the name of the home agent's Connection profile. The default value is null.

Dependencies: You must specify a value for this attribute only if the home agent is a gateway (that is, only if Type=Gateway in the Ethernet > Mod Config > ATMP Options menu).

Example: The following RADIUS profile authenticates a mobile NetWare client that connects directly to the home agent. In this example, the home agent is in gateway mode. It forwards packets from the mobile node across a nailed-up WAN link to the home IPX network.

    Mobile-IPX Password="unit"

         User-Service=Framed-User,

         Ascend-Route-IPX=Route-IPX-Yes,

         Framed-Protocol=PPP,

         Ascend-IPX-Peer-Mode=IPX-Peer-Dialin,

         Framed-IPX-Network=40000000,

         Ascend-IPX-Node-Addr=12345678,

         Ascend-Primary-Home-Agent="max1.home.com:6001",

         Ascend-Secondary-Home-Agent="max2.home.com:6001",

         Ascend-Home-Network-Name="Dave's MAX",

         Ascend-Home-Agent-Password="Pipeline"

See Also: Ascend-Home-Agent-Password (184)
Ascend-Home-Agent-UDP-Port (186)
Ascend-Primary-Home-Agent (129)
Ascend-Secondary-Home-Agent (130)

## Ascend-Host-Info (252)

Description: The Ascend-Host-Info attribute specifies a list of hosts to which a user can establish a Telnet session.

Usage: You can specify up to 10 Ascend-Host-Info entries in a user profile. Enter your attribute settings in this format:

    Ascend-Host-Info="IP_address text"

- IP_address specifies the IP address of each host.

  Specify an IP address in dotted decimal notation. An IP address consists of four numbers between 0 and 255, separated by periods. The default value is 0.0.0.0.

- text describes each host.

  You can enter up to 31 characters for text. The default value is null. The RADIUS server assigns the text a number. When the user selects the number, the terminal server initiates a Telnet session with the host at the specified IP address.

Dependencies: If you specify a value for the Ascend-Host-Info attribute, you must also make these settings in the Ethernet > Mod Config > TServ Options menu:

- Set Initial Scrn=Menu or Toggle Scrn=Yes.

- Set Remote Conf=Yes.

Example: Here is an example for a MAX named Cal:

Initial-Banner-Cal Password="Ascend", User-Service=Dialout-Framed-User

         Reply-Message="Up to 16 lines of up to 80 characters each",

         Reply-Message="will be accepted. Long lines will be
    truncated",

         Reply-Message="Additional lines will be ignored.",

         Reply-Message="",

Ascend-Host-Info="1.2.3.4 Berkeley",

Ascend-Host-Info="1.2.3.5 Alameda",

Ascend-Host-Info="1.2.36 San Francisco",

...

See Also: Reply-Message (18)

## Ascend-Idle-Limit (244)

Description: The Ascend-Idle-Limit attribute specifies the number of seconds the MAX waits before clearing a call when a session is inactive.

Usage: Specify a number between 0 and 65535. If you specify 0 (zero), the MAX always clears a call when a session is inactive. The default value is 120 seconds. If you accept the default and an existing Answer profile specifies a value for the analogous Idle parameter, the MAX ignores the Idle value and uses the Ascend-Idle-Limit default.

Dependencies: Keep this additional information in mind:

- If the time set by the Ascend-Idle-Limit expires, the call disconnects whether or not bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting.

- When bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting, the call disconnects regardless of whether the time specified by the Ascend-Idle-Limit attribute has expired.

- Because the Ascend-MPP-Idle-Percent attribute is dependent on traffic levels on both sides of the connection, we recommend that you use the Ascend-Idle-Limit attribute in preference to it.

- The Ascend-Idle-Limit attribute does not apply to nailed-up links.

See Also: Ascend-MPP-Idle-Percent (254)
Ascend-Preempt-Limit (245)

## Ascend-IF-Netmask (154)

Description: The Ascend-IF-Netmask attribute specifies the subnet mask in use for the local numbered interface.

Usage: Specify a subnet mask consisting of four numbers between 0 and 255, separated by periods. The default value is 0.0.0.0.

## Ascend-Inc-Channel-Count (236)

Description: The Ascend-Inc-Channel-Count attribute specifies the number of channels the MAX adds when bandwidth changes either manually or automatically during a call.

Usage: Specify a number between 1 and 32. The default value is 1.

Dependencies: Keep this additional information in mind:

- Ascend-Inc-Channel-Count does not apply if all channels of a link are nailed up (Ascend-Call-Type=Nailed).

- Ascend-Inc-Channel-Count applies only if the link is using MP+ encapsulation (Framed-Protocol=MPP).

- MP+ calls cannot exceed 32 channels.

- The sum of Ascend-Base-Channel-Count and Ascend-Inc-Channel-Count cannot exceed the maximum number of channels available.

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-IP-Direct (209)

Description: The Ascend-IP-Direct attribute specifies the IP address to which the MAX redirects packets from the user. When you include this attribute in a user profile, the MAX bypasses all internal routing and bridging tables, and simply sends all packets it receives on this connection's WAN interface to the specified IP address. Ascend-IP-Direct does not affect packets users send to this connection.

Usage: Specify an IP address in dotted decimal notation. An IP address consists of four numbers between 0 and 255, separated by periods. The default value is 0.0.0.0. If you accept the default, the MAX does not redirect IP traffic.

Dependencies: Keep this additional information in mind:

- You can specify the Ascend-IP-Direct attribute only under these conditions:

  - IP routing is in use.

  - The user profile contains the specification Ascend-Bridge=Bridge-No.

  - Framed-Protocol is not set to COMB or FR.

- Do not set Ascend-IP-Direct and Ascend-FR-Direct in the same user profile.

  If you do, an error occurs.

- Ascend-IP-Direct connections typically turn off RIP.

  If you configure the connection to receive RIP, the MAX keeps all RIP packets from the remote end and forwards them to the IP address you specify. To turn off RIP, set Framed-Routing=None.

Example: This user profile specifies that the MAX redirects incoming packets to the host at IP address 10.2.3.11:

    Emma Password="m2dan", User-Service=Framed-User

              Framed-Protocol=PPP,

              Framed-Address=10.8.9.10,

Framed-Netmask=255.255.252.0,

              Ascend-Route-IP=Route-IP-Yes,

              Ascend-Bridge=Bridge-No,

              Ascend-IP-Direct=10.2.3.11,

              Ascend-Metric=2,

              Framed-Routing=None,

              ...

See Also: Framed-Routing (10)

## Ascend-IP-Pool-Definition (217)

Description: The Ascend-IP-Pool-Definition attribute specifies the first IP address in a MAX-specific IP address pool, and indicates the number of addresses in the pool.

Usage: The Ascend-IP-Pool-Definition attribute has this format:

    Ascend-IP-Pool-Definition="num first_ipaddr max_entries"

Table 9-13 describes each Ascend-IP-Pool-Definition argument.

Table 9-13. Ascend-IP-Pool-Definition arguments

#### Argument

#### Description

num

Indicates the number of the pool. The default value is 1.

Specify pool numbers starting with 1, unless you have defined pools in the MAX interface using the Pool #n Start and Pool #n Count parameters and do not wish to override these settings. In this case, for the num argument, specify the highest number of an address pool on the MAX + 1.

For example, if you have set up address pools 1 through 5 on the MAX, specify pool numbers starting with 6 in RADIUS.

first_ipaddr

Specifies the first IP address in the address pool. The address you indicate should not accept a subnet mask, because it always becomes a host route. The default value is 0.0.0.0.

max_entries

Specifies the maximum number of IP addresses in the pool. The MAX assigns addresses sequentially, from first_ipaddr on, up to the limit of addresses specified by max_entries. The default value is 0 (zero).

Dependencies: You specify one or more Ascend-IP-Pool-Definition attributes in a pseudo-user profile. You create a pseudo-user to store information that the MAX can query-in this case, in order to store IP address pool information. Specify the first line of a pseudo-user profile in this format:

    Pools-unit_name Password="Ascend", User-Service=Dialout-Framed-User

unit_name is the system name of the MAX-that is, the name specified by the Name parameter in the System profile. On the next lines of the profile, specify one or more Ascend-IP-Pool-Definition attributes.

Example: In this example, the pseudo-user profile creates two IP address pools for the MAX to use. Address pool #1 contains a block of 7 IP addresses from 10.1.0.1 to 10.1.0.7. Address pool #2 contains a block of 48 IP addresses from 10.2.0.1 to 10.2.0.48.

    Pools-MAX Password="Ascend", User-Service=Dialout-Framed-User

        Ascend-IP-Pool-Definition="1 10.1.0.1 7",

        Ascend-IP-Pool-Definition="2 10.2.0.1 48"

See Also: Ascend-Assign-IP-Pool (218)

## Ascend-IP-TOS (88)

Description: Specifies the Type of Service (TOS) of the data stream.

Usage: Specify one of the following:

Ascend-IP-TOS IP-TOS-Normal (0): Normal service.

Ascend-IP-TOS IP-TOS-Disabled (1): Disables TOS.

Ascend-IP-TOS IP-TOS-Cost (2): Minimize monetary cost.

Ascend-IP-TOS IP-TOS-Reliability (4): Maximize reliability.

Ascend-IP-TOS IP-TOS-Throughput (8): Maximize throughput.

Ascend-IP-TOS IP-TOS-Latency (16): Minimize delay.

Note: The value of this attribute sets the four bits following the three most significant bits of the TOS byte which can be used to choose a link based on the type of service.

See Also: Ascend-IP-TOS-Precedence (89), Ascend-IP-TOS-Apply-To (90), Ascend-Filter (91)

## Ascend-IP-TOS-Precedence (89)

Description: Specifies the priority level of the data stream. The three most significant bits of the TOS byte are priority bits used to set precedence for priority queuing.

Usage: When you enable TOS, you can set the three most significant bits to one of the following values (most significant bit first):

IP-TOS-Precedence-Pri-Normal (0): Normal priority.

IP-TOS-Precedence-Pri-One (32): Priority level 1.

IP-TOS-Precedence-Pri-Two (64): Priority level 2.

IP-TOS-Precedence-Pri-Three (96): Priority level 3.

IP-TOS-Precedence-Pri-Four (128): Priority level 4.

IP-TOS-Precedence-Pri-Five (160): Priority level 5.

IP-TOS-Precedence-Pri-Six (192): Priority level 6.

IP-TOS-Precedence-Pri-Seven (224): Priority level 7 (the highest priority).

See Also: Ascend-IP-TOS (88), Ascend-IP-TOS-Apply-To (90), Ascend-Filter (91)

## Ascend-IP-TOS-Apply-To (90)

Description: Specifies the direction in which the MAX supports TOS.

Usage: You can set Ascend-IP-TOS-Apply-To:

- -IP-TOS-Apply-To-Incoming (1024) which is the default, the MAX sets bits in packets received on the interface.

- -IP-TOS-Apply-To-Outgoing (2048), the MAX sets bits in outbound packets.

- -IP-TOS-Apply-To-Both (3072), the MAX sets bits in packets for incoming and outgoing packets.

See Also: Ascend-IP-TOS (88), Ascend-IP-TOS-Precedence (89), Ascend-Filter (91)

## Ascend-Filter (91)

Description: Specifies a string-format filter, which can include an IP TOS filter specification.

Usage: Filter entries apply on a first-match basis. Therefore, the order in which you enter them is significant. If you make changes to a filter in a RADIUS user profile, the changes do not take effect until a call uses that profile.

A TOS filter value is specified in the following format:

    iptos dir [dstip dest_ipaddr\subnet_mask]

    [srcip src_ipaddr\subnet_mask][proto][destport cmp value]

    [srcport cmp value][precedence value][type-of-service value]

Note: A filter definition cannot contain newlines. The syntax is shown here on multiple lines for printing purposes only.

#### Keyword or argument | #### Description
--- | ---
`iptos` | Specifies an IP filter.
`dir` | Specifies filter direction. You can specify `in` (to filter packets coming into the MAX) or `out` (to filter packets going out of the MAX).
`dstip` `dest_ipaddr \subnet_mask` | If the `dstip` keyword is followed by a valid IP address, the TOS filter will set bytes only in packets with that destination address. If a subnet mask portion of the address is present, the MAX compares only the masked bits. If the `dstip` keyword is followed by the zero address (0.0.0.0), or if this keyword and its IP address specification are not present, the filter matches all IP packets.
`srcip` `src_ipaddr \subnet_mask` | If the `srcip` keyword is followed by a valid IP address, the TOS filter will set bytes only in packets with that source address. If a subnet mask portion of the address is present, the MAX compares only the masked bits. If the `srcip` keyword is followed by the zero address (0.0.0.0), or if this keyword and its IP address specification are not present, the filter matches all IP packets.
`proto` | A protocol number. A value of zero matches all protocols. If you specify a non-zero number, the MAX compares it to the Protocol field in packets. For list of protocol numbers, see RFC 1700.
`dstport` `cmp value` | If the `dstport``` keyword is followed by a comparison symbol and a port, the port is compared to the destination port of a packet. The comparison symbol can be `<` ( less-than),`=` (equal), `>` (greater-than), or `!=` (not-equal). The port value can be one of the following names or numbers: `ftp-data` (20), `ftp` (21), `telnet` (23), `smtp` (25), `nameserver` (42), `domain` (53), `tftp` (69), `gopher` (70), `finger` (79), `www` (80), `kerberos` (88), `hostname` (101), `nntp` (119), `ntp` (123), `exec` (512), `login` (513), `cmd` (514), `talk` (517).
`srcport` `cmp value` | If the `srcport``` keyword is followed by a comparison symbol and a port, the port is compared to the source port of a packet. The comparison symbol can be `<` ( less-than), `=` (equal), `>` (greater-than), or `!=` (not-equal). The port value can be one of the following names or numbers: `ftp-data` (20), `ftp` (21), `telnet` (23), `smtp` (25), `nameserver` (42), `domain` (53), `tftp` (69), `gopher` (70), `finger` (79), `www` (80), `kerberos` (88), `hostname` (101), `nntp` (119), `ntp` (123), `exec` (512), `login` (513), `cmd` (514), `talk` (517).
`precedence` `value` | Specifies the priority level of the data stream. The three most significant bits of the TOS byte are priority bits used to set precedence for priority queuing. If a packet matches the filter, those bits are set to the specified value (most significant bit first): 000-Normal priority. 001-Priority level 1. 010-Priority level 2. 011-Priority level 3. 100-Priority level 4. 101-Priority level 5. 110-Priority level 6. 111-Priority level 7 (the highest priority).
`type-of-service` `value` | Type of Service of the data stream. If a packet matches the filter, the system sets the four bits following the three most significant bits of the TOS byte to the specified value. Those four bits are used to choose a link based on the type of service. Specify one of the following values: Normal (0)-Normal service. Disabled (1)-Disables TOS. Cost (2)-Minimize monetary cost. Reliability (4)-Maximize reliability. Throughput (8)-Maximize throughput. Latency (16)-Minimize delay.

Example: The following RADIUS user profile defines a TOS filter for TCP packets (protocol 6) that are destined for a single host at 10.168.6.24. The packets must be sent on TCP port 23. For incoming packets that match this filter, the priority is set at level 2. This is a relatively low priority, which means that an upstream router that implements priority queuing may drop these packets when it becomes loaded. The commands also set TOS to prefer a low latency connection. This means that the upstream router will choose a a fast connection is one is available, even if it is higher cost, lower bandwidth, or less reliable than another available link.

    John Password="jlhkjtn", User-Service=Framed-User

        Framed-Protocol=PPP,

        Framed-IP-Address=10.168.6.120

        Framed-IP-Netmask=255.255.255.0

        Ascend-Filter="iptos in dstip 10.168.6.24/32

        dstport=23 precedence 010 type-of-service latency"

See Also: Ascend-IP-TOS (88), Ascend-IP-TOS-Apply-To (90), Ascend-IP-TOS-Precedence (89)

## Ascend-IPX-Alias (224)

Description: The Ascend-IPX-Alias attribute specifies an IPX network number to use when connecting to IPX routers that require numbered interfaces.

Usage: Specify an IPX network number. The default value is 0 (zero). RADIUS requires that this attribute have a decimal value (base 10), but IPX network numbers generally have hexadecimal values (base 16). In order to give this attribute a value, you must convert the hexadecimal IPX network number to a decimal value for use in the user profile.

See Also: Ascend-IPX-Peer-Mode (216)
Ascend-IPX-Route (174)
Ascend-Route-IPX (229)

## Ascend-IPX-Node-Addr (182)

Description: The Ascend-IPX-Node-Addr attribute specifies a unique IPX node address on the network specified by Framed-IPX-Network. This value completes the IPX address of a mobile node.

Usage: Specify a 12-digit ASCII string enclosed in double-quotes. The RADIUS server passes the attributes in the mobile node's profile to the foreign agent. The foreign agent sends these attributes when connecting with the home agent.

See Also: Framed-IPX-Network (23)

## Ascend-IPX-Peer-Mode (216)

Description: The Ascend-IPX-Peer-Mode attribute specifies whether the caller is a dial-in PPP client or an Ethernet client with its own IPX network address.

Dial-in clients do not belong to an IPX network, so you must assign them an IPX network number. When you do so, a dial-in client can establish a routing connection with the MAX. To provide an IPX network number, you must define a virtual IPX network using the IPX Pool# parameter in the MAX configuration interface. The MAX advertises the route to this virtual network and assigns it as the network address for dial-in clients.

Usage: For the Ascend-IPX-Peer-Mode attribute, you can specify one of these values:

- IPX-Peer-Router (0) indicates that the caller is on the Ethernet network and has its own IPX address.

  IPX-Peer-Router is the default.

- IPX-Peer-Dialin (1) indicates that the caller is a dial-in NetWare client that incorporates PPP software and dial-out hardware, but does not have an Ethernet interface.

  This setting causes the MAX to assign the caller an IPX address derived from the value of IPX Pool#. If the client does not supply its own unique node number, the MAX assigns a unique node number to the client as well. The MAX does not send IPX RIP and SAP advertisements across the connection, and ignores IPX RIP and SAP advertisements it receives from the remote end. However, it does respond to IPX RIP and SAP queries it receives from dial-in clients.

See Also: Ascend-IPX-Route (174)
Ascend-Route-IPX (229)

## Ascend-IPX-Route (174)

Description: The Ascend-IPX-Route attribute enables you to configure a static IPX route.

Usage: To configure a static IPX route to an internal network, use the following format:

    Ascend-IPX-Route="profile_name network# [node#] [socket#]
    [server_type] [hop_count] [tick_count] [server_name]"

Table 9-14 describes each Ascend-IPX-Route argument.

Table 9-14. Ascend-IPX-Route arguments

#### Argument

#### Description

profile_name

Specifies the RADIUS user profile used to reach the network. The default value is null.

network#

Indicates the unique internal network number of the NetWare server. The default value is 00000000.

node#

Specifies the node number of the NetWare server. The default value is 0000000000001-the typical node number for a NetWare file server.

socket#

Indicates the socket number of the NetWare server. Typically, NetWare file servers use socket 0451. The default value is 0000.

The number you specify must be a well-known socket number. Services that use dynamic socket numbers may use a different socket each time they load. To bring up a connection to a remote service that uses a dynamic socket number, specify a master server that uses a well-known socket number.

server_type

Specifies the SAP service type of the NetWare server. NetWare file servers have SAP service type 0004. The default value is 0000.

hop_count

Indicates the distance to the destination network in hops. The default value is 1.

tick_count

Specifies the distance to the destination network in IBM PC clock ticks (one-eighteenth of a second). This value is for round-trip timer calculation and for determining the nearest server of a given type.The default value is 12.

server_name

Indicates the name of an IPX server. The default value is null.

When you define a static route to an external network, the Ascend-IPX-Route attribute has the following format:

Ascend-IPX-Route="route-only [network #] [transit_network #]"

Table 9-15 describes each Ascend-IPX-Route argument.

Table 9-15. Ascend-IPX-Route arguments

#### Argument | #### Description
--- | ---
network # | Indicates the unique external network number. The default value is 00000000.
transit_network # | Indicates an intermediate network: Between the MAX and the destination network. To which the MAX knows how to route.

Dependencies: Each static route must appear in a pseudo-user profile. You create a pseudo-user to store information that the MAX can query-in this case, in order to store IPX routing information. You can configure pseudo-users for both global and MAX-specific configuration control of IPX dialout routes. The MAX loads the unit-specific dialout routes in addition to the global dialout routes.

For a unit-specific IPX dialout route, specify the first line of a pseudo-user profile in this format:

    IPXRoute-unit_name-num Password="Ascend", User-Service=Dialout-Framed-User

For a global IPX dialout route, specify the first line of a pseudo-user profile in this format:

    IPXRoute-num Password="Ascend", User-Service=Dialout-Framed-User

unit_name is the system name of the MAX-that is, the name specified by the Name parameter in the System profile. num is a number in a sequential series, starting at 1.

In each pseudo-user profile, you can specify one or more routes using the Ascend-IPX-Route attribute. Limit each pseudo-user profile to about 25 routes. The MAX fetches information from each pseudo-user profile in order to gather routing information. Whenever you power on or reset the MAX, or when you select the Upd Rem Cfg command from the Sys Diag menu, RADIUS adds IPX dialout routes to the routing table in this way:

1. RADIUS looks for profiles having the format IPXRoute-unit_name-1, where
   unit_name`` is the system name.

2. If at least one profile exists, RADIUS loads all existing profiles having the format
   IPXRoute-unit_name-num to initialize the IPX routing table.

   The variable num is a number in a sequential series, starting with 1.

3. The MAX queries IPXRoute-unit_name-1, then IPXRoute-unit_name-2, and so on, until it receives an authentication reject from RADIUS.

4. RADIUS loads the global configuration profiles.

   These configurations have the form IPXRoute-num.

5. The MAX queries IPXRoute-1, then IPXRoute-2, and so on, until it receives an authentication reject from RADIUS.

Example: This example defines a unit-specific IPX route:

    IPXRoute-CA-1 Password="Ascend", User-Service=Dialout-Framed-User

            Ascend-IPX-Route="def 6 7 8 9 10"

This example defines a global IPX route:

    IPXRoute-1 Password="Ascend", User-Service=Dialout-Framed-User

            Ascend-IPX-Route="abc 1 2 3 4 5 "

See Also: Ascend-IPX-Alias (224)
Ascend-IPX-Peer-Mode (216)
Ascend-Route-IPX (229)

## Ascend-Link-Compression (233)

Description: The Ascend-Link-Compression attribute turns data compression on or off for a PPP link.

Usage: You can specify one of these values:

- Link-Comp-None (0) disables data compression.

  Link-Comp-None in the default.

- Link-Comp-Stac (1) enables Ascend's modified version of the STACKER LZS compression/decompression algorithm.

- Link-Comp-Stac-Draft-9 (2) enables STACKER LZS compression/decompression algorithm, as specified in draft 9 of the IETF draft "PPP Stac LZS Compression Protocol".

- Link-Comp-MS-Stac (3) enables Microsoft's modified version of the STACKER LZS compression/decompression algorithm.

Dependencies: Both sides of the link must set either the Ascend-Link-Compression attribute or the Link Comp parameter to turn on data compression.

See Also: Framed-Compression (13)

## Ascend-Maximum-Call-Duration (125)

Description: Specifies the maximum number of minutes that the MAX allows individual channels in a call to stay connected regardless of the data traffic over the connection. When the time expires in single-channel calls, the MAX disconnects the call. When the time expires for a channel in a multi-channel call, the MAX disconnects only the single channel, leaving the call still connected.

For single-channel calls, the functionality of Ascend-Maximum-Time matches the functionality of Ascend-Maximum-Call-Duration.

Usage: Specify an integer from 0 to 1440. The MAX checks the connection once per minute, so the actual time the call is connected is slightly longer than the actual time you set.

The default value is 0 (zero) which specifies that the MAX does not set a limit on the duration of the call.

## Ascend-Maximum-Channels (235)

Description: The Ascend-Maximum-Channels attribute specifies the maximum number of channels the MAX allows on an MP+ call.

Usage: Specify an integer between 1 and the maximum number of channels your system supports. The default value is 1.

Dependencies: This attribute applies only to MP+ calls.

For optimum MP+ performance, both sides of a connection must set these values to the same number:

- The base channel count, as specified by Base Ch Count (in the Connection profile) or Ascend-Base-Channel-Count (in RADIUS)

- The minimum channel count, as specified by Min Ch Count (in the Answer profile or Connection profile) or Ascend-Minimum-Channels (in RADIUS)

- The maximum channel count, as specified by Max Ch Count (in the Answer profile or Connection profile) or Ascend-Maximum-Channels (in RADIUS)

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-Maximum-Time (194)

Description: Specifies the maximum number of seconds that the MAX allows the call to stay connected regardless of the data traffic over the connection. When the time expires, the MAX disconnects the call.

For single-channel calls, the functionality of Ascend-Maximum-Time matches the functionality of Ascend-Maximum-Call-Duration.

Usage: Specify an integer between 0 and 4,294,967,295. The default value is 0 (zero) which specifies that the MAX does not enforce a time limit.

## Ascend-Menu-Item (206)

Description: The Ascend-Menu-Item attribute defines a single terminal server menu item for a user profile. You can specify up to 20 Ascend-Menu-Item attributes per profile. The menu items display in the order in which they appear in the RADIUS profile.

Using this attribute, you can configure a profile to give the terminal server user a custom menu of items from which to choose. The server uses the custom menu to present the user with a subset of terminal server commands. The user does not have access to the regular menu or to the terminal server command line.

Usage: Enter your specifications using this format:

    Ascend-Menu Item=command;text;match

- command is the string that the MAX sends to the terminal server when the user selects the menu item.

- text is the text that displays to the user.

- match is the pattern the user must type to select the item.

- The first semi-colon (;) that appears acts as the delimiter between command and text.

- The second semi-colon that appears acts as the delimiter between text and match.

By default, the MAX uses the standard terminal server menu.

Example: Suppose you set these attributes:

    Emma Password="m2dan", User-Service=Login-User

          Ascend-Menu-Item="show ip stats;Display IP Stats",

          Ascend-Menu-Item="ping 1.2.3.4;Ping server",

          Ascend-Menu-Item="telnet 10.2.4.5;Telnet to Ken's machine",

          Ascend-Menu-Item="show arp;Display ARP Table",

          Ascend-Menu-Selector="                              Option:",

          ...

The terminal server displays this text:

    1. Display IP Stats     3. Telnet to Ken's machine

    2. Ping server          4. Display ARP Table.

                                  Option:

Now, suppose you also enter specifications for the match option, as in this profile:

Emma Password="m2dan", User-Service=Login-User

Ascend-Menu-Item="show ip stats;ip=Display ip stats;ip",

Ascend-Menu-Item="ping 1.2.3.4;p=Ping server. Ctrl-C stops ping;p",

Ascend-Menu-Item="telnet 10.2.4.5;t=Telnet to Ken's machine;t",

Ascend-Menu-Item="show arp;dsp=Display arp table;dsp ",

          Ascend-Menu-Selector="                              Option:",

          ...

The terminal server displays this text:

ip=Display ip stats p=Ping server. Ctrl-C stops ping

t=Telnet to Ken's machine dsp=Display arp table

                                  Option:

Note that you cannot combine numeric menu selections with pattern matching. This example shows what you should not do:

Emma Password="m2dan", User-Service=Login-User

Ascend-Menu-Item="show ip stats;ip=Display ip stats",

Ascend-Menu-Item="ping 1.2.3.4;p=Ping server. Ctrl-C stops ping;p",

Ascend-Menu-Item="telnet 10.2.4.5;t=Telnet to Ken's machine;t",

Ascend-Menu-Item="show arp;dsp=Display arp table;dsp ",

Ascend-Menu-Selector=" Option:",

...

If you mix numbered selections and pattern matching, as in this example, the terminal server screen displays the following text:

`1. ip=Display ip stats 3. t=Telnet to Ken's machine`

`2. p=Ping server. Ctrl-C stops ping 4. dsp=Display arp table`

`Option:`

See Also: Ascend-Menu-Selector (205)

## Ascend-Menu-Selector (205)

Description: The Ascend-Menu-Selector attribute specifies a string as a prompt for user input in the terminal server menu interface.

By default, when you create a custom menu with the Ascend-Menu-Item attribute, the terminal server displays this string when prompting the user to make a selection:

    Enter Selection (1-num, q)

The num argument represents the last number in the list. The terminal server code automatically determines the value of num by determining the number of items in the menu. The only valid user input is in the range 1 through num, and q to quit.

However, you can specify a different string for prompting the user to make a selection. The Ascend-Menu-Selector attribute enables you to specify a string that the terminal server displays when prompting a user for a menu selection. If you define this attribute, its value overrides the default of `Enter Selection (1-`num`, q)`.

Usage: Specify a text string containing up to 31 characters. The terminal server displays this string when prompting the user for a menu selection.

Example: Suppose you set these attributes:

    Emma Password="m2dan", User-Service=Login-User

          Ascend-Menu-Item="show ip stats;Display IP Stats",

          Ascend-Menu-Item="ping 1.2.3.4;Ping server",

          Ascend-Menu-Item="telnet 10.2.4.5; Telnet to Ken's machine",

          Ascend-Menu-Item="show arp;Display ARP Table"

          Ascend-Menu-Selector="                              Option:"

The terminal server displays this text:

    1. Display IP Stats     3. Telnet to Ken's machine

    2. Ping server          4. Display ARP Table.

                                  Option:

Note that the valid user input in this example is still 1 through 4, or q to quit.

See Also: Ascend-Menu-Item (206)

## Ascend-Metric (225)

Description: The Ascend-Metric attribute enables you to specify the virtual hop count of an IP route.

If there are two routes available to a single destination network, you can ensure that the MAX uses any available nailed-up channel before using a switched channel. Simply set the Ascend-Metric attribute to a value higher than the metric of any nailed-up route. The higher the value you enter, the less likely that the MAX will bring the link online. The MAX uses the lowest metric.

Usage: You can specify a number between 1 and 15. This value is the virtual hop count. The default value is 7.

Dependencies: Keep this additional information in mind:

- The Ascend-Metric attribute does not apply to bridged connections, such as Combinet links.

- The hop count includes the metric of each switched link in the route.

Example: If a route to a station takes three hops over nailed-up lines, and Ascend-Metric=4 in a user profile that reaches the same station, the MAX does not bring the user's link online. However, if the link is already online, the MAX does not use the nailed-up line.

See Also: Ascend-Route-IP (228)
Framed-Route (22)

## Ascend-Minimum-Channels (173)

Description: The Ascend-Minimum-Channels attribute specifies the minimum number of channels an MP+ call maintains.

Usage: You can specify a number between 1 and 32. The default value is 1.

Dependencies: This attribute applies only to MP+ calls.

For optimum MP+ performance, both sides of a connection must set these values to the same number:

- The base channel count, as specified by Base Ch Count (in the Connection profile) or Ascend-Base-Channel-Count (in RADIUS)

- The minimum channel count, as specified by Min Ch Count (in the Answer profile or Connection profile) or Ascend-Minimum-Channels (in RADIUS)

- The maximum channel count, as specified by Max Ch Count (in the Answer profile or Connection profile) or Ascend-Maximum-Channels (in RADIUS)

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-Modem-PortNo (120)

Description: Specifies, for inclusion in an accounting Stop record, the modem used for the call.

Usage: The MAX sends Ascend-Modem-PortNo as part of an accounting Stop record. The attribute does no appear in a user profile.

Dependencies: Because the MAX designates a modem by slot card and port, you must consider the value of Ascend-Modem-SlotNo.

See Also: Ascend-Modem-SlotNo

## Ascend-Modem-SlotNo (Attribute 121)

Description: Specifies, for inclusion in an accounting Stop record, the slot containing the modem used for the call.

Usage: The MAX sends Ascend-Modem-SlotNo as part of an accounting Stop record. The attribute does not appear in a user profile.

Dependencies: Because the MAX designates a modem by slot card and port, you must consider the value of Ascend-Modem-PortNo

See Also: Ascend-Modem-PortNo

## Ascend-MPP-Idle-Percent (254)

Description: The Ascend-MPP-Idle-Percent attribute specifies a percentage of bandwidth utilization below which the MAX clears a single-channel MP+ call.

Usage: Specify an integer between 0 and 99. The default value is 0 (zero). This setting causes the MAX to ignore bandwidth utilization when determining whether to clear a call.

Dependencies: Keep this additional information in mind:

- MP+ must be the selected encapsulation method for the profile (Framed-Protocol=MPP).

- If either end of a connection sets the Ascend-MPP-Idle-Percent attribute or Idle Pct parameter to 0 (zero), the MAX ignores bandwidth utilization when determining when to clear a call.

- Bandwidth utilization must fall below this percentage on both sides of the connection before the MAX clears the call.

- If the device at the remote end of the link enters an Ascend-MPP-Idle-Percent setting lower than the value you specify, the MAX does not clear the call until bandwidth utilization falls below the lower percentage.

- If the time set by the Ascend-Idle-Limit expires, the call disconnects whether or not bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting.

- When bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting, the call disconnects regardless of whether the time specified by the Ascend-Idle-Limit attribute has expired.

- Because the Ascend-MPP-Idle-Percent attribute is dependent on traffic levels on both sides of the connection, we recommend that you use the Ascend-Idle-Limit attribute in preference to it.

See Also: Ascend-Idle-Limit (244)
Ascend-Preempt-Limit (245)

## Ascend-Multicast-Client (152)

Description: The Ascend-Multicast-Client attribute specifies when the user is a multicast client of the MAX.

Usage: You can specify one of these values:

- Multicast-No (0)

  This setting indicates that the user is not a multicast client of the MAX.

- Multicast-Yes (1)

  This setting indicates that the user is a multicast client of the MAX.

Dependencies: This attribute applies solely to the IP-only release of the MAX 4000.

See Also: Ascend-Multicast-Rate-Limit (153)

## Ascend-Multicast-GLeave-Delay

Description: Specifies the number of seconds the MAX waits before forwarding an IGMP version 2 `leave group` message from a multicast client.

Usage: Specify a number of seconds from 0 to 120. The default is 0 (zero). If you specify a value other than the default, and the MAX receives a `leave group` message, the unit sends an IGMP query to the WAN interface or client from which it received the `leave group` message. If the MAX does not receive a response from an active multicast client from the same group, it sends a `leave group` message when the time you specify expires.

If you accept the default, the MAX forwards a `leave group` message immediately. If users might establish multiple multicast sessions for identical groups, set Ascend-Multicast-GLeave-Delay to a value of 10 to 20 seconds.

Dependencies: Ascend-Multicast-GLeave-Delay applies only if you set Multicast-
Forwarding=Yes in the IP-Global profile, and Multicast-Allowed=Yes in the IP-Interface
profile.

See Also: Ascend-Multicast-Client (152).

## Ascend-Multicast-GRP-Leave-Delay

Description: Specifies the amount of seconds the MAX waits before forwarding any IGMP, version 2, `leave group` message from any multicast client. If you specify the default value of zero, the MAX forwards any `leave group` message immediately. If users might establish multiple multicast sessions for identical groups, you should set GRP Leave Delay to a value between 10 and 20 seconds.

Usage: You can specify a number from 0 to 120.

Dependencies: Ascend-Multicast-GRP-Leave-Delay applies only if you set Ethernet > Mod Config > Multicast > Forwarding to Yes and Ethernet > Mod Config > Multicast > Multicast Client to Yes.

## Ascend-Multicast-Rate-Limit (153)

Description: The Ascend-Multicast-Rate-Limit attribute specifies how many seconds the MAX waits before accepting another packet from a multicast client. To prevent multicast clients from creating response storms to multicast transmissions, you configure the user profile to limit the rate at which the MAX accepts packets from clients.

Usage: Specify an integer. If you set the attribute to 0 (zero), the MAX does not apply rate limiting. The default value is 100. The MAX discards any subsequent packets it receives in the window you specify.

Dependencies: This attribute applies solely to the IP-only release of the MAX 4000.

See Also: Ascend-Multicast-Client (152)

## Ascend-Multilink-ID (187)

Description: The Ascend-Multilink-ID attribute specifies the ID number of the Multilink bundle when the session closes. A Multilink bundle is a multichannel MP or MP+ call. Each online channel of the MP or MP+ call is a session.

The MAX sends Ascend-Multilink-ID in an Accounting-Request packet when all of these conditions are true:

- The session was authenticated.

- The session has ended (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Multilink-ID does not appear in a user profile and has no default value.

See Also: Ascend-Num-In-Multilink (188)

## Ascend-Netware-timeout (223)

Description: The Ascend-Netware-Timeout attribute specifies how long in minutes the MAX responds to NCP watchdog requests on behalf of IPX clients on the other side of an offline IPX bridging connection. Responding to watchdog requests on behalf of clients is commonly called watchdog spoofing.

Usage: Specify an integer between 0 and 65535. The default value is 0 (zero). This default allows the MAX to respond to watchdog requests without a time limit.

The timer begins counting down as soon as the WAN bridging link goes offline. At the end of the selected time, the MAX releases the client-server connections. If there is a reconnection of the WAN session, the MAX cancels the timeout.

Dependencies: Ascend-Netware-timeout applies to IPX bridging connections when the MAX is on the server LAN and not on the client LAN-that is, when Ascend-Handle-IPX=
Handle-IPX-Server.

See Also: Ascend-Handle-IPX (222)

## Ascend-Number-Sessions (202)

Description: The Ascend-Number-Sessions attribute specifies the number of active user sessions of a given class (as specified by the Class attribute). In the case of multichannel calls, such as MP+ calls, each separate connection counts as a session.

Usage: The Ascend-Number-Sessions attribute has a compound value. The first part specifies a user-session class. The second part reports the number of active sessions in that class.

In the MAX, you can set the Sess Timer parameter in the Ethernet > Mod Config > Accounting menu to send accounting requests at regular intervals. At the specified interval, the MAX reports the number of open sessions by sending an Ascend-Event-Request packet (code 33). This packet contains an NAS-Identifier attribute, an Ascend-Event-Type attribute, and one or more Ascend-Number-Sessions attributes. The authentication server must send back an Ascend-Event-Response packet (code 34) with the correct identifier to the MAX.

In addition, you can set the Sess Timer parameter in the Ethernet > Mod Config > Auth menu to send requests to the authentication server at regular intervals. In a session event when Auth=RADIUS/LOGOUT, the MAX sends values for Password, NAS-Identifier, Ascend-Event-Type, and Ascend-Number-Sessions in an Ascend-Event-Request packet (code 33). The authentication server must send back an Ascend-Event-Response packet (code 34) with the correct identifier to the MAX.

Dependencies: The MAX sends the Ascend-Number-Sessions attribute in Ascend-Event-Request packets. Only RADIUS daemons you customize to recognize this packet code respond these request packets from the MAX. Other daemons ignore it. Therefore, both the standard Livingston RADIUS daemon and the Ascend daemon ignore this attribute.

When modifying the daemon, make sure that it recognizes an Ascend-Event-Request packet in this format:

    Code (8-bit)=33

    Identifier (8-bit)

    Length (16-bit)

    Authenticator (48-bit for an accounting server, 64-bit for an

    authentication server)

    List of attributes

Example: Suppose that the MAX has three classes of clients: Class-1, Class-2, and Class-3. At the time of the sessions report, there are eight active sessions: three Class-1 sessions, four Class-2 sessions, and one Class-3 session. The accounting packet the MAX sends back to the RADIUS accounting server has three Ascend-Number-Session attributes, one for each of these
class/session pairs.

See Also: Ascend-Event-Type (150)
Class (25)

## Ascend-Num-In-Multilink (188)

Description: The Ascend-Num-In-Multilink attribute specifies the number of sessions remaining in a Multilink bundle when the session closes. A Multilink bundle is a multichannel MP or MP+ call. Each online channel of the MP or MP+ call is a session.

The MAX sends Ascend-Num-In-Multilink in an Accounting-Request packet when all of these conditions are true:

- The session was authenticated.

- The session has ended (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Num-In-Multilink does not appear in a user profile and has no default value.

See Also: Ascend-Multilink-ID (187)

## Ascend-Numbering-Plan-ID (105)

Description: Specifies the NumberPlanID field in the called party's information element. NumPlanID is used for outbound calls made by the MAX on PRI lines so that the switch can properly interpret the phone number dialed. This parameter specifies

Usage: Ask your PRI provider for details on when to use each of the following settings.:

- Unknown-Numbering-Plan (0) specifies that NumberPlanID=0.

- ISDN-Numbering-Plan (1, the default) specifies that NumberPlanID=1.

- Private-Numbering-Plan specifies that NumberPlanID=9.

See Also: PRI # Type, Call-by-Call, T1-PRI:NumPlanID (Line profiles) Modem:NumPlanID (System profile).

## Ascend-PPP-Address (253)

Description: The Ascend-PPP-Address attribute specifies the MAX unit's IP address reported to the calling unit during PPP IPCP negotiations.

Usage: Specify an IP address in dotted decimal notation. An IP address consists of four numbers between 0 and 255, separated by periods. The default value is 0.0.0.0. If you accept the default, IPCP negotiates with the value of the IP Adrs parameter in the Ethernet\>Mod Config\>Ether Options menu.

If you specify a valid IP address, IPCP negotiates with that IP address. If you specify 255.255.255.255, IPCP negotiates with the address 0.0.0.0.

Dependencies: You can assign Ascend-PPP-Address a value different from the MAX unit's true IP address, as long as the user requesting access understands that limitation.

## Ascend-PPP-Async-Map (212)

Description: The Ascend-PPP-Async-Map attribute gives the Ascend PPP code the async control character map for the PPP session. The control characters pass through the PPP link as data. Only applications running over the link use this data.

Usage: Specify a 4-byte bitmap to one or more control characters. The async control character map is defined in RFC 1548 and specifies that each bit position represents its ASCII equivalent. The bits are ordered with the lowest bit of the lowest byte being 0. For example, bit 19 corresponds to Control-S (DC3) or ASCII 19.

Example: Your specification might look like this one:

    Emma Password="m2dan", User-Service=Login-User

              Ascend-PPP-Async-Map=19,

              ...

The number 19 translates to 13 hex or 10011 binary. Therefore, NUL (00), SOH (01), and EOT (04) are mapped.

## Ascend-PPP-VJ-1172 (211)

Description: The Ascend-PPP-VJ-1172 attribute instructs the Ascend PPP code to use the 0x0037 value for the VJ compression type. The MAX uses this value only during IPNCP negotiation. The MAX accepts incoming 1172 type options without your setting this option.

RFC 1172 section 5.2 contains an erroneous statement that the VJ compression type value is 0x0037. It should be 0x002d. However, many older PPP implementations use the 0x0037 value when negotiating VJ compression. If you do not specify a value for Ascend-PPP-VJ-1172, the VJ compression type is 0x002d.

Usage: Enter your specification using this format:

    Ascend-PPP-VJ-1172=PPP-VJ-1172

## Ascend-PPP-VJ-Slot-Comp (210)

Description: The Ascend-PPP-VJ-Slot-Comp attribute instructs the Ascend PPP code not to use slot compression when sending VJ-compressed packets.

When you turn on VJ compression, the MAX removes the TCP/IP header, and associates a TCP/IP packet with a connection by giving it a slot ID. The first packet coming into a connection must have a slot ID, but succeeding packets need not have one. If the packet does not have a slot ID, the MAX assumes that it uses the last slot ID. This scenario uses slot ID compression, because the slot ID does not appear in any packet but the first in a stream.

However, there may be times when you want each VJ-compressed packet to have a slot ID. The Ascend-PPP-VJ-Slot-Comp attribute exists for this purpose.

Usage: To specify that no slot compression occurs, set the Ascend-PPP-VJ-Slot-Comp attribute to VJ-Slot-Comp-No (1). If you do not specify a value for Ascend-PPP-VJ-Slot-Comp, and Framed-Compression=Van-Jacobson-TCP-IP, slot compression occurs.

See Also: Framed-Compression (13)

## Ascend-Pre-Input-Octets (190)

Description: The Ascend-Pre-Input-Octets attribute indicates the number of input octets before authentication.

The MAX includes Ascend-Pre-Input-Octets in an Accounting-Request packet when all of these conditions are true:

- The session was authenticated.

- The session has ended (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Pre-Input-Octets does not appear in a user profile. Its default value is 0 (zero).

## Ascend-Pre-Input-packets (192)

Description: The Ascend-Pre-Input-packets attribute indicates the number of input packets before authentication.

The MAX includes Ascend-Pre-Input-packets in an Accounting-Request packet when all of these conditions are true:

- The session was authenticated.

- The session has ended (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Pre-Input-packets does not appear in a user profile. Its default value is 0 (zero).

## Ascend-Pre-Output-Octets (191)

Description: The Ascend-Pre-Output-Octets attribute indicates the number of output octets before authentication.

The MAX includes Ascend-Pre-Output-Octets in an Accounting-Request packet when all of these conditions are true:

- The session was authenticated.

- The session has ended (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Pre-Output-Octets does not appear in a user profile. Its default value is 0 (zero).

## Ascend-Pre-Output-packets (193)

Description: The Ascend-Pre-Output-packets attribute indicates the number of output packets before authentication.

The MAX includes Ascend-Pre-Output-packets in an Accounting-Request packet when all of these conditions are true:

- The session was authenticated.

- The session has ended (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-Pre-Output-packets does not appear in a user profile. Its default value is 0 (zero).

## Ascend-Preempt-Limit (245)

Description: The Ascend-Preempt-Limit attribute specifies the number of idle seconds the MAX waits before using one of the channels of an idle link for a new call.

Usage: Specify an integer between 0 and 65535. The MAX never preempts a call if you enter 0 (zero). The default value is 60.

Dependencies: The Ascend-Preempt-Limit attribute does not apply to nailed-up links.

See Also: Ascend-Idle-Limit (244)
Ascend-MPP-Idle-Percent (254)

## Ascend-Preference (126)

Description: This attribute specifies the preference for a route defined by the Framed-Address attribute in a dial-in or dial-out user profile. Every RADIUS user profile that specifies an explicit IP address using the Framed-Address attribute indicates a static route.

Usage: Specify an integer. The default value is 60. We recommend that you accept this default for dial-in and dial-out user profiles.

Dependencies: Make sure that more desirable routes have a lower preference number. In particular, make sure that routes for connections that are down have a higher preference number than routes for connections that are up. The following table lists the factory default values for route preferences.

#### Route type | #### Default value
--- | ---
Interface | 0
ICMP | 30
RIP | 100
OSPF ASE | 150
OSPF Internal | 10
Static | 60
Down-WAN | 120
Infinite | 225

## Ascend-PreSession-Time (198)

Description: The Ascend-PreSession-Time attribute reports the length of time in seconds from when a call connected to when it completes authentication.

The MAX includes Ascend-PreSession-Time in an Accounting-Request packet when both of these conditions are true:

- The session has ended or has failed to authenticate (Acct-Status-Type=Stop).

- The Auth parameter is not set to RADIUS/LOGOUT.

Usage: Ascend-PreSession-Time does not appear in a user profile. Its default value is 0 (zero).

## Ascend-Primary-Home-Agent (129)

Description: The Ascend-Primary-Home-Agent attribute specifies the first home agent the foreign agent tries to reach when setting up an ATMP tunnel, and indicates the UDP port the foreign agent uses for the link.

The RADIUS server passes the attributes in the mobile node's RADIUS user profile to the foreign agent. The foreign agent sends these attributes when connecting with the home agent.

A mobile node can also connect directly to the home agent. An ATMP-based RADIUS profile that is local to the home agent enables the mobile node to bypass a foreign agent connection, but does not preclude a foreign agent. If both the home agent and the foreign agent have local RADIUS profiles for the mobile node, the node can choose between a direct connection or a tunneled connection through the foreign agent.

Usage: Specify the primary home agent using this syntax:

    Ascend-Primary-Home-Agent="hostname | ip_address [:udp_port]"

- The hostname argument indicates the home agent's symbolic hostname.

- The ip_address argument indicates the home agent's IP address in dotted decimal notation.

  Specify an IP address if a DNS server is not set up for the home agent. You can specify a hostname or an IP address, but not both.

- The optional udp_port argument indicates the UDP port on which the foreign agent communicates with the home agent.

  The default value is 5150.

- The colon (:) separates the hostname or IP address from the UDP port specification.

Example: To specify the home agent max1.home.com at IP address 10.0.0.1, and indicate that the foreign agent should use UDP port 6001, specify one of these lines in the RADIUS user profile:

    Ascend-Primary-Home-Agent="max1.home.com:6001"

    Ascend-Primary-Home-Agent="10.0.0.1:6001"

The following RADIUS profile authenticates a mobile NetWare client that connects directly to the home agent. In this example, the home agent is in gateway mode. It forwards packets from the mobile node across a nailed-up WAN link to the home IPX network.

    Mobile-IPX Password="unit"

         User-Service=Framed-User,

         Ascend-Route-IPX=Route-IPX-Yes,

         Framed-Protocol=PPP,

         Ascend-IPX-Peer-Mode=IPX-Peer-Dialin,

         Framed-IPX-Network=40000000,

         Ascend-IPX-Node-Addr=12345678,

         Ascend-Primary-Home-Agent="max1.home.com:6001",

         Ascend-Secondary-Home-Agent="max2.home.com:6001",

         Ascend-Home-Network-Name="Dave's MAX",

         Ascend-Home-Agent-Password="Pipeline"

Dependencies: Keep this additional information in mind:

- If you specify the Ascend-Home-Agent-UDP-Port attribute on the line immediately following the Ascend-Primary-Home-Agent attribute, you need not specify a value for udp_port.

  By the same token, if you specify a value for the udp_port argument of Ascend-Secondary-Home-Agent, or if you accept the default of 5150, you need not specify the Ascend-Home-Agent-UDP-Port attribute.

- It is preferable to use Ascend-Primary-Home-Agent in place of the Ascend-Home-Agent-IP-Addr attribute in the RADIUS user profile. However, the Stop record will include Ascend-Home-Agent-IP-Addr and not Ascend-Primary-Home-Agent.

- To specify a secondary home agent for use if the primary home agent is unavailable, use the Ascend-Secondary-Home-Agent attribute.

Note: The RADIUS accounting Stop record will include Ascend-Home-Agent-IP-Addr when Ascend-Primary-Home-Agent is present in the user profile.

See Also: Ascend-Home-Agent-Password (184)
Ascend-Home-Agent-UDP-Port (186)
Ascend-Home-Network-Name (185)
Ascend-Secondary-Home-Agent (130)

## Ascend-PRI-Number-Type (226)

Description: The Ascend-PRI-Number-Type attribute specifies the type of phone number the MAX dials.

Usage: You can specify one of these values:

- Unknown-Number (0)

  This setting indicates that the MAX can dial any type of number.

- Intl-Number (1)

  This setting indicates that the MAX dials a number outside the U.S.

- National-Number (2)

  This setting indicates that the MAX dials a number inside the U.S. National-Number is the default.

- Local-Number (4)

  This setting indicates that the MAX dials a number within your Centrex group.

- Abbrev-Number (5)

  This setting indicates that the MAX dials an abbreviated phone number.

## Ascend-PW-Expiration (21)

Description: The Ascend-PW-Expiration attribute specifies an expiration date for a user's password in a user profile.

When the MAX makes an authentication request, the RADIUS server checks the current date against the value of Ascend-PW-Expiration. If the date of the authentication request is a later date than the value of Ascend-PW-Expiration, the user receives a message saying that the password has expired.

You must specify Ascend-PW-Expiration when you first create a user.

Usage: Specify a month, day, and year.

- For the month specification, enter the first three letters of the month in which you want the password to expire, or specify the entire name of the month.

  The month must begin with a capital letter.

- For the day specification, enter one or more digits indicating a valid day of the month.

  The values 2, 02, 002, and 0021 are all valid, but 32 is not.

- For the year specification, enter a four-digit year.

- Separate each part of the date specification using one or more spaces, tabs, or commas.

Dependencies: Keep this additional information in mind:

- If a password expires and the user resets it, the RADIUS server adds the value of
  Ascend-PW-Lifetime to the date on which the user resets the password.

  The resulting date becomes the new value for Ascend-PW-Expiration.

  For example, suppose that Ascend-PW-Lifetime=30, Ascend-PW-Expiration=Jan 1 1997, and today's date is March 1, 1997. If the user resets the password today, the value of Ascend-PW-Expiration becomes today's date + Ascend-PW-Lifetime, or March 31, 1997.

- If the password has not expired, the value of Ascend-PW-Expiration overrides the value of Ascend-PW-Lifetime.

  For example, if on January 1, 1997 you set Ascend-PW-Lifetime=30 and
  Ascend-PW-Expiration=Jan 15 1997, the password expires on January 15, 1997.
  In other words, if the password has not expired, the value of Ascend-PW-Lifetime is
  irrelevant.

Example: Your specification might look like this one:

    Emma Password="m2dan", User-Service=Login-User,
    Ascend-PW-Expiration="Jan 1 1997"

    ...

See Also: Ascend-PW-Lifetime (208)

## Ascend-PW-Lifetime (208)

Description: The Ascend-PW-Lifetime attribute specifies the number of days that a password is valid.

Usage: Specify an integer to indicate the number of days for which the user's password is valid. You can set the Ascend-PW-Lifetime attribute on any line other than the first line of the user profile.

Dependencies: Keep this additional information in mind:

- If a password expires and the user resets it, the RADIUS server adds the value of
  Ascend-PW-Lifetime to the date on which the user resets the password.

  The resulting date becomes the new value for Ascend-PW-Expiration. For example, suppose that Ascend-PW-Lifetime=30, Ascend-PW-Expiration=Jan 1 1997, and today's date is March 1, 1997. If the user resets the password today, the value of Ascend-PW-Expiration becomes today's date + Ascend-PW-Lifetime, or March 31, 1997.

- If the password has not expired, the value of Ascend-PW-Expiration overrides the value of Ascend-PW-Lifetime.

  For example, if on January 1, 1997 you set Ascend-PW-Lifetime=30 and
  Ascend-PW-Expiration=Jan 15 1997, the password expires on January 15, 1997.
  In other words, if the password has not expired, the value of Ascend-PW-Lifetime is
  irrelevant.

- If Ascend-PW-Lifetime is absent, the value of Lifetime-In-Days determines the password duration.

  The Lifetime-In-Days value in the RADIUS dictionary is the default value for
  Ascend-PW-Lifetime. By default, Lifetime-In-Days is 0 (zero). This value means that passwords do not expire.

Example: You might make this specification:

    Emma Password="m2dan", User-Service=Login-User,
    Ascend-PW-Expiration="Jan 1, 1997"

              Ascend-PW-Lifetime=30

See Also: Ascend-PW-Expiration (21)

## Ascend-PW-Warntime (207)

Description: Specifies the number of days before password expiration that the RADIUS server sends a message informing the user that the password will expire. The message appears when the user establishes a connection, and is carried to the MAX in the Reply-Message attribute.

Usage: Specify an integer. The default is 0 (zero), which indicates that no warning message is sent.

Example: Suppose you set Ascend-PW-Warntime=5. Starting five days before the expiration of the password, the RADIUS server sends a message telling the user the number of days until the password expires.

Dependencies: Note that the user might never see a warning message, even though the RADIUS server returns the message to the MAX. This situation can occur if the user is using PPP for authentication (rather than the terminal server), or using a script to exchange information with the terminal server.

See Also: Ascend-PW-Expiration (21) and Ascend-PW-Lifetime (208).

## Ascend-Receive-Secret (215)

Description: The Ascend-Receive-Secret attribute specifies a value that must match the password that the RADIUS server sends it to your MAX from the calling unit.

Usage: You can use the Ascend-Receive-Secret attribute for CACHE-TOKEN or PAP-TOKEN-CHAP authentication. In either case, you can specify up to 20 characters. The default value is null.

- CACHE-TOKEN authentication uses a shared secret, and simplifies the authentication process by caching the user's token for the fixed length of time specified by the Ascend-Token-Expiry attribute.

  During the lifetime of the token, subsequent calls by the user require only CHAP authentication without the use of a hand-held security card. For this type of authentication, set the Ascend-Receive-Secret attribute to the same password as the Send PW parameter in the Connection profile that places the incoming call. The RADIUS server uses this value to authenticate incoming calls from a user while his or her token is cached and alive. The cached token resides on the MAX during the initial security-card authentication process.

- PAP-TOKEN-CHAP authentication uses an encrypted CHAP password with which the answering unit authenticates second and subsequent channels of an MP+ call.

  For this type of authentication, set Ascend-Receive-Secret to the value of the Aux Send PW parameter in the Connection profile at the remote end.

  In PAP-TOKEN-CHAP authentication, you need to verify only the initial connection using a hand-held security card. CHAP verifies any additional channels. That is, whenever the MAX adds channels to a PPP or MP+ call using PAP-TOKEN-CHAP, the calling unit sends the encrypted value of Aux Send PW, and the answering unit checks this password against Ascend-Receive-Secret. The answering unit receives Ascend-Receive-Secret from the RADIUS server when the first channel of the call connects.

Example: This example shows the settings necessary for a user called John to use an Enigma Logic server. The MAX sends the password to the security server for authentication.

    John    Password="SAFEWORD", Ascend-Token-Expiry=90,
    Ascend-Token-Idle=80, Ascend-Token-Immediate=Tok-Imm-Yes

                Ascend-Receive-Secret="shared-secret",

                User-Service=Framed-User,

                Framed-Protocol=MPP,

                Framed-Address=200.0.5.1,

                Framed-Netmask=255.255.255.0

This example shows the settings necessary for a user called Emma to use an Enigma Logic server. Because this profile includes the attribute Ascend-Receive-Secret, the MAX can authenticate additional channels through CHAP without having to go to the SAFEWORD server for authentication.

    Emma    Password="SAFEWORD"

                User-Service=Framed-User,

                Framed-Protocol=MPP,

                Framed-Address=200.0.5.1,

                Framed-Netmask=255.255.255.0,

                Ascend-Receive-Secret="b5XSAM"

See Also: Ascend-Token-Expiry (204)
Ascend-Token-Idle (199)
Ascend-Token-Immediate (200)

## Ascend-Remote-Addr (155)

Description: The Ascend-Remote-Addr attribute specifies the IP address of the numbered interface at the remote end of a link.

Usage: Specify the IP address of the numbered interface. An IP address consists of four numbers between 0 and 255, separated by periods. The default value is 0.0.0.0.

Dependencies: For Ascend-Remote-Addr to apply, you must enable IP for the user profile (Ascend-Route-IP=Route-IP-Yes).

See Also: Ascend-Route-IP (228)

## Ascend-Remove-Seconds (241)

Description: The Ascend-Remove-Seconds attribute specifies the number of seconds that average line utilization (ALU) for transmitted data must fall below the threshold indicated by the Ascend-Target-Util attribute before the MAX begins removing bandwidth from a session. The MAX determines the ALU for a session by using the algorithm specified by the Ascend-History-Weigh-Type attribute.

When utilization falls below the threshold for a period of time greater than the value of the Ascend-Remove-Seconds attribute, the MAX attempts to remove the number of channels specified by the Ascend-Dec-Channel-Count attribute. Using the Ascend-Remove-Seconds attribute prevents the system from continually subtracting bandwidth, and can slow down the process of removing bandwidth.

Usage: Specify a number between 1 and 300. The default value is 10.

Dependencies: Keep this additional information in mind:

- One channel must be up at all times.

- Removing bandwidth cannot cause the ALU to exceed the threshold specified by the Ascend-Target-Util attribute.

- The number of channels remaining cannot fall below the amount specified by the Ascend-Minimum-Channels attribute.

- Ascend-Add-Seconds and Ascend-Remove-Seconds have little or no effect on a system with a high Ascend-Seconds-Of-History value.

  If the value of Ascend-Seconds-Of-History is low, the Ascend-Add-Seconds and Ascend-Remove-Seconds attributes provide an alternative way to ensure that spikes must persist for a certain period of time before the system responds.

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Seconds-Of-History (238)
Ascend-Target-Util (234)

## Ascend-Require-Auth (201)

Description: The Ascend-Require-Auth attribute specifies whether the MAX requires additional authentication after Calling Line ID (CLID) or called-number authentication. Called-number authentication is also known as Dialed Number Information Service (DNIS) authentication.

Usage: You can specify one of these values:

- Not-Require-Auth (0) specifies that additional authentication is not required.

  Not-Require-Auth is the default.

- Require-Auth (1) specifies that additional authentication is required.

  If you require additional authentication, you must configure a two-tiered dial-in setup.

  For additional authentication after CLID authentication, the first-tier dial-in user profile has the following two-line format:

    phonenum Password="Ascend-CLID"

                          Ascend-Require-Auth=Require-Auth

For additional authentication after called-number authentication, the first-tier dial-in user profile has the following two-line format:

    phonenum Password="Ascend-DNIS"

                          Ascend-Require-Auth=Require-Auth

- For calls involving CLID authentication, phonenum represents the calling party's phone number.

- For calls involving called-number authentication, phonenum represents the called number.

- The Password setting specifies that RADIUS authenticates the caller by caller ID or called number, depending on your authentication setup.

- The Ascend-Require-Auth setting specifies that after CLID or called-number
  authentication, additional authentication is required.

  When you set Ascend-Require-Auth=Require-Auth, you should not include any other attributes in the user profile. You must specify the characteristics of the call in the second-tier user profile.

Example: This example shows a two-tiered approach. The first user profile specifies CLID authentication, and indicates that additional authentication will follow. Because Recv Auth=CHAP in the Answer profile, CHAP authentication will follow CLID authentication. The second user profile sets up other attributes for the call.

    5551212      Password="Ascend-CLID"

                       Ascend-Require-Auth=Require-Auth

    Emma      Password="pwd" Caller-Id="5551212"

                  User-Service=Framed-User,

                  Framed-Protocol=PPP,

                  Framed-Address=200.11.12.10,

                  Framed-Netmask=255.255.255.248,

           Ascend-Send-Secret="pwd",

                  ...

## Ascend-Route-Appletalk (118)

Description: Specifies whether AppleTalk routing is enabled for the connection. When AppleTalk routing is enabled, the connection can forward AppleTalk packets.

Usage: Specify one of the following values:

- Route-Appletalk-No (0) disables AppleTalk routing for this user profile.

  The default is No (0).

- Route-Appletalk-Yes (1) enables AppleTalk routing for this user profile.

Dependencies: If you specify Route-Appletalk-Yes, you must set the Ascend- Appletalk-Peer-Mode attribute.

## Ascend-Route-IP (228)

Description: The Ascend-Route-IP attribute specifies whether the MAX enables IP routing for the user profile.

Usage: You can specify one of these values:

- Route-IP-No (0) disables IP routing.

- Route-IP-Yes (1) enables IP routing.

  Route-IP-Yes is the default.

See Also: Framed-Route (22)

## Ascend-Route-IPX (229)

Description: The Ascend-Route-IPX attribute indicates whether the MAX enables IPX routing for the user profile. For PPP and MP+ calls, both ends of the connection must have matching settings to route IPX.

Usage: You can specify one of these values:

- Route-IPX-No (0) disables IPX routing.

  Route-IPX-No is the default.

- Route-IPX-Yes (1) enables IPX routing.

See Also: Ascend-IPX-Alias (224)
Ascend-IPX-Peer-Mode (216)
Ascend-IPX-Route (174)

## Ascend-Secondary-Home-Agent (130)

Description: The Ascend-Secondary-Home-Agent attribute specifies the secondary home agent the foreign agent tries to reach when the primary home agent (specified by Ascend-Primary-Home-Agent) is unavailable. The attribute also indicates the UDP port the foreign agent uses for the link.

Usage: Specify the secondary home agent using this syntax:

    Ascend-Secondary-Home-Agent="hostname | ip_address [:udp_port]"

- The hostname argument indicates the home agent's symbolic hostname.

- The ip_address argument indicates the home agent's IP address in dotted decimal notation.

  Specify an IP address if a DNS server is not set up for the home agent. You can specify a hostname or an IP address, but not both.

- The optional udp_port argument indicates the UDP port on which the foreign agent communicates with the home agent.

  The default value is 5150.

- The colon (:) separates the hostname or IP address from the UDP port specification.

Example: To specify max2.home.com at IP address 10.0.0.2 as the secondary home agent, and indicate that the foreign agent should use UDP port 6002, specify one of these lines in the RADIUS user profile:

    Ascend-Secondary-Home-Agent="max2.home.com:6002"

    Ascend-Secondary-Home-Agent="10.0.0.2:6002"

To specify a primary home agent and a secondary home agent, enter these lines in the RADIUS user profile:

    Ascend-Primary-Home-Agent="max1.home.com:6001"

    Ascend-Secondary-Home-Agent="max2.home.com:6002"

The foreign agent first tries max1.home.com on UDP port 6001. If the name cannot be resolved, or if max1.home.com does not respond, the foreign agent then tries max2.home.com on UDP port 6002.

The RADIUS accounting Stop record will include Ascend-Home-Agent-IP-Addr when Ascend-Secondary-Home-Agent is present in the user profile.

Dependencies: If you specify the Ascend-Home-Agent-UDP-Port attribute on the line immediately following the Ascend-Secondary-Home-Agent attribute, you need not specify a value for udp_port. By the same token, if you specify a value for the udp_port argument of Ascend-Secondary-Home-Agent, or if you accept the default of 5150, you need not specify the Ascend-Home-Agent-UDP-Port attribute.

See Also: Ascend-Home-Agent-Password (184)
Ascend-Home-Agent-UDP-Port (186)
Ascend-Home-Network-Name (185)
Ascend-Primary-Home-Agent (129)

## Ascend-Seconds-Of-History (238)

Description: The Ascend-Seconds-Of-History attribute specifies the number of seconds the MAX uses as a sample for calculating average line utilization (ALU) of transmitted data. The MAX arrives at this average using the algorithm specified by the Ascend-History-Weigh-Type attribute.

The number of seconds you choose for the Ascend-Seconds-Of-History attribute depends on your device's traffic patterns. For example, if you want to average spikes with normal traffic flow, you may want the MAX to establish a longer historical time period. If, on the other hand, traffic patterns consist of many spikes that are short in duration, you may want to specify a shorter period of time. Doing so assigns less weight to the short spikes.

Usage: Specify a number between 1 and 300. The default value is 15 seconds.

Dependencies: Keep this additional information in mind:

- Ascend-Seconds-Of-History applies only to MP+ calls (Framed-Protocol=MPP).

- If you specify a small value for the Ascend-Seconds-Of-History attribute, and increase the values of the Ascend-Add-Seconds attribute and the Ascend-Remove-Seconds attribute relative to the value of Ascend-Seconds-Of-History, the system becomes less responsive to quick spikes.

  The easiest way to determine the proper values for all these attributes is to observe usage patterns. If the system is not responsive enough, the value of Ascend-Seconds-Of-History is too high.

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Target-Util (234)

## Ascend-Send-Auth (231)

Description: The Ascend-Send-Auth attribute specifies the authentication protocol that the MAX requests when initiating a connection using PPP or MP+ encapsulation. The answering side of the connection determines which authentication protocol, if any, the connection uses.

Usage: You can specify one of these values:

- Send-Auth-None (0) indicates that the MAX does not request an authentication protocol for outgoing calls.

Send-Auth-None is the default.

- Send-Auth-PAP (1) indicates that the MAX requests Password Authentication Protocol (PAP).

PAP is a PPP authentication protocol that provides a simple method for the MAX to establish its identity in a two-way handshake. Authentication takes place only upon initial link establishment, and does not use encryption. The remote device must support PAP.

If you specify this setting, the MAX requests PAP authentication, but uses CHAP authentication if the called unit requires CHAP. Choose this setting for non-token card authentication if you want to send your password unencrypted.

- Send-Auth-CHAP (2) indicates that the MAX requests Challenge Handshake Authentication Protocol (CHAP).

CHAP is a PPP authentication protocol that is more secure than PAP. CHAP provides a way for the remote device to periodically verify the identity of the MAX using a three-way handshake and encryption. Authentication takes place upon initial link establishment. A device can repeat the authentication process any time after the connection is made. The remote device must support CHAP.

If you specify this setting, the MAX does not bring up the connection using PAP. Choose this setting for non-token card authentication if you do not wish to send your password unencrypted-that is, if you do not wish to use PAP authentication.

Dependencies: Keep this additional information in mind:

- Ascend-Send-Auth is applicable only to outgoing user profiles in RADIUS.

- The link must use PPP or MP+ encapsulation.

- If you request PAP or CHAP authentication, you must also specify a password using Ascend-Send-Secret or Ascend-Send-Passwd.

See Also: Ascend-Send-Passwd (232)
Ascend-Send-Secret (214)

## Ascend-Send-Passwd (232)

Description: The Ascend-Send-Passwd attribute specifies the password that the RADIUS server sends to the remote end of a connection on an outgoing call.

Usage: Specify a text string containing up to 20 characters. The default value is null.

Dependencies: In a user profile, you can specify either Ascend-Send-Passwd or Ascend-Send-Secret, but not both. Use Ascend-Send-Passwd only if your version of the MAX does not
support Ascend-Send-Secret.

See Also: Ascend-Send-Auth (231)
Ascend-Send-Secret (214)

## Ascend-Send-Secret (214)

Description: The Ascend-Send-Secret attribute specifies the password that the RADIUS server sends to the remote end of a connection on an outgoing call. It is encrypted when passed between the RADIUS server and the MAX.

Usage: Specify a text string containing up to 20 characters. The default value is null.

Dependencies: In a user profile, you can specify either Ascend-Send-Passwd or Ascend-Send-Secret, but not both. Use Ascend-Send-Passwd only if your version of the MAX does not support Ascend-Send-Secret.

See Also: Ascend-Send-Auth (231)
Ascend-Send-Passwd (232)

## Ascend-Session-Svr-Key (151)

Description: The Ascend-Session-Svr-Key attribute enables the MAX to match a user session with a client request to perform certain operations, such as disconnecting a session or changing a session's filters.

The client sends Ascend-Session-Svr-Key to the RADIUS server in a Disconnect-Request or Change-Filter-Request packet when it initiates an operation. In addition, Ascend-Session-Svr-Key appears in a RADIUS Accounting-Start packet when a session starts.

Usage: Specify up to 16 characters. The default value is null.

Dependencies: The client sends the Ascend-Session-Svr-Key attribute only if Session Key=Yes in the Ethernet > Mod Config > RADIUS Server menu.

## Ascend-Shared-Profile-Enable (128)

Description: Enables or disables sharing of a RADIUS user file for multiple incoming users.

Note: To apply Shared Profiles on a per RADIUS user profile basis, you have to disable profile sharing on a system-wide basis by setting Ethernet > Mod Config > Shared Prof = No on the MAX

Usage: You can specify one of the following settings:

- Ascend-Shared-Profile-Enable = Shared-Profile-Yes specifies that multiple incoming calls can share this RADIUS user profile.

- Ascend-Shared-Profile-Enable = Shared-Profile-No specifies that multiple incoming calls cannot share a local Connection Profile.

  The default value is Shared-Profile-No

Dependencies: For the Ascend-Shared-Profile-Enable attribute to apply, you must disable shared profiles for the MAX as a whole with Ethernet > Mod Config > Shared Prof = No.

## Ascend-Target-Util (234)

Description: The Ascend-Target-Util attribute specifies the percentage of bandwidth use at which the MAX adds or subtracts bandwidth.

Usage: Specify an integer between 0 and 100. The default value is 70.When the value is 70%, the device adds bandwidth when it exceeds a 70 percent utilization rate, and subtracts bandwidth when it falls below that number.

Dependencies: Keep this additional information in mind:

- When selecting a target utilization value, monitor how the application behaves when using different bandwidths. For example, an application might be able to use 88% of a 64-kbps link, but only 70% of a 256-kbps link. Also, monitor the application at different loads.

- Ascend-Target-Util applies only if the link is using MP+ encapsulation
  (Framed-Protocol=MPP).

See Also: Ascend-Add-Seconds (240)
Ascend-Base-Channel-Count (172)
Ascend-DBA-Monitor (171)
Ascend-Dec-Channel-Count (237)
Ascend-History-Weigh-Type (239)
Ascend-Inc-Channel-Count (236)
Ascend-Maximum-Channels (235)
Ascend-Minimum-Channels (173)
Ascend-Remove-Seconds (241)
Ascend-Seconds-Of-History (238)

## Ascend-Telnet-Profile (91)

Description: Specifies the name of the Security profile to use for the authenticated Telnet session.

Usage: Specify the name of a Security profile. The default is null.

Example: `Ascend-Telnet-Profile="Full Access"`

See Also: Ascend-Host-Info (252), Login-Host (14).

## Ascend-Third-Prompt (213)

Description: In the MAX configuration interface, the 3rd Prompt parameter enables you to specify an additional prompt for user input in the terminal server interface after the login and password prompts. The MAX passes the information the user enters to the RADIUS server as the Ascend-Third-Prompt attribute.

Usage: The Ascend-Third-Prompt attribute can contain up to 80 characters and does not appear in a user profile. If the user enters more than 80 characters, the MAX truncates the input to 80. If the user does enter any characters, the MAX sets the attribute to null.

## Ascend-Token-Expiry (204)

Description: The Ascend-Token-Expiry attribute specifies the lifetime in minutes of a cached token.

CACHE-TOKEN authentication uses a shared secret, and simplifies the authentication process by caching the user's token for the fixed length of time specified by the Ascend-Token-Expiry attribute.When the cached token is still alive, CHAP authenticates subsequent CACHE-TOKEN access requests from the same user without the use of a hand-held security card. When the cached token has expired, the ACE or SAFEWORD server authenticates CACHE-TOKEN access requests.

Usage: On the first line of the user profile, specify an integer representing the lifetime of the cached token in minutes. The default value is 0 (zero). If you accept the default, the MAX rejects subsequent CACHE-TOKEN requests from the same user.

Example: The following two-line example sets up CACHE-TOKEN authentication with a 90-minute token cache. Notice that the Ascend-Token-Expiry attribute must appear on the first line of the profile, along with the user name and ACE or SAFEWORD password:

Connor Password="ACE", Ascend-Token-Expiry=90

Ascend-Receive-Secret="shared-secret",

...

See Also: Ascend-Token-Idle (199)
Ascend-Token-Immediate (200)

## Ascend-Token-Idle (199)

Description: The Ascend-Token-Idle attribute specifies the maximum length of time in minutes a cached token can remain alive between authentications.

Usage: On the first line of the user profile, specify an integer representing the maximum length of time in minutes that a cached token can remain alive. The default value is o (zero). If you accept this default, the cached token remains alive until the value of the Ascend-Token-Expiry attribute causes it to expire.

Dependencies: Typically, the value of Ascend-Token-Idle is lower than the value of
Ascend-Token-Expiry.

Example: The following two-line example sets up CACHE-TOKEN authentication with a 90-minute token cache and an 80-minute idle limit. Notice that the Ascend-Token-Idle attribute must appear on the first line of the profile:

Jim Password="ACE", Ascend-Token-Expiry=90, Ascend-Token-Idle=80

Ascend-Receive-Secret="shared secret"

See Also: Ascend-Token-Expiry (204)
Ascend-Token-Immediate (200)

## Ascend-Token-Immediate (200)

Description: The Ascend-Token-Immediate attribute specifies how RADIUS treats the password it receives from a login user when the user profile specifies a hand-held security card server. Use this attribute in an ACE or SAFEWORD user profile that contains the setting User-Service=Login-User.

Usage: You can specify one of these values:

- Tok-Imm-No (0) indicates that the MAX ignores the password.

  Choose this value for a security server that requires that a user enter a challenge using a security card before the security server derives a password.

  Tok-Imm-No is the default.

- Tok-Imm-Yes (1) specifies that the MAX sends the password to the security server for authentication.

Dependencies: The Ascend-Token-Immediate attribute does not work with CHAP authentication.

Example: This example shows a portion of a user profile that requires the MAX to send the password to the ACE server. The login-user derives the password from a hand-held security card:

    Connor    Password="ACE", Ascend-Token-Immediate=Tok-Imm-Yes

                    Ascend-Receive-Secret="shared-secret",

                    User-Service=Login-User,

                    ...

See Also: Ascend-Token-Expiry (204)
Ascend-Token-Idle (199)

## Ascend-Transit-Number (251)

Description: The Ascend-Transit-Number attribute specifies the U.S InterExchange Carrier (IEC) you use for long distance calls over a T1 PRI line.

Usage: Specify the same digits you use to prefix a phone number you dial over an ISDN BRI line, T1 access line, or voice interface:

- 288 selects AT&T.

- 222 selects MCI.

- 333 selects Sprint.

The default value is null. If you accept the default, the MAX uses any available IEC for long-distance calls.

## Ascend-TS-Idle-Limit (169)

Description: The Ascend-TS-Idle-Limit attribute specifies the number of seconds that a terminal server connection must be idle before the MAX disconnects the session.

Usage: You can specify a value between 0 and 65535.The default value is 120. A setting of 0 (zero) means that the line can be idle indefinitely.

Dependencies: Ascend-TS-Idle-Limit does not apply if you are using a Frame Relay or raw TCP connection, or if Ascend-TS-Idle-Mode=TS-Idle-None.

See Also: Ascend-TS-Idle-Mode (170)

## Ascend-TS-Idle-Mode (170)

Description: The Ascend-TS-Idle-Mode attribute specifies whether the MAX uses a terminal server idle timer and, if so, whether both the user and host must be idle before the MAX disconnects the session.

Usage: You can specify one of these settings:

- TS-Idle-None (0)

  This setting indicates that the MAX does not disconnect the session no matter how long the line is idle. This setting disables the idle timer.

- TS-Idle-Input (1)

  This setting indicates that the MAX disconnects the session if the user is idle for a length of time greater than the value of the Ascend-TS-Idle-Limit attribute.

  TS-Idle-Input is the default.

- TS-Idle-Input-Output (2)

  This setting indicates that the MAX disconnects the session if both the user and the host are idle for a length of time greater than the value of the Ascend-TS-Idle-Limit attribute.

Example: This profile specifies that the user must be idle for 90 seconds before the MAX disconnects the session.

    Default Password="UNIX"

            User-Service=Login-User,

            Ascend-TS-Idle-Limit=90,

            Ascend-TS-Idle-Mode=TS-Idle-Input

Dependencies: Ascend-TS-Idle-Mode does not apply if you are using a Frame Relay or raw TCP connection.

See Also: Ascend-TS-Idle-Limit (169)

## Ascend-User-Acct-Base (142)

Description: The Ascend-User-Acct-Base attribute specifies whether the numeric base of the RADIUS Acct-Session-ID attribute is 10 or 16.

Usage: Specify one of these settings:

- Ascend-User-Acct-Base-10 indicates that the numeric base is 10.

  The default is 10.

- Ascend-User-Acct-Base-16 indicates that the numeric base is 16.

For example, when you set Ascend-User-Acct-Base=Ascend-User-Acct-Base-10, the MAX presents a typical session ID to the accounting server in this way:

`"1234567890"`

When you set Ascend-User-Acct-Base=Ascend-User-Acct-Base-16, the MAX presents the same session ID in this way:

`"499602D2"`

Dependencies: Changing the value of Ascend-User-Acct-Base while sessions are active results in inconsistent reporting between the Start and Stop records.

See Also: Ascend-User-Acct-Host (139)
Ascend-User-Acct-Key (141)
Ascend-User-Acct-Port (140)
Ascend-User-Acct-Time (143)
Ascend-User-Acct-Type (138)

## Ascend-User-Acct-Host (139)

Description: The Ascend-User-Acct-Host attribute specifies the IP address of the RADIUS accounting server to use for this connection.

Usage: Specify an IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255. The default value is 0.0.0.0.

See Also: Ascend-User-Acct-Base (142)
Ascend-User-Acct-Key (141)
Ascend-User-Acct-Port (140)
Ascend-User-Acct-Time (143)
Ascend-User-Acct-Type (138)

## Ascend-User-Acct-Key (141)

Description: The Ascend-User-Acct-Key attribute specifies the RADIUS client password as it appears in the clients file.

Usage: Specify a text string. The default value is null.

See Also: Ascend-User-Acct-Base (142)
Ascend-User-Acct-Host (139)
Ascend-User-Acct-Port (140)
Ascend-User-Acct-Time (143)
Ascend-User-Acct-Type (138)

## Ascend-User-Acct-Port (140)

Description: The Ascend-User-Acct-Port attribute specifies a UDP port number for the connection between the user and the RADIUS accounting server.

Usage: Specify the UDP port number you indicated for the authentication process of the daemon in /etc/services. Or, if you used the incr keyword to the -A option when starting the daemon, specify the number of the UDP port for authentication services +1. You can specify a number between 1 and 32767.

See Also: Ascend-User-Acct-Base (142)
Ascend-User-Acct-Host (139)
Ascend-User-Acct-Key (141)
Ascend-User-Acct-Time (143)
Ascend-User-Acct-Type (138)

## Ascend-User-Acct-Time (143)

Description: The Ascend-User-Acct-Time attribute specifies the number of seconds the MAX waits for a response to a RADIUS accounting request from the RADIUS accounting server for this connection.

Usage: Specify an integer between 1 and 10. The default value is 0 (zero).

See Also: Ascend-User-Acct-Base (142)
Ascend-User-Acct-Host (139)
Ascend-User-Acct-Key (141)
Ascend-User-Acct-Port (140)
Ascend-User-Acct-Type (138)

## Ascend-User-Acct-Type (138)

Description: The Ascend-User-Acct-Type attribute specifies the RADIUS accounting server(s) to use for this connection.

Usage: You can specify one of these settings:

- Ascend-User-Acct-None (0)

  This setting indicates the MAX sends accounting information to the RADIUS server specified by the Acct Host #1, Acct Host #2, or Acct Host #3 parameter in the Ethernet > Mod Config > Accounting menu, depending on which server is available. This server is known as the default server.

  The default value is Ascend-User-Acct-None (0).

- Ascend-User-Acct-User (1)

  This setting indicates that the MAX sends accounting information to the RADIUS server specified by the Ascend-User-Acct-Host attribute in the RADIUS user profile.

- Ascend-User-Acct-User-Default (2)

  This setting indicates that the MAX sends accounting information both to the RADIUS server specified by the Ascend-User-Acct-Host attribute in the RADIUS user profile and to the default server.

See Also: Ascend-User-Acct-Base (142)
Ascend-User-Acct-Host (139)
Ascend-User-Acct-Key (141)
Ascend-User-Acct-Port (140)
Ascend-User-Acct-Time (143)

## Ascend-VRouter-Name (102)-TNT only

Description: Specifies the name of a defined Virtual Router (VRouter). Specifying the VRouter name in a RADIUS user profile groups the WAN interfaces with the VRouter.

Usage: Specify the name of a VRouter. The default is null, which specifies that the global VRouter is in use.

Example: The following user profiles specifies a VRouter called `Corpa`:

    bob Password="bob", User-Service=Framed-User

       Framed-Protocol=PPP,

       Ascend-VRouter-Name="Corpa"

Example: Ascend-IP-Pool-Definition (217) and Framed-Route (22).

## Ascend-Xmit-Rate (255)

Description: Specifies the transmit baud rate for the connection.

Dependencies: The Ascend-Xmit-Rate attribute is sent in Accounting-Request packets at the end of a session under these conditions:

- The Accounting-Request packet has Acct-Status-Type=Stop.

- The Auth parameter is set to a value other than RADIUS/LOGOUT.

The attribute is still sent with the Accounting-Request packet whether the connection is authenticated or not.

## Caller-Id (31)

Description: The Caller-Id attribute specifies the calling party number for Calling Line ID (CLID) authentication, indicating the phone number of the user that wants to connect to the MAX.

- If you set Id Auth=Prefer in the Ethernet > Answer menu, the MAX checks the calling party's phone number against the value of the Caller-Id attribute whenever CLID authentication is available.

  If a match is found, and no further authentication is required, the MAX accepts the call.

- If you set Id Auth=Require in the Ethernet > Answer menu, the calling party's phone number must match the value of the Caller-Id attribute before the MAX can answer the call.

  If CLID is not available, the MAX does not answer the call.

Usage: Specify a telephone number. You can indicate up to 37 characters, limited to the following: 1234567890()[]!z-*#|

The default value is null.

Example: This user profile specifies CLID authentication using name, password, and caller ID:

    Emma  Password="test", Caller-Id="123456789"

                User-Service=Framed-User,

                Framed-Protocol=PPP,

                Framed-Address=255.255.255.254,

                Framed-Netmask=255.255.255.255,

                Ascend-Assign-IP-Pool=1,

                Ascend-Route-IP=Route-IP-Yes,

                Ascend-Idle-Limit=30

## Challenge-Response (3)

Description: The Challenge-Response attribute specifies the value that a Challenge Handshake Authentication Protocol (CHAP) user provides in response to the password challenge.

Usage: The MAX sets the Challenge-Response value and sends it in Access-Request packets. The default value is null.

## Change-Password (17)

Description: The MAX and the RADIUS server use the Change-Password attribute to change an expired password.

When a user specifies an expired password, RADIUS prompts the user for a new password. When the user enters the new password, the MAX sends an Access-Password-Request packet that contains both the old password (as the value of the Change-Password attribute), and the new password (as the value of the Password attribute).

If the RADIUS server accepts the new password, it tries to edit the users file and replace the expired password with the new one. Note that the RADIUS server can make this change only in the flat file. It cannot make this change in the database version of the users file.

Usage: Change-Password does not appear in a user profile and has no default value.

## Class (25)

Description: The Class attribute enables access providers to classify user sessions, such as for the purpose of billing users depending on the service option they choose.

If you include the Class attribute in the RADIUS user profile, the RADIUS server sends it to the MAX in the Access-Accept packet when the session begins. The MAX then includes Class in Accounting-Request packets sent to the RADIUS accounting server under these conditions:

- Whenever a session starts

- Whenever a session stops (as long as the Auth parameter is not set to RADIUS/LOGOUT)

Keep in mind that the accounting entries give the class on a per-user and per-session basis. The Ascend-Number-Sessions attribute reports information on all user sessions-that is, on the number of current sessions of each class.

In addition, suppose the MAX starts CLID authentication by sending an Access-Request packet and receives the Class attribute in an Access-Accept packet. If the MAX requires further authentication, it includes Class in the Access-Request packet.

Usage: Specify an alphanumeric text string containing up to 253 characters. The default value is null.

See Also: Ascend-Number-Sessions (202)

## Client-Port-DNIS (30)

Description: The Client-Port-DNIS attribute specifies the called-party number, indicating the phone number the user dialed to connect to the MAX. DNIS stands for Dialed Number Information Service. You use this attribute to set up called-number authentication, also known as DNIS authentication.

Usage: Specify the number the remote end dials to reach the MAX, limiting your specification to these characters:

1234567890()[]!z-*#|

You can specify up to 18 characters. The default value is null.

Typically, the phone numbers different callers can use to reach the MAX share a group of digits. For example, a local caller may dial 555-1234, while a long distance caller may dial 1-415-555-1234. In cases such as this, you need only specify the rightmost digits the calls have in common. In this case, you would need to specify only 1234.

Example: This user profile sets up called-number authentication in addition to name and password authentication:

Clara-p50 Password="Ascend", Client-Port-DNIS=1234

User-Service=Framed-User,

Framed-Protocol=MPP,

Framed-Address=200.10.11.12,

Framed-Netmask=255.255.255.248

## Filter-Id (11)

Description: This attribute specifies a local data filter or local data firewall profile applied in the current RADIUS user profile. The MAX uses the filter only when it places a call or receives a call using the profile that includes the filter definition. The filters and firewalls specified in the RADIUS user profile are applied for that user the next time the RADIUS user profile is loaded to the MAX.

Usage: You can specify any number of data filters and firewalls. Filter entries apply on a first-match basis, so the order in which you enter the filter entries is significant. If you make changes to a filter in a RADIUS user profile, the changes do not take effect until a call uses that profile.

Example: The following are examples of how a RADIUS user profile can be set up to refer to a filter profile defined on the MAX, and to refer to a firewall defined using SAM.

Assume the following two filter profiles are already set up on the MAX are:

    Filter-id=6

    Name=DisAllowPing

    Out filter 01...Valid=Yes

    Out filter 01...Type=IP

    Out filter 01...Ip...Forward=No

    Out filter 01...Ip...Protoco1=6

    Filter-id=9

    Name=DisAllowTelnet

    Out filter 01...Valid=Yes

    Out filter 01...Type=IP

    Out filter 01...Ip...Forward=No

    Out filter 01...Ip...Protocol=6

    Out filter 01...Ip...Src Port Cmp-Eql

    Out filter 01...Ip...Src Port #=23

The RADIUS user profile is:

    someuser      Password="ascend"

                          User-Service=Framed-User,

                          Filter-Id="6",

                          Filter-Id="9",

                          Ascend-Data-Filter="ip out forward",

                          Framed-Protocol=PPP,

                          Framed-Address=10.11.1.1,

                          Framed-Netmask=255.255.255.0,

                          State="p"

    The first filter is applied, disallowing pings. The second
    filter disallows Telnet packets. The Ascend-Data-Filter entry
    allows all IP packets to be forwarded. All pings and Telnet
    packets will be blocked, but other IP data packets are allowed.

The following is an example of a RADIUS user profile that specifies a firewall set up in SAM:

Example: someuser Password="ascend"
User-Service=Framed-User,
Filter-Id="101",
Framed-Protocol=PPP,
Framed-Address=10.11.1.1,
Framed-Netmask=255.255.255.0,
State="p"

See Also: Ascend-Data-Filter, Ascend-Call-Filter

## Framed-Address (8)

Description: The Framed-Address attribute specifies the IP address of the caller in a user profile.

RADIUS can authenticate an incoming call by matching its IP address to one you specify in the RADIUS user profile. In addition, if the remote end requires an IP address on an outgoing call, and does not assign one dynamically, you must specify it in the user profile.

Usage: Specify an IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255. The default value is 0.0.0.0. An answering user profile with this setting matches all IP addresses.

Dependencies: Every Connection profile and RADIUS user profile that specifies an explicit IP address is a static route.

See Also: Framed-Netmask (9)

## Framed-Compression (13)

Description: The Framed-Compression attribute turns TCP/IP header compression on or off.

Usage: To turn on TCP/IP header compression, specify Van-Jacobson-TCP-IP. This setting applies only to packets in TCP applications, such as Telnet, and turns on header compression for both sides of the link. By default, this attribute does not turn on header compression.

Dependencies: Turning on header compression is most effective in reducing overhead when the data portion of the packet is small.

See Also: Ascend-Link-Compression (233)

## Framed-IPX-Network (23)

Description: The Framed-IPX-Network attribute specifies a virtual IPX network required for the Ascend Tunnel Management Protocol (ATMP) home agent to route IPX packets to the mobile node. When specified in a user profile, the Framed-IPX-Network attribute instructs the answering unit to advertise an additional IPX route.

Usage: Specify the IPX network number of the IPX router at the remote end of the connection. The default value is null.

RADIUS requires that Framed-IPX-Network have a decimal value (base 10), but IPX network numbers generally appear as hexadecimal values (base 16). In order to give this attribute a value, you must convert the hexadecimal IPX network number to decimal format for use in the user profile. For example, if the IPX network number is 00001387, you must convert it to the decimal 00004999. This requirement does not apply for the IPX node address, which appears as a 12-digit string enclosed in double-quotes.

See Also: Ascend-IPX-Node-Addr (182)

## Framed-MTU (12)

Description: The Framed-MTU attribute specifies the maximum number of bytes the MAX can receive in a single packet on a PPP, Frame Relay, EU-UI, or EU-RAW link.

Usage: The default value is 1524. You should accept this default unless the device at the remote end of the link cannot support it. If the administrator of the remote network specifies that you must change this value, specify a number between 1 and 1524 (for a PPP, EU-UI, or EU-RAW link) or between 128 and 1600 (for a Frame Relay link).

## Framed-Netmask (9)

Description: The Framed-Netmask attribute specifies a subnet mask for the caller at Framed-Address.

Usage: Specify an IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255. The default value is 0.0.0.0. If you accept this default, the MAX assumes a default subnet mask based on the class of the address

Table 9-16. IP address classes and default subnet masks

#### Class | #### Address range | #### Network bits
--- | --- | ---
Class A | 0.0.0.0 127.255.255.255 | 8
Class B | 128.0.0.0 191.255.255.255 | 16
Class C | 192.0.0.0 223.255.255.255 | 24
Class D | 224.0.0.0 239.255.255.255 | N/A
Class E (reserved) | 240.0.0.0 247.255.255.255 | N/A

, as shown in Table 9-16.

See Also: Framed-Address (8)

## Framed-Protocol (7)

Description: The Framed-Protocol attribute specifies the type of framed protocol the link can use. When you set this attribute, the link cannot use any other type of framed protocol.

This attribute can appear in both an Access-Request and Access-Accept packet. However, it does not appear in an Access-Request packet if Auth Send Attr 6, 7=No in the Ethernet> Mod Config > Auth menu.

Usage: Table 9-17 lists the values you can specify for Framed-Protocol.

Table 9-17. Framed-Protocol settings

#### Setting | #### Incoming call | #### Outgoing call
--- | --- | ---
PPP (1) | A user requesting access can dial in using Multilink Protocol Plus (MP+), Multilink Protocol (MP), or Point-to-Point Protocol (PPP) framing. A user requesting access can also dial in unframed, and then change to PPP framing. If the user dials in using any other type of framing, the MAX rejects the call. | Outgoing calls use PPP framing.
SLIP (2) | A user requesting access can dial in unframed and change to SLIP framing. SLIP requires that a user dial in without using a framed protocol before changing to SLIP. | This value does not apply to outgoing calls.
MPP (256) | This value does not apply to incoming calls. | Outgoing calls request MP+ framing.
EURAW (257) | A user requesting access can dial in using EU-RAW framing. EU-RAW is a type of X.75 encapsulation in which IP packets are HDLC encapsulated with a CRC field. If the user dials in using any other type of framing, the MAX rejects the call. | Outgoing calls use EU-RAW framing.
EUUI (258) | A user requesting access can dial in using EU-UI framing. EU-UI is a type of X.75 encapsulation in which IP packets are HDLC encapsulated with a CRC field and a small header. If the user dials in using any other type of framing, the MAX rejects the call. | Outgoing calls use EU-UI framing.
COMB (260) | A user requesting access can dial in using Combinet framing. If the user dials in using any other type of framing, the MAX rejects the call. | Outgoing calls use Combinet framing.
FR (261) | This value does not apply to incoming calls. | Outgoing calls use Frame Relay (RFC 1490) framing.
ARA (262) | A dial-in user can establish an AppleTalk Remote Access (ARA) connection to the Ethernet network. | This value does not apply to outgoing calls.
FR-CIR (263) | This value specifies a Frame Relay circuit. | This value specifies a Frame Relay circuit.

Note: By default, the MAX does not limit the protocols a link can access.

Dependencies: What Framed-Protocol does depends on how you set User-Service:

- If User-Service=Framed-User or is unspecified, a user requesting access can dial in using the framing specified by Framed-Protocol.

  The MAX rejects other types of framing. A user requesting access can also dial in without using a framed protocol, but can then change to the framing specified by the Framed-Protocol attribute.

- If User-Service=Framed-User or is unspecified, and Framed-Protocol has no specified value, the operator can use any framed protocol.

- If User-Service=Login-User, the user cannot use a framed protocol.

- If User-Service=Dialout-Framed-User, Framed-Protocol specifies the type of framing allowed on the outgoing call.

Example: The dial-in user in this example can use only PPP protocols (PPP, MP+, or MP), and cannot use the terminal server:

    Ascend  Password="Pipeline"

                  User-Service=Framed-User,

                  Framed-Protocol=PPP,

                  Framed-Address=10.0.200.225,

                  Framed-Netmask=255.255.255.0,

                  Ascend-Metric=2,

                  Framed-Routing=None,

                  Framed-Route="10.0.220.0 10.0.200.225 1",

                  Ascend-Idle-Limit=30

The dial-in user in this example establishes an ARA connection to the Ethernet network:

    Ascend  Password="Pipeline"

                  User-Service=Framed-User,

                  Framed-Protocol=ARA,

                  Ascend-Idle-Limit=30,

                  ...

## Framed-Route (22)

Description: The Framed-Route attribute enables you to add static IP routes to the MAX unit's routing table.

Usage: The Framed-Route attribute has this format:

    Framed-Route="host_ipaddr[/subnet_mask] gateway_ipaddr metric

    [private] [name] [preference]"

Table 9-18 describes each Framed-Route argument.

Table 9-18. Framed-Route arguments

#### Syntax element

#### Description

host_ipaddr/subnet_mask

Indicates the IP address of the destination host or subnet reached by this route.

If the address includes a subnet mask, the remote router specified by router_ipaddr is a router to that subnet, rather than to a whole remote network. To specify the entire remote network, do not specify a subnet mask.

router_ipaddr

Specifies the IP address of the router at the remote end of the connection.

The 0.0.0.0 address is a wildcard entry that the MAX replaces with the caller's IP address.When RADIUS authenticates a caller and sends the MAX an Access-Accept message with a Framed-Route 0.0.0.0 router, the MAX updates its routing tables with the Framed-Route value, but substitutes the caller's IP address for the router. This setting is especially useful when RADIUS cannot know the IP address of the caller because the IP address comes from an address pool.

metric

Indicates the metric for this route. If the MAX has more than one possible route to a destination network, it chooses the one with the lower metric.

private

Specifies y if this route is private, or n if it is not private. If you specify that the route is private, the MAX does not disclose the existence of the route when queried by RIP or another routing protocol.

name

Indicates the name outgoing user profile that uses the route.

preference

Specifies the preference the MAX assigns to the route. Routes with lower preferences have priority over identical metrics with higher preferences.

Dependencies: Each static route must appear in a pseudo-user profile. You create a pseudo-user to store information that the MAX can query-in this case, in order to store IP routing information. You can configure pseudo-users for both global and MAX-specific configuration control of IP dialout routes. The MAX loads the unit-specific dialout routes in addition to the global dialout routes.

For a unit-specific IP dialout route, specify the first line of a pseudo-user profile in this format:

    Route-unit_name-num Password="Ascend", User-Service=Dialout-Framed-User

For a global IP dialout route, specify the first line of a pseudo-user profile in this format:

    Route-num Password="Ascend", User-Service=Dialout-Framed-User

unit_name is the system name of the MAX-that is, the name specified by the Name parameter in the System profile. num is a number in a sequential series, starting at 1.

In each pseudo-user profile, you can specify one or more routes using the Framed-Route attribute. You should limit each pseudo-user profile to about 25 routes. The MAX fetches information from each profile in order to initialize its routing table. Whenever you power on or reset the MAX, or when you select the Upd Rem Cfg command from the Sys Diag menu, RADIUS adds IP dialout routes to the routing table in this way:

1. RADIUS looks for profiles having the format Route-unit_name-1, where
   unit_name is the system name.

2. If at least one profile exists, RADIUS loads all existing profiles having the format
   Route-unit_name-num to initialize the IP routing table.

   The variable num is a number in a sequential series, starting with 1.

3. The MAX queries Route-unit_name-1, then Route-unit_name-2, and so on, until it receives an authentication reject from RADIUS.

4. RADIUS loads the global configuration profiles.

   These configurations have the form Route-num.

5. The MAX queries Route-1, then Route-2, and so on, until it receives an authentication reject from RADIUS.

The routes remain in effect until the next restart or until overwritten by dynamic updates or routes specified in Connection profiles.

Note: In some cases, you might wish to update the MAX unit's routing tables when connecting to a user whose profile specified User-Service=Framed-User. In this case, you can set the Framed-Route attribute in an incoming user profile to specify the user's IP address and subnet mask in the host_ipaddr and subnet_mask arguments, respectively. The route you specify in this manner exists only during the time the call is online. When you also enter a nonzero router address for router_ipaddr that is different from the caller's address, the static route of a dial-in framed-user persists even after the connection goes offline.

Example: This example shows two RADIUS pseudo-user profiles defining global static IP routes:

    Route-1      Password="Ascend", User-Service=Dialout-Framed-User

          Framed-Route="10.0.200.33/29 10.0.200.37 1 n lala-gw-out ",

          Framed-Route="10.0.200.50/29 10.0.200.37 1 n lala-gw-out ",

          Framed-Route="10.0.200.47/29 10.0.200.49 1 n nana-gw-out "

    Route-2      Password="Ascend", User-Service=Dialout-Framed-User

          Framed-Route="11.0.200.33/29 11.0.200.37 1 n zzz-gw-out ",

          Framed-Route="12.0.200.47/29 11.0.200.49 1 n kk-gw-out "

See Also: Ascend-Route-IP (228)

## Framed-Routing (10)

Description: The Framed-Routing attribute specifies whether the MAX sends Routing Information Protocol (RIP) packets, receives RIP packets, or both.

If you enable RIP to both send and receive RIP updates on the WAN interface, the MAX broadcasts its routing table to the remote network and listens for RIP updates from that network. Gradually, all routers on both networks have consistent routing tables (all of which may become quite large).

Usage: You can specify one of these values:

- None (0) indicates that the MAX does not send or receive RIP updates.

  None is the default. Many sites turn off RIP on the WAN interface in order to avoid storing very large local routing tables. If you turn off RIP, the MAX does not listen to RIP updates across the connection. To route to other networks through that connection, the MAX must rely on static routes specified in a pseudo-user profile. For details, see

- Broadcast (1) indicates that the MAX sends RIP version 1 updates, but does not receive them.

- Listen (2) indicates that the MAX receives RIP version 1 updates, but does not send them.

- Broadcast-Listen (3) indicates that the MAX both sends and receives RIP version 1 updates.

- Broadcast-v2 (4) indicates that the MAX sends RIP version 2 updates, but does not receive them.

- Listen-v2 (5) indicates that the MAX receives RIP version 2 updates, but does not send them.

- Broadcast-Listen-v2 (6) indicates that the MAX both sends and receives RIP version 2 updates.

See Also: Ascend-Route-IP (228)

## Login-Host (14)

Description: The Login-Host attribute specifies the IP host to which the user automatically connects when you set User-Service=Login-User and specify a value for the Login-Service attribute. Access begins immediately after login.

Usage: Specify an IP address in dotted decimal notation n.n.n.n, where n is an integer between 0 and 255. The default value is 0.0. 0.0.This setting specifies that the Login-User does not automatically connect to a particular host.

If you do not specify a value for the Login-Host attribute, the user can access any remote host through the Telnet or raw TCP commands of the terminal server command-line interface. When the operator uses the menu-driven terminal server interface, he or she can only gain access to the hosts listed by the Ascend-Host-Info attribute.

Dependencies: When User-Service=Framed-User, RADIUS ignores the Login-Host attribute.

See Also: Login-Service (15)

## Login-Service (15)

Description: The Login-Service attribute specifies the type of terminal service connection to an IP host that occurs immediately after authentication.

Usage: Specify one of these values:

- Telnet (0)

  The user immediately establishes a Telnet session with the host specified by the Login-Host attribute.

- Rlogin (1)

  The user immediately establishes an Rlogin session with the host specified by the Login-Host attribute.

- TCP-Clear (2)

  This setting specifies a TCP/IP connection with no Telnet protocol. TCP-Clear establishes a TCP session between the MAX and the host specified by Login-Host over which the user can run an application specified by Login-TCP-Port.

  If you specify this setting, the TCP-Clear must be set to Yes in the Ethernet > Answer > Encaps menu.

When you set the Login-Service attribute, a dial-in terminal server user makes an immediate connection to an IP host on your local network and never sees the terminal server interface.

By default, the MAX does not grant immediate access to an IP host.

Dependencies: Keep this additional information in mind:

- If you specify both Login-Service and Login-Host, the MAX automatically connects the Login-User to the host specified by Login-Host.

- If you do not specify Login-Service or Login-Host, the Login-User sees either the MAX unit's terminal server command-line interface or the terminal server menu interface, depending upon how you configure the MAX.

Example: In this example, an Rlogin session starts automatically for anyone using the `Userx` user name and `xyzzy` password. When the session terminates, the connection also terminates.

    # This profile causes an auto-rlogin to 10.0.200.4 upon login.

    Userx    Password="xyzzy"

                  User-Service=Login-User,

                  Login-Service=Rlogin,

                  Login-Host=10.0.200.4

Further, when you specify the following settings, a raw TCP session starts automatically for anyone using the User1 user name and Test1 password:

    # This profile causes an auto-TCP to 4.2.3.1 port 9 upon login.

    User1    Password="Test1"

                  User-Service=Login-User,

                  Login-Service=TCP-Clear,

                  Login-Host=4.2.3.1,

                  Login-TCP-Port=9

See Also: Login-Host (14)
Login-TCP-Port (16)

## Login-TCP-Port (16)

Description: The Login-TCP-Port attribute specifies the port number to which a TCP session connects when Login-Service=TCP-Clear in a user profile.

Usage: Specify an integer between 1 and 65535. The default value is 23.

See Also: Login-Service (15)

## NAS-Identifier (4)

Description: The NAS-Identifier attribute indicates the IP address of the MAX. When the MAX sends an Access-Request packet or Ascend-Event-Request packet, it indicates its IP address to the RADIUS server using this attribute.

Usage: In most cases, you never need to specify the NAS-Identifier attribute in a user profile.

However, you might want to specify it if multiple MAX units use a single RADIUS server, and you want to specify the MAX to which a particular user can connect. In this case, the NAS-Identifier value in the Access-Request packet and the NAS-Identifier value in the user profile must match for the RADIUS server to authenticate the connection.

Specify an IP address in dotted decimal notation n.n.n.n/nn, where n is an integer between 0 and 255, and nn is a subnet mask between 8 and 32. The default value is 0.0.0.0/0. The NAS-Identifier value must appear in the first line of the user profile.

Example: Suppose that the user Emma is allowed to dial into the MAX at IP address 200.65.212.46. The first line of the user profile might look like this one:

    Emma Password="pwd", NAS-Identifier=200.65.212.46

## NAS-Port (5)

Description: The NAS-Port attribute identifies the network interface and service the session is using. The MAX sends this attribute to the RADIUS server in an Access-Request packet and an Accounting-Request packet.

Usage: You can specify two formats, one restricting the dial-in user to a service, line, and channel, and one restricting the dial-in user to a slot, line, and channel.

1. To restrict a user to a service, line, and channel,

Specify NAS-Port in the first line of the user profile using this format:

    service line channel

- service can have the value 1 for a digital call, or 2 for an analog call.

  An analog call is one that a modem on the MAX has processed. A value of 1 does not imply that the caller logged in through the MAX unit's terminal server.

- line consists of two digits that specify the line number the call is using.

- channel consists of two digits that represent the channel on the line the call is using.

  The incoming authentication request must match the NAS-Port setting. The default value is 0 (zero).

1. To restrict a dial-in user to a shelf, slot, line, and channel, enter a value in the following format:

    FF SSSS LLLLL CCCCC

    For an ISDN call:

- FF specifies the shelf number (always 0 in RADIUS, 1 on the MAX)

- SSSS specifies the slot number (0-15)

- LLLLL specifies the line number (0-31)

- CCCCC specifies the channel number (0-31)

For an analog call, the values are the same, except that the line number can be 0-63, and the channel number is always 1.

Because the value you enter is zero-based, you must add 1 to each component to ascertain the actual slot, line, and channel number. The RADIUS daemon converts the NAS-Port number to decimal on most systems.

Example: To restrict a dial-in user to analog service on line 1, set up a user profile like this one:

    Dave Password="password", NAS-Port=20100
        User-Name="Dave",
        User-Service=Framed-User,
        Framed-Protocol=PPP,
        Ascend-Assign-IP-Pool=1,
        Ascend-Route-IP=1,
        Ascend-Idle-Limit=300,
        Framed-Routing=None

To restrict a dial-in user to channel 10 on line 2 for slot 1, set up a user profile like this one:

    Robin Password="password", NAS-Port=1098
        User-Service=Framed-User,
        Framed-Protocol=PPP,
        Ascend-Assign-IP-Pool=1,
        Ascend-Route-IP=1,
        Ascend-Idle-Limit=300,
        Framed-Routing=None

The value NAS-Port=1098 translates to the following NAS port:

- FF=shelf 0

- SSSS=slot 1

- LLLLL=line 2

- CCCCC=channel 10

## NAS-Port-Type (61)

Description: The NAS-Port-Type attribute indicates the type of physical port the MAX is using to authenticate the client. The NAS-Port-Type attribute appears in RADIUS Start, Stop, and Checkpoint messages.

Some ISPs offer different levels of service based on connection type. To prevent a client from using a capability to which he or she has not subscribed, set the NAS-Port-Type attribute to an appropriate value.

Usage: You can specify one of these settings:

- Async indicates a call routed to a digital modem.

- Sync indicates a non-ISDN synchronous connection, such as a Switched-56K connection.

- ISDN-Sync indicates a synchronous ISDN connection.

- ISDN-Async-v120 indicates an ISDN connection using V.120 asynchronous rate adaption.

- ISDN-Async-v110 indicates an ISDN connection using V.110 asynchronous rate adaption.

- Virtual indicates a connection to the MAX using a transport protocol instead of a physical port.

See Also: NAS-Port (5)

## Password (2)

Description: The Password attribute specifies the password of the calling device or dial-in user in a user profile.

Usage: Specify an alphanumeric string containing up to 252 characters. The default value is null. The Password attribute must appear on the first line of the user profile. You can make any of these specifications:

- A static password

  For example, consider this first line in a user profile:

  Emma Password="Pwd"

  The user called Emma must specify the password Pwd in order to gain access to the MAX.

- UNIX

  You can request validation using the /etc/password file on the UNIX host by setting the Password attribute to UNIX, as shown in this first line of a user profile:

  John Password="UNIX"

  Setting the password to UNIX provides authentication through the normal UNIX authentication procedures, as for a user login.

- SAFEWORD

  You can request validation using the Enigma Logic SafeWord dynamic password library by setting the Password attribute to SAFEWORD, as shown in this first line of a user profile:

  Mike Password="SAFEWORD"

- ACE

  You can request validation using the Security Dynamics ACE dynamic password library by setting the Password attribute to ACE, as shown in this first line of a user profile:

  Connor Password="ACE"

- Ascend-CLID

  You can require RADIUS to authenticate incoming calls by checking the calling party's phone number. When you do so, you set the Password attribute to Ascend-CLID, as shown in this first line of a user profile:

  5551212 Password="Ascend-CLID"

- Ascend-DNIS

  You can require RADIUS to authenticate incoming calls by checking the called number. When you do so, you set the Password attribute to Ascend-DNIS, as shown in this first line of a user profile:

  5551212 Password="Ascend-DNIS"

See Also: Ascend-Ara-PW (181)

## Reply-Message (18)

Description: The Reply-Message attribute carries message text from a RADIUS server to RADIUS clients such as the MAX under these two circumstances:

- In a pseudo-user profile that configures message text and a list of IP hosts, the
  Reply-Message attribute specifies text that appears to the terminal server operator who is using the menu-driven interface.

- If the RADIUS server determines that the MAX should terminate the session, it sends an Access-Terminate-Session packet containing the Reply-Message attribute.

Usage: Specify a text string containing up to 80 characters. The default value is null. You can specify up to 16 Reply-Message attributes in a pseudo-user profile.

Dependencies: Keep this additional information in mind:

- An Access-Terminate-Session packet is a RADIUS packet identified by the code number 31.

  Only RADIUS daemons you customize to support this packet code can send an Access-Terminate-Session packet. Neither the Ascend RADIUS daemon nor the Livingston RADIUS daemon supports this packet type. This packet can include only one attribute-the Reply-Message attribute-and this attribute can specify up to 80 characters of text.

  When the MAX receives an Access-Terminate-Session packet, it starts a timer, displays any Reply-Message included in the packet, and terminates the session. For example, if a user's bill is past due, the Access-Terminate-Session packet could include the message `Emma, you have not paid your connect charges.`

- If you do not specify a Reply-Message attribute in a user profile that authenticates callers, and the RADIUS server sends an Access-Accept packet, no message appears.

- If the RADIUS server sends an Access-Reject packet and you do not specify a Reply-Message attribute in a customized RADIUS daemon, this message appears:

  `** Bad Password`

  The MAX then allows the user two additional attempts to enter the correct password. If the user does not supply the correct password in three attempts, the MAX terminates the session.

- If the RADIUS server sends an Access-Terminate-Session packet and you do not specify a Reply-Message attribute in a customized RADIUS daemon, the MAX displays this message to the terminal server user:

  `** Session Terminated`

  The MAX then uses a timer to terminate the login session. The RADIUS server discards all input it received before it terminated the session.

Example: Here is an example of a pseudo-user profile setting up message text for a MAX named Cal:

    Initial-Banner-Cal Password="Ascend", User-Service=Dialout-Framed-User

              Reply-Message="Up to 16 lines of up to 80 characters each",

              Reply-Message="will be accepted. Long lines will be truncated",

              Reply-Message="Additional lines will be ignored.",

              Reply-Message="",

Ascend-Host-Info="1.2.3.4 Berkeley",

Ascend-Host-Info="1.2.3.5 Alameda",

Ascend-Host-Info="1.2.36 San Francisco",

...

See Also: Ascend-Host-Info (252)

## Tunnel-Client-Endpoint (Attribute 66)

Description: A string assigned by RADIUS that specifies the name for the unit placing the call. This is used by RADIUS accounting for tracking the session.

Dependencies: Keep this additional information in mind:

- DNIS or CLID must be enabled in the Id Auth parameter of Ethernet Answer profile.

- The MAX must have RADIUS user entries that specify DNIS or CLID.

See Also: Client-Port-DNIS (Attribute 30), used for Called Number authentication.

## Tunnel-ID (Attribute 68)

Description: String assigned by RADIUS to each session using CLID or DNIS tunneling. This value is used for accounting when accounting is implemented.

Dependencies: Keep this additional information in mind:

- DNIS or CLID must be enabled in the Id Auth parameter of Ethernet Answer profile.

- The MAX must have RADIUS user entries that specify DNIS or CLID.

See Also: Client-Port-DNIS (Attribute 30), used for Called Number authentication.

## Tunneling-Protocol (127)

Description: The Tunneling-Protocol attribute indicates if a session used the ATMP tunneling protocol.

Usage: Specify ATMP if the connection uses the ATMP tunneling protocol.

Example: The following is an example of a RADIUS accounting record with the Tunneling-Protocol attribute.

    Mon Apr 21 02:41:38 1997

            User-Name = "JacobP75"

            NAS-Identifier = 1.1.1.1

            NAS-Port = 10105

            Acct-Status-Type = Stop

            Acct-Delay-Time = 0

            Acct-Session-Id = "111111111"

            Acct-Authentic = RADIUS

            Acct-Session-Time = 0

            Acct-Input-Octets = 215

            Acct-Output-Octets = 208

            Acct-Input-Packets = 10

            Acct-Output-Packets = 10

            Ascend-Disconnect-Cause = 1

            Ascend-Connect-Progress = 60

            Ascend-Data-Rate = 56000

            Ascend-PreSession-Time = 1

            Ascend-Pre-Input-Octets = 215

            Ascend-Pre-Output-Octets = 208

            Ascend-Pre-Input-Packets = 10

            Ascend-Pre-Output-Packets = 10

            Framed-Protocol = PPP

            Framed-Address = 2.2.2.2

            Tunneling-Protocol = ATMP

Dependencies: The Tunneling-Protocol attribute is sent in Accounting-Request packets at the end of a session under the following conditions:

- The Accounting -Request packet has Acct-Status-Stop

- The session was authenticated and encapsulated using the ATMP tunneling protocol.

## Tunnel-Medium-Type (Attribute 65)

Description: Specifies the type of medium supported over the tunnel specified in the Tunnel-Type attribute.

Currently, the MAX supports only the IP medium type.

Usage: Currently, you can specify IP for the value of Tunnel-Medium-Type.

Example: Tunnel-Medium-Type=IP

Dependencies: For the MAX to correctly create an L2TP tunnel, you must set Tunnel-Type to L2TP and set Tunnel-Server-Endpoint to the IP address of an accessible LNS, in addition to setting Tunnel-Medium-Type to IP.

For the MAX to correctly create a PPTP tunnel, you must set Tunnel-Type to PPTP and set Tunnel-Server-Endpoint to the IP address of an accessible PPTP Network Server (PNS), in addition to setting Tunnel-Medium-Type to IP.

See Also: Tunnel-Type (64), Tunnel-Server-Endpoint (67)

## Tunnel-Server-Endpoint (67)

Description: Specifies the fully-qualified host name or IP address of the network server to contact for building a tunnel. If you set Tunnel-Type to L2TP, Tunnel-Server-Endpoint indicates the IP address of the LNS. If you set Tunnel-Type to PPTP, Tunnel-Sever-Endpoint indicates the IP address of the PNS.

Usage: Specify the primary home agent in the following format:

    Tunnel-Server-Endpoint="hostname | ip_address"

where:

- `hostname` is the fully-host name of the network server.

- ip_address is the network server's IP address in dotted decimal notation.

  Specify an IP address if the network server does not have access to a DNS server.

You can specify a host name or IP address, but not both.

Example: To specify the network server maxSF.home.com at IP address 10.10.10.10, specify one of the following lines in the RADIUS user profile:

    Tunnel-Server-Endpoint=10.10.10.10

    Tunnel-Server-Endpoint=maxSF.home.com

Dependencies: For the MAX to correctly create an L2TP tunnel, you must set Tunnel-Type to L2TP and Tunnel-Medium-Type to IP, in addition to specifying the IP address of an accessible LNS.

For the MAX to correctly create an PPTP tunnel, you must set Tunnel-Type to PPTP and Tunnel-Medium-Type to IP, in addition to specifying the IP address of an accessible PPTP Network Server (PNS).

See Also: Tunnel-Type (64), Tunnel-Medium-Type (65

## Tunnel-Type (64)

Description: Specifies the type of tunneling protocol to create.

Usage: You can specify the following values for Tunnel-Type:

- PPTP

- L2TP

Example: Tunnel-Type=L2TP

Dependencies: For the MAX to correctly create an L2TP tunnel, you must set Tunnel-Medium-Type to IP and set Tunnel-Server-Endpoint to the IP address of an accessible LNS, in addition to setting Tunnel-Type to L2TP.

For the MAX to correctly create an PPTP tunnel, you must set Tunnel-Medium-Type to IP and set Tunnel-Server-Endpoint to the IP address of an accessible PNS, in addition to setting Tunnel-Type to PPTP.

See Also: Tunnel-Medium-Type (65), Tunnel-Server-Endpoint (67)

## Tunneling-Protocol (127)

Description: Specifies whether a session used the ATMP tunneling protocol.

Usage: The value is ATMP if the connection used the ATMP tunneling protocol.

Example: The following is an example of a RADIUS accounting record with the Tunneling-Protocol attribute.

    Mon Apr 21 02:41:38 1997

            User-Name = "JacobP75"

            NAS-Identifier = 1.1.1.1

            NAS-Port = 10105

            Acct-Status-Type = Stop

            Acct-Delay-Time = 0

            Acct-Session-Id = "111111111"

            Acct-Authentic = RADIUS

            Acct-Session-Time = 0

            Acct-Input-Octets = 215

            Acct-Output-Octets = 208

            Acct-Input-Packets = 10

            Acct-Output-Packets = 10

            Ascend-Disconnect-Cause = 1

            Ascend-Connect-Progress = 60

            Ascend-Data-Rate = 56000

            Ascend-PreSession-Time = 1

            Ascend-Pre-Input-Octets = 215

            Ascend-Pre-Output-Octets = 208

            Ascend-Pre-Input-Packets = 10

            Ascend-Pre-Output-Packets = 10

            Framed-Protocol = PPP

            Framed-Address = 2.2.2.2

            Tunneling-Protocol = ATMP

Dependencies: The Tunneling-Protocol attribute is sent in Accounting-Request packets at the end of a session under the following conditions:

- The Accounting -Request packet has Acct-Status-Stop.

- The session was authenticated and encapsulated using the ATMP tunneling protocol.

## User-Name (1)

Description: The User-Name attribute can specify one of the following in a user profile:

- The name of the calling device or dial-in user.

- The keyword Default.

  If you create a profile with the user name Default and make that profile the last profile of the users file, the RADIUS server will use that profile to determine what to do with users who are not in the users file. You can configure only one Default profile in the users file.

- The incoming phone number (for CLID authentication).

- The called number (for called-number authentication).

- The name of a pseudo-user profile.

  You can set up a pseudo-user profile to configure outgoing calls, a pool of dynamic IP addresses, static IP and IPX routes, bridge entries, and the message text and host list for the terminal server interface.

Usage: Specify an alphanumeric string containing up to 252 characters. The default value is null. The user name must be the first word in a user profile. You need not specify the name of the attribute.

Example: For example, consider this first line in a user profile:

    Emma Password="pwd", Ascend-PW-Expiration="Jan 30 1997"

The user name is Emma. The RADIUS server tests the user's name and password against the values the user provides when making a request for access. If the RADIUS server does not find a match, it denies the request for access.

Here is a sample user profile for CLID authentication using the incoming phone number as the User-Name:

    5551212    Password="Ascend-CLID"

                      Ascend-Require-Auth=Not-Require-Auth,

                      User-Service=Framed-User,

                      Framed-Protocol=PPP,

                      Framed-Address=255.255.255.254,

                      Framed-Netmask=255.255.255.255,

                      Ascend-Assign-IP-Pool=1,

                      Ascend-Route-IP=Route-IP-Yes,

                      Ascend-Idle-Limit=30

Finally, this example shows User-Name in a pseudo-user profile for a static route:

    Route-1 Password="Ascend", User-Service=Dialout-Framed-User

            Framed-Route="10.4.5.0/22 10.9.8.10 1 n inu-out"

## User-Service (6)

Description: The User-Service attribute specifies the type of services the link can use.

If RADIUS authenticates an incoming call using the User-Name and Password attributes, and the type of call matches the value of the User-Service attribute, the MAX applies the attributes in the user profile to the call. If the type of call does not match the User-Service attribute, the MAX rejects the call.

This attribute can appear in both an Access-Request and Access-Accept packet. However, it does not appear in an Access-Request packet if Auth Send Attr 6, 7=No in the Ethernet > Mod Config > Auth menu.

Usage: You can specify one of these values:

- Login-User (1)

  The operator can use an asynchronous Telnet connection to log into the terminal server. The MAX rejects incoming framed calls. The operator cannot use any framed protocol, but can start Telnet or raw TCP sessions.

- Framed-User (2)

  Incoming calls must use a framed protocol. Otherwise, the MAX rejects them. Asynchronous Telnet sessions are unframed and therefore not allowed when you specify this value.

- Dialout-Framed-User (5)

  The MAX can use this profile for outgoing calls only. The MAX sends this value to the RADIUS server during an authentication request.

By default, the MAX does not limit the services the link can access.

Dependencies: Keep this additional information in mind:

- Login-User must have an asynchronous means for reaching the MAX.

  That is, the MAX must have digital modems or V.110 modules, or the call must be V.120 or X.75 encapsulated.

- Asynchronous Telnet sessions are unframed and therefore not allowed when you set User-Service=Framed-User.

## Vendor-Specific (26)

Description: Encapsulates attributes introduced by vendors. The purpose of the Vendor-Specific attribute is to enable companies to extend RADIUS operations without leading to possible attribute collisions (two attributes with the same type number but different meanings).

Usage: In Vendor-Specific Attribute (VSA) compatibility mode, the MAX uses the Vendor-Specific attribute to encapsulate Ascend vendor attributes and uses the RFC-defined User-Password encryption algorithm. In the Old compatibility mode (the default), the MAX does not send the Vendor-Specific attribute to the RADIUS server and does not recognize it if the server sends it. In this mode, the system uses the Ascend algorithm of encrypting and decrypting the User-Password attribute, which differs from the RFC-defined algorithm in that it does not null fill the password string to a multiple of 16 bytes before encryption, and it does not use the previous segment's hash to calculate the next intermediate value when the password is longer than 16 bytes.

For complete information about configuring the MAX to use the
Vendor-Specific attribute, see Vendor-Specific Attribute (VSA) support.

Copyright © 1998, Ascend Communications, Inc. All rights reserved.