Section: 16.3.1 IP PDP type
Content: Figure 22 represents the RADIUS message flows between a GGSN and an Authentication, Authorization and Accounting (AAA) server. NOTE 1: If some external applications require RADIUS Accounting request (Start) information before they can process user packets, then the selected APN (GGSN) may be configured in such a way that the GGSN drops user data until the Accounting Response (START) is received from the AAA server. The GGSN may wait for the Accounting Response (START) before sending the CreatePDPContextResponse. The GGSN may reject the PDP context if the Accounting Response (START) is not received. NOTE 2: Separate accounting and authentication servers may be used. NOTE 3: The Access-Request message shall be used for primary PDP context only. NOTE 4: The Accounting-Request (Start) message may be sent at a later stage, e.g. after IPv6 address has been assigned and PDP Context updated, in case of IP address allocation via DHCPv4 after successful PDP context activation signalling. Figure 22: RADIUS message flow for PDP type IP (successful user authentication case) When a GGSN receives a Create PDP Context Request message for a given APN, the GGSN may (depending on the configuration for this APN) send a RADIUS Access-Request to an AAA server. The AAA server authenticates and authorizes the user. If RADIUS is also responsible for IPv4 address and/or IPv6 prefix allocation the AAA server shall return the allocated IPv4 address and/or IPv6 prefix in the Access-Accept message. When PDP type is IPv4v6 and deferred IPv4 addressing via IPv4 address pool in the AAA server is used, the GGSN may intiate RADIUS re-authorization procedures after successful initial attach for the purpose of IPv4 address allocation or to renew the lease for a previously allocated IPv4 address. In this case, the GGSN shall set the Service-Type attribute to "Authorize Only" and the 3GPP-Allocate-IP-Type subattribute to the type of IP address to be allocated in the Access-Request message sent to the AAA server. See subclause 16.4.7.2 for the conditions to use 3GPP-Allocate-IP-Type sub-attribute in Access-Request messages. If the GGSN is using DHCPv4 signalling towards the MS and the RADIUS server includes the Session-Timeout attribute in the Access-Accept, the GGSN may use the Session-Timeout value as the DHCPv4 lease time. The GGSN shall not set the DHCPv4 lease time value higher than the Session-Timeout value. The GGSN may renew the DHCP lease to the MS without re-authorization towards the AAA server providing that the new lease expiry is no later than the Session-Timeout timer expiry. If the GGSN wishes to extend the lease time beyond the current Session-Timeout expiry, it shall initiate a new AAA re-authorization. Even if the GGSN was not involved in user authentication (e.g. transparent network access mode), it may send a RADIUS Accounting-Request START message to an AAA server. This message contains parameters, e.g. the tuple which includes the user-id and IPv4 address and/or IPv6 prefix, to be used by application servers (e.g. WAP gateway) in order to identify the user. This message also indicates to the AAA server that the user session has started. The session is uniquely identified by the Acct-Session-Id that is composed of the Charging-Id and the GGSN-Address. If some external applications require RADIUS Accounting request (Start) information before they can process user packets, then the selected APN (GGSN) may be configured in such a way that the GGSN drops user data until the Accounting Response (START) is received from the AAA server. The GGSN may wait for the Accounting Response (START) before sending the CreatePDPContextResponse. The GGSN may reject the PDP context if the Accounting Response (START) is not received. The authentication and accounting servers may be separately configured for each APN. For PDP type IPv4, at IPv4 address allocation via DHCP4 signalling between the TE and the PDN, no IPv4 address is available at PDP context activation. In that case the GGSN may wait to send the Accounting-Request START message until the TE receives its IPv4 address in a DHCPACK. For PDP type IPv4v6 and deferred IPv4 addressing, when the IPv4 address is allocated or re-allocated, the accounting session that was established for the IPv6 prefix allocation shall be used to inform the accounting server about the allocated IPv4 address by sending RADIUS Accounting-Request Interim-Update with the Framed-IP-Address attribute and its value field containing the allocated IPv4 address. When the GGSN receives a Delete PDP Context Request message and providing a RADIUS Accounting-Request START message was sent previously, the GGSN shall send a RADIUS Accounting-Request STOP message to the AAA server, which indicates the termination of this particular user session. The GGSN shall immediately send a Delete PDP context response, without waiting for an Accounting-Response STOP message from the AAA server. The AAA server shall deallocate the IPv4 address and/or IPv6 prefix (if any) initially allocated to the subscriber, if there is no session for the subscriber. For PDP type IPv4v6 and deferred IPv4 addressing, when the GGSN receives a message from the MS or the network indicating the release of the IPv4 address (e.g. receiving DHCPRELEASE) or decides to release the IPv4 address on its own (e.g. due to DHCP lease timer expiry or GGSN assigned IPv4 address), the GGSN shall inform the accounting server about the deallocation of the IPv4 address by sending RADIUS Accounting-Request Interim-Update without the Framed-IP-Address attribute. Accounting-Request ON and Accounting-Request OFF messages may be sent from the GGSN to the AAA server to ensure the correct synchronization of the session information in the GGSN and the AAA server. The GGSN may send an Accounting-Request ON message to the AAA server to indicate that a restart has occurred. The AAA server may then release the associated resources. Prior to a scheduled restart, the GGSN may send Accounting-Request OFF message to the AAA server. The AAA server may then release the associated resources. If an Access-Challenge is sent to the GGSN when an Access-Request message is pending and when IP PDP type is used, the GGSN shall silently discard the Access-Challenge message and it shall treat an Access-Challenge as though it had received an Access-Reject instead RFC 2865 [38].