Reference to RADIUS Attributes

This chapter discusses RADIUS attributes found in user and pseudo-user profiles. Each listing provides information in the following format:

Attribute Name

Usage: The Usage text explains the values you can specify for the attribute.

Example: The Example text presents an example of how to use the attribute.

Dependencies: The Dependencies text tells you what other information you need in order to specify the proper value for the attribute.

See Also: The See Also text points you to related information.

Acct-Authentic (45)

Usage: Acct-Authentic does not appear in a user profile It can have either of the following values:

• RADIUS (1) indicates that RADIUS authenticated the incoming call. RADIUS is the default.

• Local (2) indicates that the MAX TNT authenticated the call by means of a local Connection profile, TACACS profile, or TACACS+ profile, or that the MAX TNT accepted the call without authentication.

• At the start of a session (when Acct-Status-Type=Start)

• At the end of an authenticated session (Acct-Status-Type=Stop)

Acct-Delay-Time (41)

Usage: Acct-Delay-Time does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT sends Acct-Delay-Time in an Accounting-Request packet under the following conditions:

• At the start of a session (when Acct-Status-Type=Start)

• At the end of a session (when Acct-Status-Type=Stop)

• When a session has failed authentication (when Acct-Status-Type=Stop)

Acct-Input-Octets (42)

Usage: Acct-Input-Octets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT sends Acct-Input-Octets in an Accounting-Request packet, at the end of a session (Acct-Status-Type=Stop), when both of the following conditions are true:

• The session has been authenticated.

• The connection was asynchronous.

Acct-Input-Packets (47)

Usage: Acct-Input-Packets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT sends Acct-Input-Packets in an Accounting-Request packet, at the end of a session (Acct-Status-Type=Stop), when both of the following conditions are true:

• The session has been authenticated.

• A framed protocol is in use.

Acct-Output-Octets (43)

Usage: Acct-Output-Octets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT sends Acct-Output-Octets in an Accounting-Request packet, at the end of a session (Acct-Status-Type=Stop), when both of the following conditions are true:

• The session has been authenticated.

• The connection was asynchronous.

Acct-Output-Packets (48)

Usage: Acct-Output-Packets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT sends Acct-Output-Packets in an Accounting-Request packet, at the end of a session (Acct-Status-Type=Stop), when both of the following conditions are true:

• The session is authenticated.

• A framed protocol is in use.

Acct-Session-Id (44)

Usage: Acct-Session-Id does not appear in a user profile. Its value is a random number with a range from 1 to 2,137,383,647. For every session, RADIUS generates a unique session ID.

Dependencies: The MAX TNT sends Acct-Session-Id in an Accounting-Request packet under the following conditions:

• At the start of a session (when Acct-Status-Type=Start)

• At the end of a session (when Acct-Status-Type=Stop)

• When a session has failed authentication (when Acct-Status-Type=Stop)

• When an SNMP accounting session and a RADIUS accounting session have the same ID, they are identical. However, SNMP records all calls, while RADIUS records only those calls that result in a successful login or authentication.

• At the MAX TNT configuration interface, you can use the Acct-Id-Base parameter to specify whether the numeric base of the Acct-Session-Id attribute is 10 or 16. For more information, see the MAX TNT Reference Guide.

Acct-Session-Time (46)

Usage: Acct-Session-Time does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT sends Acct-Session-Time in an Accounting-Request packet, at the end of a session (Acct-Status-Type=Stop), when the session has been authenticated.

Acct-Status-Type (40)

Usage: Acct-Status-Type does not appear in a user profile.

Dependencies: The MAX TNT includes Acct-Status-Type in an Accounting-Request packet under the following conditions:

• At the start of a session (when Acct-Status-Type=Start)

• At the end of a session (when Acct-Status-Type=Stop)

• When a session has failed authentication (when Acct-Status-Type=Stop)

Ascend-Add-Seconds (240)

When utilization exceeds the threshold for a period greater than the value of the Ascend-Add-Seconds attribute, the MAX TNT attempts to add the number of channels specified by the Ascend-Inc-Channel-Count attribute. Using the Ascend-Add-Seconds attribute prevents the system from continually adding bandwidth, and can slow down the process of allocating bandwidth.

Usage: Specify an integer from 1 to 300. The default value is 5.

Dependencies: Consider the following:

• Additional channels must be available, and the number of channels the MAX TNT adds cannot exceed the number specified by the Ascend-Maximum-Channels attribute.

• Ascend-Add-Seconds and Ascend-Remove-Seconds have little or no effect on a system with a high Ascend-Seconds-Of-History value. If the value of Ascend-Seconds-Of-History is low, the Ascend-Add-Seconds and Ascend-Remove-Seconds attributes provide an alternative way to ensure that spikes must persist for a certain period of time before the system responds.

Ascend-ARA-PW (181)

Usage: Specify an alphanumeric text string containing up to 20 characters. The default value is null. The password you enter for this attribute must be identical to the password you enter in the first line of the user profile. The MAX TNT requires both entries.

Example: This example shows how to set up a TCP connection through ARA with a dynamic IP address assignment:

Emma Password="pwd"

          Framed-Protocol=ARA,

          Ascend-ARA-PW="pwd",

          Ascend-Route-IP=Route-IP-Yes,

          Ascend-Assign-IP-Pool=1

Ascend-Assign-IP-Pool (218)

A dynamic address comes from the pool of addresses you set up by assigning values to the Pool-Base-Address and Assign-Count parameters in an IP-Global profile on the MAX TNT, the Ascend-IP-Pool-Definition attribute in a RADIUS profile, or both. An IP address pool you set up in RADIUS overrides an IP address pool you set up in the MAX TNT configuration interface, but only if you designate the two pools by the same number.

Usage: Specify an integer corresponding to an address pool. The default value is 1. If you set Ascend-Assign-IP-Pool=0, RADIUS chooses an address from any pool that has one available.

Example: In the following user profile, the host requests an address from pool #2:

Emma Password="m2dan", User-Service=Framed-User

     Framed-Protocol=PPP,

     Ascend-Route-IP=Route-IP-Yes,

     Ascend-Metric=2, 

     Framed-Routing=None,

     Ascend-Assign-IP-Pool=2

Ascend-Authen-Alias (203)

When the MAX TNT places an outgoing call, it identifies itself by a login name and password. The login name is either its system name (as specified by the Name parameter in the System profile) or the value you specify for the Ascend-Authen-Alias attribute.

Usage: Specify a text string of up to 16 characters. The default is the value of the Name parameter in the System profile on the MAX TNT.

Example: The following example shows how to use the Ascend-Authen-Alias attribute in an outgoing profile:

Homer-Out Password="ascend", User-Service=Dialout-Framed-User

      User-Name="Homer",

      Ascend-Authen-Alias="myMAXTNTcallingU",

      Ascend-Send-Auth=Send-Auth-PAP,

      Ascend-Send-Secret="passwrd1",

      Ascend-Dial-Number="31",

      Framed-Protocol=PPP,

      Framed-Address=10.0.100.1,

      Framed-Netmask=255.255.255.0,

      Ascend-Metric=2,

      Framed-Routing=None,

      Framed-Route="10.5.0.0/24 10.0.100.1 1",

      Ascend-Idle-Limit=30

Ascend-Backup (176)

Usage: Specify the name of the profile that you want to act as the backup. The backup connection can be switched or nailed up. The default value is null.

Dependencies: Consider the following:

• The Ascend-Backup attribute applies to nailed-up connections only (Ascend-Call-Type=Nailed or Nailed/Mpp).

• Do not create nested backup connections.

• When you use the backup connection, the MAX TNT does not move routes to the backup profile. Therefore, the IP routes that appear in the terminal-server display might be incorrect, although statistical counts reflect the change.

• Do not use the Ascend-Backup attribute to provide alternative lines for getting to a single destination.

Ascend-BACP-Enable (133)

BACP is the Internet standard protocol equivalent to the Ascend MP+ bandwidth allocation protocol. BACP functions similarly to MP+ and uses the same attributes as MP+.

Usage: Specify one of the following settings:

• BACP-No (0) disables BACP for the link. BACP-No is the default.

• BACP-Yes (1) enables BACP for the link.

Ascend-Base-Channel-Count (172)

Usage: The maximum number of channels you can specify depends upon the nature of the link:

• For a PPP link, the maximum number of channels is always 1.

• For an MP+ or MP link, you can specify any value up to the number of channels available, but the device at the remote end of the link must also support MP+ or MP.

Dependencies: The Ascend-Base-Channel-Count attribute does not apply when all channels of the link are nailed up (Ascend-Call-Type=Nailed). For optimum MP+ performance, both sides of a connection must set the following values to the same number:

• Base channel count, as specified by Base-Channel-Count (in the Connection profile) or Ascend-Base-Channel-Count (in RADIUS).

• Minimum channel count, as specified by Minimum-Channels (in the Answer-Defaults profile or Connection profile) or Ascend-Minimum-Channels (in RADIUS).

• Maximum channel count, as specified by Maximum-Channels (in the Answer-Defaults profile or Connection profile) or Ascend-Maximum-Channels (in RADIUS).

Ascend-Billing-Number (249)

Usage: Specify a telephone number of up to ten characters, limited to the following:

1234567890()[]!z-*# |

• For a T1 line, the MAX TNT appends the value specified in the Ascend-Billing-Number attribute to the end of each phone number it dials for the call.

• Ascend-Billing-Number for outgoing calls applies only to installations in Australia.

• For a T1 PRI line, the MAX TNT uses the value of Ascend-Billing-Number rather than the phone number to identify itself to the answering party. In this situation, the Calling-Line ID (CLID) that the answering side receives is not the true phone number of the caller. This situation presents a security breach if you use CLID-Auth-Mode.

See Also: Setting up CLID authentication and
Caller-Id (31).

Ascend-Callback (246)

Callback occurs when the MAX TNT answers a call and verifies a name and password against a user profile. If Ascend-Callback=Yes, the MAX TNT hangs up and dials back to the caller by using the following values:

• The phone number specified by Ascend-Dial-Number

• The password specified by Ascend-Send-Secret or Ascend-Send-Passwd

• Any other relevant attributes in the user profile that authenticated the call

Usage: Specify one of the following values:

• Callback-No (0) specifies that the MAX TNT answers in the normal manner after authentication. Callback-No is the default.

• Callback-Yes (1) specifies that the MAX TNT hangs up and calls back after authentication.

See Also: Setting up the MAX TNT for callback.

Ascend-Call-By-Call (250)

Usage: Specify a number corresponding to the type of service the MAX TNT uses. The default value is 6. Table 14-1 lists the services available for each service provider.

Table 14-1. Ascend-Call-By-Call settings

Number	AT&T	Sprint	MCI
0	Disable call-by-call service.	Reserved	N/A
1	SDN (including GSDN)	Private	VNET/Vision
2	Megacom 800	Inwatts	800
3	Megacom	Outwatts	PRISM1, PRISM II, WATS
4	N/A	FX	900
5	N/A	Tie Trunk	DAL
6	ACCUNET Switched Digital Services	N/A	N/A
7	Long Distance Service (including AT&T World Connect)	N/A	N/A
8	International 800 (I800)	N/A	N/A
16	AT&T MultiQuest	N/A	N/A

Ascend-Call-Filter (243)

Usage: Filter entries apply on a first-match basis. Therefore, the order in which you enter them is significant. If you make changes to a filter in a RADIUS user profile, the changes do not take effect until a call uses that profile.

You can specify an IP filter or a generic filter. The following subsections describe how to configure each of the filter types.

IP call filter entries

Ascend-Call-Filter="ip dir action [dstip dest_ipaddr\subnet_mask] 
[srcip src_ipaddr\subnet_mask] [proto [dstport cmp value         
[srcport cmp value] [est]]"

Table 14-2 describes each element of the syntax. None of the keywords are case sensitive.

Table 14-2. IP call filter syntax elements

Element	Description
ip	Specifies an IP filter.
dir	Specifies filter direction. You can specify in (to filter packets coming into the MAX TNT) or out (to filter packets going out of the MAX TNT).
action	Specifies the action the MAX TNT should take with a packet that matches the filter. You can specify either forward or drop.
dstip dest_ipaddr \subnet_mask	The keyword dstip enables destination-IP-address filtering. The filter applies to packets whose destination address matches the value of dest_ipaddr. If a subnet mask portion of the address is present, the MAX TNT compares only the masked bits. If you set dest_ipaddr to 0.0.0.0, or if the keyword and its IP address specification are not present, the filter matches all IP packets.
srcip src_ipaddr \subnet_mask	The keyword srcip enables source-IP-address filtering. The filter applies to packets whose source address matches the value of src_ipaddr. If a subnet mask portion of the address is present, the MAX TNT compares only the masked bits. If you set src_ipaddr to 0.0.0.0, or if the keyword and its specification are not present, the filter matches all IP packets.
proto	Specifies a protocol specified as a name or a number. The filter applies to packets whose protocol field matches this value.The supported names and numbers are icmp (1), tcp (6), udp (17), and ospf (89). If you set proto to 0 (zero), the filter matches any protocol.
dstport cmp value	The keyword dstport enables destination-port filtering. This argument is valid only when the protocol is tcp (6) or udp (17). If you do not specify a destination port, the filter matches any port. The cmp argument defines how to compare the specified value to the actual destination port. It can have the value <, =, >, or !=. value can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
srcport cmp value	The keyword srcport enables source-port filtering. It is valid only when the protocol is tcp (6) or udp (17). If you do not specify a source port, the filter matches any port. The cmp argument defines how to compare the specified value to the actual source port. It can have the value <, =, >, or !=. value can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
est	If you set this argument to 1, the filter matches a packet only if a TCP session is already established. It is valid only when the proto specification is tcp (6).

Generic call filter entries

Ascend-Call-Filter="generic dir action offset mask value compare 
[more]"

Table 14-3 describes each element of the syntax. None of the keywords are case sensitive.

Table 14-3. Generic call filter syntax elements

Element	Description
generic	Specifies a generic filter.
dir	Defines filter direction. You can specify in (to filter packets coming into the MAX TNT) or out (to filter packets going out of the MAX TNT).
action	Defines the action the MAX TNT should take with a packet that matches the filter. You can specify either forward or drop.
offset	Specifies the number of bytes masked from the start of the packet. The byte position specified by offset is called the byte-offset. Starting at the position specified by offset, the MAX TNT applies the value of the mask argument. A mask hides the part of a number that appears behind the binary zeroes in the mask. The unit then compares the unmasked portion of the packet with the value specified by the value argument.
mask	Specifies which bits to compare in a segment of the packet. The mask must not exceed 6 bytes (12 hexadecimal digits). A one bit in the mask indicates a bit to compare. A zero bit indicates a bit to ignore. The length of the mask specifies the length of the comparison.
value	Specifies the value to compare to the packet contents at the specified offset in the packet. The length of the value must be the same as the length of the mask. Otherwise, the MAX TNT ignores the filter.
compare	Defines how the MAX TNT compares a packet's contents to the value specified by value. You can specify == (for Equal) or != (for NotEqual). Equal is the default.
more	If present, specifies whether the MAX TNT applies the next filter definition in the profile to the current packet before deciding whether to forward or drop the packet. The dir and action values for the next entry must be the same as the dir and action values for the current entry. Otherwise, the MAX TNT ignores the more flag.

Example: The following are examples of IP call filter entries:

Ascend-Call-Filter="ip in drop"

Ascend-Call-Filter="ip out forward tcp"

Ascend-Call-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip 
10.0.200.25/16 dstport!=telnet"

Ascend-Call-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip 
10.0.200.25/16 icmp"

Ascend-Call-Filter="generic in drop 0 ffff 0080"

Ascend-Call-Filter="generic in drop 0 ffff != 0080 more"

Ascend-Call-Filter="generic in drop 16 ff aa"

Ascend-Call-Type (177)

Usage: Table 14-4 lists the settings you can specify for Ascend-Call-Type.

Table 14-4. Ascend-Call-Type settings

Setting	Specifies
Nailed (1)	Link that consists entirely of nailed-up channels. Nailed is the default.
Nailed/Mpp (2)	Link that consists of both nailed-up and switched channels. The MAX TNT establishes the connection whenever any of its nailed-up or switched channels are connected end-to-end. If a Nailed/Mpp link is down and the nailed-up channels are down, the link cannot re-establish itself until the MAX TNT brings up one or more of the nailed-up channels, or dials one or more switched channels. Typically, the MAX TNT dials the switched channels when it receives a packet whose destination is the unit at the remote end of the Nailed/Mpp connection. The packet initiating the switched call must come from the caller side of the connection. If a failed channel is in the group specified by the Ascend-Group attribute, the MAX TNT replaces that channel with a switched channel, even if the call is online with more than the minimum number of channels. The MAX TNT always replaces failed nailed-up channels with switched channels, regardless of the Ascend-Minimum-Channels setting.
Perm/Switched (3)	Permanent switched connection (an outbound call that the MAX TNT attempts to keep up at all times). If the unit or central switch resets, or if one end terminates the link, the permanent switched connection attempts to restore the link at ten-second intervals. Use this setting if your telephone company charges for each incoming and outgoing connection attempt, but does not charge for connection time on local calls. Ascend's regular bandwidth-on-demand feature conserves connection time but causes many connection attempts. A permanent switched connection performs the opposite function. It conserves connection attempts but causes a long connection time. For the answering device at the remote end of the permanent switched connection, Ascend recommends that you configure the Connection profile to answer calls but not originate them. If the remote device initiates a call, the MAX TNT simply does not answer it. This situation could result in repeated charges for calls that have no purpose. To keep the remote device from originating calls, set Answer-Originate=Ans-Only for that device.

Dependencies: The MAX TNT adds or subtracts switched channels on a Nailed/Mpp connection as the settings on either side of the connection require. Each side makes its calculations on the basis of the traffic it receives at that side. If the two sides of the connection disagree on the number of channels needed, the side requesting the greater number prevails.

Ascend-Client-Assign-DNS (137)

Usage: Specify one of the following settings:

• DNS-Assign-No (0) disables client DNS server negotiation for the link. DNS-Assign-No is the default.

• DNS-Assign-Yes (1) enables client DNS server negotiation for the link.

See Also: Setting up access to specific DNS servers,
Ascend-Client-Primary-DNS (135), and
Ascend-Client-Secondary-DNS (136).

Ascend-Client-Gateway (132)

Usage: Specify the IP address of the next-hop router in dotted decimal notation. The default value is 0.0.0.0. If you accept the default, the Ascend unit routes packets as specified in the routing table, using the system-wide default route if it cannot find a more specific route.

Dependencies: The Ascend unit must have a direct route to the address you specify. The direct route can come from a profile or an Ethernet connection. If the Ascend unit does not have a direct route, it drops the packets on the connection. When you diagnose routing problems with a profile that includes a default route, an error in a per-user gateway address is not apparent from inspection of the global routing table.

Example: If you specify Ascend-Client-Gateway=10.0.0.3 in the RADIUS user profile
Berkeley, IP packets from the user with destinations through the default route go through the router at 10.0.0.3.

Ascend-Client-Primary-DNS (135)

Usage: Specify the IP address of the primary DNS server. You must specify the address in dotted decimal notation. The default is 0.0.0.0, which specifies that no primary DNS server is available for the connection. If you do not specify Ascend-Client-Primary-DNS or Ascend-Client-Secondary-DNS in any user profile, the Ascend unit routes packets as specified in the routing table, using the system-wide default route if it cannot find a more specific route.

Dependencies: You must include the setting Ascend-Client-Assign-DNS=DNS-Assign-Yes to direct the MAX TNT to send the primary DNS server address during connection negotiation.

See Also: Setting up access to specific DNS servers,
Ascend-Client-Assign-DNS (137), and
Ascend-Client-Secondary-DNS (136).

Ascend-Client-Secondary-DNS (136)

Usage: Specify the IP address of the secondary DNS server. You must specify the address in dotted decimal notation. The default is 0.0.0.0, which specifies that no primary DNS server is available for the connection. If you do not specify Ascend-Client-Primary-DNS or Ascend-Client-Secondary-DNS in any user profile, the Ascend unit routes packets as specified in the routing table, using the system-wide default route if it cannot find a more specific route.

Dependencies: You must include the setting Ascend-Client-Assign-DNS=DNS-Assign-Yes to direct the MAX TNT to send the secondary DNS server address during connection negotiation.

See Also: Setting up access to specific DNS servers,
Ascend-Client-Assign-DNS (137), and
Ascend-Client-Primary-DNS (135).

Ascend-Connect-Progress (196)

Usage: Ascend-Connect-Progress can have any one of values specified in Table 14-5.

Table 14-5. Ascend-Connect-Progress codes

Code	Explanation
0	No progress.
1	Not applicable.
2	The progress of the call is unknown.
10	The call is up.
30	The modem is up.
31	The modem is waiting for DCD.
32	The modem is waiting for result codes.
40	The terminal-server session has started up.
41	The MAX TNT is establishing the TCP connection.
42	The MAX TNT is establishing the immediate Telnet connection.
43	The MAX TNT has established a raw TCP session with the host. This code does not imply that the user has logged into the host.7
44	The MAX TNT has established an immediate Telnet connection with the host. This code does not imply that the user has logged into the host.
45	The MAX TNT is establishing an Rlogin session.
46	The MAX TNT has established an Rlogin session with the host. This code does not imply that the user has logged into the host.
60	The LAN session is up.
61	LCP negotiations are allowed.
62	CCP negotiations are allowed.
63	IPNCP negotiations are allowed.
65	LCP is in the Open state.
66	CCP is in the Open state.
67	IPNCP is in the Open state.
69	LCP is in the Initial state.
70	LCP is in the Starting state.
71	LCP is in the Closed state.
72	LCP is in the Stopped state.
73	LCP is in the Closing state.
74	LCP is in the Stopping state.
75	LCP is in the Request Sent state.
76	LCP is in the ACK Received state.
77	LCP is in the ACK Sent state.
80	IPXNCP is in the Open state.

Dependencies: The MAX TNT includes Ascend-Connect-Progress in an Accounting-Request packet when the session has ended or has failed authentication (Acct-Status-Type=Stop).

Ascend-Data-Filter (242)

Usage: Filter entries apply on a first-match basis. Therefore, the order in which you enter them is significant. If you make changes to a filter in a RADIUS user profile, the changes do not take effect until a call uses that profile.

You can specify an IP filter or a generic filter. The following sections describe how to configure each of the filter types.

IP data filter entries

Ascend-Data-Filter="ip dir action [dstip dest_ipaddr\subnet_mask] 
[srcip src_ipaddr\subnet_mask] [proto [dstport cmp value] 

[srcport cmp value] [est]]"

Table 14-6 describes each element of the syntax. None of the keywords are case sensitive.

Table 14-6. IP data filter syntax elements

Element	Description
ip	Specifies an IP filter.
dir	Specifies filter direction. You can specify in (to filter packets coming into the MAX TNT) or out (to filter packets going out of the MAX TNT).
action	Specifies the action the MAX TNT should take with a packet that matches the filter. You can specify either forward or drop.
dstip dest_ipaddr \subnet_mask	The keyword dstip enables destination-IP-address filtering. The filter applies to packets whose destination address matches the value of dest_ipaddr. If a subnet mask portion of the address is present, the MAX TNT compares only the masked bits. If you set dest_ipaddr to 0.0.0.0, or if the keyword and its IP address specification are not present, the filter matches all IP packets.
srcip src_ipaddr \subnet_mask	The keyword srcip enables source-IP-address filtering. The filter applies to packets whose source address matches the value of src_ipaddr. If a subnet mask portion of the address is present, the MAX TNT compares only the masked bits. If you set src_ipaddr to 0.0.0.0, or if the keyword and its specification are not present, the filter matches all IP packets.
proto	Specifies a protocol specified as a name or a number. The filter applies to packets whose protocol field matches this value.The supported names and numbers are icmp (1), tcp (6), udp (17), and ospf (89). If you set proto to 0 (zero), the filter matches any protocol.
dstport cmp value	The keyword dstport enables destination-port filtering. This argument is valid only when the protocol is tcp (6) or udp (17). If you do not specify a destination port, the filter matches any port. The cmp argument defines how to compare the specified value to the actual destination port. It can have the value <, =, >, or !=. value can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
srcport cmp value	The keyword srcport enables source-port filtering. It is valid only when the protocol is tcp (6) or udp (17). If you do not specify a source port, the filter matches any port. The cmp argument defines how to compare the specified value to the actual source port. It can have the value <, =, >, or !=. value can be a number or a name. Supported names and numbers are ftp-data (20), ftp (21), telnet (23), smtp (25), nameserver (42), domain (53), tftp (69), gopher (70), finger (79), www (80), kerberos (88), hostname (101), nntp (119), ntp (123), exec (512), login (513), cmd (514), and talk (517).
est	If you set this argument to 1, the filter matches a packet only if a TCP session is already established. It is valid only when the proto specification is tcp (6).

Generic data filter entries

Ascend-Data-Filter="generic dir action offset mask value compare 
[more]"

Table 14-7 describes each element of the syntax. None of the keywords are case sensitive.

Table 14-7. Generic data filter syntax elements

Element	Description
generic	Specifies a generic filter.
dir	Defines filter direction. You can specify in (to filter packets coming into the MAX TNT) or out (to filter packets going out of the MAX TNT).
action	Defines the action the MAX TNT should take with a packet that matches the filter. You can specify either forward or drop.
offset	Specifies the number of bytes masked from the start of the packet. The byte position specified by offset is called the byte-offset. Starting at the position specified by offset, the MAX TNT applies the value of the mask argument. A mask hides the part of a number that appears behind the binary zeroes in the mask. The unit then compares the unmasked portion of the packet with the value specified by the value argument.
mask	Specifies which bits to compare in a segment of the packet. The mask must not exceed 6 bytes (12 hexadecimal digits). A one bit in the mask indicates a bit to compare. A zero bit indicates a bit to ignore. The length of the mask specifies the length of the comparison.
value	Specifies the value to compare to the packet contents at the specified offset in the packet. The length of the value must be the same as the length of the mask. Otherwise, the MAX TNT ignores the filter.
compare	Defines how the MAX TNT compares a packet's contents to the value specified by value. You can specify == (for Equal) or != (for NotEqual). Equal is the default.
more	If present, specifies whether the MAX TNT applies the next filter definition in the profile to the current packet before deciding whether to forward or drop the packet. The dir and action values for the next entry must be the same as the dir and action values for the current entry. Otherwise, the MAX TNT ignores the more flag.

Example: The following are examples of IP data filter entries:

Ascend-Data-Filter="ip in drop"

Ascend-Data-Filter="ip out forward tcp"

Ascend-Data-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip 
10.0.200.25/16 dstport!=telnet"

Ascend-Data-Filter="ip out forward tcp dstip 10.0.200.3/16 srcip 
10.0.200.25/16 icmp"

Ascend-Data-Filter="generic in drop 0 ffff 0080"

Ascend-Data-Filter="generic in drop 0 ffff != 0080 more"

Ascend-Data-Filter="generic in drop 16 ff aa"

Ascend-Data-Rate (197)

Usage: Ascend-Data-Rate does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT includes Ascend-Data-Rate in an Accounting-Request packet when the session has ended or has failed authentication (Acct-Status-Type=Stop).

Ascend-Data-Svc (247)

Usage: Set the Ascend-Data-Svc attribute to one of the values listed in Table 14-8. The data service you specify must be available end-to-end.

Table 14-8. Ascend-Data-Svc settings

Setting	Description
Switched-Voice-Bearer (0)	Applies only to calls made over a T1 PRI line. The MAX TNT enables the network to place an end-to-end digital voice call for transporting data when a switched data service is not available.
Switched-56KR (1)	Contains restricted data, guaranteeing that the data the MAX TNT transmits meets the density restrictions of D4-framed T1 lines. D4 specifies the D4 format, also known as the Superframe format, for framing data at the physical layer. This format consists of 12 consecutive frames separated by framing bits. The call connects to the Switched-56 data service. The only services available to lines that use inband signaling (T1 access lines containing one or more switched channels, and Switched-56 lines) are Switched-56K and Switched-56KR.
Switched-64K (2)	Contains any type of data and connects to the Switched-64 data service.
Switched-64KR (3)	Contains restricted data and connects to the Switched-64 data service.
Switched-56K (4)	Contains any type of data and connects to the Switched-56 data service. The only services available to lines that use inband signaling (T1 access lines containing one or more switched channels, and Switched-56 lines) are Switched-56K and Switched- 56KR. For most T1 PRI lines, select Switched-56K.
Nailed-56KR (1)	Contains restricted data and connects to the Nailed-56 data service.
Nailed-64K (2)	Contains any type of data and connects to the Nailed-64 data service.
Switched-384KR	Contains restricted data, and connects to MultiRate or GloBanD data services at 384 Kbps.
Switched-384K	Contains any type of data and connects to the Switched-384 data service. This AT&T data service does not require MultiRate or GloBanD.
Switched-1536K	Contains any type of data and connects to the Switched-1536 data service at 1536 Kbps. This setting is valid only for a MAX TNT that supports ISDN D-channel signaling, and connects to two or more T1 PRI lines that use Non-Facility Associated Signaling (NFAS).
Switched-1536KR	Contains restricted data, and connects to the Switched-1536 data service at 1536 Kbps. This setting is valid only for a MAX TNT that supports ISDN D-channel signaling, and is connected to two or more T1 PRI lines that use Non-Facility Associated Signaling (NFAS).
Switched-128K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-192K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-256K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-320K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-384K-MR	Available on a T1 PRI line with the MultiRate data service.
Switched-448K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-512K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-576K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-640K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-704K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-768K	Available on a T1 PRI line with MultiRate or GloBanD data services.
Switched-832K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-896K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-960K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1024K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1088K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1152K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1216K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1280K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1344K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1408K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1472K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1600K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1664K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1728K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1792K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1856K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-1920K	Available on a T1 PRI line with MultiRate or GloBanD data
Switched-restricted-bearer-x30	Specifies 56-Kbps X.30 switched service from DPNSS and DASS 2 switches.
Switched-restricted-64-x30	Specifies 64-Kbps X.30 switched service from DPNSS and DASS 2 switches. For most DASS 2 and DPNSS installations, select Switched-restricted-64-x30.
Switched-modem	Places an outgoing call on any available digital modem. If no digital modems are available, the MAX TNT does not place the call. The data rate depends on the quality of the connections between modems and the types of modems used. The Switched-modem setting requires that your MAX TNT have digital modems installed. The setting applies only for PPP and MP+ calls. Currently, the MAX TNT does not support multichannel modem calls.

Dependencies: Consider the following:

• You can determine the base bandwidth of a call by multiplying the value of the Ascend-Base-Channel-Count attribute by the value of the Ascend-Data-Svc attribute.

• Either party can request a data service that is unavailable. In such a case, the MAX TNT cannot connect the call.

Ascend-DBA-Monitor (171)

Usage: Specify one of the following values:

• DBA-Transmit (0) specifies that the MAX TNT adds or subtracts bandwidth on the basis of the amount of data it transmits. DBA-Transmit is the default.

• DBA-Transmit-Recv (1) specifies that the MAX TNT adds or subtracts bandwidth on the basis of the amount of data it transmits and receives.

• DBA-None (2) specifies that the MAX TNT does not monitor traffic over the link.

• The MAX TNT supports Ascend-DBA-Monitor only for MP+ calls.

• If both sides of the link have Ascend-DBA-Monitor set to DBA-None, Dynamic Bandwidth Allocation is disabled.

Ascend-Dec-Channel-Count (237)

Usage: Specify a number from 1 to 32. The default value is 1.

Dependencies: Consider the following:

• Ascend-Dec-Channel-Count does not apply if all channels of a link are nailed up (Ascend-Call-Type=Nailed).

• Ascend-Dec-Channel-Count applies only when the link is using MP+ encapsulation.

• You cannot clear a call by decrementing channels.

Ascend-Dialout-Allowed (131)

Usage: Specify one of the following settings:

• Dialout-Not-Allowed (0) specifies that the RADIUS user profile does not allow modem dialout. Dialout-Not Allowed is the default.

• Dialout-Allowed (1) specifies that the RADIUS user profile allows modem dialout.

Ascend-Dial-Number (227)

Usage: Specify a telephone number of up to 21 characters, limited to the following:

1234567890()[]!z-*#|

Dependencies: If Use-Trunk-Groups=Yes in the System profile, the first digits in the Ascend-Dial-Number attribute have the meanings listed in Table 14-9.

Table 14-9. Ascend-Dial-Number digits

First digit	Significance
4 through 9	The MAX TNT places the call over the corresponding trunk group listed in the Trunk-Group parameter.
3	The MAX TNT places the call to a destination listed in a Call-Route profile. The second and third digits specify the number of the Call-Route profile.
2	The MAX TNT places the call between host ports on the same MAX TNT. If you enter 0 (zero) for the second digit, the call connects to any available serial port and ignores the third digit. If you enter a nonzero value for the second digit, the third digit selects the serial port. If you enter 0 (zero) for the third digit, the call connects to any available serial port in the module selected by the second digit.

Ascend-Disconnect-Cause (195)

Usage: Ascend-Disconnect-Cause can return any of the values listed in Table 14-10.

Table 14-10. Ascend-Disconnect-Cause codes

Code	Description
0	No reason.
1	The event was not a disconnect.
2	The reason for the disconnect is unknown. The code can appear when the remote connection goes down.
3	The call has disconnected.
4	CLID authentication has failed.
The following codes can appear if a disconnect occurs during the initial modem connection.
10	The modem never detected DCD.
11	The modem detected DCD, but became inactive.
12	The result codes could not be parsed.
The following codes are related to immediate Telnet and raw TCP disconnects during a terminal-server session.
20	The user exited normally from the terminal server.
21	The user exited from the terminal server because the idle timer expired.
22	The user exited normally from a Telnet session.
23	The user could not switch to SLIP or PPP because the remote host had no IP address or because the dynamic pool could not assign one.
24	The user exited normally from a raw TCP session.
25	The login process ended because the user failed to enter a correct password after three attempts.
26	The raw TCP option is not enabled.
27	The login process ended because the user typed Ctrl-C.
28	The terminal-server session has ended.
29	The user closed the virtual connection.
30	The virtual connection has ended.
31	The user exited normally from an Rlogin session.
32	The user selected an invalid Rlogin option.
33	The MAX TNT has insufficient resources for the terminal-server session.
The following codes concern PPP connections.
40	PPP LCP negotiation timed out while waiting for a response from a peer.
41	There was a failure to converge on PPP LCP negotiations.
42	PPP PAP authentication failed.
43	PPP CHAP authentication failed.
44	Authentication failed from the remote server.
45	The peer sent a PPP Terminate Request.
46	LCP got a close request from the upper layer while LCP was in an open state.
47	LCP closed because no NCPs were open.
48	LCP closed because it could not determine to which MP bundle it should add the user.
49	LCP closed because the MAX TNT could not add any more channels to an MP session.
The following codes are related to immediate Telnet and raw TCP disconnects, and contain more specific information than the Telnet and TCP codes listed earlier in this table.
50	The Raw TCP or Telnet internal session tables are full.
51	Internal resources are full.
52	The IP address for the Telnet host is invalid.
53	The MAX TNT could not resolve the hostname.
54	The MAX TNT detected a bad or missing port number.
The TCP stack can return the following disconnect codes during an immediate Telnet or raw TCP session.
60	The host reset the TCP connection.
61	The host refused the TCP connection.
62	The TCP connection timed out.
63	A foreign host closed the TCP connection.
64	The TCP network was unreachable.
65	The TCP host was unreachable.
66	The TCP network was administratively unreachable.
67	The TCP host was administratively unreachable.
68	The TCP port was unreachable.
The following are additional disconnect codes.
100	The session timed out because there was no activity on a PPP link.
101	The session failed for security reasons.
120	One end refused the call because the protocol was disabled or unsupported.
150	RADIUS requested the disconnect.
170	PPP authentication has timed out.
180	The call disconnected as the result of a local hangup.
185	The call disconnected because the remote end hung up. The disconnection might have occurred because authentication failed, modem negotiation failed, the remote modem or device was turned off, or the remote device issued a Hangup command.
190	The call disconnected because the T1 line that carried it was quiesced.
195	The call disconnected because the call duration exceeded the maximum amount of time allowed by the Ascend-Maximum-Call-Duration attribute.

Dependencies: The MAX TNT includes Ascend-Disconnect-Cause in an Accounting-Request packet when the session has ended or has failed authentication (Acct-Status-Type=Stop).

Ascend-Event-Type (150)

• A cold-start notification, informing the accounting server that the MAX TNT has started up

• A session event, informing the authentication server that a session has begun

Dependencies: In a cold-start notification, the MAX TNT sends values for NAS-Identifier, Ascend-Event-Type, and Ascend-Number-Sessions in an Ascend-Access-Event-Request packet (code 33). The RADIUS accounting server must send back an Ascend-Access-Event-Response packet (code 34) with the correct identifier to the MAX TNT.

In a session event, the MAX TNT sends values for Password, NAS-Identifier, Ascend-Access-Event-Type, and Ascend-Number-Sessions in an Ascend-Access-Event-Request packet (code 33). The authentication server must send back an Ascend-Access-Event-Response packet (code 34) with the correct identifier to the MAX TNT.

See Also: Ascend-Number-Sessions (202) and
NAS-Identifier (4).

Ascend-Expect-Callback (149)

Usage: Specify one of the following values:

• Expect-Callback-No (0) specifies that the caller does not wait for a callback after placing a call that does not connect. Expect-Callback-No is the default.

• Expect-Callback-Yes (1) specifies that the caller waits 90 seconds after placing a call that does not connect before attempting to place another call to the same number.

Ascend-First-Dest (189)

Usage: Ascend-First-Dest does not appear in a user profile and has no default value.

Dependencies: Ascend-First-Dest applies only if the session routes IP. The MAX TNT includes Ascend-First-Dest in an Accounting-Request packet when both of the following conditions are true:

• The session has been authenticated.

• The session has ended (Acct-Status-Type=Stop).

Ascend-Force-56 (248)

Usage: Specify one of the following values:

• Force-56-No (0) specifies that the MAX TNT should use the entire 64 Kbps (when available). Force-56-No is the default.

• Force-56-Yes (1) specifies that the MAX TNT should use only the 56-Kbps portion of a channel.

Ascend-FR-Circuit-Name (156)

Usage: Specify a text string of up to 15 characters. The default value is null.

Dependencies: Consider the following:

• You can specify Ascend-FR-Circuit-Name only when Framed-Protocol=FR-CIR.

• The MAX TNT requires two profiles for a single PVC. You can use two RADIUS user profiles, two Connection profiles, or one RADIUS user profile and one Connection profile. The two DLCIs can use the same Frame Relay profile or different ones.

• The Frame Relay network switches matching pairs of Ascend-FR-Circuit-Name attributes to each other, so make sure that you specify the exact same name for Ascend-FR-Circuit-Name in each profile.

Ascend-FR-DCE-N392 (162)

Usage: Specify an integer from 1 to 10. The default value is 3.

Dependencies: Consider the following:

• You should set Ascend-FR-DCE-N392 to a value less than Ascend-FR-DCE-N393.

• Ascend-FR-DCE-N392 does not apply if Ascend-FR-Type=Ascend-FR-DTE.

Ascend-FR-DCE-N393 (164)

Usage: Specify a number from 1 to 10. The default value is 4.

Dependencies: The Ascend-FR-DCE-N393 attribute does not apply if Ascend-FR-Type=Ascend-FR-DTE.

See Also: Ascend-FR-Type (159).

Ascend-FR-Direct (219)

Usage: Specify one of the following values:

• FR-Direct-No (0) specifies that the MAX TNT does not use a direct connection. FR-Direct-No is the default.

• FR-Direct-Yes (1) specifies that the MAX TNT uses a direct connection.

Ascend-FR-Direct-DLCI (221)

Usage: Specify an integer from 16 to 991. The default value is 16. Many direct connections can use the same DLCI.

Dependencies: Ascend-FR-Direct-DLCI applies only if Ascend-FR-Direct=FR-Direct-Yes.

See Also: Direct connections (rarely used),
Configuring a Frame Relay direct connection,
Ascend-FR-Direct (219), and
Ascend-FR-Direct-Profile (220).

Ascend-FR-Direct-Profile (220)

Usage: Specify the name of a Frame Relay profile. This profile connects to the Frame Relay switch handling the Data Link Connection Indicator (DLCI) specified by Ascend-FR-Direct-DLCI. You can specify up to 15 alphanumeric characters. The default value is null.

Dependencies: Ascend-FR-Direct-Profile applies only if Ascend-FR-Direct=FR-Direct-Yes.

See Also: Direct connections (rarely used),
Configuring a Frame Relay direct connection,
Ascend-FR-Direct (219), and
Ascend-FR-Direct-DLCI (221).

Ascend-FR-DLCI (179)

Usage: Specify an integer from 16 to 991. The default value is 16. You must assign each gateway connection its own DLCI.

Dependencies: Ascend-FR-DLCI applies only if Ascend-FR-Direct=FR-Direct-No.

See Also: Gateway connections,
Configuring a Frame Relay gateway connection,
Ascend-FR-Direct (219), and
Ascend-FR-Profile-Name (180).

Ascend-FR-DTE-N392 (163)

Usage: Specify an integer from 1 to 10. The default value is 3.

Dependencies: Consider the following:

• You should set Ascend-FR-DTE-N392 to a value less than Ascend-FR-DTE-N393.

• Ascend-FR-DTE-N392 does not apply if Ascend-FR-Type=Ascend-FR-DCE.

Ascend-FR-DTE-N393 (165)

Usage: Specify a number from 1 to 10. The default value is 4.

Dependencies: The Ascend-FR-DTE-N393 attribute does not apply if Ascend-FR-Type=Ascend-FR-DCE.

See Also: Ascend-FR-Type (159).

Ascend-FR-Link-Mgt (160)

Usage: Specify one of the following values:

• Ascend-FR-No-Link-Mgt (0) specifies no link management, and is the default. The MAX TNT always considers a link active if no link management functions take place.

• Ascend-FR-T1-617D (1) specifies T1.617 Annex D link management.

• Ascend-FR-Q-933A (2) specifies Q.933 Annex A link management.

Ascend-FR-N391 (161)

Usage: Specify an integer from 1 to 255. The default value is 6.

Dependencies: The Ascend-FR-N391 attribute does not apply if Ascend-FR-Type=Ascend-FR-DCE.

See Also: Ascend-FR-Type (159).

Ascend-FR-Nailed-Grp (158)

Usage: Specify a number from 1 to the maximum number of nailed-up channels that your MAX TNT allows. The default value is 1.

Dependencies: Do not associate a group with more than one active Frame Relay profile.

See Also: Setting up Frame Relay user connections.

Ascend-FR-Profile-Name (180)

Usage: Specify the name of a Frame Relay profile. This profile connects to the Frame Relay switch handling the Data Link Connection Indicator (DLCI) specified by Ascend-FR-DLCI. You can specify up to 15 alphanumeric characters. The default value is null.

Dependencies: Ascend-FR-Profile-Name applies only if Ascend-FR-Direct=FR-Direct-No.

See Also: Gateway connections,
Configuring a Frame Relay gateway connection,
Ascend-FR-Direct (219), and
Ascend-FR-DLCI (179).

Ascend-FR-T391 (166)

Usage: Specify a number of seconds from 5 to 30. The default value is 10.

Dependencies: The Ascend-FR-T391 attribute does not apply if Ascend-FR-Type=Ascend-FR-DCE.

See Also: Ascend-FR-Type (159).

Ascend-FR-T392 (167)

Usage: Specify a number of seconds from 5 to 30. The default value is 10.

Dependencies: The Ascend-FR-T392 attribute does not apply if Ascend-FR-Type=Ascend-FR-DTE.

See Also: Ascend-FR-Type (159).

Ascend-FR-Type (159)

Usage: Specify one of the following values:

• Ascend-FR-DTE (0) specifies a UNI-DTE interface (the default). When you specify this value, the MAX TNT acts as a DTE that can connect to a Frame Relay switch.

• Ascend-FR-DCE (1) specifies a UNI-DCE interface. When you specify this value, the MAX TNT acts as a DCE that can connect to a Frame Relay DTE unit.

• Ascend-FR-NNI (2) specifies an NNI interface. When you specify this value, the MAX TNT can connect to another NNI unit (a Frame Relay switch).

Ascend-FT1-Caller (175)

Usage: Specify one of the following values:

• FT1-No (0) specifies that the MAX TNT waits for the remote end to initiate the call. FT1-No is the default.

• FT1-Yes (1) specifies that the MAX TNT initiates the call. If you choose this setting, the MAX TNT dials to bring online any switched circuits that are part of the call.

Ascend-Group (178)

Usage: Your usage depends upon the value you specify for the Ascend-Call-Type attribute:

• If you set Ascend-Call-Type=Nailed, you can specify a number from 1 to 60 for Ascend-Group. The default value is 1.

• If you set Ascend-Call-Type=Nailed/Mpp, you can use the Ascend-Group attribute to assign multiple nailed-up groups to the profile. Specify a single number, or specify a list of numbers from 1 to 60, separated by commas, with no spaces. The default value is 1.

• Ascend-Group does not apply if the link consists entirely of switched channels.

• If you add channels for the Ascend-Group attribute, the MAX TNT adds the channels to any online connection that uses the group.

• Do not duplicate group numbers in active profiles.

• Although you can assign multiple groups to a user profile, do not mix the Serial WAN circuit with nailed-up T1/E1 channels.

Ascend-History-Weigh-Type (239)

Usage: Specify one of the following settings:

• History-Constant (0) gives equal weight to all samples taken during the historical time period specified by the Ascend-Seconds-Of History attribute. When you select this option, older historical samples have as much impact on the decision to change bandwidth allocation as more recent samples.

• History-Linear (1) gives more weight to recent samples of bandwidth usage than to older samples taken during the historical period specified by Ascend-Seconds-Of-History. The weighting grows at a linear rate.

• History-Quadratic (2) gives more weight to recent samples of bandwidth usage than to older samples taken during the historical period specified by the Ascend-Seconds-Of-History attribute. The weighting grows at a quadratic rate. History-Quadratic is the default.

Ascend-Home-Agent-IP-Addr (183)

Usage: The Ascend-Home-Agent-IP-Addr attribute appears in an accounting Stop record under the following conditions:

• The session has ended.

• The Accounting-Request packet includes Acct-Status-Type=Stop.

• The session was authenticated and encapsulated by means of Ascend Tunnel Management Protocol (ATMP).

Ascend-Home-Agent-Password (184)

Usage: Specify a text string of up to 20 characters. The default value is null.

See Also: Setting up an ATMP tunnel for an IP network.

Ascend-Home-Agent-UDP-Port (186)

Usage: Specify a UDP port number from 0 to 65535. The default value is 5150.

Dependencies: If you specify a value for the udp_port argument of Ascend-
Primary-Home-Agent or Ascend-Secondary-Home-Agent, or if you accept the default of 5150 for udp_port, you need not specify the Ascend-Home-Agent-UDP-Port attribute.

See Also: Setting up an ATMP tunnel for an IP network,
Ascend-Primary-Home-Agent (129), and
Ascend-Secondary-Home-Agent (130).

Ascend-Home-Network-Name (185)

Usage: Specify the name of the home agent's Connection profile. The default value is null.

Dependencies: You must specify a value for the Ascend-Home-Network-Name attribute only if the home agent is a gateway.

See Also: Setting up an ATMP tunnel for an IP network.

Ascend-Host-Info (252)

Usage: You can specify up to 10 Ascend-Host-Info entries in a user profile. Enter your attribute settings in the following format:

Ascend-Host-Info="IP_address text"

Dependencies: If you specify a value for the Ascend-Host-Info attribute, you must also specify the following settings in the Menu-Mode-Options subprofile of the Terminal-Server profile:

• Start-With-Menus=Yes or Toggle-Screen=Yes

• Remote-Configuration=Yes

initial-banner-Cal Password="ascend", User-Service=Dialout-Framed-User

     Reply-Message="Up to 16 lines of up to 80 characters each",

     Reply-Message="will be accepted. ",

     Reply-Message="Additional lines will be ignored.",

     Reply-Message="",

     Ascend-Host-Info="1.2.3.4 Berkeley",

     Ascend-Host-Info="1.2.3.5 Alameda",

     Ascend-Host-Info="1.2.36 San Francisco",

     ...

Ascend-Idle-Limit (244)

Usage: Specify a number from 0 to 65535. If you specify 0 (zero), the MAX TNT always clears a call when a session is inactive. The default value is 120 seconds. If you accept the default, and the Answer-Defaults profile specifies a value for the analogous Idle-Timer parameter, the MAX TNT ignores the Idle-Timer value and uses the Ascend-Idle-Limit default.

Dependencies: Consider the following:

• If the time set by the Ascend-Idle-Limit expires, the call disconnects whether or not bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting.

• When bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting, the call disconnects regardless of whether the time specified by the Ascend-Idle-Limit attribute has expired.

• Because the Ascend-MPP-Idle-Percent attribute is dependent on traffic levels on both sides of the connection, Ascend recommends that you use the Ascend-Idle-Limit attribute instead.

• The Ascend-Idle-Limit attribute does not apply to nailed-up links.

Ascend-IF-Addr

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0.0.0.

See Also: Setting up an interface-based IP routing connection,
Ascend-IF-Netmask (153), and
Ascend-Remote-Addr (154).

Ascend-IF-Netmask (153)

Usage: Specify a subnet mask consisting of four numbers from 0 to 255, separated by periods. The default value is 0.0.0.0.

See Also: Setting up an interface-based IP routing connection,
Ascend-IF-Addr, and
Ascend-Remote-Addr (154).

Ascend-Inc-Channel-Count (236)

Usage: Specify a number from 1 to 32. The default value is 1.

Dependencies: Consider the following:

• Ascend-Inc-Channel-Count does not apply if all channels of a link are nailed up (Ascend-Call-Type=Nailed).

• Ascend-Inc-Channel-Count applies only if the link is using MP+ encapsulation.

• MP+ calls cannot exceed 32 channels.

• The sum of Ascend-Base-Channel-Count and Ascend-Inc-Channel-Count must not exceed the maximum number of channels available.

Ascend-IP-Direct (209)

Ascend-IP-Direct only affects packets from the user. It does not affect packets that go to the user. The MAX TNT uses its internal routing scheme to route packets to the user.

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0.0.0. If you accept the default, the MAX TNT does not redirect IP traffic.

Dependencies: Consider the following:

• You can specify the Ascend-IP-Direct attribute only if IP routing is in use and Framed-Protocol is not set to FR.

• Do not set Ascend-IP-Direct and Ascend-FR-Direct in the same user profile. If you do, an error occurs.

• Ascend-IP-Direct connections typically turn off RIP. If you configure the connection to receive RIP, the MAX TNT forwards all RIP packets it receives to the IP address you specify. To turn off RIP, set Framed-Routing=None.

Emma Password="m2dan", User-Service=Framed-User

          Framed-Protocol=PPP,

          Framed-Address=10.8.9.10,

          Framed-Netmask=255.255.252.0,

          Ascend-Route-IP=Route-IP-Yes,

          Ascend-IP-Direct=10.2.3.11,

          Ascend-Metric=2,

          Framed-Routing=None,

          ...

Ascend-IP-Pool-Definition (217)

Usage: The Ascend-IP-Pool-Definition attribute has the following format:

Ascend-IP-Pool-Definition="num first_ipaddr max_entries"

Table 14-11 describes each Ascend-IP-Pool-Definition argument.

Table 14-11. Ascend-IP-Pool-Definition arguments

Argument	Specifies
num	Number of the pool. The default value is 1. Specify pool numbers starting with 1, unless you have defined pools with the Pool-Base-Address and Assign-Count parameters in the MAX TNT interface, and do not wish to override those settings. In that case, for the num argument, start with one plus the highest number you used for an IP address pool on the MAX TNT. For example, if you set up address pools 1 through 5 on the MAX TNT, specify pool numbers starting with 6 in RADIUS.
first_ipaddr	First IP address in the address pool. The address you specify should not accept a subnet mask, because it always becomes a host route. The default value is 0.0.0.0.
max_entries	Maximum number of IP addresses in the pool. The MAX TNT assigns addresses sequentially, from first_ipaddr on, up to the limit of addresses specified by max_entries. The default value is 0 (zero).

Example: In the following example, an administrator configures a pseudo-user profile to create two address pools. Address pool #1 contains a block of 7 IP addresses from 10.1.0.1 to 10.1.0.7. Address pool #2 contains a block of 48 IP addresses from 10.2.0.1 to 10.2.0.48.

pools-TNT Password="ascend", User-Service=Dialout-Framed-User

    Ascend-IP-Pool-Definition="1 10.1.0.1 7",

    Ascend-IP-Pool-Definition="2 10.2.0.1 48"

Ascend-IPX-Alias (224)

Usage: Specify an IPX network number. The default value is 0 (zero). RADIUS requires that the Ascend-IPX-Alias attribute have a decimal value (base 10), but IPX network numbers generally have hexadecimal values (base 16). In order to give the Ascend-IPX-Alias attribute a value, you must convert the hexadecimal IPX network number to a decimal value for use in the user profile.

See Also: Setting up IPX routing in a user profile,
Ascend-IPX-Peer-Mode (216),
Ascend-IPX-Route (174), and
Ascend-Route-IPX (229).

Ascend-IPX-Peer-Mode (216)

Dial-in clients do not belong to an IPX network, so you must assign them an IPX network number. When you do so, a dial-in client can establish a routing connection with the MAX TNT. You must use the IPX-Dialin-Pool parameter in the MAX TNT configuration interface to define a virtual IPX network. The MAX TNT advertises the route to the virtual network, and assigns it as the network address for dial-in clients.

Usage: Specify one of the following values:

• IPX-Peer-Router (0) specifies that the caller is on the Ethernet network and has its own IPX address. IPX-Peer-Router is the default.

• IPX-Peer-Dialin (1) specifies that the caller is a dial-in NetWare client that incorporates PPP software and dial-out hardware, but does not have an Ethernet interface. This setting causes the MAX TNT to assign the caller an IPX address derived from the value of IPX-Dialin-Pool.

See Also: Setting up IPX routing in a user profile,
Ascend-IPX-Route (174), and
Ascend-Route-IPX (229).

Ascend-IPX-Route (174)

Usage: To configure a static IPX route, use the following format:

Ascend-IPX-Route="profile_name network# [node#] [socket#] 
[server_type] [hop_count] [tick_count] [server_name]"

Table 14-12. Ascend-IPX-Route arguments

Argument	Specifies
profile_name	RADIUS user profile the MAX TNT uses to reach the network. The default value is null.
network#	Unique internal network number for the NetWare server. The default value is 00000000.
node#	Node number for the NetWare server. The default value is 0000000000001 (the typical node number for a NetWare file server.)
socket#	Socket number for the NetWare server. Typically, NetWare file servers use socket 0451. The default value is 0000. The number you specify must be a well-known socket number. Services that use dynamic socket numbers might use a different socket each time they load. To bring up a connection to a remote service that uses a dynamic socket number, specify a master server that uses a well-known socket number.
server_type	SAP service type of the NetWare server. NetWare file servers have SAP service type 0004. The default value is 0000.
hop_count	Distance to the destination network, in hops. The default value is 1.
tick_count	Distance to the destination network, in IBM PC clock ticks (one-eighteenth of a second). This value is for round-trip timer calculation and for determining the nearest server of a given type. The default value is 12.
server_name	Name of an IPX server. The default value is null.

Example: To define an IPX route, you would configure a pseudo-user profile as follows:

ipxroute-CA-1 Password="ascend", User-Service=Dialout-Framed-User

        Ascend-IPX-Route="def 6 7 8 9 10"

Ascend-Link-Compression (233)

Usage: You can specify one of the following values:

• Link-Comp-None (0) disables data compression. Link-Comp-None in the default.

• Link-Comp-Stac (1) enables Ascend's modified version of the STACKER LZS compression/decompression algorithm.

• Link-Comp-Stac-Draft-9 (2) enables the STACKER LZS compression/decompression algorithm, as specified in draft 9 of the IETF draft "PPP Stac LZS Compression Protocol".

• Link-Comp-MS-Stac (3) enables Microsoft's modified version of the STACKER LZS compression/decompression algorithm.

See Also: Framed-Compression (13).

Ascend-Maximum-Call-Duration (125)

Usage: Specify a number from 0 to 1440. The MAX TNT checks the connection once per minute, so the actual time the call is connected is slightly longer than the time you set. The default value is 0 (zero), which specifies that the MAX TNT does not set a limit on the duration of an incoming call.

See Also: Configuring a time limit and idle connection attributes.

Ascend-Maximum-Channels (235)

Usage: Specify an integer from 1 to the maximum number of channels your system supports. The default value is 1.

Dependencies: The Ascend-Maximum-Channels attribute applies only to MP+ calls. For optimum MP+ performance, both sides of a connection must set the following values to the same number:

• Base channel count, as specified by Base-Channel-Count (in the Connection profile) or Ascend-Base-Channel-Count (in RADIUS).

• Minimum channel count, as specified by Minimum-Channels (in the Answer-Defaults profile or Connection profile) or Ascend-Minimum-Channels (in RADIUS).

• Maximum channel count, as specified by Maximum-Channels (in the Answer-Defaults profile or Connection profile) or Ascend-Maximum-Channels (in RADIUS).

Ascend-Maximum-Time (194)

Usage: Specify a number from 0 to 4,294,967,295. The default value is 0 (zero), which specifies that the MAX TNT does not enforce a time limit.

See Also: Configuring a time limit and idle connection attributes.

Ascend-Menu-Item (206)

Using the Ascend-Menu-Item attribute, you can configure a profile to give a terminal-server user a custom menu of items from which to choose. The server uses the custom menu to present the user with a subset of terminal-server commands. The user does not have access to the regular menu or to the terminal-server command line.

Usage: Enter your specifications using the following format:

Ascend-Menu Item=command;text;match

Table 14-13. Ascend-Menu-Item arguments

Argument	Description
command	Specifies the string sent to the terminal server when the user selects the menu item. The string must be in a format that the Ascend terminal server understands. It can contain up to 80 characters.
text	Specifies the text that appears on the user's screen, up to 31 characters.
match	Specifies the pattern, of up to 10 characters, that the user must type to select the item. The MAX TNT considers blanks part of the matching pattern.
; (semi-colon)	The first semicolon (;) you enter acts as the delimiter between command and text. If you enter a second semicolon, it acts as the delimiter between text and match.

By default, the MAX TNT uses the standard terminal-server menu.

Example: Suppose you set the following attributes:

Emma Password="m2dan", User-Service=Login-User

      Ascend-Menu-Item="show ip stats;Display IP Stats",

      Ascend-Menu-Item="ping 1.2.3.4;Ping server",

      Ascend-Menu-Item="telnet 10.2.4.5; Telnet to Ken's machine",

      Ascend-Menu-Item="show arp;Display ARP Table"

      Ascend-Menu-Selector="                              Option:"

1. Display IP Stats     3. Telnet to Ken's machine

2. Ping server          4. Display ARP Table.

                              Option:

Ascend-Menu-Selector (205)

By default, when you create a custom menu with the Ascend-Menu-Item attribute, the terminal server displays the following string when prompting the user to make a selection:

Enter Selection (1-num, q) 

However, you can specify a different string for prompting the user to make a selection. The Ascend-Menu-Selector attribute enables you to specify a string that the terminal server displays when prompting a user for a menu selection.

Usage: Specify a text string of up to 31 characters. The terminal server displays the string when prompting the user for a menu selection.

Example: Suppose you set the following attributes:

Emma Password="m2dan", User-Service=Login-User

      Ascend-Menu-Item="show ip stats;Display IP Stats",

      Ascend-Menu-Item="ping 1.2.3.4;Ping server",

      Ascend-Menu-Item="telnet 10.2.4.5; Telnet to Ken's machine",

      Ascend-Menu-Item="show arp;Display ARP Table"

      Ascend-Menu-Selector="                              Option:"

1. Display IP Stats     3. Telnet to Ken's machine

2. Ping server          4. Display ARP Table.

                              Option:

See Also: Setting up a custom menu and an input prompt and
Ascend-Menu-Item (206).

Ascend-Metric (225)

If there are two routes available to a single destination network, you can make sure that the MAX TNT uses any available nailed-up channel before it uses a switched channel. Simply set the Ascend-Metric attribute to a value higher than the metric of any nailed-up route. The higher the value you enter, the less likely that the MAX TNT will bring the link online. The MAX TNT uses the lowest metric.

Usage: Specify a number from 1 to 15. The default value is 7.

Dependencies: The hop count includes the metric of each switched link in the route.

Example: If a route to a station takes three hops over nailed-up lines, and Ascend-Metric=4 in a user profile that reaches the same station, the MAX TNT does not bring the user's link online. However, if the link is already online, the MAX TNT does not use the nailed-up line.

See Also: Ascend-Route-IP (228) and
Framed-Route (22).

Ascend-Minimum-Channels (173)

Usage: Specify a number from 1 to 32. The default value is 1.

Dependencies: The Ascend-Minimum-Channels attribute applies only to MP+ calls. For optimum MP+ performance, both sides of a connection must set the following values to the same number:

• Base channel count, as specified by Base-Channel-Count (in the Connection profile) or Ascend-Base-Channel-Count (in RADIUS).

• Minimum channel count, as specified by Minimum-Channels (in the Answer-Defaults profile or Connection profile) or Ascend-Minimum-Channels (in RADIUS).

• Maximum channel count, as specified by Maximum-Channels (in the Answer-Defaults profile or Connection profile) or Ascend-Maximum-Channels (in RADIUS).

Ascend-MPP-Idle-Percent (254)

Usage: Specify a number from 0 to 99. The default value is 0 (zero), which causes the MAX TNT to ignore bandwidth utilization when determining whether to clear a call.

Dependencies: Consider the following:

• MP+ must be in use on the link.

• If either end of a connection sets the Ascend-MPP-Idle-Percent attribute to 0 (zero), the MAX TNT ignores bandwidth utilization when determining when to clear a call.

• Bandwidth utilization on both sides of the connection must fall below the percentage specified by Ascend-MPP-Idle-Percent before the MAX TNT clears the call.

• If the device at the remote end of the link enters an Ascend-MPP-Idle-Percent setting lower than the value you specify, the MAX TNT does not clear the call until bandwidth utilization falls below the lower percentage.

• If the time set by the Ascend-Idle-Limit expires, the call disconnects whether or not bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting.

• When bandwidth utilization falls below the Ascend-MPP-Idle-Percent setting, the call disconnects regardless of whether the time specified by the Ascend-Idle-Limit attribute has expired.

• Because the Ascend-MPP-Idle-Percent attribute is dependent on traffic levels on both sides of the connection, Ascend recommends that you use the Ascend-Idle-Limit attribute instead.

Ascend-Multicast-Client (155)

Usage: Specify one of the following values:

• Multicast-No (0) specifies that the user is not a multicast client of the MAX TNT. Multicast-No is the default.

• Multicast-Yes (1) specifies that the user is a multicast client of the MAX TNT.

Ascend-Multicast-GRP-Leave-Delay

Usage: Specify a number of seconds from 0 to 120. The default is 0 (zero). If you specify a value other than the default, and the MAX TNT receives a leave group message, the unit sends an IGMP query to the WAN interface or client from which it received the leave group message. If the MAX TNT does not receive a response from an active multicast client from the same group, it sends a leave group message when the time you specify expires.

If you accept the default, the MAX TNT forwards a leave group message immediately. If users might establish multiple multicast sessions for identical groups, set Ascend-Multicast-GRP-Leave-Delay to a value of 10 to 20 seconds.

Dependencies: Ascend-Multicast-GRP-Leave-Delay applies only if you set Multicast-
Forwarding=Yes in the IP-Global profile, and Multicast-Allowed=Yes in the IP-Interface
profile.

See Also: Ascend-Multicast-Client (155).

Ascend-Multicast-Rate-Limit (152)

Usage: Specify an integer. If you set the attribute to 0 (zero), the MAX TNT does not apply rate limiting. The default value is 100.

See Also: Ascend-Multicast-Client (155).

Ascend-Multilink-ID (187)

Usage: Ascend-Multilink-ID does not appear in a user profile and has no default value.

Dependencies: The MAX TNT sends Ascend-Multilink-ID in an Accounting-Request packet when both of the following conditions are true:

• The session was authenticated.

• The session has ended (Acct-Status-Type=Stop).

Ascend-Number-Sessions (202)

Usage: The Ascend-Number-Sessions attribute has a compound value. The first part specifies a user-session class. The second part reports the number of active sessions in that class.

Dependencies: The MAX TNT sends the Ascend-Number-Sessions attribute in an Ascend-Access-Event-Request (33) packet. Only RADIUS daemons you customize to recognize this packet respond to requests from the MAX TNT. Other daemons ignore it.

When modifying the daemon, make sure that it recognizes an Ascend-Access-Event-Request packet in the following format:

Code (8-bit)=33
Identifier (8-bit)
Length (16-bit)
Authenticator (48-bit for an accounting server, 64-bit for an authentication server)
List of attributes

Example: Suppose that the MAX TNT has three classes of clients: Class-1, Class-2, and Class-3. At the time of the sessions report, there are eight active sessions: three Class-1 sessions, four Class-2 sessions, and one Class-3 session. The accounting packet the MAX TNT sends back to the RADIUS accounting server has three Ascend-Number-Session attributes, one for each of the class/session pairs.

See Also: Ascend-Event-Type (150) and
Class (25).

Ascend-Num-In-Multilink (188)

Usage: Ascend-Num-In-Multilink does not appear in a user profile and has no default value.

Dependencies: The MAX TNT sends Ascend-Num-In-Multilink in an Accounting-Request packet when both of the following conditions are true:

• The session was authenticated.

• The session has ended (Acct-Status-Type=Stop).

Ascend-PPP-Address (253)

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0.0.0, which specifies that IPCP negotiates with the value of the IP-Address parameter in the IP-Interface profile on the MAX TNT.

If you specify a valid IP address, IPCP negotiates with that IP address. If you specify 255.255.255.255, IPCP negotiates with the address 0.0.0.0.

Dependencies: You can assign Ascend-PPP-Address a value different from the MAX TNT unit's true IP address, as long as the user requesting access is aware of the discrepancy.

Ascend-PPP-Async-Map (212)

Usage: Specify a four-byte bitmap to one or more control characters. The async control character map is defined in RFC 1548 and specifies that each bit position represents its ASCII equivalent. The bits are ordered with the lowest bit of the lowest byte being 0. For example, bit 19 corresponds to Control-S (DC3) or ASCII 19.

Example: Your specification might look like the following:

Emma Password="m2dan", User-Service=Login-User

          Ascend-PPP-Async-Map=19,

          ...

Ascend-PPP-VJ-1172 (211)

RFC 1172 section 5.2 contains an erroneous statement that the VJ compression type value is 0037h. It should be 002dh. However, many older implementations use the 0037h value when negotiating VJ compression. If you do not specify a value for Ascend-PPP-VJ-1172, the VJ compression type is 002dh.

Usage: Enter your specification in the following format:

Ascend-PPP-VJ-1172=PPP-VJ-1172

Ascend-PPP-VJ-Slot-Comp (210)

When you turn on VJ compression, the MAX TNT removes the TCP/IP header, and associates a TCP/IP packet with a connection by giving it a slot ID. The first packet coming into a connection must have a slot ID, but succeeding packets need not have one. If the packet does not have a slot ID, the MAX TNT associates it with the last-used slot ID. This scenario uses slot ID compression, because the slot ID does not appear in any packet but the first in a stream.

There may be times when you want each VJ-compressed packet to have a slot ID. The Ascend-PPP-VJ-Slot-Comp attribute exists for this purpose.

Usage: To specify that no slot compression occurs, set the Ascend-PPP-VJ-Slot-Comp attribute to VJ-Slot-Comp-No (1). If you do not specify a value for Ascend-PPP-VJ-Slot-Comp, and Framed-Compression=Van-Jacobson-TCP-IP, slot compression occurs.

See Also: Framed-Compression (13).

Ascend-Preempt-Limit (245)

Usage: Specify a number from 0 to 65535. The MAX TNT never preempts a call if you enter 0 (zero). The default value is 60.

Dependencies: The Ascend-Preempt-Limit attribute does not apply to nailed-up links.

See Also: Configuring a time limit and idle connection attributes,
Ascend-Idle-Limit (244), and
Ascend-MPP-Idle-Percent (254).

Ascend-Pre-Input-Octets (190)

Usage: Ascend-Pre-Input-Octets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT includes Ascend-Pre-Input-Octets in an Accounting-Request packet when all of the following conditions are true:

• The session was authenticated.

• The connection was asynchronous.

• The session has ended (Acct-Status-Type=Stop).

Ascend-Pre-Input-Packets (192)

Usage: Ascend-Pre-Input-Packets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT includes Ascend-Pre-Input-Packets in an Accounting-Request packet when both of the following conditions are true:

• The session was authenticated.

• The session has ended (Acct-Status-Type=Stop).

Ascend-Pre-Output-Octets (191)

Usage: Ascend-Pre-Output-Octets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT includes Ascend-Pre-Output-Octets in an Accounting-Request packet when all of the following conditions are true:

• The session was authenticated.

• The connection was asynchronous.

• The session has ended (Acct-Status-Type=Stop).

Ascend-Pre-Output-Packets (193)

Usage: Ascend-Pre-Output-Packets does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT includes Ascend-Pre-Output-Packets in an Accounting-Request packet when both of the following conditions are true:

• The session was authenticated.

• The session has ended (Acct-Status-Type=Stop).

Ascend-PreSession-Time (198)

Usage: Ascend-PreSession-Time does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT includes Ascend-PreSession-Time in an Accounting-Request packet when the session has ended or has failed authentication (Acct-Status-Type=Stop).

Ascend-Primary-Home-Agent (129)

Usage: Specify the primary home agent in the following format:

Ascend-Primary-Home-Agent="hostname | ip_address [:udp_port]"

Table 14-14. Ascend-Primary-Home-Agent syntax

Syntax element	Specifies
hostname	Home agent's symbolic hostname.
ip_address	Home agent's IP address in dotted decimal notation. Specify an IP address if a DNS server is not set up for the home agent. You can specify a host name or an IP address, but not both. The home agent IP address should be the system address, not the IP address of the interface on which the home agent receives tunneled data.
udp_port	UDP port on which the foreign agent communicates with the home agent. The default value is 5150.
: (colon)	Separator between the hostname (or IP address) and the UDP port.

Dependencies: Consider the following:

• If you specify the Ascend-Home-Agent-UDP-Port attribute on the line immediately following the Ascend-Primary-Home-Agent attribute, you need not specify a value for udp_port.

• If you specify a value for the udp_port argument of Ascend-Primary-Home-Agent, or if you accept the default of 5150, you need not specify the Ascend-Home-Agent-UDP-Port attribute.

• Use Ascend-Primary-Home-Agent instead of the Ascend-Home-Agent-IP-Addr attribute.

• To specify a secondary home agent for use if the primary home agent is unavailable, enter a value for the Ascend-Secondary-Home-Agent attribute.

Ascend-Primary-Home-Agent="max1.home.com:6001"

Ascend-Primary-Home-Agent="10.0.0.1:6001"

Ascend-PRI-Number-Type (226)

Usage: Specify one of the settings listed in Table 14-15.

Table 14-15. Ascend-PRI-Number-Type settings

Setting	Specifies
Unknown-Number (0)	Any type of number.
Intl-Number (1)	A number outside the U.S.
National-Number (2)	A number inside the U.S. The default value is National-Number.
Local-Number (4)	A number within your Centrex group.
Abbrev-Number (5)	An abbreviated phone number.

Ascend-PW-Expiration (21)

You must specify Ascend-PW-Expiration when you first create a user, and it must appear on the first line of the user profile. If it appears after the first line, RADIUS does not check the expiration date and could accept an expired password.

Usage: Specify a month, day, and year in the following format:

month day year

Table 14-16 lists each argument.

Table 14-16. Ascend-PW-Expiration arguments

Argument	Specifies
month	The first three letters of the month in which you want the password to expire, or the entire name of the month. Begin the specification with a capital letter.
day	One or more digits indicating a valid day of the month. The settings 2, 02, 002, and 0021 are all valid, but 32 is not.
year	A four-digit year starting with the number 19.

Dependencies: Consider the following:

• If a password expires and the user resets it, the RADIUS server adds the value of Ascend-PW-Lifetime to the date on which the user resets the password. The resulting date becomes the new value for Ascend-PW-Expiration.

• If the password has not expired, the value of Ascend-PW-Expiration overrides the value of Ascend-PW-Lifetime.

Emma Password="m2dan", User-Service=Login-User, Ascend-PW-Expiration="January
1, 1997"

...

Ascend-PW-Lifetime (208)

Usage: Specify an integer. You can set the Ascend-PW-Lifetime attribute on any line other than the first.

Dependencies: Consider the following:

• If a password expires and the user resets it, the RADIUS server adds the value of Ascend-PW-Lifetime to the date on which the user resets the password. The resulting date becomes the new value for Ascend-PW-Expiration.

• If the password has not expired, the value of Ascend-PW-Expiration overrides the value of Ascend-PW-Lifetime.

• If Ascend-PW-Lifetime is absent, the value of Lifetime-In-Days determines the password duration. The Lifetime-In-Days value in the RADIUS dictionary is the default value for Ascend-PW-Lifetime. By default, Lifetime-In-Days is 0 (zero), which indicates that passwords do not expire.

Emma Password="m2dan", User-Service=Login-User, Ascend-PW-Expiration="Jan
1, 1997"

          Ascend-PW-Lifetime=30

Ascend-Receive-Secret (215)

Usage: Specify up to 20 characters. The default value is null.

Dependencies: You can set the Ascend-Receive-Secret attribute for Cache-Token or PAP-Token-CHAP authentication only.

Example: The following example shows the settings you would specify for a user called Emma to access an Enigma Logic server. Because the profile includes Ascend-Receive-Secret, the MAX TNT can authenticate additional channels through CHAP without having to use the
SAFEWORD server for authentication.

Emma    Password="SAFEWORD"

            User-Service=Framed-User,

            Framed-Protocol=PPP, 

            Framed-Address=200.0.5.1,

            Framed-Netmask=255.255.255.0,

            Ascend-Receive-Secret="b5XSAM"

Ascend-Remote-Addr (154)

Usage: Specify the IP address of the numbered interface in dotted decimal notation. The default value is 0.0.0.0.

Dependencies: For Ascend-Remote-Addr to apply, you must enable IP for the user profile (Ascend-Route-IP=Route-IP-Yes).

See Also: Setting up an interface-based IP routing connection,
Ascend-IF-Addr,
Ascend-IF-Netmask (153), and
Ascend-Route-IP (228).

Ascend-Remove-Seconds (241)

When utilization falls below the threshold for a period of time greater than the value of the Ascend-Remove-Seconds attribute, the MAX TNT attempts to remove the number of channels specified by the Ascend-Dec-Channel-Count attribute. Using the Ascend-Remove-Seconds attribute prevents the system from continually subtracting bandwidth, and can slow down the process of removing bandwidth.

Usage: Specify a number from 1 to 300. The default value is 10.

Dependencies: Consider the following:

• One channel must be up at all times.

• Removing bandwidth cannot cause the ALU to exceed the threshold specified by the Ascend-Target-Util attribute.

• The number of channels remaining cannot fall below the amount specified by the Ascend-Minimum-Channels attribute.

• Ascend-Add-Seconds and Ascend-Remove-Seconds have little or no effect on a system with a high Ascend-Seconds-Of-History value. If the value of Ascend-Seconds-Of-History is low, the Ascend-Add-Seconds and Ascend-Remove-Seconds attributes provide an alternative way to ensure that spikes must persist for a certain period of time before the system responds.

Ascend-Require-Auth (201)

Usage: Specify one of the following values:

• Not-Require-Auth (0) specifies that the MAX TNT does not require additional authentication. Not-Require-Auth is the default.

• Require-Auth (1) specifies that the MAX TNT requires additional authentication.

Example: The following example shows a two-tiered approach to using the Ascend-Require-Auth attribute. The first user profile specifies CLID authentication, and indicates that additional authentication will follow. Because Recv-Auth-Mode=CHAP-PPP-Auth in the PPP-Answer subprofile of the Answer-Defaults profile, CHAP authentication will follow CLID authentication. The second user profile sets up other attributes for the call.

5551212      Password="Ascend-CLID"

                   Ascend-Require-Auth=Require-Auth

Emma      Password="pwd", Caller-Id="5551212"

              User-Service=Framed-User,

              Framed-Protocol=PPP,

              Framed-Address=200.11.12.10,

              Framed-Netmask=255.255.255.248,

       Ascend-Send-Secret="pwd",

              ...

Ascend-Route-IP (228)

Usage: Specify one of the following values:

• Route-IP-No (0) disables IP routing for the profile.

• Route-IP-Yes (1) enables IP routing for the profile. Route-IP-Yes is the default.

Ascend-Route-IPX (229)

Usage: Specify one of the following values:

• Route-IPX-No (0) disables IPX routing. Route-IPX-No is the default.

• Route-IPX-Yes (1) enables IPX routing.

See Also: Setting up IPX routing in a user profile,
Ascend-IPX-Alias (224),
Ascend-IPX-Peer-Mode (216), and
Ascend-IPX-Route (174).

Ascend-Secondary-Home-Agent (130)

Usage: Specify the secondary home agent using the following format:

Ascend-Secondary-Home-Agent="hostname | ip_address [:udp_port]"

Table 14-17. Ascend-Secondary-Home-Agent syntax

Syntax element	Specifies
hostname	Home agent's symbolic hostname.
ip_address	Home agent's IP address in dotted decimal notation. Specify an IP address if a DNS server is not set up for the home agent. You can specify a host name or an IP address, but not both. The home agent IP address should be the system address, not the IP address of the interface on which the home agent receives tunneled data.
udp_port	UDP port on which the foreign agent communicates with the home agent. The default value is 5150.
: (colon)	Separator between the hostname (or IP address) and the UDP port.

Dependencies: If you specify the Ascend-Home-Agent-UDP-Port attribute on the line immediately following the Ascend-Secondary-Home-Agent attribute, you need not specify a value for udp_port. By the same token, if you specify a value for the udp_port argument of Ascend-Secondary-Home-Agent, or if you accept the default of 5150, you need not specify the Ascend-Home-Agent-UDP-Port attribute.

Example: To specify max2.home.com at IP address 10.0.0.2 as the secondary home agent, and to indicate that the foreign agent should use UDP port 6002, enter one of the following lines in the RADIUS user profile:

Ascend-Secondary-Home-Agent="max2.home.com:6002"

Ascend-Secondary-Home-Agent="10.0.0.2:6002"

Ascend-Primary-Home-Agent="max1.home.com:6001"

Ascend-Secondary-Home-Agent="max2.home.com:6002"

See Also: Setting up an ATMP tunnel for an IP network,
Ascend-Home-Agent-Password (184),
Ascend-Home-Agent-UDP-Port (186),
Ascend-Home-Network-Name (185), and
Ascend-Primary-Home-Agent (129).

Ascend-Seconds-Of-History (238)

Usage: Specify a number from 1 to 300. The default value is 15 seconds. The number of seconds you specify depends on your device's traffic patterns. For example, if you want to average spikes with normal traffic flow, you might want the MAX TNT to use a longer time period. If, on the other hand, traffic patterns consist of many spikes that are short in duration, you might want to specify a shorter period of time. Doing so assigns less weight to the short spikes.

Dependencies: Consider the following:

• Ascend-Seconds-Of-History applies only to MP+ calls.

• If you specify a small value for the Ascend-Seconds-Of-History attribute, and increase the values of the Ascend-Add-Seconds and Ascend-Remove-Seconds attributes, the system becomes less responsive to quick spikes.

• The easiest way to determine the values for all the attributes is to observe usage patterns.

Ascend-Send-Auth (231)

Usage: Specify one of the following values:

• Send-Auth-None (0) specifies that the MAX TNT does not request an authentication protocol for outgoing calls. Send-Auth-None is the default.

• Send-Auth-PAP (1) specifies that the MAX TNT requests Password Authentication Protocol (PAP). The MAX TNT requests PAP authentication, but uses CHAP authentication if the called unit requires CHAP. To send your password unencrypted, choose this setting.

• Send-Auth-CHAP (2) specifies that the MAX TNT requests Challenge Handshake Authentication Protocol (CHAP). The remote device must support CHAP. To send an encrypted password, choose this setting.

• Ascend-Send-Auth applies only to outgoing user profiles in RADIUS.

• The link must use PPP or MP+ encapsulation.

• If you request PAP or CHAP authentication, you must also specify a password with Ascend-Send-Secret or Ascend-Send-Passwd.

Ascend-Send-Passwd (232)

Usage: Specify a text string of up to 20 characters. The default value is null.

Dependencies: In a user profile, you can specify either Ascend-Send-Passwd or Ascend-Send-Secret, but not both. Use Ascend-Send-Passwd only if your version of the MAX TNT does not support Ascend-Send-Secret.

See Also: Requesting an access protocol for outgoing calls,
Ascend-Send-Auth (231), and
Ascend-Send-Secret (214).

Ascend-Send-Secret (214)

Usage: Specify a text string of up to 20 characters. The default value is null.

Dependencies: In a user profile, you can specify either Ascend-Send-Passwd or Ascend-Send-Secret, but not both. Use Ascend-Send-Passwd only if your version of the MAX TNT does not support Ascend-Send-Secret.

See Also: Requesting an access protocol for outgoing calls,
Ascend-Send-Auth (231), and
Ascend-Send-Passwd (232).

Ascend-Session-Svr-Key (151)

Usage: Specify up to 16 characters. The default value is null.

Dependencies: Consider the following:

• The client sends Ascend-Session-Svr-Key to the RADIUS server in a Disconnect-Request or Change-Filter-Request packet when it initiates an operation.

• The Ascend-Session-Svr-Key attribute appears in a RADIUS Accounting-Start packet when a session starts.

• The client sends the Ascend-Session-Svr-Key attribute only if Auth-Session-Key=Yes in the Rad-Auth-Server subprofile of the External-Auth profile.

Ascend-Shared-Profile-Enable (128)

Usage: Specify one of the following settings:

• Shared-Profile-No (0) specifies that multiple incoming callers cannot share the RADIUS user profile. Shared-Profile-No is the default.

• Shared-Profile-Yes (1) specifies that multiple incoming callers can share the RADIUS user profile.

Ascend-Target-Util (234)

Usage: Specify a number from 0 to 100. The default value is 70. With a value of 70%, the device adds bandwidth when it exceeds a 70 percent utilization rate, and subtracts bandwidth when it falls below that number.

Dependencies: When choosing a target utilization rate, consider the following:

• Monitor how the application behaves when using different bandwidths. For example, an application might be able to use 88% of a 64-Kbps link, but only 70% of a 256-Kbps link.

• Monitor the application at different loads.

• Ascend-Target-Util applies only if the link is using MP+ encapsulation.

Ascend-Third-Prompt (213)

Usage: The Ascend-Third-Prompt attribute can contain up to 80 characters. It does not appear in a user profile. If the user enters more than 80 characters at the third prompt, the MAX TNT truncates the input to 80. If the user does enter any characters, the MAX TNT sets the attribute to null.

Ascend-Token-Expiry (204)

Usage: On the first line of the user profile, specify an integer representing the number of minutes in the lifetime of the cached token. The default value is 0 (zero). If you accept the default, the MAX TNT rejects subsequent Cache-Token requests from the same user.

Example: The following two-line example shows how to set up Cache-Token authentication with a 90-minute token cache. Notice that the Ascend-Token-Expiry attribute must appear on the first line of the profile, along with the user name and password.

Connor    Password="ACE", Ascend-Token-Expiry=90

                Ascend-Receive-Secret="shared-secret",

                ...

Ascend-Token-Idle (199)

Usage: On the first line of the user profile, specify an integer representing the maximum length of time in minutes that a cached token can remain alive. The default value is 0 (zero). If you accept the default, the cached token remains alive until the value of the Ascend-Token-Expiry attribute causes it to expire.

Dependencies: Typically, the value of Ascend-Token-Idle is lower than the value of Ascend-Token-Expiry.

Example: The following two-line example shows how to set up Cache-Token authentication with a 90-minute token cache and an 80-minute idle limit. Notice that the Ascend-Token-Idle attribute must appear on the first line of the profile.

Jim    Password="ACE", Ascend-Token-Expiry=90, Ascend-Token-Idle=80 

          Ascend-Receive-Secret="shared secret"

Ascend-Token-Immediate (200)

Usage: Specify one of the following values:

• Tok-Imm-No (0) specifies that the MAX TNT ignores the password it receives from the user. Choose this value for a security server that requires a user to enter a token-card challenge before the server derives a password. Tok-Imm-No is the default.

• Tok-Imm-Yes (1) specifies that the MAX TNT sends the password to the token-card server for authentication.

Example: To specify that the MAX TNT must send the password it receives from the login user to the ACE server, you would configure the user profile as follows:

Connor    Password="ACE", Ascend-Token-Immediate=Tok-Imm-Yes

                Ascend-Receive-Secret="shared-secret",

                User-Service=Login-User,

                ...

Ascend-Transit-Number (251)

Usage: Specify the same digits you use to prefix a phone number you dial over a T1 access line or voice interface:

• 288 selects AT&T.

• 222 selects MCI.

• 333 selects Sprint.

Ascend-TS-Idle-Limit (169)

Usage: Specify a value from 0 to 65535.The default value is 120. A setting of 0 (zero) specifies that the line can be idle indefinitely.

Dependencies: Ascend-TS-Idle-Limit does not apply if you are using a Frame Relay or raw TCP connection, or if Ascend-TS-Idle-Mode=TS-Idle-None.

See Also: Ascend-TS-Idle-Mode (170).

Ascend-TS-Idle-Mode (170)

Usage: Specify one of the following settings:

• TS-Idle-None (0) specifies that the MAX TNT does not disconnect the session no matter how long the line is idle. This setting disables the idle timer.

• TS-Idle-Input (1) specifies that the MAX TNT disconnects the session if the user is idle for a length of time greater than the value of the Ascend-TS-Idle-Limit attribute. TS-Idle-Input is the default.

• TS-Idle-Input-Output (2) specifies that the MAX TNT disconnects the session if both the user and the host are idle for a length of time greater than the value of the Ascend-TS-Idle-Limit attribute.

Default Password="UNIX"

       User-Service=Login-User,

       Ascend-TS-Idle-Limit=90,

       Ascend-TS-Idle-Mode=TS-Idle-Input

See Also: Ascend-TS-Idle-Limit (169).

Ascend-User-Acct-Base (142)

Usage: Specify one of the following settings:

• Ascend-User-Acct-Base-10 specifies that the numeric base is 10. The default value is 10.

• Ascend-User-Acct-Base-16 specifies that the numeric base is 16.

Example: When you set Ascend-User-Acct-Base=Ascend-User-Acct-Base-10, the MAX TNT presents a typical session ID to the accounting server in the following way:

"1234567890"

"499602D2"

Ascend-User-Acct-Host (139)

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0.0.0.

See Also: Setting up accounting on a per-user basis,
Ascend-User-Acct-Base (142),
Ascend-User-Acct-Key (141),
Ascend-User-Acct-Port (140),
Ascend-User-Acct-Time (143), and
Ascend-User-Acct-Type (138).

Ascend-User-Acct-Key (141)

Usage: Specify a text string. The default value is null.

See Also: Setting up accounting on a per-user basis,
Ascend-User-Acct-Base (142),
Ascend-User-Acct-Host (139),
Ascend-User-Acct-Port (140),
Ascend-User-Acct-Time (143), and
Ascend-User-Acct-Type (138).

Ascend-User-Acct-Port (140)

Usage: Specify the UDP port number you indicated for the authentication process of the daemon in /etc/services. Or, if you used the incr keyword to the -A argument when starting the daemon, specify the number of the UDP port for authentication services plus 1. You can specify a number from 1 to 32767.

See Also: Setting up accounting on a per-user basis,
Ascend-User-Acct-Base (142),
Ascend-User-Acct-Host (139),
Ascend-User-Acct-Key (141),
Ascend-User-Acct-Time (143), and
Ascend-User-Acct-Type (138).

Ascend-User-Acct-Time (143)

Usage: Specify an integer from 1 to 10. The default value is 0 (zero).

See Also: Setting up accounting on a per-user basis,
Ascend-User-Acct-Base (142),
Ascend-User-Acct-Host (139),
Ascend-User-Acct-Key (141),
Ascend-User-Acct-Port (140), and
Ascend-User-Acct-Type (138).

Ascend-User-Acct-Type (138)

Usage: Specify one of the following settings:

• Ascend-User-Acct-None (0) specifies the MAX TNT sends accounting information to the RADIUS server specified by the Acct-Server parameter. This server is known as the default server. Ascend-User-Acct-None is the default.

• Ascend-User-Acct-User (1) specifies that the MAX TNT sends accounting information to the RADIUS server specified by the Ascend-User-Acct-Host attribute in the RADIUS user profile.

• Ascend-User-Acct-User-Default (2) specifies that the MAX TNT sends accounting information both to the RADIUS server specified by the Ascend-User-Acct-Host attribute in the RADIUS user profile, and to the default server.

Ascend-Xmit-Rate (255)

Usage: Ascend-Xmit-Rate does not appear in a user profile. Its default value is 0 (zero).

Dependencies: The MAX TNT includes Ascend-Xmit-Rate in an Accounting-Request packet when the session has ended or has failed authentication (Acct-Status-Type=Stop).

Caller-Id (31)

Usage: Specify a telephone number of up to 37 characters, limited to the following:

1234567890()[]!z-*#|

Dependencies: Consider the following:

• If you set CLID-Auth-Mode=CLID-Prefer in the Answer-Defaults profile, the MAX TNT checks the calling party's phone number against the value of the Caller-Id attribute whenever CLID authentication is available. If the MAX TNT finds a match and requires no further identification, it accepts the call.

• If you set CLID-Auth-Mode=CLID-Require in the Answer-Defaults profile, the calling party's phone number must match the value of the Caller-Id attribute before the MAX TNT can answer the call. If CLID is not available, the MAX TNT does not answer the call.

Emma  Password="test", Caller-Id="123456789"

            User-Service=Framed-User,

            Framed-Protocol=PPP,

            Framed-Address=255.255.255.254,

            Framed-Netmask=255.255.255.255,

            Ascend-Assign-IP-Pool=1,

            Ascend-Route-IP=Route-IP-Yes,

            Ascend-Idle-Limit=30

Challenge-Response (3)

Usage: The MAX TNT sends the Challenge-Response value in an Access-Request packet. The default value is null.

Change-Password (17)

When a user specifies an expired password, RADIUS prompts the user for a new password. When the user enters the new password, the MAX TNT sends an Access-Password-Request packet containing both the old password (as the value of the Change-Password attribute), and the new password (as the value of the Password attribute).

If the RADIUS server accepts the new password, it tries to edit the users file and replace the expired password with the new one. Note that the RADIUS server can make the change only in the flat file. It cannot make the change in the database version of the users file.

Usage: Change-Password does not appear in a user profile and has no default value.

Class (25)

Keep in mind that accounting entries specify the class on a per-user and per-session basis. The Ascend-Number-Sessions attribute reports information about all user sessions (that is, on the number of current sessions of each class).

Usage: Specify an alphanumeric text string of up to 253 characters. The default value is null.

Dependencies: If you include the Class attribute in the RADIUS user profile, the RADIUS server sends it to the MAX TNT in the Access-Accept packet when the session begins. The MAX TNT then includes Class in Accounting-Request packets it sends to the RADIUS accounting server under the following conditions:

• Whenever a session starts

• Whenever a session stops

See Also: Classifying user sessions in RADIUS and
Ascend-Number-Sessions (202).

Client-Port-DNIS (30)

Usage: Specify the number the remote end dials to reach the MAX TNT, limiting your specification to the following characters:

1234567890()[]!z-*#|

Typically, the phone numbers different callers can use to reach the MAX TNT share a group of digits. For example, a local caller might dial 555-1234, while a long distance caller would dial 1-415-555-1234. In such cases, you need only specify the rightmost digits the calls have in common. In this example, you would specify only 1234.

Example: To set up called-number authentication in addition to name and password authentication, you could configure the user profile as follows:

Clara-p50 Password="ascend", Client-Port-DNIS=1234

     User-Service=Framed-User,

     Framed-Protocol=PPP,

     Framed-Address=200.10.11.12,

     Framed-Netmask=255.255.255.248

Framed-Address (8)

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0.0.0. An answering user profile with the default setting matches all IP addresses.

Dependencies: Every Connection profile and RADIUS user profile that specifies an explicit IP address is a static route.

See Also: Framed-Netmask (9).

Framed-Compression (13)

Usage: To turn on TCP/IP header compression, specify Van-Jacobson-TCP-IP. This setting applies only to packets in TCP applications, such as Telnet, and turns on header compression for both sides of the link. By default, the Framed-Compression attribute does not turn on header compression.

Dependencies: Turning on header compression is most effective in reducing overhead when the data portion of the packet is small.

Framed-MTU (12)

Usage: The default value is 1524. You should accept the default unless the device at the remote end of the link cannot support it. If the administrator of the remote network determines that you must change the value, specify a number from 1 to 1524 (for a PPP, MP, or MP+ link) or from 128 to 1600 (for a Frame Relay link).

Framed-Netmask (9)

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0.0.0, which specifies that the MAX TNT assumes a default subnet mask on the basis of the class of the address (as shown in Table 14-18).

Table 14-18. IP address classes and default subnet masks

Class	Address range	Network bits
Class A	0.0.0.0 -> 127.255.255.255	8
Class B	128.0.0.0 -> 191.255.255.255	16
Class C	192.0.0.0 -> 223.255.255.255	24
Class D	224.0.0.0 -> 239.255.255.255	N/A
Class E (reserved)	240.0.0.0 -> 247.255.255.255	N/A

See Also: Framed-Address (8).

Framed-Protocol (7)

Usage: Table 14-19 lists the values you can specify for Framed-Protocol. By default, the MAX TNT does not limit the protocols a link can access.

Table 14-19. Framed-Protocol settings

Setting	Incoming call	Outgoing call
PPP (1)	A user requesting access can dial in with Multilink Protocol Plus (MP+), Multilink Protocol (MP), or Point-to-Point Protocol (PPP) framing. A user requesting access can also dial in unframed, and then change to PPP, MP, or MP+ framing. If the user dials in with any other type of framing, the MAX TNT rejects the call.	Outgoing calls use PPP framing.
SLIP (2)	A user requesting access can dial in unframed and change to SLIP framing.	Does not apply to outgoing calls.
ARA (255)	Specifies an AppleTalk Remote Access (ARA) connection.	Does not apply to outgoing calls.
MPP (256)	Does not apply to incoming calls.	Outgoing calls request MP+ framing.
FR (261)	Does not apply to incoming calls.	Outgoing calls use Frame Relay (RFC 1490) framing.
FR-CIR (263)	Specifies a Frame Relay circuit.	Specifies a Frame Relay circuit.

Dependencies: Framed-Protocol can appear in both Access-Request and Access-Accept packets. However, it does not appear in an Access-Request packet if Auth-Send67=No in the External-Auth profile's Rad-Auth-Client subprofile.

What Framed-Protocol does depends on how you set User-Service:

• If User-Service=Framed-User or is unspecified, a user requesting access can dial in with the framing specified by Framed-Protocol. The MAX TNT rejects other types of framing. A user requesting access can also dial in without a framed protocol, and then change to the framing specified by Framed-Protocol.

• If User-Service=Framed-User or is unspecified, and Framed-Protocol has no specified value, the operator can use any framed protocol.

• If User-Service=Login-User, the user cannot use a framed protocol.

• If User-Service=Dialout-Framed-User, Framed-Protocol specifies the type of framing allowed on the outgoing call.

Ascend  Password="Pipeline"

              User-Service=Framed-User,

              Framed-Protocol=PPP,

              Framed-Address=10.0.200.225,

              Framed-Netmask=255.255.255.0,

              Ascend-Metric=2,

              Framed-Routing=None,

              Framed-Route="10.0.220.0 10.0.200.225 1",

              Ascend-Idle-Limit=30

              ...

Framed-Route (22)

Usage: The Framed-Route attribute has the following format:

Framed-Route="host_ipaddr[/subnet_mask] gateway_ipaddr metric 

[private] [profile_name]"

Table 14-20. Framed-Route arguments

Syntax element	Specifies
host_ipaddr [/subnet_mask]	IP address of the destination host or subnet reached by the route. The default value is 0.0.0.0/0., which represents the default route (the destination to which the MAX TNT forwards packets when no route to the packet's destination exists). If the address includes a subnet mask, the remote router specified by router_ipaddr is a router to that subnet, rather than to a whole remote network. To specify the entire remote network, do not specify a subnet mask.
router_ipaddr	IP address of the router the MAX TNT uses to reach the target destination. The default value is 0.0.0.0. The 0.0.0.0 address is a wildcard entry the MAX TNT replaces with the caller's IP address.When RADIUS authenticates a caller and sends the MAX TNT an Access-Accept message with a value of 0.0.0.0 for router_ipaddr, the MAX TNT updates its routing tables with the Framed-Route value, but substitutes the caller's IP address for the router. This setting is especially useful when the MAX TNT assigns an IP address from an address pool and RADIUS cannot know the IP address of the caller.
metric	Metric for the route. If the MAX TNT has more than one possible route to a destination network, it chooses the one with the lower metric. The default value is 8.
private	Value y if the route is private, or n if it is not private. If you specify that the route is private, the MAX TNT does not disclose the existence of the route when queried by RIP or another routing protocol. The default value is n.
profile_name	Name of the outgoing user profile that uses the route. The default value is null.

Example: The following example shows how to set up two RADIUS pseudo-user profiles to define global static IP routes:

route-1      Password="ascend", User-Service=Dialout-Framed-User

      Framed-Route="10.0.200.33/29 10.0.200.37 1 n lala-gw-out ",

      Framed-Route="10.0.200.50/29 10.0.200.37 1 n lala-gw-out ",

      Framed-Route="10.0.200.47/29 10.0.200.49 1 n nana-gw-out "

route-2      Password="ascend", User-Service=Dialout-Framed-User

      Framed-Route="11.0.200.33/29 11.0.200.37 1 n zzz-gw-out ",

      Framed-Route="12.0.200.47/29 11.0.200.49 1 n kk-gw-out "

Framed-Routing (10)

If you enable RIP to both send and receive updates on the WAN interface, the MAX TNT broadcasts its routing table to the remote network and listens for RIP updates from that network. Gradually, all routers on both networks have consistent routing tables (all of which can become quite large).

Usage: Specify one of the following values:

• None (0) specifies that the MAX TNT does not send or receive RIP updates. None is the default.

• Broadcast (1) specifies that the MAX TNT sends RIP version 1 updates, but does not receive them.

• Listen (2) specifies that the MAX TNT receives RIP version 1 updates, but does not send them.

• Broadcast-Listen (3) specifies that the MAX TNT both sends and receives RIP version 1 updates.

• Broadcast-v2 (4) specifies that the MAX TNT sends RIP version 2 updates, but does not receive them.

• Listen-v2 (5) specifies that the MAX TNT receives RIP version 2 updates, but does not send them.

• Broadcast-Listen-v2 (6) specifies that the MAX TNT both sends and receives RIP version 2 updates.

See Also: Requiring that a caller accept an IP address,
Setting up static IP routes, and
Ascend-Route-IP (228).

Login-Host (14)

• Set User-Service=Login-User.

• Specify a value for Login-Service.

Usage: Specify an IP address in dotted decimal notation. The default value is 0.0. 0.0, which specifies that the Login-User does not automatically connect to a particular host.

Dependencies: Consider the following:

• If you do not specify a value for the Login-Host attribute, the user can access any remote host through the Telnet or raw TCP commands of the terminal-server command-line interface. (When the operator uses the menu-driven terminal-server interface, access to remote hosts is limited to the hosts listed by the Ascend-Host-Info attribute.)

• Closing the remote terminal-server session also automatically closes the session with Login-Host.

• When User-Service=Framed-User, RADIUS ignores the Login-Host attribute.

Login-Service (15)

Usage: Specify one of the following values:

• Telnet (0) specifies that the user immediately establishes a Telnet session with the host specified by Login-Host.

• Rlogin (1) specifies that the user immediately establishes an Rlogin session with the host specified by Login-Host.

• TCP-Clear (2) specifies that the user immediately establishes a TCP session between the MAX TNT and the host specified by Login-Host. The TCP/IP connection cannot use the Telnet protocol. The user can run an application specified by Login-TCP-Port.

Dependencies: Consider the following:

• If you specify both Login-Service and Login-Host, the MAX TNT automatically connects the Login-User to the host specified by Login-Host.

• If you do not specify Login-Service or Login-Host, the user sees either the MAX TNT unit's terminal-server command-line interface or the terminal-server menu interface, depending upon how you configure the MAX TNT.

# The following profile causes an auto-TCP to 4.2.3.1 port 9 

upon login.

Greg     Password="test1"

              User-Service=Login-User,

              Login-Service=TCP-Clear,

              Login-Host=4.2.3.1, 

              Login-TCP-Port=9 

Login-TCP-Port (16)

Usage: Specify an integer from 1 to 65535. The default value is 23.

See Also: Enabling Telnet, TCP, and Rlogin connections and
Login-Service (15).

NAS-Identifier (4)

Usage: NAS-Identifier does not appear in a user profile. Its default value is 0.0.0.0.

NAS-Port (5)

Usage: The format of the NAS-Port value depends on the setting of the New-NAS-Port-ID-Format parameter in the System profile.

When New-NAS-Port-ID-Format=Yes

shelf slot line channel

The values are all bit encoded. For an ISDN call, the bit-encoded number has the following format:

• The shelf number is composed of two bits.

• The slot number is composed of four bits.

• The line and channel numbers are each composed of five bits.

• The shelf number is composed of two bits.

• The slot number is composed of four bits.

• The line number is composed of six bits.

• The channel number is composed of four bits.

When New-NAS-Port-ID-Format=No

tllcc

Example: To restrict an ISDN user to channel 2 on line 2 for slot 2 and shelf 1, you could set up a user profile as follows:

Robin Password="password", NAS-Port=1057

      User-Service=Framed-User,

      Framed-Protocol=PPP,

      Ascend-Assign-IP-Pool=1,

      Ascend-Route-IP=1,

      Ascend-Idle-Limit=300,

      Framed-Routing=None

shelf=00 (shelf 1)

slot=0001 (slot 2)

line=00001 (line 2)

channel=00001 (channel 2)

NAS-Port-Type (61)

Some ISPs offer different levels of service on the basis of connection type. To prevent a client from using a capability to which he or she has not subscribed, set the NAS-Port-Type attribute to an appropriate value.

Usage: Specify one of the following settings:

• NAS_Port_Type_Sync specifies a synchronous ISDN connection.

• NAS_Port_Type_Async specifies a call that the MAX TNT routes to a digital modem. NAS_Port_Type_Async is the default.