RFC 7155
Diameter Network Access Server Application
Standards Track Obsoletes: RFC 4005 April 2014
Abstract: The Diameter NASREQ application provides AAA functionality for Network Access Server environments. It defines the Diameter equivalent of RADIUS NAS-specific functionality and is used in 3GPP for non-3GPP access authentication via trusted and untrusted WLAN.
Canonical source: https://www.rfc-editor.org/rfc/rfc7155
| IETF Datatracker
1. Introduction
▶NASREQ provides AAA for network access scenarios — PPP, IEEE 802.1X, WLAN, and VPN authentication. It translates RADIUS NAS functionality to Diameter's more capable framework.
In 3GPP, NASREQ concepts apply to non-3GPP access authentication (Wi-Fi offload, trusted WLAN) where the WLAN access point acts as a NAS communicating with 3GPP AAA infrastructure.
2. NASREQ Commands
▶| Command | Code | Description |
|---|---|---|
| AA-Request/Answer | 265 | Authentication and Authorization request/response |
| Re-Auth-Request/Answer | 258 | Server-initiated re-authentication |
| Abort-Session-Request/Answer | 274 | Server-initiated session termination |
| Session-Termination-Request/Answer | 275 | Client session end |
| Accounting-Request/Answer | 271 | Usage accounting |
3. EAP Integration
▶NASREQ carries EAP messages within Diameter for network access authentication:
- EAP-Payload AVP (462): Carries encapsulated EAP packets between NAS and AAA server
- EAP-Master-Session-Key AVP (464): Carries MSK derived from EAP method for link-layer keying
- EAP-Reissued-Payload (463): Allows AAA proxy to modify EAP messages
- EAP-AKA' (RFC 5448) for 3GPP authentication is typically carried in NASREQ or SWx Diameter messages
4. Security Considerations
▶- EAP-Payload contains authentication credentials — transport MUST be secured
- Master-Session-Key AVP is highly sensitive — must be protected end-to-end
- NASREQ inherits Diameter base protocol security requirements (TLS/IPsec)