Authentication and service plans

RADIUS is the intended authority for who a subscriber is and what they may do. All available identifiers are sent to the AAA server and its policy decides. Two BlueDot-specific conveniences sit on top:

• A local plan table. You can define service tiers (their rates) locally on the BNG and have AAA simply name the plan. This means most operators never have to ship a vendor dictionary into their RADIUS server. When a plan name comes back, the BNG looks it up locally and applies those rates.
• A guarantee that no session is ever unpoliced. If AAA returns explicit rates, they are used; if it names a plan, the plan is used; if it returns neither, a default (Bronze) plan is applied and a warning is logged. A subscriber is never left with no rate limit.

For operators who do want RADIUS to carry the full rate set, BlueDot defines eight vendor attributes (up/down × committed/peak × rate/burst) under its assigned enterprise number (PEN 65664). That path activates with the production RADIUS client.

Alpha caveat. This build runs a local AAA provider instead of a live RADIUS server. It has an open mode (admit everyone at a flat rate — the free-tier default) and a gated mode (admit known lines, send unknown-but-identifiable lines to the captive portal, reject terminated lines). The plan-resolution logic above is real and runs regardless of which back-end answers. The production RADIUS client — real sockets, retransmit and failover, the CoA listener, and the RADIUS accounting record assembly — is the defined future addition.