> # VSA Format

> The following VSA protocol options are supported by the Cisco NX-OS software:

> - Shell protocol—Used in Access-Accept packets to provide user profile information.
> - Accounting protocol—Used in Accounting-Request packets. If a value contains any white spaces, it should be put within double quotation marks.

> The following attributes are supported by the Cisco NX-OS software:

> - roles—This attribute lists all the roles to which the user belongs. The value field is a string storing the list of group names delimited by white space. For example, if you belong to roles vsan-admin and storage-admin, the value field would be “vsan-admin storage-admin”. This subattribute is sent in the VSA portion of the Access-Accept frames from the RADIUS server, and it can only be used with the shell protocol value. These are two examples using the roles attribute:

> `shell:roles=“network-admin vsan-admin”`

> `shell:roles*“network-admin vsan-admin”`

> When an VSA is specified as shell:roles*“network-admin vsan-admin”, this VSA is flagged as an optional attribute, and other Cisco devices ignore this attribute.

> - accountinginfo—This attribute stores additional accounting information besides the attributes covered by a standard RADIUS accounting protocol. This attribute is only sent in the VSA portion of the Account-Request frames from the RADIUS client on the switch, and it can only be used with the accounting protocol-related PDUs.

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.