Introduction
This document provides an overview of Vendor Specific attributes that can be used in the ASR9000 BNG solution. They can either be used as part of the Access Accept Radius message or COA requests to change the behavior of the session.
Vendor Specific Attributes
1. RADIUS Attributes for pQoS
| QOS Feature | Action format in Radius attribute |
|---|---|
| Shaping | shape(<rate-in-kbps>) |
shape-rpct(<rate-in-pct>) | |
| Policing | police-rpct(<conform-rate-in-pct>,<conform-burst-in-us>,<exceed-rate-in-pct>,<exceed-burst-in-us>, <conform-action>,<exceed-action>, <violate-action>) |
police(<conform-rate-in-kbps>,<conform-burst-in-kBytes>,<exceed-rate-in-kbps>,<exceed-burst-in-kbytes>, <conform-action>,<exceed-action>, <violate-action>) | |
| Marking | set-cos(<cos-val>) |
set-ip-dscp(<dscp-val>) | |
set-ip-prec(<precedence>) | |
| Queuing | pri-level(<priority-level>) |
bw-rpct(<pct>) bw-rratio(<ratio>) bw-abs(<bw-in-kbps>) bw-pct(<bw-in-pct>) | |
queue-limit(<qlimit-in-packets>) queue-limit-us(<qlimit-in-us>) | |
random-detect-dscp(<dscp>) | |
random-detect-prec(<precedence>) |
Example
2. VSA's for Account operations (services and logon/off)
| Primitive | Radius AVP |
|---|---|
| Account Logon | authentication cpe12 CoA cisco123 attribute 44 “<string>” <<< Accounting Session ID vsa cisco generic 1 string "subscriber:command=account-logon" |
| Account Logoff | attribute 44 “<string>” <<< Accounting Session ID vsa cisco generic 1 string "subscriber:command=account-logoff" |
Account update (used to change a profile) | attribute 44 “<string>” <<< Accounting Session ID vsa cisco generic 1 string "subscriber:command=account-update” <radius attributes to set/update> |
| Service Activate | attribute 44 “<string>” <<< Accounting Session ID vsa cisco generic 1 string "subscriber:sa=<service-name>” |
| Service De-Activate | attribute 44 “<string>” <<< Accounting Session ID vsa cisco generic 1 string "subscriber:sd=<service-name>” |
All these operations from the first column, report an event to the control policy.
RP/0/RSP0/CPU0:A9K-BNG(config-pmap)#event ?
account-logoff Account logoff event
account-logon Account logon event
authentication-failure Authentication failure event
authentication-no-response Authentication no response event
authorization-failure Authorization failure event
authorization-no-response Authorization no response event
exception Exception event
service-start Service start event
service-stop Service stop event
session-activate Session activate event
session-start Session start event
session-stop Session stop event
timer-expiry Timer expiry event
Note
Accounting session ID is the preferred session identifier. You can also use the framed-ip-address to key on the subscriber and the vrf (if applicable)
(IPv4 only):
Attribute 8: Framed-IP-Address
and starting 4.2.1:
Attribute 8: Framed-IP-Address + AVPair: ip:vrf-id=<vrf name>
Template comparison to radius attribute
Operation | Dynamic Template cmd | RADIUS Attribute | ||
Service Activation | ||||
Service Activation | N/A | 26 | 9,1 | subscriber:sa=<service-name> |
Network Forwarding | ||||
IP addess source intf | ipv4 unnumbered <interface> | 26 | 9,1 | ipv4:ipv4-unnumbered=<interface> |
PPP framed address | N/A | 8 | framed-ip-address=<IPv4 address> | |
PPP Address Pool | ppp ipcp peer-address pool <addr pool > | 26 | 9,1 | ipv4:addr-pool=<addr pool name> |
PPP framed pool | N/A | 88 | framed-pool=<addr pool name> | |
PPP framed route | N/A | 22 | framed-route=<subnet><mask> | |
VRF | vrf <vrf name> | 26 | 9,1 | subscriber:vrf-id=<vrf name> |
V4 DNS | ppp ipcp dns <pprimary dns ip> <secondary dns ip> | 26 | 9.1 | ip:primary-dns=<primary dns ip> Ip:secondary-dns=<secondary dns ip> |
DHCP classname | N/A | 26 | 9,1 | subscriber:classname=<dhcp-class-name> |
| Traffic Accounting | ||||
Accounting | accounting aaa list <method list> type session | 26 | 9,1 | subscriber:accounting-list=<method list> |
Interim Interval | accounting aaa list <method list> type session periodic-interval <minutes> | 85 | Acct-Interim-Interval <minutes> | |
Dual Stack Accnt Start Delay | accounting aaa list <method list> type session dual-stack-delay <secs> | subscriber:dual-stack-delay=<sec> | ||
| Session Administration | ||||
keepalives | keepalive <sec> | 26 | 9,1 | subscriber:keepalive=interval<sec> NOT SUPPORTED/Implemented |
Absolute Timeout | ppp timeout absolute <sec> | 27 | n/a | session-timeout=<sec> |
Idle Timeout | timeout idle <sec> | 28 | n/a | idle-timeout=<sec> |
Traffic conditioning | ||||
HQoS(with SPI) | service-policy input <in_mqc_name> shared-policy-instance <spi-name> service-policy output <out_mqc_name> shared-policy-instance <spi-name> | 26 | 9,1 | subscriber:sub-qos-policy-in=<in_mqc_name> [shared-policy-instance <spi-name> ] subscriber:sub-qos-policy-out=<out_mqc_name> [shared-policy-instance <spi-name>] |
pQoS | N/A | 26 | 9,1 | subscriber:qos-policy-in=add-class(target policy (class-list) qos-actions-list) subscriber:qos-policy-in=remove-class(target policy (class-list)) subscriber:qos-policy-out=add-class(target policy (class-list) qos-actions-list) subscriber:qos-policy-out=remove-class(target policy (class-list)) |
Subscriber ACLs/ABF | ipv4 access-group <in_acl_name> in Ipv4 access-group <out_acl_name> out ipv6 access-group <in_v6acl_name> in ipv6 access-group <out_v6acl_name> out | 26 | 9,1 | ipv4:inacl=<in_acl_name> ipv4:outacl=<out_acl_name> ipv6:ipv6_inacl=<in_v6acl_name> ipv6:ipv6_outacl=<out_v6acl_name> |
HTTP-R | service-policy type pbr <HTTR policy name> | 26 | 9,1 | subscriber:sub-pbr-policy-in=<HTTR policy name> |
IPv6 Attributes
Attribute | Defined By | Received In | IPv6 Client | Address Assignment | Dynamic Template equivalent config |
Framed-Interface-Id (96) | RFC3162 | Access-Accept | PPPoE | Any | ppp ipv6cp peer-interface-id <64bit #> |
Framed-IPv6-Prefix (97) | RFC3162 | Access-Accept | PPPoE | SLAAC | N.A. |
Framed-IPv6-Route (99) | RFC3162 | Access-Accept CoA | Any | Any | N.A. |
Framed-IPv6-Pool (100) | RFC3162 | Access-Accept | PPPoE | SLAAC | ipv6 nd framed-prefix-pool <name> |
Framed-ipv6-Address (*) | draft-ietf-radext-ipv6-access-06 | Access-Accept | PPPoE, IPoE | DHCP6 (Local Server) | N.A. |
Stateful-IPv6-Address-Pool(*) | draft-ietf-radext-ipv6-access-06 | Access-Accept | PPPoE, IPoE | DHCP6 (Local Server) | dhcpv6 address-pool <name> |
Delegated-IPv6-Prefix-Pool (*) | draft-ietf-radext-ipv6-access-06 | Access-Accept | PPPoE, IPoE | DHCP6 (Local Server) | dhcpv6 delegated-prefix-pool <name> |
DNS-Server-IPv6-Address (*) | draft-ietf-radext-ipv6-access-06 | Access-Accept | PPPoE, IPoE | DHCP6 (Local Server) | To be configured in DHCPv6 server profile |
Delegated-IPv6-Prefix | RFC4818 | Access-Accept | PPPoE, IPoE | DHCP6 (Local Server) | N.A. |
NOTE
draft-ietf-radext-ipv6-access-*
Framed-ipv6-Address | “ipv6:addrv6=<ipv6 address>” |
Stateful-IPv6-Address-Pool | “ipv6:stateful-ipv6-address-pool=<name>” |
Delegated-IPv6-Prefix-Pool | “ipv6:delegated-ipv6-pool=<name>” |
DNS-Server-IPv6-Address | “ipv6:ipv6-dns-servers-addr=<ipv6 address>” |
Radius Accounting bytes and packets
the following accounting attributes pertaining to packet accounting for the ASR9000 solution, also specific to IPv6
Attribute | Defined By | Description |
Acct-Input-Octets (42) | RFC2866 | Session input total byte count |
Acct-Input-Packets (47) | RFC2866 | Session input total packet count |
Acct-Output-Octets (43) | RFC2866 | Session output total byte count |
Acct-Output-Packets (48) | RFC2866 | Session output total packet count |
Cisco VSA (26,9,1): acct-input-octets-ipv4 | Cisco | Session input IPv4 byte count |
Cisco VSA (26,9,1): acct-input-packets-ipv4 | Cisco | Session input IPv4 packet count |
Cisco VSA (26,9,1): acct-output-octets-ipv4 | Cisco | Session output IPv4 byte count |
Cisco VSA (26,9,1): acct-output-packets-ipv4 | Cisco | Session output IPv4 packet count |
Cisco VSA (26,9,1): acct-input-octets-ipv6 | Cisco | Session input IPv6 byte count |
Cisco VSA (26,9,1): acct-input-packets-ipv6 | Cisco | Session input IPv6 packet count |
Cisco VSA (26,9,1): acct-output-octets-ipv6 | Cisco | Session output IPv6 byte count |
Cisco VSA (26,9,1): acct-output-packets-ipv6 | Cisco | Session output IPv6 packet count |
Cisco VSA (26,9,1): connect-progress | Cisco | Indicates Session set up connection progress |
3.
Dynamic Route insertion
RADIUS attribute example for different type of framed-route:
PPPoE V6 route
Framed-IPv6-Route = "45:1:1:1:2:3:4:5/128 :: 4 tag 5”
PPPoE v4 route
Framed-Route = "45.1.6.0 255.255.255.0 0.0.0.0 6 tag 7”
IPoE v4 route
Framed-Route = "vrf vpn1 45.1.4.0/24 vrf vpn1 0.0.0.0 4 tag 5”
4. Route destribution (please don't!)
router bgp 100
address-family ipv4 unicast
redistribute subscriber <route-policy>
Related Information
Xander Thuijs CCIE#6775
Principal Engineer, ASR9000
