Hello. Can someone clarify what limits are for number of ACL entries and number of network object-group entries? My router is ASR 1002-X and IOS XE 3.13S (15.4.3.S9)   Also, should ACLs with object-group entries work on subinterfaces?   I have run into trouble that ACL containing object-group with over 80 thousands entries does not filter.   ... View more

Hi. I want to create such policy, that users, while in dead radius fallback mode are not getting interrupted, untill radius replied. All examples i saw, set 1 minute timeout, set fallback service applied and after timer expires, they force to drop session and start over, it radius is not back on, users has no fallback service during radius timeout, which is unacceptable.   here is what i tried, but after radius comes back, users got aouthenticated but continue using Fallback50m service and completely ignoring radius supplied services.   any thoughts?   policy-map type control testing class type control CM_C_IPOE_REJECT_REAUTH event timed-policy-expiry 1 service disconnect ! class type control CM_C_IPOE_RTIMEOUT_REAUTH event timed-policy-expiry 10 authorize aaa list IPOE password ciscoo identifier source-ip-address ! class type control always event session-start 10 authorize aaa list IPOE password ciscoo identifier source-ip-address ! class type control always event access-reject 20 set-timer IPOE_REJECT_REAUTH 1 30 service-policy type service name Redirect100 40 service-policy type service name Redirect110 50 service-policy type service name Redirect400 60 service-policy type service name Redirect410 70 service-policy type service name Redirect500 80 service-policy type service name Redirect510 ! class type control always event radius-timeout 10 set-timer IPOE_RTIMEOUT_REAUTH 1 20 service-policy type service name Failover50m ! class type control always event account-logon 10 service-policy type service unapply name Failover50m 20 service-policy type service aaa list IPOE identifier authenticated-username ! class type control always event account-logoff 1 service disconnect ! ... View more

Hello. I've set up classic IPoE routed subscriber service policy: aaa group server radius rg_radiusbsd server-private 10.50.50.2 auth-port 1812 acct-port 1813 key blahblah ! aaa authentication login default local aaa authentication ppp IPOE group rg_radiusbsd aaa authorization console aaa authorization exec default local aaa authorization network IPOE group rg_radiusbsd aaa authorization configuration IPOE group rg_radiusbsd aaa authorization subscriber-service default local group rg_radiusbsd aaa authorization subscriber-service IPOE local group rg_radiusbsd aaa accounting delay-start all aaa accounting delay-start extended-delay 2 aaa accounting update periodic 1 aaa accounting include auth-profile framed-ip-address aaa accounting include auth-profile framed-ipv6-prefix aaa accounting include auth-profile delegated-ipv6-prefix aaa accounting network default start-stop group rg_radiusbsd aaa accounting network IPOE start-stop group rg_radiusbsd ! aaa server radius dynamic-author client 10.50.50.2 server-key 0 blahblah port 1645 auth-type any ignore session-key ! aaa session-id common aaa policy interface-config allow-subinterface ! subscriber service session-accounting subscriber templating subscriber accounting ssg subscriber accounting send-encoded-name ! redirect server-group IPOE_HTTP server ip xxxx port 80 ! redirect server-group IPOE_DNS server ip xxxx port 53 ! redirect server-group IPOE_HTTP_ipv6 server ip xxx port 5600 ! redirect server-group IPOE_DNS_ipv6 server ip xxx port 53 ! class-map type traffic match-any CM_T_IPOE_REDIRECT_DNS6 match access-group input name CM_T_IPOE_REDIRECT_DNS6 ! class-map type traffic match-any CM_T_IPOE_REDIRECT_WWW6 match access-group input name CM_T_IPOE_REDIRECT_WWW6 ! class-map type traffic match-any CM_T_NULL match access-group input name CM_T_NULL match access-group output name CM_T_NULL ! class-map type traffic match-any CM_ANY6 match access-group input name CM_T_ANY6 match access-group output name CM_T_ANY6 ! class-map type traffic match-any CM_ANY match access-group input name CM_T_ANY match access-group output name CM_T_ANY ! class-map type traffic match-any CM_T_IPOE_PASS match access-group input name CM_T_IPOE_PASS match access-group output name CM_T_IPOE_PASS ! class-map type traffic match-any CM_T_IPOE_REDIRECT_WWW match access-group input name CM_T_IPOE_REDIRECT_WWW ! class-map type traffic match-any CM_T_IPOE_REDIRECT_DNS match access-group input name CM_T_IPOE_REDIRECT_DNS ! class-map type traffic match-any CM_T_IPOE_PASS_IPv6 match access-group input name CM_T_IPOE_PASS_IPv6 match access-group output name CM_T_IPOE_PASS_IPv6 ! class-map type control match-all CM_C_IPOE_RTIMEOUT_REAUTH match timer IPOE_RTIMEOUT_REAUTH match authen-status unauthenticated ! class-map type control match-all CM_C_IPOE_REJECT_REAUTH match timer IPOE_REJECT_REAUTH match authen-status unauthenticated ! policy-map type service Block10 10 class type traffic CM_T_NULL ! class type traffic default in-out drop ! ! policy-map type service Redirect100 100 class type traffic CM_T_IPOE_PASS ! class type traffic default in-out drop ! ! policy-map type service Redirect110 110 class type traffic CM_T_IPOE_PASS_IPv6 ! class type traffic default in-out drop ! ! policy-map type service Redirect400 400 class type traffic CM_T_IPOE_REDIRECT_WWW6 redirect to group IPOE_HTTP_ipv6 ! class type traffic default in-out drop ! ! policy-map type service Redirect410 410 class type traffic CM_T_IPOE_REDIRECT_DNS6 redirect to group IPOE_DNS_ipv6 ! class type traffic default in-out drop ! ! policy-map type service Redirect500 500 class type traffic CM_T_IPOE_REDIRECT_WWW redirect to group IPOE_HTTP ! class type traffic default in-out drop ! ! policy-map type service Redirect510 510 class type traffic CM_T_IPOE_REDIRECT_DNS redirect to group IPOE_DNS ! class type traffic default in-out drop ! ! policy-map type control IPOE_routed class type control CM_C_IPOE_RTIMEOUT_REAUTH event timed-policy-expiry 1 service disconnect ! class type control CM_C_IPOE_REJECT_REAUTH event timed-policy-expiry 1 service disconnect ! class type control always event session-start 10 authorize aaa list IPOE password ciscoo identifier source-ip-address 20 set-timer IPOE_REJECT_REAUTH 1 30 service-policy type service aaa list IPOE name Redirect100 35 service-policy type service aaa list IPOE name Redirect110 38 service-policy type service aaa list IPOE name Redirect400 39 service-policy type service aaa list IPOE name Redirect410 40 service-policy type service aaa list IPOE name Redirect500 50 service-policy type service aaa list IPOE name Redirect510 ! class type control always event service-stop 1 service-policy type service unapply identifier service-name ! class type control always event session-restart 10 authorize aaa list IPOE password ciscoo identifier source-ip-address 20 set-timer IPOE_REJECT_REAUTH 1 30 service-policy type service aaa list IPOE name Redirect100 35 service-policy type service aaa list IPOE name Redirect110 38 service-policy type service aaa list IPOE name Redirect400 39 service-policy type service aaa list IPOE name Redirect410 40 service-policy type service aaa list IPOE name Redirect500 50 service-policy type service aaa list IPOE name Redirect510 ! class type control always event radius-timeout 1 set-timer IPOE_RTIMEOUT_REAUTH 1 10 service-policy type service aaa list IPOE name Redirect100 15 service-policy type service aaa list IPOE name Redirect110 20 service-policy type service aaa list IPOE name Redirect500 30 service-policy type service aaa list IPOE name Redirect510 38 service-policy type service aaa list IPOE name Redirect400 39 service-policy type service aaa list IPOE name Redirect410 ! ! interface GigabitEthernet0/0/1 description test link ip address .... negotiation auto service-policy type control IPOE_routed ip subscriber routed initiator unclassified ip-address ! ! radius-server attribute 44 include-in-access-req default-vrf radius-server attribute 8 include-in-access-req radius-server attribute 55 include-in-acct-req radius-server attribute 25 access-request include radius-server attribute 31 mac format ietf ! ip access-list ... all defined ! When session create, a list of services is applied:   (19) Sent Access-Accept Id 71 from 10.50.50.2:1812 to 10.50.50.1:1645 length 0 (19) Cisco-AVPair = "accounting-list=IPOE" (19) Acct-Interim-Interval = 60 (19) Cisco-Account-Info += "NBlock10" (19) Cisco-Account-Info += "NRedirect100" (19) Cisco-Account-Info += "NRedirect110" (19) Cisco-Account-Info += "NRedirect400" (19) Cisco-Account-Info += "NRedirect410" (19) Cisco-Account-Info += "NRedirect500" (19) Cisco-Account-Info += "NRedirect510" (19) Cisco-Account-Info += "QU;10000;D;10000" (19) Cisco-Account-Info += "Sx.x.x.x" (19) Idle-Timeout = 3600 (19) Finished request Every works fine, except there is no Cisco-Account-Info fields in accounting messages:   (21) Received Accounting-Request Id 127 from 10.50.50.1:1646 to 10.50.50.2:1813 length 373 (21) Acct-Session-Id = "0001A61E" (21) Framed-IP-Address = x.x.x.x (21) Framed-Protocol = PPP (21) User-Name = "x.x.x.x" (21) Cisco-AVPair = "connect-progress=Call Up" (21) Cisco-Control-Info = "I0;40" (21) Cisco-Control-Info = "O0;0" (21) Acct-Session-Time = 65 (21) Acct-Input-Octets = 0 (21) Acct-Output-Octets = 40 (21) Acct-Input-Packets = 0 (21) Acct-Output-Packets = 1 (21) Acct-Authentic = Local (21) Acct-Status-Type = Interim-Update (21) NAS-Port-Type = Virtual (21) NAS-Port = 0 (21) NAS-Port-Id = "0/0/1/0" (21) Service-Type = Framed-User (21) NAS-IP-Address = 10.50.50.1 (21) Event-Timestamp = "Dec 8 2017 12:53:47 MSK" (21) Acct-Delay-Time = 0 I've got almost the same setup on another ASR 1002-X, with same IOS tree, just a bit older service release, and it sends along a list af all services subscriber has and a list of serices active, all in one common session accounting request. I really need that info in case radius failover - backup radius won't know which services are curently on on session and what actions are allowed. Am i missing something? ... View more

Hello. I'm trying to setup a ikev2 VPN server on ASR(CSR) router with EAP Auth. I've come to point where Android AnyConnect client is able to connect and ping internal resources via VPN and external resources via it's own connection (WiFi), but i have faced the issue when no DNS is working. Android device uses DNS provided by WiFi and i do not push any DNS settings via VPN. Here is my config: aaa authentication login default local aaa authentication login IKEV2 group radius aaa authentication ppp default local aaa authorization console aaa authorization exec default local aaa authorization network default none aaa authorization network IKEV2_AUTHOR local aaa accounting network default none ! crypto pki trustpoint TP revocation-check none rsakeypair TP ! ! crypto pki certificate chain TP certificate 00E41264991977340C ... ! username ppptest privilege 0 password 7 00140316105E1812 ! ! crypto ikev2 authorization policy POL pool ipsec_pool netmask 255.255.255.255 route set remote ipv4 10.2.0.0 255.255.0.0 ! crypto ikev2 proposal default encryption aes-cbc-256 aes-cbc-192 aes-cbc-128 3des integrity sha512 sha384 sha256 sha1 md5 group 5 2 14 15 16 19 ! ! ! crypto ikev2 profile PR match identity remote any authentication remote eap query-identity authentication local rsa-sig pki trustpoint TP nat keepalive 60 aaa authentication eap IKEV2 aaa authorization group eap list IKEV2_AUTHOR POL aaa authorization user eap cached virtual-template 2 ! interface Loopback1 ip address 10.2.1.1 255.255.255.255 ! interface GigabitEthernet2.11 encapsulation dot1Q 11 ip address 10.0.11.94 255.255.255.0 ! interface Virtual-Template2 type tunnel ip unnumbered Loopback1 tunnel mode ipsec ipv4 tunnel protection ipsec profile PROF ! ip local pool ipsec_pool 10.2.3.1 10.2.3.254 ! radius server rad address ipv4 10.0.11.101 auth-port 1812 acct-port 1813 key 7 110A1016141D0805172924 ! Any thoughts? ... View more

Hi. Is there an OID pointing out to which given interface is "ip unnumbered" to ? ... View more