® Access Registrar is the leading Cisco RADIUS and Diameter authentication, authorization, and accounting (AAA) server for the service provider market. It supports service provider deployment of access services by centralizing AAA information and simplifying provisioning and management. Cisco Access Registrar is a standards-based RADIUS/Diameter and proxy RADIUS/Diameter server designed for high performance, extensibility, and integration with external data stores and systems. It provides an ideal solution for service providers with wide-area broadband (WiMax), wide-area mobile Code Division Multiple Access (CDMA), General Packet Radio Service (GPRS), Universal Mobile Telecommunications Service (UMTS), 1xRTT, 1xEV-DOrA), wired and wireless local-area networks (Wi-Fi, WiMax), dial-up, and DSL services.
Table 1 lists the features of Cisco Access Registrar.
Table 1. Cisco Access Registrar Features
Cisco Access Registrar supports a wide range of authentication including the latest Extensible Authentication Protocol (EAP) methods. User information can be stored in its internal database or external directories or databases.
Cisco Access Registrar has user and group authorization. Session limits and IP address pools can be managed centrally, across multiple Cisco Access Registrar servers.
Cisco Access Registrar's flexible accounting allows accounting records to be stored to local files, to external databases, proxies, or any combination of these methods.
Cisco Access Registrar provides rich RADIUS proxy functions including EAP proxy and failover and round-robin modes.
Cisco Access Registrar has the flexibility to implement complex realm and AAA policies used in today's multiple-technology service provider environments. It also provides interfaces for automated configuration provisioning and custom-built AAA methods.
Cisco Access Registrar provides an option to customers to decide whether session management needs to be done internal by Cisco Access Registrar or needs to off-load the active session information to an external database like Oracle to achieve multi-million sessions.
Cisco Access Registrar's high-performance AAA processing increases Return On Investment (ROI) through lower hardware and server management costs.
New Features in Cisco Access Registrar 5.0
Cisco Access Registrar 5.0 adds support to the Diameter base protocol as per RFC 3588. The Diameter base application needs to be supported by all Diameter implementations.
Support for Diameter provides the following facilities:
• Supports authentication with the help of a local database or an external database (such as Lightweight Directory Access Protocol [LDAP], Open Database Connectivity [ODBC])
• Does session management and resource management as Cisco Access Registrar currently does for the RADIUS packet
• Supports writing the Diameter accounting packet in a local file or proxy to another AAA server
• Supports adding, modifying, or deleting the attribute-value pairs (AVPs) in Diameter packets through extension point scripting only for the local AAA service
• Supports open-ended Diameter applications
Cisco Access Registrar 5.0 process Diameter packets through profiles, polices, and rules, the same as for RADIUS packets, and supports session management and extension point scripting. Cisco Access Registrar 5.0 supports authentication through external databases with the interfaces such as LDAP and ODBC.
Another application that is supported as a part of this release is Diameter Network Access Server Application as per RFC 4005.
IPv6 Interface Support
Cisco Access Registrar 5.0 provides support for:
• Processing of radius requests originated from IPv6 RADIUS clients (network access server [NAS])
• AAA proxy for remote IPv6 AAA server
• IPv6 or IPv4 as the interface between Cisco Access Registrar and Broadband Remote Access Server (BRAS)/NAS
• IPv6 as per RFC 3162 attributes
Cisco Access Registrar 5.0 provides support for Extensible Authentication Protocol Method for UMTS Authentication and Key Agreement (EAP-AKA) as per RFC 4187.
The following EAP-AKA features are supported:
• MAP protocol
• Home Location Register (HLR) and Home Subscriber Server (HSS) and the list of compliant Third-Generation partnership Project (3GPP) standards
• Messages exchanged with the HLR/HSS
• Description of the HLR/HSS
• User profile information
Cisco Access Registrar servers have support for migration to a converged IP next-generation network (IP NGN) by supporting SIGTRAN SS7 messaging over IP (SS7oIP) for HLR communication to facilitate the seamless transition to next-generation IP-based signaling networks.
SIGTRAN, a working group of the Internet Engineering Task Force (IETF), has defined a protocol for the transport of real-time signaling data over IP networks. Cisco Access Registrar supports SS7oIP through SIGTRAN, a new transport layer that uses Stream Control Transmission Protocol (SCTP).
WiMAX NWG Stage 3 Latest Document Support
The WiMAX forum keeps updating the stage 3 document to address various requirements needed in the WiMAX communication between various devices that exist in the network. Cisco Access Registrar 5.0 complies with the Network Working Group (NWG) stage 3 document version 1.3.1 released in 2009 and addresses the newly added WiMAX attributes.
WiMAX Provisioning Server Support Along with Bootstrap Encryption Key
Cisco Access Registrar 5.0 provides support to generate and cache the bootstrap encryption key (BEK) when it receives the authentication request from the unprovisioned WiMAX subscriber or device.
Cisco Access Registrar can identify the unprovisioned device either by looking into the special pattern in the access request (for example, the User-Name attribute used in a RADIUS access request will be a temporary ID that indicates the unprovisioned device) or by performing explicit database lookup.
When the Cisco Access Registrar receives the accounting start packet for the unprovisioned device:
• IP, MAC address, and BEK of this unprovisioned device need to be sent to the Open Mobile Alliance Device Management (OMA-DM) server to initiate the provisioning.
• Cisco Access Registrar needs to maintain the IP address to MAC address association using the web service until it receives the provisioning complete message from the OMA-DM server.
The back-end portal could query the Cisco Access Registrar web service for this unprovisioned device MAC address by giving the device IP address and also the OMA-DM server request the Cisco Access Registrar web service to validate the MAC to IP address association.
The communication between Cisco Access Registrar and OMA-DM/portal server is through web service by using Simple Object Access Protocol (SOAP) over HTTPS. It is assumed that the OMA-DM server (or a mediation function) will have a web service that Cisco Access Registrar can use to communicate.
Lawful Intercept Support in Cisco Access Registrar
Cisco Access Registrar 5.0 provides support for Intercept Access Point (IAP), which is responsible for receiving the intercept/monitoring request for the subscriber whose Access Associated Communications Identifying Information (AA CMIII) is to be intercepted and delivered to a Law Interception Server (LIS).
Following intercept requests from LIS are supported by Cisco Access Registrar 5.0:
• ProvisionTarget: To start monitoring the target user
• DeprovisionTarget: To stop monitoring the target user
• LinkUpdate: To query the target user in monitored list
• ListTarget: To list all the users that are currently being monitored
The goal is to enhance the current session scalability of Cisco Access Registrar to hold multimillions of active sessions by storing the active session records on an external database server (Oracle) instead of storing it in the internal memory of Cisco Access Registrar.
Some of the internal variables and data structures of session management are modified in such a way as not to affect existing functionality as well as to optimize database reads/writes by means of a cache.
With single instance of Cisco Access Registrar 5.0, customers can scale multimillions of active sessions. Session scalability of Cisco Access Registrar with an external database depends upon the potentiality of the database. Supported Oracle database servers are 10g and 11i.
An option is provided to the customer to decide whether the active session information needs to be stored internally or externally.
Interim Accounting Update Support for ODBC Server
Cisco Access Registrar Release 5.0 will address the interim accounting records with DELETE and UPDATE entries to the external database.
LDAP Accounting Write-up
Cisco Access Registrar supports the LDAP interface for authentication and authorization. Cisco Access Registrar Release 5.0 will start support for LDAP write-up for accounting request messages to an external LDAP directory.
Red Hat Enterprise Linux 5.3 Support
Considering the changing business needs of the customer, Cisco Access Registrar 5.0 has started supporting Red Hat Enterprise Linux (RHEL) 5.3.
In Cisco Access Registrar Release 5.0 the graphical user interface (GUI) is completely revamped with the latest Java technologies to give a better look and feel with support for configuring most of the objects in Cisco Access Registrar. The Cisco Access Registrar 5.0 GUI has support for Internet Explorer version 6, 7, 8.
Support for Veritas Clustering
Cisco Access Registrar 5.0 supports Veritas clustering. The Veritas Cluster Server is the industry's leading cross-platform clustering solution for minimizing application downtime. Through central management tools, automated failover features to test disaster recovery plans without disruption, and advanced failover management based on server capacity, Cluster Server allows IT managers to maximize resources by moving beyond reactive recovery to proactive management of application availability.
Cisco Access Registrar Release 5.0 officially starts supporting VMware ESX for Linux machines.
VMware ESX is an enterprise-level virtualization product offered by VMware, Inc. ESX is a component of VMware's larger offering, VMware Infrastructure, which adds management and reliability services to the core server product.
Cisco UCS represents a radical simplification of traditional architectures, dramatically reducing the number of devices that must be purchased, cabled, configured, powered, cooled, and secured. The solution delivers end-to-end optimization for virtualized environments while retaining the ability to support traditional OSs and application stacks in physical environments.
Cisco UCS is built to meet today's demands while being ready to accommodate future technologies-including more powerful processors and faster Ethernet standards-as they become available.
Cisco Access Registrar Director License
Cisco Access Registrar Director is a lightweight software version of Cisco Access Registrar that provides only the proxy function and scripting capability. Cisco Access Registrar Director can be used in proxy scenarios in which a customer is going to use Access Registrar only for the proxy functionality or in load balancing, where Access Registrar can be used as a load balancer to the backed RADIUS servers. No other service is available as part of Cisco Access Registrar Director. It supports both RADIUS and Diameter proxies.
Availability and Ordering Information
Cisco Access Registrar 5.0 and its associated upgrade kit begins shipping in December 2009.
New customers can directly go with Cisco Access Registrar 5.0 version by purchasing the part numbers listed in Table 2 for regular delivery or in Table 3 for e-delivery.
Table 2. Ordering Information for Cisco Access Registrar 5.0
Access Registrar Base license for Solaris/Linux; support for RADIUS only; limited to 100 transactions per second
Access Registrar Next Generation Base license for Solaris/Linux; support for RADIUS, Diameter, and IPv6; limited to 100 transactions per second
Access Registrar Additional License per server; limited to 100 transactions per second
Access Registrar Additional License per server; limited to 200 transactions per second
Access Registrar Additional License per server; limited to 500 transactions per second
Access Registrar Additional License per server; limited to 1000 transactions per second
Access Registrar Additional License per server; limited to 2000 transactions per second
Access Registrar Additional License per server; limited to 3000 transactions per second
Access Registrar Additional License per server; limited to 5000 transactions per second
Access Registrar Secondary license; required for each secondary server
Access Registrar Director Base license; load balancing and AAA proxy support; required for each Access Registrar Director Base server; limited to 2000 transactions per second
Access Registrar Director Next Generation Base license; load balancing and AAA proxy support; Includes Diameter and IPv6 support; required for each Access Registrar Director Next Generation Base server; limited to 2000 transactions per second
Access Registrar Director Additional license per server; limited to 2000 transactions per second
In addition, Cisco Access Registrar is now also available by e-delivery; with e-delivery, the licenses are obtained electronically. The licenses need to be ordered using the part numbers in Table 2.
Table 3. Ordering Information for Cisco Access Registrar 5.0 E-Delivery
E-Delivery Access Registrar Additional License per server; limited to 100 transactions per second
E-Delivery Access Registrar Additional License per server; limited to 200 transactions per second
E-Delivery Access Registrar Additional License per server; limited to 500 transactions per second
E-Delivery Access Registrar Additional License per server; limited to 1000 transactions per second
E-Delivery Access Registrar Additional License per server; limited to 2000 transactions per second
E-Delivery Access Registrar Additional License per server; limited to 3000 transactions per second
E-Delivery Access Registrar Additional License per server; limited to 5000 transactions per second
E-Delivery Access Registrar Director Additional license per server; limited to 2000 transactions per second
E-Delivery Access Registrar Upgrade Additional License per server; limited to 100 transactions per second
E-Delivery Access Registrar Upgrade Additional License per server; limited to 200 transactions per second
E-Delivery Access Registrar Upgrade Additional License per server; limited to 500 transactions per second
E-Delivery Access Registrar Upgrade Additional License per server; limited to 1000 transactions per second
E-Delivery Access Registrar Upgrade Additional License per server; limited to 2000 transactions per second
E-Delivery Access Registrar Upgrade Additional License per server; limited to 3000 transactions per second
E-Delivery Access Registrar Upgrade Additional License per server; limited to 5000 transactions per second
Existing Cisco Access Registrar customers with versions 3.x or 4.x with or without a Software Application Support (SAS) contract can upgrade to Cisco Access Registrar 5.0 by purchasing the appropriate upgrade part numbers listed in Table 4.