IP Mobility: Mobile IP Configuration Guide, Cisco IOS Release 15M&T
Mobile IP Home Agent Accounting
Downloads: This chapterpdf (PDF - 157.0KB) The complete bookPDF (PDF - 1.3MB) | Feedback

Mobile IP Home Agent Accounting

Mobile IP Home Agent Accounting

Last Updated: December 2, 2012

In Cisco IOS Mobile IP, the home agent keeps track of the location of the mobile node as it roams away from its home network and forwards all traffic destined to the mobile node to its new location on the Internet. The Mobile IP--Home Agent Accounting feature allows the home agent to generate the following three new accounting messages that are forwarded to the authentication, authorization, and accounting (AAA) server or the Service Selection Gateway (SSG):

  • Accounting Start
  • Accounting Update
  • Accounting Stop

The SSG can act as the proxy server for the AAA server and acknowledge the accounting messages sent by the home agent. The accounting records generated by the home agent can be stored on the AAA server and be used by Internet service providers (ISPs) for billing, capacity planning, and operations.

Feature Specifications for the Mobile IP: Home Agent Accounting Feature

Feature History

Release

Modification

12.2(15)T

This feature was introduced.

Supported Platforms

For platform supported in Cisco IOS Release 12.2(15)T consult Cisco Feature Navigator.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

Prerequisites for Mobile IP Home Agent Accounting

Because home agent accounting generates messages for the AAA server, the network should have a reachable AAA server or SSG.

Information About Mobile IP Home Agent Accounting

Service Selection Gateway

The SSG is a switching solution for service providers that offer intranet, extranet, and Internet connections to subscribers using broadband access technology such as digital subscriber lines (DSL), cable modems, or wireless to allow simultaneous access to network services.

The SSG communicates with the AAA management network where RADIUS, Dynamic Host Configuration Protocol (DHCP), and Simple Network Management Protocol (SNMP) servers reside and with the ISP network, which may connect to the Internet, corporate networks, and value-added services.

SSG is designed and deployed such that all network traffic passes through it.

Feature Design of Home Agent Accounting

The SSG collects all the statistics information because all network traffic passes through it. However, it does not have the Mobile IP session information that the home agent maintains. The session information tracks how long a mobile node session lasts.


Note


This feature was developed for the SSG to act as the proxy server for the AAA. However, this feature works equally well without the SSG and any standard AAA server can accept home agent accounting messages.

For each mobile node, the home agent sends this session information to the SSG in the form of messages, which are described in the following sections. The SSG forwards the messages to the AAA server as shown in the figure below.

Figure 1 Topology for Home Agent Accounting with SSG and AAA Server


Message Types

The following messages are sent from the home agent to the SSG or AAA server:

Accounting Start

The home agent sends an Accounting Start message to the SSG/AAA when a mobile node successfully registers for the first time. This indicates the start of a new Mobile IP session for a mobile node.

In the case of a redundant home agent, a standby home agent will send an Accounting Start message only when it becomes active and does not have any bindings. This allows the SSG to maintain host objects for mobile nodes on the failed home agent.

Accounting Update

The home agent generates an Accounting Update message when the mobile node changes its point of attachment (POA) in the mobile network. For a Mobile IP session, this corresponds to a successful re-registration from a mobile node when it changes its care-of address (CoA). The CoA is the current location of the mobile node on the foreign network.

Accounting Stop

The home agent sends an Accounting Stop message to indicate that the Mobile IP session has ended. This occurs when the lifetime of the mobile node expires, when the mobile node sends a successful deregisration request, or when the home agent is unconfigured by a network administrator.

Message Formats

All the messages contain only the following information:

  • Network access identifier (NAI). This field is the name of the mobile node. The NAI is a character string that can be a unique identifier (username@realm) or a group identifier (realm).
  • Network access server (NAS) IP. This field is the IP address of the accounting node. The home agent is the accounting node, so this field contains the home agent address.
  • Framed IP address. This field is the IP address of the mobile node. Typically, the home agent will allocate an IP address to a mobile node after successful registration.
  • Point of attachment (POA). This field indicates the POA for the mobile node on the network. For a Mobile IP session, this is the care-of address of the mobile node.

The message format is shown in the table below, including the RADIUS attribute number, which is transparent to the Mobile IP--Home Agent Accounting feature.

Table 1 Accounting Record Attributes

RADIUS Attribute Number

Attribute

Description

1

NAI/User-Name

Mobile node user name.

4

NAS IP Address

Accounting node IP address

8

Framed IP Address

IP address of the mobile node.

66

Tunnel-Client-Endpoint

This attribute is used to indicate POA/CoA address, because there is no CoA attribute. This choice of attribute works because the Mobile IP tunnel terminates on the CoA/POA and qualifies as Tunnel-Client-Endpoint.

40, 2

Acct_status_type

Indicates the accounting Start/Stop/Update for the service.

Benefits of Home Agent Accounting

The Mobile IP--Home Agent Accounting feature allows ISPs to bill consumers based on the usage of the service. The accounting information is stored on a AAA server database and used by billing software to charge for service usage for each mobile node. The ISPs can use this accounting information for billing, capacity planning, and operations.

How to Configure Mobile IP Home Agent Accounting

Configuring AAA

Access control is the way you manage who has user access to the network server and what services the users are allowed to use. AAA network security services provide the primary framework through which you set up access control on your router or access server.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa accounting network {default | list-name} start-stop group group-name

5.    aaa accounting update newinfo


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables higher privilege levels, such as privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
aaa new-model


Example:

Router(config)# aaa new-model

 

Enables AAA access control.

 
Step 4
aaa accounting network {default | list-name} start-stop group group-name


Example:

Router(config)# aaa accounting network mylist start-stop group radius

 

Enables AAA accounting of requested services for billing or security purposes.

  • This command creates an accounting method list for network accounting and instructs the home agent to send network events for Mobile IP. The method list can be of any name or default.
  • The start-stop keyword indicate that the home agent will send Start and Stop records to the SSG or AAA server.
 
Step 5
aaa accounting update newinfo


Example:

Router(config)# aaa accounting update newinfo

 

Enables periodic interim accounting records to be sent to the accounting server.

  • This command instructs the home agent to send an Accounting Update message to the SSG or AAA server when a mobile node changes its POA and acquires a new care-of address.
 

Configuring RADIUS

RADIUS is a method for defining the exchange of AAA information in the network. In the Cisco implementation, RADIUS clients run on Cisco routers and send authentication requests to a RADIUS server that contains all user authentication and network server access information.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    radius-server host {hostname | ip-address}[auth-port port-number] [acct-port port-number]

4.    radius-server retransmit retries

5.    radius-server key {0 string |7 string | string}

6.    radius-server attribute 44 include-in-access-req


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
radius-server host {hostname | ip-address}[auth-port port-number] [acct-port port-number]


Example:

Router(config)# radius-server host 128.107.162.173 auth-port 1645 acct-port 1646

 

Specifies a RADIUS server host.

 
Step 4
radius-server retransmit retries


Example:

Router(config)# radius-server retransmit 3

 

Specifies the number of times the Cisco IOS software searches the list of RADIUS server hosts before giving up.

 
Step 5
radius-server key {0 string |7 string | string}


Example:

Router(config)# radius-server key cisco

 

Sets the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon.

 
Step 6
radius-server attribute 44 include-in-access-req


Example:

Router(config)# radius-server attribute 44 include-in-access-req

 

(Optional) Sends RADIUS attribute 44 in access-request packets.

 

Enabling Home Agent Accounting

To enable home agent accounting, use the following commands:

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip mobile home-agent accounting {default | list-name}

4.    ip mobile home-agent address ip-address

5.    ip mobile host {lower[upper] | nai string} {interface name}

6.    ip mobile secure {host {lower-address[upper-address]| nai string} spi spi key hex string algorithm {md5 | hmac-md5} mode prefix-suffix

7.    end

8.    show ip mobile globals


DETAILED STEPS
  Command or Action Purpose
Step 1
enable


Example:

Router> enable

 

Enables privileged EXEC mode.

  • Enter your password if prompted.
 
Step 2
configure terminal


Example:

Router# configure terminal

 

Enters global configuration mode.

 
Step 3
ip mobile home-agent accounting {default | list-name}


Example:

Router(config)# ip mobile home-agent accounting mylist

 

Enables home agent accounting.

  • Applies the method list defined in the aaa accounting command.
 
Step 4
ip mobile home-agent address ip-address


Example:

Router(config)# ip mobile home-agent address 10.3.3.1

 

Enables and controls home agent services.

 
Step 5
ip mobile host {lower[upper] | nai string} {interface name}


Example:

Router(config)# ip mobile host 10.3.3.2 10.3.3.5 interface ethernet2/2

 

Configures the mobile node or mobile host group.

 
Step 6
ip mobile secure {host {lower-address[upper-address]| nai string} spi spi key hex string algorithm {md5 | hmac-md5} mode prefix-suffix


Example:

Router(config)# ip mobile secure host 10.3.3.2 spi 1000 key hex 123456781234567812345678123245678 algorithm md5 mode prefix-suffix

 

Specifies the mobility security associations for the mobile host.

 
Step 7
end


Example:

Router(config)# end

 

Exits to privileged EXEC mode.

 
Step 8
show ip mobile globals


Example:

Router# show ip mobile globals

 

Displays global information for mobile agents.

  • See the display output in the Examples section. Notice that the HA accounting field shows enabled status.
 

Examples

The following sample output shows the home agent accounting status:

Router# show ip mobile globals
IP Mobility global information:
Home Agent
    Registration lifetime: INFINITE
    Broadcast enabled
    Replay protection time: 10 secs
    Reverse tunnel enabled
    ICMP Unreachable enabled
    Strip realm disabled
    NAT detect disabled
    HA Accounting enabled using method list: mylist
    Address 10.3.3.1
Foreign Agent is not enabled, no care-of address
Mobility Agent
1 interfaces providing service
Encapsulations supported: IPIP and GRE
Tunnel fast switching enabled
Discovered tunnel MTU aged out after 1:00:00

Troubleshooting Tips

In the event that home agent accounting is not operating correctly, use the following debug commands in privileged EXEC mode to determine where the problem may exist:

  • debug aaa accounting
  • debug radius
  • debug ip mobile

See the Cisco IOS Debug Command Reference publication for information about these commands.

Configuration Examples for Mobile IP Home Agent Accounting

Home Agent Accounting Example

In the following example, an accounting method list called mylist is created for network accounting. The accounting method list, mylist , is applied at the home agent, which enables home agent accounting.

!
aaa new-model
!
!
aaa accounting mylist start-stop group radius
aaa accounting update newinfo
!
!
ip mobile home-agent accounting mylist address 10.3.3.1
ip mobile host 10.3.3.2 10.3.3.5 interface Ethernet2/2
ip mobile secure host 10.3.3.2 spi 1000 key hex 123456781234567812345678123245678 algorithm md5 mode prefix-suffix
!
!
radius-server host 128.107.162.173 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key cisco

Additional References

For additional information related to Mobile IP--Home Agent Accounting feature, refer to the following references:

Related Documents

Related Topic

Document Title

Mobile IP configuration tasks

"Configuring Mobile IP" chapter in theCisco IOS IP Configuration Guide, Release 12.2

Mobile IP commands: complete command syntax, command mode, defaults, usage guidelines, and examples

"Mobile IP Commands" chapter in theCisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2T

AAA configuration tasks

Cisco IOS Security Configuration Guide, Release 12.2

AAA commands: complete command syntax, command mode, defaults, usage guidelines, and examples

Cisco IOS Security Command Reference, Release 12.2T

RADIUS configuration tasks

Cisco IOS Security Configuration Guide, Release 12.2

RADIUS commands: complete command syntax, command mode, defaults, usage guidelines, and examples

Cisco IOS Security Command Reference, Release 12.2T

SSG configuration tasks and commands

"Service Selection Gateway " feature document, Release 12.2(8)T

Standards

Standards

Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

--

MIBs

MIBs

MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://tools.cisco.com/ITDIT/MIBS/servlet/index

If Cisco MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco MIBs page at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

http://www.cisco.com/register

RFCs

RFCs

Title

No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

--

Technical Assistance

Description

Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/public/support/tac/home.shtml

Command Reference

The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List .

  • ip mobile home-agent accounting
  • show ip mobile globals

Glossary

care-of address --The termination point of the tunnel to a mobile node or mobile router. This can be a collocated care-of address, by which the mobile node or mobile router acquires a local address and detunnels its own packets, or a foreign agent care-of address, by which a foreign agent detunnels packets and forwards them to the mobile node or mobile router. The care-of address is included in the Mobile IP registration request and is used by the home agent to forward packets to the mobile node in its current location.

foreign agent --A router on the visited network of a foreign network that provides routing services to the mobile node while registered. The foreign agent detunnels and delivers packets to the mobile node or mobile router that were tunneled by the home agent of the mobile node. For packets sent by a mobile node, the foreign agent may serve as a default router for registered mobile nodes.

home agent --A router on a home network of the mobile node or that tunnels packets to the mobile node or mobile router while they are away from home. It keeps current location information for registered mobile nodes called a mobility binding.

mobile node --A host or router that changes its point of attachment from one network or subnet to another. A mobile node may change its location without changing its IP address; it may continue to communicate with other Internet nodes at any location using its home IP address, assuming that link-layer connectivity to a point of attachment is available.

NAI --Network access identifier. The user ID submitted by the mobile node during registration to identify the user for authentication. The NAI may help route the registration request to the correct home agent.


Note


Refer to the Internetworking Terms and Acronyms for terms not included in this glossary.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2012 Cisco Systems, Inc. All rights reserved.