In Cisco IOS Mobile IP, the home agent keeps track of the location of the mobile node as it roams away from its home network and forwards all traffic destined to the mobile node to its new location on the Internet. The Mobile IP--Home Agent Accounting feature allows the home agent to generate the following three new accounting messages that are forwarded to the authentication, authorization, and accounting (AAA) server or the Service Selection Gateway (SSG):
The SSG can act as the proxy server for the AAA server and acknowledge the accounting messages sent by the home agent. The accounting records generated by the home agent can be stored on the AAA server and be used by Internet service providers (ISPs) for billing, capacity planning, and operations.
Feature Specifications for the Mobile IP: Home Agent Accounting Feature
This feature was introduced.
For platform supported in Cisco IOS Release 12.2(15)T consult Cisco Feature Navigator.
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see
Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Mobile IP Home Agent Accounting
Because home agent accounting generates messages for the AAA server, the network should have a reachable AAA server or SSG.
The SSG is a switching solution for service providers that offer intranet, extranet, and Internet connections to subscribers using broadband access technology such as digital subscriber lines (DSL), cable modems, or wireless to allow simultaneous access to network services.
The SSG communicates with the AAA management network where RADIUS, Dynamic Host Configuration Protocol (DHCP), and Simple Network Management Protocol (SNMP) servers reside and with the ISP network, which may connect to the Internet, corporate networks, and value-added services.
SSG is designed and deployed such that all network traffic passes through it.
Feature Design of Home Agent Accounting
The SSG collects all the statistics information because all network traffic passes through it. However, it does not have the Mobile IP session information that the home agent maintains. The session information tracks how long a mobile node session lasts.
This feature was developed for the SSG to act as the proxy server for the AAA. However, this feature works equally well without the SSG and any standard AAA server can accept home agent accounting messages.
For each mobile node, the home agent sends this session information to the SSG in the form of messages, which are described in the following sections. The SSG forwards the messages to the AAA server as shown in the figure below.
Figure 1. Topology for Home Agent Accounting with SSG and AAA Server
The following messages are sent from the home agent to the SSG or AAA server:
The home agent sends an Accounting Start message to the SSG/AAA when a mobile node successfully registers for the first time. This indicates the start of a new Mobile IP session for a mobile node.
In the case of a redundant home agent, a standby home agent will send an Accounting Start message only when it becomes active and does not have any bindings. This allows the SSG to maintain host objects for mobile nodes on the failed home agent.
The home agent generates an Accounting Update message when the mobile node changes its point of attachment (POA) in the mobile network. For a Mobile IP session, this corresponds to a successful re-registration from a mobile node when it changes its care-of address (CoA). The CoA is the current location of the mobile node on the foreign network.
The home agent sends an Accounting Stop message to indicate that the Mobile IP session has ended. This occurs when the lifetime of the mobile node expires, when the mobile node sends a successful deregisration request, or when the home agent is unconfigured by a network administrator.
All the messages contain only the following information:
Network access identifier (NAI). This field is the name of the mobile node. The NAI is a character string that can be a unique identifier (username@realm) or a group identifier (realm).
Network access server (NAS) IP. This field is the IP address of the accounting node. The home agent is the accounting node, so this field contains the home agent address.
Framed IP address. This field is the IP address of the mobile node. Typically, the home agent will allocate an IP address to a mobile node after successful registration.
Point of attachment (POA). This field indicates the POA for the mobile node on the network. For a Mobile IP session, this is the care-of address of the mobile node.
The message format is shown in the table below, including the RADIUS attribute number, which is transparent to the Mobile IP--Home Agent Accounting feature.
Table 1 Accounting Record Attributes
RADIUS Attribute Number
Mobile node user name.
NAS IP Address
Accounting node IP address
Framed IP Address
IP address of the mobile node.
This attribute is used to indicate POA/CoA address, because there is no CoA attribute. This choice of attribute works because the Mobile IP tunnel terminates on the CoA/POA and qualifies as Tunnel-Client-Endpoint.
Indicates the accounting Start/Stop/Update for the service.
Benefits of Home Agent Accounting
The Mobile IP--Home Agent Accounting feature allows ISPs to bill consumers based on the usage of the service. The accounting information is stored on a AAA server database and used by billing software to charge for service usage for each mobile node. The ISPs can use this accounting information for billing, capacity planning, and operations.
Access control is the way you manage who has user access to the network server and what services the users are allowed to use. AAA network security services provide the primary framework through which you set up access control on your router or access server.
Router(config)# aaa accounting network mylist start-stop group radius
Enables AAA accounting of requested services for billing or security purposes.
This command creates an accounting method list for network accounting and instructs the home agent to send network events for Mobile IP. The method list can be of any name or default.
The start-stop keyword indicate that the home agent will send Start and Stop records to the SSG or AAA server.
Router(config)# aaa accounting update newinfo
Enables periodic interim accounting records to be sent to the accounting server.
This command instructs the home agent to send an Accounting Update message to the SSG or AAA server when a mobile node changes its POA and acquires a new care-of address.
RADIUS is a method for defining the exchange of AAA information in the network. In the Cisco implementation, RADIUS clients run on Cisco routers and send authentication requests to a RADIUS server that contains all user authentication and network server access information.
Router(config)# ip mobile secure host 10.3.3.2 spi 1000 key hex 123456781234567812345678123245678 algorithm md5 mode prefix-suffix
Specifies the mobility security associations for the mobile host.
Exits to privileged EXEC mode.
Router# show ip mobile globals
Displays global information for mobile agents.
See the display output in the Examples section. Notice that the HA accounting field shows enabled status.
The following sample output shows the home agent accounting status:
Router# show ip mobile globals
IP Mobility global information:
Registration lifetime: INFINITE
Replay protection time: 10 secs
Reverse tunnel enabled
ICMP Unreachable enabled
Strip realm disabled
NAT detect disabled
HA Accounting enabled using method list: mylist
Foreign Agent is not enabled, no care-of address
1 interfaces providing service
Encapsulations supported: IPIP and GRE
Tunnel fast switching enabled
Discovered tunnel MTU aged out after 1:00:00
In the event that home agent accounting is not operating correctly, use the following debug commands in privileged EXEC mode to determine where the problem may exist:
See the Cisco IOS Debug Command Reference
publication for information about these commands.
Configuration Examples for Mobile IP Home Agent Accounting
In the following example, an accounting method list called mylist
is created for network accounting. The accounting method list, mylist
, is applied at the home agent, which enables home agent accounting.
aaa accounting mylist start-stop group radius
aaa accounting update newinfo
ip mobile home-agent accounting mylist address 10.3.3.1
ip mobile host 10.3.3.2 10.3.3.5 interface Ethernet2/2
ip mobile secure host 10.3.3.2 spi 1000 key hex 123456781234567812345678123245678 algorithm md5 mode prefix-suffix
radius-server host 188.8.131.52 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key cisco
For additional information related to Mobile IP--Home Agent Accounting feature, refer to the following references:
Mobile IP configuration tasks
"Configuring Mobile IP" chapter in theCisco IOS IP Configuration Guide,
Mobile IP commands: complete command syntax, command mode, defaults, usage guidelines, and examples
"Mobile IP Commands" chapter in theCisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services,
To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to firstname.lastname@example.org. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.
The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the
Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at
http://tools.cisco.com/Support/CLILookup or to the
Cisco IOS Master Commands List .
care-ofaddress--The termination point of the tunnel to a mobile node or mobile router. This can be a collocated care-of address, by which the mobile node or mobile router acquires a local address and detunnels its own packets, or a foreign agent care-of address, by which a foreign agent detunnels packets and forwards them to the mobile node or mobile router. The care-of address is included in the Mobile IP registration request and is used by the home agent to forward packets to the mobile node in its current location.
foreignagent--A router on the visited network of a foreign network that provides routing services to the mobile node while registered. The foreign agent detunnels and delivers packets to the mobile node or mobile router that were tunneled by the home agent of the mobile node. For packets sent by a mobile node, the foreign agent may serve as a default router for registered mobile nodes.
homeagent--A router on a home network of the mobile node or that tunnels packets to the mobile node or mobile router while they are away from home. It keeps current location information for registered mobile nodes called a mobility binding.
mobilenode--A host or router that changes its point of attachment from one network or subnet to another. A mobile node may change its location without changing its IP address; it may continue to communicate with other Internet nodes at any location using its home IP address, assuming that link-layer connectivity to a point of attachment is available.
NAI--Network access identifier. The user ID submitted by the mobile node during registration to identify the user for authentication. The NAI may help route the registration request to the correct home agent.