This documentation has been moved
AAA High Availability Support for Local PPPoX Sessions
Downloads: This chapterpdf (PDF - 135.0KB) The complete bookPDF (PDF - 1.63MB) | Feedback

AAA High Availability Support for Local PPPoX Sessions

Table Of Contents

AAA High Availability Support for Local PPPoX Sessions

Finding Feature Information

Contents

Restrictions for AAA High Availability Support for Local PPPoX Sessions

Information About AAA High Availability Support for Local PPPoX Sessions

AAA HA Enhancement

HA and Authentication

HA and Authorization

HA and Accounting

System Accounting

Periodic Accounting

How to Configure AAA High Availability Support for Local PPPoX Sessions

Configuring AAA High Availability Support for Local PPPoX Sessions

Troubleshooting an AAA High Availability Configuration

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for AAA High Availability Support for Local PPPoX Sessions


AAA High Availability Support for Local PPPoX Sessions


First Published: November 20, 2006
Last Updated: November 19, 2010

This feature enhances the authentication, authorization, and accounting (AAA) capability to meet high availability (HA) criteria for locally terminated Point-to-Point Protocol (PPP) over Ethernet (PPPoE) and PPPoEoX sessions, where X represents VLAN or QinQ. The following Feature Manager features are supported in this implementation of AAA HA:

Absolute (session) timeout

Idle timeout

Access control lists (ACLs)

ACL Filter

Quality of service (QoS)

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for AAA High Availability Support for Local PPPoX Sessions" section.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

Restrictions for AAA High Availability Support for Local PPPoX Sessions

Information About AAA High Availability Support for Local PPPoX Sessions

How to Configure AAA High Availability Support for Local PPPoX Sessions

Additional References

Additional References

Feature Information for AAA High Availability Support for Local PPPoX Sessions

Restrictions for AAA High Availability Support for Local PPPoX Sessions

If an administrator changes the protocol of a server group (for example, from RADIUS to TACACS+), HA will not be available for sessions configured to use that server group.

IP sessions are not supported in this implementation of AAA HA.

This implementation of AAA HA supports only locally terminated PPPoX sessions, including the following:

PPP over Ethernet (PPPoE)

PPPoE terminated into a multiprotocol label switching (MPLS) virtual private network (VPN)

PPPoEoE 802.1q into MPLS VPN

PPPoEoE 802.1q-in-q into MPLS VPN

Dynamic Host Configuration Protocol (DHCP) VPN ID option 82

Per VPN AAA

The following Feature Manager features are not supported in this implementation of AAA HA:

Prepaid Time Monitor

Prepaid Volume Monitor

L4 Redirect

Traffic Classification

Portbundle Hostkey

IPv6 DHCP from AAA

Information About AAA High Availability Support for Local PPPoX Sessions

AAA HA Enhancement

HA and Authentication

HA and Authorization

HA and Accounting

AAA HA Enhancement

Cisco HA delivers carrier grade reliability with Cisco devices running Cisco IOS XE software. Carrier grade means that service disruption because of outages, service upgrades, or other maintenance activities on Cisco IOS XE platforms are rarely experienced. To achieve this level of service, Cisco uses two route processors to manage and control the sessions and services for each device. One processor is active and the other is in standby mode, ready to provide backup. A transition from the active processor to the standby processor is transparent to the end user, but not necessarily to the service provider.

The router must maintain the following information during transient component failures:

Authentication status of clients

Authorization status

Accounting and billing information

To maintain this information during transitions to the standby processor, Cisco IOS XE software uses an HA replay model to re-create as much state and database information as possible between the active and standby devices. The HA replay model works within existing external AAA server protocols to achieve the desired behavior.

HA and Authentication

For authentication, only the following state information is maintained: knowledge that a session authenticated on the active processor need not be reauthenticated on the standby processor. Each authentication protocol, such as local, TACACS+, or RADIUS, responds in its protocol-specific way to an authentication request from a standby device. All AAA client authentication replies on a standby device should be successful.

HA and Authorization

The HA process for authorization data is different from the authentication process. The AAA server caches the authorization responses for the sessions in order to provide the appropriate authorization attributes to AAA clients during a session replay. AAA clients use the authorization attributes to create a session copy on the standby route processor.

HA and Accounting

The AAA HA accounting framework takes advantage of existing AAA features such as system accounting and periodic accounting to limit the loss of accounting and billing information caused by a switchover between an active processor and a standby processor.

System Accounting

System accounting is a separate accounting capability that informs AAA servers about the state of a client device, such as a router. The AAA server receives a "System-Off" message when a controlled restart takes place on a client device. The message notifies the AAA server to clear any active sessions being managed for the specified client. When the client restarts and becomes available for new sessions, the AAA server receives a "System-On" message. The "System-On" message is also sent following uncontrolled restarts caused by device failures or other events that do not generate a "System-Off" message. In either case, the AAA server no longer maintains any active sessions for the specified client device. The server bills or accounts for the sessions prior to the "System-On" message and starts a new session.

AAA's accounting HA solution does not add any new requirements to system accounting for AAA servers. Any switchover will look like a very fast, minimally disruptive outage. Although end users do not experience any loss of service during an HA switchover, AAA servers reset their sessions and restart accounting for all switched-over sessions.

Periodic Accounting

You can use periodic accounting to dynamically update records of session utilization for billing purposes. Periodic accounting minimizes the loss of usage statistics. HA does not eliminate the need to configure periodic accounting on a device if you require dynamic usage statistics for billing purposes. To achieve the HA level of reliability, the existing network topology configuration must be maintained.

How to Configure AAA High Availability Support for Local PPPoX Sessions

Configuring AAA High Availability Support for Local PPPoX Sessions

Troubleshooting an AAA High Availability Configuration

Configuring AAA High Availability Support for Local PPPoX Sessions

There are no configuration tasks associated with this feature. If you maintain your network topology for HA, then the AAA functions automatically participate in the HA feature for locally terminated PPPoX sessions.

Troubleshooting an AAA High Availability Configuration

SUMMARY STEPS

1. enable

2. debug aaa redundancy

3. disable

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enters the privileged EXEC mode.

Enter your password, if prompted to do so.

Step 2 

debug aaa redundancy

Example:

Router# debug aaa redundancy

Displays AAA synchronization data for the session synchronization to the standby device.

Step 3 

disable

Example:

Router# disable

Exits to user EXEC mode.

Additional References

Related Documents

Related Topic
Document Title

AAA commands

Cisco IOS Security Command Reference

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

Cisco IOS debug commands

Cisco IOS Debug Command Reference

Authentication, Authorization, and Accounting (AAA)

"Authentication, Authorization, and Accounting (AAA)" section of the Security Configuration Guide: Securing User Services


Standards

Standard
Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.


MIBs

MIB
MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFC
Title

No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.


Technical Assistance

Description
Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html


Feature Information for AAA High Availability Support for Local PPPoX Sessions

Table 1 lists the features in this module and provides links to specific configuration information.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.


Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.


Table 1 Feature Information for AAA HA Support for Local PPPoX Sessions 

Feature Name
Releases
Feature Information

AAA High Availability Support for Local PPPoX Sessions

Cisco IOS XE Release 2.1

This feature enhances the AAA capability to meet HA criteria for locally terminated PPPoE and PPPoEoX sessions.

The following command was introduced or modified: debug aaa redundancy.