Cisco IOS Intelligent Service Gateway Configuration Guide, Release 12.2 SB
Configuring ISG Policies for Session Maintenance
Download this chapter
Configuring ISG Policies for Session MaintenanceConfiguring ISG Policies for Session Maintenance
give_us_feedback

Table Of Contents

Configuring ISG Policies for Session Maintenance

Contents

Prerequisites for Configuring Policies for Session Maintenance

Restrictions for Configuring Policies for Session Maintenance

Information About Configuring Policies for Session Maintenance

Session Maintenance Timers

Benefits of the Session Maintenance Timers

How to Configure the Session Maintenance Timers

Configuring the Session Timer in a Service Policy Map

What to Do Next

Configuring the Session Timer on a AAA Server

Configuring the Connection Timer in a Service Policy Map

What to Do Next

Configuring the Connection Timer on a AAA Server

Verifying the Session and Connection Timer Settings

Troubleshooting the Session and Connection Timer Settings

Prerequisites for Troubleshooting the Session Maintenance Timers

Restrictions for Troubleshooting the Session Maintenance Timers

Debug Commands Available for the Session Maintenance Timers

Enabling the Session Maintenance Timer Debug Commands

Configuration Examples for Session Maintenance Timers

Session Timer Configuration in a Service Policy Map: Example

Connection Idle Timer Configuration in a Service Policy Map: Example

Session Timer Show Command Output: Example

Connection Idle Timer Show Command Output: Example

Session Timer Debug Output: Example

Connection Idle Timer Debug Output: Example

Additional References

Related Documents

Technical Assistance

Feature Information for Configuring Policies for Session Maintenance


Configuring ISG Policies for Session Maintenance

First Published: March 20, 2006
Last Updated: March 20, 2006

Intelligent Service Gateway (ISG) is a Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. ISG provides two commands, timeout absolute and timeout idle, that each allow control over a session and a traffic class configured on the session as defined by a service policy map. Additionally, the Internet Engineering Task Force (IETF) RADIUS attributes Session-Timeout (attribute 27) and Idle-Timeout (attribute 28) can be used in service profiles on a authentication, authorization, and accounting (AAA) server to configure the same session maintenance control.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all features. To find information about feature support and configuration and platform requirements, use the "Feature Information for Configuring Policies for Session Maintenance" section.

Contents

•Prerequisites for Configuring Policies for Session Maintenance

•Restrictions for Configuring Policies for Session Maintenance

•Information About Configuring Policies for Session Maintenance

•How to Configure the Session Maintenance Timers

•Configuration Examples for Session Maintenance Timers

•Additional References

•Feature Information for Configuring Policies for Session Maintenance

Prerequisites for Configuring Policies for Session Maintenance

For information about release and platform support, see the "Feature Information for Configuring Policies for Session Maintenance" section.

A traffic class is required only if the idle timer or session timer is being installed on a service that has a traffic class definition in it. If the timer is installed on a session or service that has no traffic class, a traffic class is not required. See the "Configuring ISG Subscriber Services" module for information about how to configure a traffic class.

Restrictions for Configuring Policies for Session Maintenance

For the idle timeout that is applied on an IP session (rather than on a PPP session), there is currently no way to specify the direction. By default, the direction in which the idle timer is applied is always outbound.

Information About Configuring Policies for Session Maintenance

Before you configure the ISG session maintenance timers, you should understand the following concepts:

•Session Maintenance Timers

•Benefits of the Session Maintenance Timers

Session Maintenance Timers

ISG provides two commands (each of which can be set independently) to maintain control over a session and its connection. The timeout absolute command controls how long a session can be connected before it is terminated. The timeout idle command controls how long a connection can be idle before it is terminated. Both commands detect both PPP and IP sessions and can be applied in a service, on a per-session basis, or in a flow. All subscriber traffic will reset the timers; however, non-network traffic such as PPP control packets will not reset the timers.

The scope of the session timers and connection timers is determined by the type of service within which the timer is specified. If specified in a service profile for which no traffic class is defined, the timer action will be to terminate the session or connection. If a traffic class specifier resides in the service profile, the timer action will be to deactivate the service.

Benefits of the Session Maintenance Timers

The PPP idle timeout functionality has been replaced by the ISG idle timeout feature. The idle timer is a generic feature that can be set to detect idle traffic in both PPP and IP sessions.

You set the idle timer in a service profile that is installed on a session to control how long that service stays installed before it is removed from the session because no traffic is flowing through that service. If the service has traffic class parameters associated with it, that traffic class is terminated when this timer expires, or when the session itself is terminated.

The same is true for the session timer, except that this timer determines how long the session or service stays up, regardless of traffic flowing through it.

How to Configure the Session Maintenance Timers

Configuring the session maintenance timers requires two separate tasks, one to set the idle timer and one to set the session timer. Either one or both of these tasks can be performed in order to set session maintenance control. The following tasks show how to set these timers in a service policy map and in a RADIUS AAA server profile:

•Configuring the Session Timer in a Service Policy Map (required)

•Configuring the Session Timer on a AAA Server (required)

•Configuring the Connection Timer in a Service Policy Map (required)

•Configuring the Connection Timer on a AAA Server (required)

•Verifying the Session and Connection Timer Settings (optional)

•Troubleshooting the Session and Connection Timer Settings (optional)

Configuring the Session Timer in a Service Policy Map

Perform this task to set the session timer in a service policy map.

SUMMARY STEPS

1. enable

2. configure terminal

3. policy-map type service policy-map-name

4. [priority] class type traffic class-map-name

5. timeout absolute duration-in-seconds

6. end

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

policy-map type service policy-map-name

Example:

Router(config)# policy-map type service policy1

Enters policy map configuration mode so you can begin configuring the service policy.

Step 4 

[priority] class type traffic class-map-name

Example:

Router(config-control-policymap)# class type traffic class1

Associates a previously configured traffic class with the policy map.

Step 5 

timeout absolute duration-in-seconds

Example:

Router(config-control-policymap-class-control)# timeout absolute 30

Specifies the session lifetime, in a range from 30 to 4294967 seconds.

Step 6 

end

Example:

Router(conf-subscriber-profile)# end

(Optional) Returns to privileged EXEC mode.

What to Do Next

You may want to configure a method of activating the service policy map or service profile; for example, control policies can be used to activate services. For more information about methods of service activation, see the module "Configuring ISG Subscriber Services."

Configuring the Session Timer on a AAA Server

Perform this task to set the session timer on a AAA server profile.

SUMMARY STEPS

1. Add the RADIUS Session-Timeout attribute to a user or service profile.

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

Session-Timeout=duration-in-seconds

Sets the IETF RADIUS session timer (attribute 27) in a user or service profile, in a range from 30 to 4294967 seconds.

Configuring the Connection Timer in a Service Policy Map

Perform this task to set the connection timer in a service policy map.

SUMMARY STEPS

1. enable

2. configure terminal

3. policy-map type service policy-map-name

4. [priority] class type traffic class-map-name

5. timeout idle duration-in-seconds

6. end

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

policy-map type service policy-map-name

Example:

Router(config)# policy-map type service policy1

Enters policy map configuration mode so you can begin configuring the service policy.

Step 4 

[priority] class type traffic class-map-name

Example:

Router(config-control-policymap)# class type traffic class1

Associates a previously configured traffic class to the policy map.

Step 5 

timeout idle duration-in-seconds

Example:

Router(config-control-policymap-class-control)# timeout idle 3000

Specifies how long a connection can be idle before it is terminated, in a range from 1 to 4294967 seconds.

Step 6 

end

Example:

Router(conf-subscriber-profile)# end

(Optional) Returns to privileged EXEC mode.

What to Do Next

You may want to configure a method of activating the service policy map or service profile; for example, control policies can be used to activate services. For more information about methods of service activation, see the module "Configuring ISG Subscriber Services."

Configuring the Connection Timer on a AAA Server

Perform this task to set the connection timer on a AAA server profile.

SUMMARY STEPS

1. Add the RADIUS Idle-Timeout attribute to a user or service profile.

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

Idle-Timeout=duration-in-seconds

Sets IETF RADIUS (attribute 28) in a user or service profile, in a range from 1 to 4294967 seconds.

Verifying the Session and Connection Timer Settings

Perform this task to verify that the timers have been installed correctly.

SUMMARY STEPS

1. enable

2. show subscriber session all

3. end

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

show subscriber session all

Example:

Router# show subscriber session all

Displays current subscriber information, including reports about the timers that are enabled.

Step 3 

end

Example:

Router# end

Exits privileged EXEC mode.

Troubleshooting the Session and Connection Timer Settings

The following sections list the debug commands that can be used to troubleshoot the session maintenance timers and describes the tasks you perform to enable them:

•Prerequisites for Troubleshooting the Session Maintenance Timers

•Restrictions for Troubleshooting the Session Maintenance Timers

•Debug Commands Available for the Session Maintenance Timers

•Enabling the Session Maintenance Timer Debug Commands

Prerequisites for Troubleshooting the Session Maintenance Timers

Before performing the task in this section, it is recommended that you be familiar with the use of Cisco IOS debug commands described in the introductory chapters of the Cisco IOS Debug Command Reference, Release 12.3T. Also see the module "Troubleshooting ISG with Session Monitoring and Distributed Conditional Debugging."

Restrictions for Troubleshooting the Session Maintenance Timers

Caution Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, use the Cisco IOS debug commands only to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network traffic and fewer users, or on a debug chassis with a single active session. Debugging during these periods decreases the likelihood that increased debug command processing overhead will affect system use.

Debug Commands Available for the Session Maintenance Timers

Table 17 lists the debug commands that can be used to diagnose problems with the session maintenance timers.

Table 17 Debug Commands for Troubleshooting Session Maintenance Timers

Command
Purpose

debug subscriber feature error

Displays general Feature Manager errors.

debug subscriber feature event

Displays general Feature Manager events.

debug subscriber feature name idle-timer error

Displays idle timer errors.

debug subscriber feature name idle-timer event

Displays idle timer events.

debug subscriber feature name session-timer error

Displays session timer errors.

debug subscriber feature name session-timer event

Displays session timer events.


Enabling the Session Maintenance Timer Debug Commands

Perform this task to enable the session maintenance timer debug commands.

SUMMARY STEPS

1. enable

2. debug command

3. end

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables higher privilege levels, such as privileged EXEC mode.

•Enter your password if prompted.

Step 2 

debug command

Example:

Router# debug subscriber feature name session-timer error

Enter one or more of the debug commands listed in Table 17.

•Enter the specific no debug command when you are finished.

Step 3 

end

Example:

Router# end

Exits privileged EXEC mode.

Configuration Examples for Session Maintenance Timers

This section contains the following examples:

•Session Timer Configuration in a Service Policy Map: Example

•Connection Idle Timer Configuration in a Service Policy Map: Example

•Session Timer Show Command Output: Example

•Connection Idle Timer Show Command Output: Example

•Session Timer Debug Output: Example

•Connection Idle Timer Debug Output: Example

Session Timer Configuration in a Service Policy Map: Example

The following example limits session time in a service policy map to 4800 seconds (80 minutes): 

class-map type traffic match-any traffic-class

 match access-group input 101

 match access-group output 102

policy-map type service video-service

 class traffic-class

  police input 20000 30000 60000

  police output 21000 31500 63000

  timeout absolute 4800

 class type traffic default

 drop

Connection Idle Timer Configuration in a Service Policy Map: Example

The following example limits idle connection time in a service policy map to 30 seconds: 

class-map type traffic match-any traffic-class

 match access-group input 101

 match access-group output 102

policy-map type service video-service

 class type traffic traffic-class

  police input 20000 30000 60000

  police output 21000 31500 63000

  timeout idle 30

 class type traffic default

 drop

Session Timer Show Command Output: Example

The following example shows the settings for the session timer displayed by the show subscriber session all privileged EXEC command. Reports of interest are highlighted in bold text. 

Current Subscriber Information: Total sessions 1

--------------------------------------------------

Unique Session ID: 3

Identifier: user01

SIP subscriber access type(s): PPPoE/PPP

Current SIP options: Req Fwding/Req Fwded

Session Up-time: 00:02:50, Last Changed: 00:02:53

AAA unique ID: 4

Interface: Virtual-Access2.1


Policy information:

  Context 02DE7380: Handle 1B000009

  Authentication status: authen

  User profile, excluding services:

    Framed-Protocol      1 [PPP]

    username             "user01"

    Framed-Protocol      1 [PPP]

    username             "user01"

  Prepaid context: not present



Non-datapath features:

 Feature: Session Timeout

  Timeout value is 180000 seconds

  Time remaining is 2d01h

Configuration sources associated with this session:

Interface: Virtual-Template1, Active Time = 00:02:52

Connection Idle Timer Show Command Output: Example

The following example shows the settings for the idle timer as displayed by the show subscriber session all privileged EXEC command. Reports of interest are highlighted in bold text. 

Current Subscriber Information: Total sessions 1

--------------------------------------------------

Unique Session ID: 4

Identifier: user01

SIP subscriber access type(s): PPPoE/PPP

Current SIP options: Req Fwding/Req Fwded

Session Up-time: 00:01:44, Last Changed: 00:01:46

AAA unique ID: 5

Interface: Virtual-Access2.1


Policy information:

  Context 02DE7380: Handle AD00000C

  Authentication status: authen

  User profile, excluding services:

    Framed-Protocol      1 [PPP]

    username             "user01"

    Framed-Protocol      1 [PPP]

    username             "user01"

  Prepaid context: not present



Session outbound features:

 Feature: PPP Idle Timeout

  Timeout value is 2000		

  Idle time is 00:01:44		

Configuration sources associated with this session:

Interface: Virtual-Template1, Active Time = 00:01:47

Session Timer Debug Output: Example

The following example shows output when the session timer debug commands (debug subscriber feature error, debug subscriber feature event, debug subscriber feature name session-timer error, and debug subscriber feature name session-timer event) are enabled. Reports of interest are highlighted in bold text. 

*Jan 12 18:38:51.947: SSF[Vi2.1/Abs Timeout]: Vaccess interface config

update; not per-user, ignore

*Jan 12 18:38:53.195: SSF[Vt1/uid:3]: Install interface configured

features

*Jan 12 18:38:53.195: SSF[Vt1/uid:3]: Associate segment element handle

0x95000002 for session 1191182344, 1 entries

*Jan 12 18:38:53.195: SSF[Vt1/uid:3/Abs Timeout]: Group feature install

*Jan 12 18:38:53.195: SSF[uid:3/Abs Timeout]: Adding feature to none segment(s)

Connection Idle Timer Debug Output: Example

The following example shows output when the idle timer debug commands (debug subscriber feature error, debug subscriber feature event, debug subscriber feature name idle-timer error, and debug subscriber feature name idle-timer event) are enabled. Reports of interest are highlighted in bold text. 

*Jan 12 18:43:15.167: SSF[Vt1/uid:4]: Install interface configured

features

*Jan 12 18:43:15.167: SSF[Vt1/uid:4]: Associate segment element handle

0xF4000003 for session 67108875, 1 entries

*Jan 12 18:43:15.167: SSF[Vt1/uid:4/Idle Timeout]: Group feature install

*Jan 12 18:43:15.167: SSF[uid:4/Idle Timeout]: Adding feature to outbound

segment(s)	

*Jan 12 18:43:15.167: Idle Timeout[uid:4]: Idle timer start, duration 2000

seconds, direction: outbound

*Jan 12 18:43:16.327: SSM FH: [SSS:PPPoE:8198:Idle Timeout:4097] created

02DFFDD8

*Jan 12 18:43:16.327: SSM FH: [SSS:PPPoE:8198:Idle Timeout:4097] added

02DFFDD8 [outbound]

*Jan 12 18:43:16.327: SSM FH: [SSS:PPPoE:8198:Idle Timeout:4097]

installed: ok

*Jan 12 18:43:16.327: SSM FH: [SSS:PPPoE:8198:Idle Timeout:4097]

installed: ok

*Jan 12 18:43:19.147: SSM FH: [SSS:PPPoE:8198:Idle Timeout:4097] bound

Additional References

The following sections provide references related to session maintenance timers.

Related Documents

Related Topic
Document Title

ISG commands

Cisco IOS Intelligent Service Gateway Command Reference

ppp timeout idle and timeout absolute PPP timer commands

Cisco IOS Dial Technologies Command Reference, Release 12.3T


Technical Assistance

Description
Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/public/support/tac/home.shtml


Feature Information for Configuring Policies for Session Maintenance

Table 18 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Release 12.2(28)SB or later releases appear in the table. If you are looking for information on a feature in this technology that is not documented here, see the "Intelligent Service Gateway Features Roadmap."

Not all commands may be available in your Cisco IOS software release. For details on when support for specific commands was introduced, see the command reference documents.

Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Note Table 18 list only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

Table 18 Feature Information for ISG Session Maintenance 

Feature Name
Releases
Feature Configuration Information

ISG: Session: Lifecycle: Idle Timeout

12.2(28)SB

The ISG idle timeout controls how long a connection can be idle before it is terminated.

The following sections provide information about this feature:

•Session Maintenance Timers

•How to Configure the Session Maintenance Timers


Copyright © 2006 Cisco Systems, Inc. All rights reserved.