Table Of Contents
AAA High Availability Support for Local PPPoX Sessions
Prerequisites for AAA High Availability Support for Local PPPoX Sessions
Restrictions for AAA High Availability Support for Local PPPoX Sessions
Information About AAA High Availability Support for Local PPPoX Sessions
How to Configure AAA High Availability Support for Local PPPoX Sessions
How to Troubleshoot an AAA High Availability Configuration
Feature Information for AAA High Availability Support for Local PPPoX Sessions
AAA High Availability Support for Local PPPoX Sessions
First Published: November 20, 2006Last Updated: January 2, 2008This feature enhances the authentication, authorization, and accounting (AAA) capability to meet high availability (HA) criteria for locally terminated Point-to-Point Protocol over X (PPPoX) sessions, where X represents a transport technology, such as Ethernet or ATM.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all of the features documented in this module. For the latest feature information and caveats, see the release notes for your Cisco IOS software release. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for AAA High Availability Support for Local PPPoX Sessions" section.
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Prerequisites for AAA High Availability Support for Local PPPoX Sessions
•
•
•
•
Prerequisites for AAA High Availability Support for Local PPPoX Sessions
AAA HA support for local PPPoX sessions is available only on Cisco 10000 series routers running Cisco IOS Release 12.2(31)SB or later images that support broadband remote access servers (BRAS).
Restrictions for AAA High Availability Support for Local PPPoX Sessions
This implementation of AAA HA supports only locally terminated PPPoX sessions, including the following:
•
•
•
•
•
•
•
•
•
•
•
•
Note
The following Feature Manager features are supported in this implementation of AAA HA:
•
•
•
•
•
The following Feature Manager features are not supported in this implementation of AAA HA:
•
•
•
•
•
•
•
•
•
•
Information About AAA High Availability Support for Local PPPoX Sessions
You should understand the following concepts:
AAA HA Enhancement
The Cisco HA program aims to deliver carrier grade reliability with Cisco devices running Cisco IOS software. "Carrier grade" means that end users very seldom experience service disruption because of outages, service upgrades, or other maintenance activities on Cisco IOS platforms. To achieve this level of service, Cisco uses two route processors to manage and control the sessions and services for each device. One processor is active and the other is in standby mode, ready to provide backup. Because the focus of HA is on availability of service to the end user, a transition from the active processor to the standby processor must be transparent to the end user, but not necessarily to the service provider, to meet the criteria for carrier grade performance.
This enhancement is designed to make carrier grade AAA services available for locally terminated PPPoX sessions. To achieve HA support for AAA, the router must maintain the following information during transient component failures:
•
•
•
To maintain this information during transitions to the standby processor, Cisco IOS software uses an HA replay model to recreate as much state and database information as possible between the active and standby devices. The HA replay model works within existing external AAA server protocols to achieve the desired behavior.
HA and Authentication
For authentication, only the following state information has to be maintained: knowledge that a session authenticated on the active processor need not be reauthenticated on the standby processor. Each authentication protocol, such as local, TACACS+, or RADIUS, will respond in its protocol-specific way to an authentication request from a standby device. All AAA client authentication replies on a standby device should be successful.
Note
HA and Authorization
The HA process for authorization data is different from the authentication process. The AAA server caches the authorization responses for the sessions in order to provide the appropriate authorization attributes to the AAA clients during a session replay. The AAA clients use the authorization attributes to create a session copy on the standby route processor.
HA and Accounting
The AAA HA accounting framework takes advantage of existing AAA features such as system accounting and periodic accounting to limit the loss of accounting and billing information caused by a switchover between an active processor and a standby processor.
System Accounting
System accounting is a separate accounting capability that informs AAA servers about the state of a client device, such as a router. The AAA server receives a "System-Off" message when a controlled restart takes place on a client device. The message notifies the AAA server to clear any active sessions being managed for the specified client. When the client restarts and becomes available for new sessions, the AAA server receives a "System-On" message. The "System-On" message is also sent following uncontrolled restarts caused by device failures or other events that do not generate a "System-Off" message. In either case, the AAA server no longer maintains any active sessions for the specified client device. The server bills or accounts for the sessions prior to the "System-On" message and starts a new session.
AAA's accounting HA solution does not add any new requirements to system accounting for AAA servers. Any switchover will look like a very fast, minimally disruptive outage. Although end users do not experience any loss of service during an HA switchover, AAA servers reset their sessions and restart accounting for all switched-over sessions.
Periodic Accounting
You can use periodic accounting to dynamically update records of session utilization for billing purposes. Periodic accounting minimizes the loss of usage statistics. HA does not eliminate the need to configure periodic accounting on a device if you require dynamic usage statistics for billing purposes. To achieve the HA level of reliability, the existing network topology configuration must be maintained.
How to Configure AAA High Availability Support for Local PPPoX Sessions
There are no configuration tasks associated with this feature. On a Cisco 10000 series router, running Cisco IOS Release 12.2(31)SB or a later release, if you maintain your network topology for HA, then the AAA functions will automatically participate in the HA feature for locally terminated PPPoX sessions.
The following task provides information about troubleshooting AAA high availability:
•
How to Troubleshoot an AAA High Availability Configuration
You can use the debug aaa redundancy command to troubleshoot the AAA HA configuration. This command displays the AAA synchronization data for the session synchronization to the standby device. You can use the data to troubleshoot AAA issues related to the session synchronization.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Additional References
The following sections provide references related to the AAA HA Support for Local PPPoX Sessions feature.
Related Documents
Configuring AAA
Cisco IOS Security Configuration Guide, Part 1: "Authentication, Authorization, and Accounting (AAA)"
Configuring authentication
Cisco IOS Security Configuration Guide, Part 1: "Authentication, Authorization, and Accounting (AAA), Configuring Authentication"
Configuring authorization
Cisco IOS Security Configuration Guide, Part 1: "Authentication, Authorization, and Accounting (AAA), Configuring Authorization"
Configuring accounting
Cisco IOS Security Configuration Guide, Part 1: "Authentication, Authorization, and Accounting (AAA), Configuring Accounting"
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.
—
MIBs
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Command Reference
The following commands are introduced or modified in the feature documented in this module. For information about these commands, see the Cisco IOS High Availability Command Reference at http://www.cisco.com/en/US/docs/ios/ha/command/reference/ha_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List.
•
Feature Information for AAA High Availability Support for Local PPPoX Sessions
Table 1 lists the release history for this feature.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
CCDE, CCSI, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Stackpower, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0903R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2006-2009 Cisco Systems, Inc. All rights reserved.
Guest
