Cisco IOS IP Mobility Configuration Guide, Release 12.4T
Mobile IP—Home Agent Accounting
Download this chapter
Mobile IP—Home Agent AccountingMobile IP—Home Agent Accounting
Download the complete book
Cisco IOS IP Mobility Configuration Guide, Release 12.4TCisco IOS IP Mobility Configuration Guide, Release 12.4T (PDF - 4 MB)
give_us_feedback

Table Of Contents

Mobile IP—Home Agent Accounting

Contents

Prerequisites for Mobile IP—Home Agent Accounting

Information About Mobile IP—Home Agent Accounting

Service Selection Gateway

Feature Design of Home Agent Accounting

Message Types

Message Formats

Benefits of Home Agent Accounting

How to Configure Mobile IP—Home Agent Accounting

Configuring AAA

Configuring RADIUS

Enabling Home Agent Accounting

Examples

Troubleshooting Tips

Configuration Examples for Mobile IP—Home Agent Accounting

Home Agent Accounting Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

Glossary


Mobile IP—Home Agent Accounting

In Cisco IOS Mobile IP, the home agent keeps track of the location of the mobile node as it roams away from its home network and forwards all traffic destined to the mobile node to its new location on the Internet. The Mobile IP—Home Agent Accounting feature allows the home agent to generate the following three new accounting messages that are forwarded to the authentication, authorization, and accounting (AAA) server or the Service Selection Gateway (SSG):

•Accounting Start

•Accounting Update

•Accounting Stop

The SSG can act as the proxy server for the AAA server and acknowledge the accounting messages sent by the home agent. The accounting records generated by the home agent can be stored on the AAA server and be used by Internet service providers (ISPs) for billing, capacity planning, and operations.

Feature Specifications for the Mobile IP—Home Agent Accounting Feature

Feature History
 
Release
Modification

12.2(15)T

This feature was introduced.

Supported Platforms

For platform supported in Cisco IOS Release 12.2(15)T consult Cisco Feature Navigator.


Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for Mobile IP—Home Agent Accounting

•Information About Mobile IP—Home Agent Accounting

•How to Configure Mobile IP—Home Agent Accounting

•Configuration Examples for Mobile IP—Home Agent Accounting

•Additional References

•Command Reference

•Glossary

Prerequisites for Mobile IP—Home Agent Accounting

Because home agent accounting generates messages for the AAA server, the network should have a reachable AAA server or SSG.

Information About Mobile IP—Home Agent Accounting

Before you configure Mobile IP—Home Agent Accounting, you should understand the following concepts:

•Service Selection Gateway

•Feature Design of Home Agent Accounting

•Benefits of Home Agent Accounting

Service Selection Gateway

The SSG is a switching solution for service providers that offer intranet, extranet, and Internet connections to subscribers using broadband access technology such as digital subscriber lines (DSL), cable modems, or wireless to allow simultaneous access to network services.

The SSG communicates with the AAA management network where RADIUS, Dynamic Host Configuration Protocol (DHCP), and Simple Network Management Protocol (SNMP) servers reside and with the ISP network, which may connect to the Internet, corporate networks, and value-added services.

SSG is designed and deployed such that all network traffic passes through it.

Feature Design of Home Agent Accounting

The SSG collects all the statistics information because all network traffic passes through it. However, it does not have the Mobile IP session information that the home agent maintains. The session information tracks how long a mobile node session lasts.

Note This feature was developed for the SSG to act as the proxy server for the AAA. However, this feature works equally well without the SSG and any standard AAA server can accept home agent accounting messages.

For each mobile node, the home agent sends this session information to the SSG in the form of messages, which are described in the following sections. The SSG forwards the messages to the AAA server as shown in Figure 1.

Figure 1 Topology for Home Agent Accounting with SSG and AAA Server

Message Types

The following messages are sent from the home agent to the SSG or AAA server:

Accounting Start

The home agent sends an Accounting Start message to the SSG/AAA when a mobile node successfully registers for the first time. This indicates the start of a new Mobile IP session for a mobile node.

In the case of a redundant home agent, a standby home agent will send an Accounting Start message only when it becomes active and does not have any bindings. This allows the SSG to maintain host objects for mobile nodes on the failed home agent.

Accounting Update

The home agent generates an Accounting Update message when the mobile node changes its point of attachment (POA) in the mobile network. For a Mobile IP session, this corresponds to a successful re-registration from a mobile node when it changes its care-of address (CoA). The CoA is the current location of the mobile node on the foreign network.

Accounting Stop

The home agent sends an Accounting Stop message to indicate that the Mobile IP session has ended. This occurs when the lifetime of the mobile node expires, when the mobile node sends a successful deregisration request, or when the home agent is unconfigured by a network administrator.

Message Formats

All the messages contain only the following information:

•Network access identifier (NAI). This field is the name of the mobile node. The NAI is a character string that can be a unique identifier (username@realm) or a group identifier (realm).

•Network access server (NAS) IP. This field is the IP address of the accounting node. The home agent is the accounting node, so this field contains the home agent address.

•Framed IP address. This field is the IP address of the mobile node. Typically, the home agent will allocate an IP address to a mobile node after successful registration.

•Point of attachment (POA). This field indicates the POA for the mobile node on the network. For a Mobile IP session, this is the care-of address of the mobile node.

The message format is shown in Table 1, including the RADIUS attribute number, which is transparent to the Mobile IP—Home Agent Accounting feature.

Table 1 Accounting Record Attributes  

RADIUS Attribute Number
Attribute
Description

1

NAI/User-Name

Mobile node user name.

4

NAS IP Address

Accounting node IP address

8

Framed IP Address

IP address of the mobile node.

66

Tunnel-Client-Endpoint

This attribute is used to indicate POA/CoA address, because there is no CoA attribute. This choice of attribute works because the Mobile IP tunnel terminates on the CoA/POA and qualifies as Tunnel-Client-Endpoint.

40, 2

Acct_status_type

Indicates the accounting Start/Stop/Update for the service.


Benefits of Home Agent Accounting

The Mobile IP—Home Agent Accounting feature allows ISPs to bill consumers based on the usage of the service. The accounting information is stored on a AAA server database and used by billing software to charge for service usage for each mobile node. The ISPs can use this accounting information for billing, capacity planning, and operations.

How to Configure Mobile IP—Home Agent Accounting

This section contains the following procedures:

•Configuring AAA (required)

•Configuring RADIUS (required)

•Enabling Home Agent Accounting (required)

Configuring AAA

Access control is the way you manage who has user access to the network server and what services the users are allowed to use. AAA network security services provide the primary framework through which you set up access control on your router or access server.

SUMMARY STEPS

1. enable

2. configure terminal

3. aaa new-model

4. aaa accounting network {default | list-name} start-stop group group-name

5. aaa accounting update newinfo

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables higher privilege levels, such as privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

aaa new-model

Example:

Router(config)# aaa new-model

Enables AAA access control.

Step 4 

aaa accounting network {default | list-name} start-stop group group-name

Example:

Router(config)# aaa accounting network mylist start-stop group radius

Enables AAA accounting of requested services for billing or security purposes.

•This command creates an accounting method list for network accounting and instructs the home agent to send network events for Mobile IP. The method list can be of any name or default.

•The start-stop keyword indicate that the home agent will send Start and Stop records to the SSG or AAA server.

Step 5 

aaa accounting update newinfo

Example:

Router(config)# aaa accounting update newinfo

Enables periodic interim accounting records to be sent to the accounting server.

•This command instructs the home agent to send an Accounting Update message to the SSG or AAA server when a mobile node changes its POA and acquires a new care-of address.


Configuring RADIUS

RADIUS is a method for defining the exchange of AAA information in the network. In the Cisco implementation, RADIUS clients run on Cisco routers and send authentication requests to a RADIUS server that contains all user authentication and network server access information.

SUMMARY STEPS

1. enable

2. configure terminal

3. radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number]

4. radius-server retransmit retries

5. radius-server key {0 string | 7 string | string}

6. radius-server attribute 44 include-in-access-req

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

radius-server host {hostname | ip-address} [auth-port port-number] [acct-port port-number]

Example:

Router(config)# radius-server host 128.107.162.173 auth-port 1645 acct-port 1646

Specifies a RADIUS server host.

Step 4 

radius-server retransmit retries

Example:

Router(config)# radius-server retransmit 3

Specifies the number of times the Cisco IOS software searches the list of RADIUS server hosts before giving up.

Step 5 

radius-server key {0 string | 7 string | string}

Example:

Router(config)# radius-server key cisco

Sets the authentication and encryption key for all RADIUS communications between the router and the RADIUS daemon.

Step 6 

radius-server attribute 44 include-in-access-req

Example:

Router(config)# radius-server attribute 44 include-in-access-req

(Optional) Sends RADIUS attribute 44 in access-request packets.


Enabling Home Agent Accounting

To enable home agent accounting, use the following commands:

SUMMARY STEPS

1. enable

2. configure terminal

3. ip mobile home-agent accounting {default | list-name}

4. ip mobile home-agent address address

5. ip mobile host {lower [upper] | nai string} {interface name}

6. ip mobile secure {host {lower-address [upper-address] | nai string} spi spi key hex string algorithm {md5 | hmac-md5} mode prefix-suffix

7. show ip mobile globals

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

ip mobile home-agent accounting {default | list-name}

Example:

Router(config)# ip mobile home-agent accounting mylist

Enables home agent accounting.

•Applies the method list defined in the aaa accounting command.

Step 4 

ip mobile home-agent address ip-address

Example:

Router(config)# ip mobile home-agent address 10.3.3.1

Enables and controls home agent services.

Step 5 

ip mobile host {lower [upper] | nai string} {interface name}

Example:

Router(config)# ip mobile host 10.3.3.2 10.3.3.5 interface ethernet2/2

Configures the mobile node or mobile host group.

Step 6 

ip mobile secure {host {lower-address [upper-address] | nai string} spi spi key hex string algorithm {md5 | hmac-md5} mode prefix-suffix

Example:

Router(config)# ip mobile secure host 10.3.3.2 spi 1000 key hex 123456781234567812345678123245678 algorithm md5 mode prefix-suffix

Specifies the mobility security associations for the mobile host.

Step 7 

end

Example:

Router(config)# end

Exits to privileged EXEC mode.

Step 8 

show ip mobile globals

Example: 
Router# show ip mobile globals

Displays global information for mobile agents.

•See the display output in the "Examples"section. Notice that the HA accounting field shows enabled status.

Examples

The following sample output shows the home agent accounting status: 

Router# show ip mobile globals


IP Mobility global information:


Home Agent


    Registration lifetime: INFINITE

    Broadcast enabled

    Replay protection time: 10 secs

    Reverse tunnel enabled

    ICMP Unreachable enabled

    Strip realm disabled

    NAT detect disabled

    HA Accounting enabled using method list: mylist

    Address 10.3.3.1


Foreign Agent is not enabled, no care-of address


Mobility Agent


1 interfaces providing service

Encapsulations supported: IPIP and GRE

Tunnel fast switching enabled

Discovered tunnel MTU aged out after 1:00:00

Troubleshooting Tips

In the event that home agent accounting is not operating correctly, use the following debug commands in privileged EXEC mode to determine where the problem may exist:

•debug aaa accounting

•debug radius

•debug ip mobile

See the Cisco IOS Debug Command Reference publication for information about these commands.

Configuration Examples for Mobile IP—Home Agent Accounting

This section provides the following configuration examples:

•Home Agent Accounting Example

Home Agent Accounting Example

In the following example, an accounting method list called mylist is created for network accounting. The accounting method list, mylist, is applied at the home agent, which enables home agent accounting. 

!

aaa new-model

!

!

aaa accounting mylist start-stop group radius

aaa accounting update newinfo

!

!

ip mobile home-agent accounting mylist address 10.3.3.1

ip mobile host 10.3.3.2 10.3.3.5 interface Ethernet2/2

ip mobile secure host 10.3.3.2 spi 1000 key hex 123456781234567812345678123245678 
algorithm md5 mode prefix-suffix

!

!

radius-server host 128.107.162.173 auth-port 1645 acct-port 1646

radius-server retransmit 3

radius-server key cisco

Additional References

For additional information related to Mobile IP—Home Agent Accounting feature, refer to the following references:

•Related Documents

•Standards

•MIBs

•RFCs

•Technical Assistance

Related Documents

Related Topic
Document Title

Mobile IP configuration tasks

"Configuring Mobile IP" chapter in the Cisco IOS IP Configuration Guide, Release 12.2

Mobile IP commands: complete command syntax, command mode, defaults, usage guidelines, and examples

"Mobile IP Commands" chapter in the Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2T

AAA configuration tasks

Cisco IOS Security Configuration Guide, Release 12.2

AAA commands: complete command syntax, command mode, defaults, usage guidelines, and examples

Cisco IOS Security Command Reference, Release 12.2T

RADIUS configuration tasks

Cisco IOS Security Configuration Guide, Release 12.2

RADIUS commands: complete command syntax, command mode, defaults, usage guidelines, and examples

Cisco IOS Security Command Reference, Release 12.2T

SSG configuration tasks and commands

"Service Selection Gateway" feature document, Release 12.2(8)T


Standards

Standards
Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

—


MIBs

MIBs
MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml


To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://tools.cisco.com/ITDIT/MIBS/servlet/index

If Cisco  MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco  MIBs page at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

http://www.cisco.com/register

RFCs

RFCs
Title

No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

—


Technical Assistance

Description
Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and lots more. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/public/support/tac/home.shtml


Command Reference

The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS IP Mobility Command Reference at http://www.cisco.com/en/US/docs/ios/ipmobility/command/reference/imo_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List.

•ip mobile home-agent accounting

•show ip mobile globals

Glossary

care-of address—The termination point of the tunnel to a mobile node or mobile router. This can be a collocated care-of address, by which the mobile node or mobile router acquires a local address and detunnels its own packets, or a foreign agent care-of address, by which a foreign agent detunnels packets and forwards them to the mobile node or mobile router. The care-of address is included in the Mobile IP registration request and is used by the home agent to forward packets to the mobile node in its current location.

foreign agent—A router on the visited network of a foreign network that provides routing services to the mobile node while registered. The foreign agent detunnels and delivers packets to the mobile node or mobile router that were tunneled by the home agent of the mobile node. For packets sent by a mobile node, the foreign agent may serve as a default router for registered mobile nodes.

home agent—A router on a home network of the mobile node or that tunnels packets to the mobile node or mobile router while they are away from home. It keeps current location information for registered mobile nodes called a mobility binding.

mobile node—A host or router that changes its point of attachment from one network or subnet to another. A mobile node may change its location without changing its IP address; it may continue to communicate with other Internet nodes at any location using its home IP address, assuming that link-layer connectivity to a point of attachment is available.

NAI—Network access identifier. The user ID submitted by the mobile node during registration to identify the user for authentication. The NAI may help route the registration request to the correct home agent.

Note Refer to the Internetworking Terms and Acronyms for terms not included in this glossary.


Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.