Configuring AAA for Cisco Voice Gateways, Release 12.4 - Examples [Cisco IOS Software Releases 12.4 Mainline]

Directing a AAA Request Based on Trunk Grouping

Directing a AAA Request Using an Account Number

Debit Card Application for Directing AAA Requests Using an Account Number

Directing AAA Traffic Using Called Number

Directing Accounting Templates Using Called Number

Examples

This chapter includes Cisco IOS configuration examples and application scenarios of p sending customized accounting templates to billing servers and directing AAA requests based on account number, called number, and trunk grouping.

This chapter includes the following examples:

•Directing a AAA Request Based on Trunk Grouping

•Directing a AAA Request Using an Account Number

•Directing AAA Traffic Using Called Number

•Directing Accounting Templates Using Called Number

Directing a AAA Request Based on Trunk Grouping

A Cisco IOS configuration example for directing a AAA request based on trunk grouping is shown below:

aaa new-model

aaa group server radius sg1

server 10.1.0.1 auth-port 1645 acct-port 1646

aaa group server radius sg2

server 10.20.0.1 auth-port 1645 acct-port 1646

aaa group server radius sg-def

server 10.0.50.50 auth-port 1645 acct-port 1646

aaa authentication login abc group sg1

aaa authentication login def group sg2

aaa authentication login h323 group sg-def

aaa authorization exec abc group sg1

aaa authorization exec def group sg2

aaa authorization exec h323 group sg-def

aaa accounting connection abc start-stop group sg1

aaa accounting connection def start-stop group sg2

aaa accounting connection h323 start-stop group sg-def

gw-accounting aaa

radius-server host 10.1.0.1 auth-port 1645 acct-port 1646 key abc

radius-server host 10.20.0.1 auth-port 1645 acct-port 1646 key ghi

radius-server host 10.0.50.50 auth-port 1645 acct-port 1646 key ghi

trunk group 101

interface Serial1/0/0:23

no ip address

no ip directed-broadcast

isdn switch-type primary-ni

isdn protocol-emulate network

isdn incoming-voice modem

no cdp enable

trunk-group 101

interface Serial1/0/1:23

no ip address

no ip directed-broadcast

isdn switch-type primary-ni

isdn protocol-emulate network

isdn incoming-voice modem

no cdp enable

trunk-group 101

voice-class aaa 1

authentication abc

authorization abc

accounting abc

voice-class aaa 1

authentication def

authorization def

accounting def

dial-peer voice 700 pots

destination-pabcern 1700.......

voice-class aaa 1

trunkgroup 101

dial-peer voice 900 pots

destination-pabcern 1900.......

voice-class aaa 2

trunkgroup 202

Directing a AAA Request Using an Account Number

In Figure 1, the caller places a call to MGCP 1 with a modified debit card application applied to an incoming POTS dial peer. After the caller enters the card number (for example, 5555550001), AAA requests are directed to RADIUS 4.

Figure 1 AAA Redirect Using An Account Number : Scenario 1

A Cisco IOS configuration example for the topology in Figure 1 is shown below:

Radius protocol debugging is on

Radius packet hex dump debugging is off

Radius packet protocol debugging is on

mgcp1#

02:27:24: %ISDN-6-CONNECT: Interface Serial3:22 is now connected to 4111234567

02:27:30: %ISDN-6-CONNECT: Interface Serial3:22 is now connected to 4111234567

02:27:44: RADIUS/ENCODE(00000024): Unsupported AAA abcribute timezone

02:27:44: RADIUS(00000024): Encoding nas-port...Only port-type avlbl

02:27:44: RADIUS(00000024): sending

02:27:44: RADIUS(00000024): Encoding nas-port...Only port-type avlbl

02:27:44: RADIUS/ENCODE(00000024): acct_session_id: 36

02:27:44: RADIUS(00000024): sending

02:27:44: RADIUS(00000024): Encoding nas-port...Only port-type avlbl

02:27:44: RADIUS/ENCODE(00000024): acct_session_id: 36

02:27:44: RADIUS(00000024): sending

02:27:44: RADIUS: Send to unknown id 10 10.5.20.60:1234, Accounting-Request, len 480 <-- 
Accounting request sent

02:27:44: RADIUS:  authenticator CD F1 66 D1 C1 CB A1 68 - B7 3F 5C 2B 21 D6 B7 4B         
to AAA server 4 instead

02:27:44: RADIUS:  User-Name           [1]   12  "4111234567"		             server 2.

02:27:44: RADIUS:  Acct-Status-Type    [40]  6   Start                     [1]

02:27:44: RADIUS:  Acct-Session-Id     [44]  10  "00000024"

02:27:44: RADIUS:  Vendor, Cisco       [26]  25

02:27:44: RADIUS:   h323-gw-id         [33]  19  "h323-gw-id=mgcp1."

02:27:44: RADIUS:  Vendor, Cisco       [26]  56

02:27:44: RADIUS:   Conf-Id            [24]  50  "h323-conf-id=2E17E6F2 8E6611D4 8048FAFD 
CD27A5B5"

02:27:44: RADIUS:  Vendor, Cisco       [26]  65

02:27:44: RADIUS:   Cisco AVpair       [1]   59  "h323-incoming-conf-id=2E17E6F2 8E6611D4 
8048FAFD CD27A5B5"

02:27:44: RADIUS:  Vendor, Cisco       [26]  38

02:27:44: RADIUS:   Cisco AVpair       [1]   32  "h323-ivr-out=account range: 55"

02:27:44: RADIUS:  Vendor, Cisco       [26]  33

02:27:44: RADIUS:   Cisco AVpair       [1]   27  "h323-ivr-out=color:violet"

02:27:44: RADIUS:  Vendor, Cisco       [26]  41

02:27:44: RADIUS:   Cisco AVpair       [1]   35  "h323-ivr-out=MethodName:sanjo_aaa4"

02:27:44: RADIUS:  Vendor, Cisco       [26]  38

02:27:44: RADIUS:   Cisco AVpair       [1]   32  "h323-ivr-out=account range: 55"

02:27:44: RADIUS:  Vendor, Cisco       [26]  33

02:27:44: RADIUS:   Cisco AVpair       [1]   27  "h323-ivr-out=color:red"

02:27:44: RADIUS:  Vendor, Cisco       [26]  41

02:27:44: RADIUS:   Cisco AVpair       [1]   35  "h323-ivr-out=MethodName:sanjo_aaa4"

02:27:44: RADIUS:  NAS-Port-Type       [61]  6   Async                     [0]

02:27:44: RADIUS:  Vendor, Cisco       [26]  19

02:27:44: RADIUS:   cisco-nas-port     [2]   13  "ISDN 0:D:23"

02:27:44: RADIUS:  Calling-Station-Id  [31]  12  "4111234567"

02:27:44: RADIUS:  Called-Station-Id   [30]  7   "13120"

02:27:44: RADIUS:  Service-Type        [6]   6   Login                     [1]

02:27:44: RADIUS:  NAS-IP-Address      [4]   6   10.6.20.500

02:27:44: RADIUS:  Delay-Time          [41]  6   0

02:27:44: RADIUS: Send to unknown id 20 10.6.20.60:1704, Access-Request, len 170 <-- 
Authentication request sent

02:27:44: RADIUS:  authenticator 12 F5 47 5D 2D 07 74 A4 - 97 02 33 36 14 34 DE 07	      to 
server specified in

02:27:44: RADIUS:  User-Name           [1]   8   "555555"		     application  and defined in

02:27:44: RADIUS:  User-Password       [2]   18  *		     CLI.  NOTE: authentication

02:27:44: RADIUS:  Vendor, Cisco       [26]  56   		     Is not used in standard debit app

02:27:44: RADIUS:   Conf-Id            [24]  50  "h323-conf-id=2E17E6F2 8E6611D4 8048FAFD 
CD27A5B5"

02:27:44: RADIUS:  Vendor, Cisco       [26]  37  		     but was included here to exercise

02:27:44: RADIUS:   Cisco AVpair       [1]   31  "h323-ivr-out=transactionID:20"	     AAA 
authentication tcl verb.

02:27:44: RADIUS:  NAS-Port-Type       [61]  6   Async                     [0]	     Also 
authentication

02:27:44: RADIUS:  Vendor, Cisco       [26]  19  		    done using account number

02:27:44: RADIUS:   cisco-nas-port     [2]   13  "ISDN 0:D:23"	 	     instead  of ANI.

02:27:44: RADIUS:  NAS-IP-Address      [4]   6   10.6.20.500

02:27:44: RADIUS: Send to unknown id 21 10.6.20.60:1704, Access-Request, len 200   <-- 
Authorization request

02:27:44: RADIUS:  authenticator CA 67 12 31 EE 78 19 F4 - 4E 4E 21 1B FB DB B2 06

02:27:44: RADIUS:  User-Name           [1]   8   "0555550"

02:27:44: RADIUS:  User-Password       [2]   18  *

02:27:44: RADIUS:  Vendor, Cisco       [26]  56

02:27:44: RADIUS:   Conf-Id            [24]  50  "h323-conf-id=2E17E6F2 8E6611D4 8048FAFD 
CD27A5B5"

02:27:44: RADIUS:  Vendor, Cisco       [26]  37

02:27:44: RADIUS:   Cisco AVpair       [1]   31  "h323-ivr-out=transactionID:21"

02:27:44: RADIUS:  Calling-Station-Id  [31]  12  "4111234567"

02:27:44: RADIUS:  NAS-Port-Type       [61]  6   Async                     [0]

02:27:44: RADIUS:  Vendor, Cisco       [26]  19

02:27:44: RADIUS:   cisco-nas-port     [2]   13  "ISDN 0:D:23"

02:27:44: RADIUS:  Calling-Station-Id  [31]  12  "4111234567"

02:27:44: RADIUS:  Service-Type        [6]   6   Login                     [1]

02:27:44: RADIUS:  NAS-IP-Address      [4]   6   10.6.20.500

02:27:44: RADIUS: Received from id 10 10.5.20.60:1234, Accounting-response, len 20     <-- 
AccountingResponse from 02:27:44: RADIUS:  authenticator E8 35 04 32 38 3E 78 78 - F1 D4 
38 10 41 F3 EE F3         Radius observed

02:27:44: RADIUS: Received from id 20 10.6.20.60:1704, Access-Accept, len 200               
<-- Response from Radius

02:27:44: RADIUS:  authenticator 46 30 66 55 18 DC 82 A0 - 05 14 ED D8 3B 17 0C E7

02:27:44: RADIUS:  Vendor, Cisco       [26]  27

02:27:44: RADIUS:   Cisco AVpair       [1]   21  "h323-ivr-in=sanjose"

02:27:44: RADIUS:  Vendor, Cisco       [26]  34

02:27:44: RADIUS:   Cisco AVpair       [1]   28  "h323-credit-amount=5555.55"

02:27:44: RADIUS:  Vendor, Cisco       [26]  26

02:27:44: RADIUS:   Cisco AVpair       [1]   20  "h323-return-code=0"

02:27:44: RADIUS:  Vendor, Cisco       [26]  30

02:27:44: RADIUS:   h323-credit-time   [102] 24  "h323-credit-time=54123"

02:27:44: RADIUS:  Vendor, Cisco       [26]  33

02:27:44: RADIUS:   h323-billing-model [109] 27  "h323-billing-model=prepay"

02:27:44: RADIUS:  Vendor, Cisco       [26]  24

02:27:44: RADIUS:   h323-currency      [110] 18  "h323-currency=US"

02:27:44: RADIUS:  Idle-Timeout        [28]  6   30

02:27:44: RADIUS: Received from id 24

02:27:44: RADIUS: Received from id 21 10.6.20.60:1704, Access-Accept, len 200

02:27:44: RADIUS:  authenticator 0F 13 36 EA B1 FC B3 95 - 85 FC CC FE 1F 2F 95 D0

02:27:44: RADIUS:  Vendor, Cisco       [26]  27

02:27:44: RADIUS:   Cisco AVpair       [1]   21  "h323-ivr-in=sanjose"

02:27:44: RADIUS:  Vendor, Cisco       [26]  34

02:27:44: RADIUS:   Cisco AVpair       [1]   28  "h323-credit-amount=5555.55"

02:27:44: RADIUS:  Vendor, Cisco       [26]  26

02:27:44: RADIUS:   Cisco AVpair       [1]   20  "h323-return-code=0"

02:27:44: RADIUS:  Vendor, Cisco       [26]  30

02:27:44: RADIUS:   h323-credit-time   [102] 24  "h323-credit-time=54123"

02:27:44: RADIUS:  Vendor, Cisco       [26]  33

02:27:44: RADIUS:   h323-billing-model [109] 27  "h323-billing-model=prepay"

02:27:44: RADIUS:  Vendor, Cisco       [26]  24

02:27:44: RADIUS:   h323-currency      [110] 18  "h323-currency=US"

02:27:44: RADIUS:  Idle-Timeout        [28]  6   30

02:27:44: RADIUS: Received from id 24

In Figure 2, the caller places a call to MGCP 1 with a modified debit card application applied to an incoming POTS dial peer. After the caller enters the card number ( for example, 7777770001), the AAA requests are directed to RADIUS server 1.

Figure 2 AAA Redirect Using An Account Number: Scenario 2

Shown below are some Cisco IOS configuration examples for the topology in Figure 2:

version 12.2

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

hostname mgcp1

aaa new-model

aaa group server radius sg1

 server 10.6.20.60 auth-port 1698 acct-port 1699

aaa group server radius sg4

 server 10.6.20.60 auth-port 1704 acct-port 1705

aaa group server radius sg6

 server 10.6.20.60 auth-port 1708 acct-port 1709

aaa authentication login sanjo_aaa1 group sg1

aaa authentication login sanjo_aaa4 group sg4

aaa authentication login sanjo_aaa6 group sg6

aaa authorization exec sanjo_aaa1 group sg1

aaa authorization exec sanjo_aaa4 group sg4

aaa authorization exec sanjo_aaa6 group sg6

aaa accounting connection sanjo_aaa1 start-stop group sg1

aaa accounting connection sanjo_aaa4 start-stop group sg4

aaa accounting connection sanjo_aaa6 start-stop group sg6

aaa session-id common

resource-pool disable

ip subnet-zero

ip host milp 10.223.254.255

isdn switch-type primary-5ess

fax interface-type modem

mta receive maximum-recipients 0

controller T1 3

 framing esf

 clock source line secondary

 linecode b8zs

 pri-group timeslots 1-24

gw-accounting aaa

interface Ethernet0

 ip address 10.0.254.255

 no ip redirects

 no ip mroute-cache

 no cdp enable

interface Serial0:23

 no ip address

 isdn switch-type primary-5ess

 isdn T321 0

 isdn T310 4000

 no cdp enable

interface Serial3:23

 no ip address

 trunk-group 1

 isdn switch-type primary-5ess

 isdn incoming-voice modem

 isdn T321 0

 no cdp enable

interface FastEthernet0

 ip address 10.1.2.3  254.254.255.0

 duplex auto

 speed auto

ip classless

ip route 254.255.1.0  223.254.10.0.1.5.0.1 <- Route to tftp server

no ip http server		              10.223.254.255

radius-server host 10.6.20.60 auth-port 1704 acct-port 1705

radius-server host 10.6.20.60 auth-port 1698 acct-port 1699

radius-server retransmit 3

radius-server key cisco

radius-server vsa send accounting

radius-server vsa send authentication

call rsvp-sync

call accounting-template voice cdr1 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr1.cdr

call accounting-template voice cdr2 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr2.cdr

call language voice en tftp://milp/doe/scripts/multi-lang/en_translate.tcl

call application voice integ_debit 
tftp://10.223.254.255/johndoe/sanjose/apps/debitcard_int_redirect.tcl

call application voice integ_debit uid-len 6

call application voice integ_debit language 1 en

call application voice integ_debit language 2 sp

call application voice integ_debit set-location en 0 
tftp://10.223.254.255/johndoe/prompts/en/

call application voice integ_debit set-location sp 0 tftp://10.6.20.50/prompts/

call application voice plain_debit 
tftp://10.223.254.255/johndoe/sanjose/apps/debitcard.tcl

call application voice plain_debit uid-len 6

call application voice plain_debit language 1 en

call application voice plain_debit language 2 sp

call application voice plain_debit set-location en 0 
tftp://10.223.254.255/johndoe/prompts/en/

call application voice plain_debit set-location sp 0 tftp://10.6.20.50/prompts/

voice-port 3:D

voice-port 0:D

dial-peer cor custom

dial-peer voice 100 pots

 application integ_debit <-----------  !Modified debit app to play

 incoming called-number 13120           new dynamic prompts, do

dial-peer voice 101 voip                authentication,

 destination-pabcern 510.......             authorization,

 session target ipv4:10.0.0.1           accounting redirect

!                                       and use accounting

dial-peer voice 102 voip                template.

 destination-pabcern 408.......

 session target ipv4:10.0.0.1

line con 0

 exec-timeout 0 0

line aux 0

line vty 0 4

end

Debit Card Application for Directing AAA Requests Using an Account Number

A debit card application for directing AAA requests using an account number is shown below:

proc act_GotCardNumber { } {

    global count

    global retryCnt

    global promptFlag

    global account

    global pin

    global accountLen

    global cardLen

    global pinLen

    global ani

    global method

    global acct-template

    set status [infotag get evt_status]

    # Do we need to calculate len ???

    if {$status == "cd_005"} {

	set number [infotag get evt_dcdigits]

	set numberLen [ string length $number ]

	if { $numberLen == $cardLen } {

            set account [ string range $number 0 [expr $accountLen -1]]

            set pin [ string range $number $accountLen [expr $cardLen -1]]

	    ######################################

	    # Select Servertag based on first 2  #

	    # digits of account number.          #

	    ######################################

	    set spcode [ string range $account 0 1]

	    if { $spcode == 77 } {

	    	set method "sanjo_aaa1"

	    	set avList(h323-ivr-out,1) "account range: 77"

	    	set avList(h323-ivr-out,2) "color:violet"

	    	set avList(h323-ivr-out,3) "MethodName:sanjo_aaa1"

	    	puts "note that accounting template cdr1 needs to be defined in IOS CLI"

		set acct-template "cdr1"

puts "$spcode"

	    	set method "sanjo_aaa4"

	    	set avList(h323-ivr-out,1) "account range: 55"

	    	set avList(h323-ivr-out,2) "color:red"

	    	set avList(h323-ivr-out,3) "MethodName:sanjo_aaa4"

 		set acct-template "cdr2"

	    } else {

	       	set method "h323"

		set acct-template "none"

	    puts "THIS IS THE METHOD LIST USED: $method \r"

 	    puts "THIS IS THE TEMPLATE USED   : $template \r"

	    #Do accounting

	    if { $method != "h323" } {

            	aaa accounting start leg_incoming -a avList -s $method -t $template

	    	set avList(h323-ivr-out,2) "color:purple"

	    	aaa accounting update leg_incoming -a avList -s $method -t $template

	        # supppress service provide module automatically generating

	        # accounting records on outgoing call leg

	        infotag set leg_suppress_outgoing_auto_acct 1

		#Do authenticate

	        puts "\r DOING AUTHENTICATION on account number and pin \r"

	        aaa authenticate $account $pin -s $method

		puts "\r DOING AUTHORIZATION \r"

		# DO authorize

	        aaa authorize $account $pin $ani "" leg_incoming -s $method

	    } else {

	        aaa accounting start leg_incoming -a avList -s $method

                set avList(h323-ivr-out,2) "color:indigo"

                aaa accounting update leg_incoming -a avList -s $method

                # supppress service provide module automatically generating

                # accounting records on outgoing call leg

                infotag set leg_suppress_outgoing_auto_acct 1

infotag set leg_suppress_outgoing_auto_acct 1

		#Do authenticate

	        puts "\r DOING AUTHENTICATION on account number and pin \r"

	        aaa authenticate $account $pin -s $method

		puts "\r DOING AUTHORIZATION \r"

		# DO authorize

	        aaa authorize $account $pin $ani "" leg_incoming -s $method

	    } else {

	        aaa accounting start leg_incoming -a avList -s $method

                set avList(h323-ivr-out,2) "color:indigo"

                aaa accounting update leg_incoming -a avList -s $method

                # supppress service provide module automatically generating

                # accounting records on outgoing call leg

                infotag set leg_suppress_outgoing_auto_acct 1

		#Do authenticate for using default h323 method list

                puts "\r DOING AUTHENTICATION \r"

                aaa authenticate $account $pin -s $method

                puts "\r DOING AUTHORIZATION \r"

                 aaa authorize $account $pin $ani "" leg_incoming -s $method

Directing AAA Traffic Using Called Number

In Figure 3, the caller places a phone call to MGCP 1. A modified debit card application is applied to an incoming POTS dial peer. The caller enters the card number and the destination number sequence which is completed at MGCP 1. The destination number (for example 408-428-xxxx) is now dialed and directed to MGCP 2. Accounting information based on the called number is directed from MGCP 2 to RADIUS server 5.

Figure 3 Directing AAA Traffic Using Called Number

An example of a AAA redirect using the called number is shown below:

version 12.2

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

hostname mgcp2

aaa new-model

aaa group server radius sg2

 server 10.6.20.60 auth-port 1700 acct-port 1701

aaa group server radius sg5

 server 10.6.20.60 auth-port 1706 acct-port 1707

aaa group server radius sg6

 server 10.6.20.60 auth-port 1708 acct-port 1709

aaa accounting connection sanjo_aaa5 start-stop group sg5

aaa accounting connection sanjo_aaa2 start-stop group sg2

aaa session-id common

username lab password 0 lab

resource-pool disable

ip subnet-zero

isdn switch-type primary-5ess

voice class aaa 2

 accounting method sanjo_aaa2

voice class aaa 5

 accounting method sanjo_aaa5

fax interface-type modem

mta receive maximum-recipients 0

controller T1 0

 framing sf

 clock source line primary

 linecode ami

controller T1 1

 framing sf

 clock source line secondary 1

 linecode ami

controller T1 2

 framing sf

 linecode ami

controller T1 3

 framing esf

 linecode b8zs

 pri-group timeslots 1-24

gw-accounting aaa

interface Ethernet0

 ip address 10.6.20.501 254.255.1.0

 no cdp enable

interface Serial3:23

 no ip address

 isdn switch-type primary-5ess

 isdn incoming-voice modem

 no cdp enable

interface FastEthernet0

 ip address 10.0.0.1 255.255.255.0

 duplex auto

 speed auto

ip classless

ip route 254.255.1.0  223.254.10.0.1.5.0.1

no ip http server

radius-server host 10.6.20.60 auth-port 1700 acct-port 1701 key cisco

radius-server host 10.6.20.60 auth-port 1706 acct-port 1707 key cisco

radius-server retransmit 3

radius-server key cisco

radius-server vsa send accounting

radius-server vsa send authentication

voice-port 3:D

mgcp profile default

On the terminating side, the incoming dial peers are VoIP. In this configuration, if the incoming called number begins with 510, VoIP dial peer 101 is applied. If the incoming called number begins with 408, VoIP dial peer 102 is applied.

dial-peer voice 100 pots

 destination-pabcern 510 ......

 port 3:D

 prefix 91510 .......

dial-peer voice 101 voip

 incoming called-number 510 .......

 voice-class aaa 5

dial-peer voice 200 pots

 destination-pabcern 408......

 port 3:D

 prefix 9

dial-peer voice 102 voip

 incoming called-number 408.......

 voice-class aaa 2

dial-peer voice 300 pots

 application integ_debit

 incoming called-number .

 port 3:D

line con 0

 exec-timeout 0 0

line aux 0

line vty 0 4

end

Directing Accounting Templates Using Called Number

In Figure 4 below, accounting template cdr1 allows h323-gw-id av pair but does not allow h323-call-origin. Accounting template cdr2 allows h323-call-origin but does not allow h323-gw-id av pair. The caller places a phone call to MGCP 1. A modified debit card application is applied to an incoming POTS dial peer.

Accounting template cdr1 is selected using an account number ( for example 7777770001). To verify that cdr1 was applied correctly, examine the accounting record on RADIUS server 1.

Accounting template cdr2 is selected using an account number ( for example 5555550001). To verify that cdr2 was applied correctly, examine the accounting record on RADIUS server 2.

Figure 4 Selecting Accounting Templates Using an Account Number

Shown below is an example of directing an accounting template using an incoming called number:

version 12.2

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

hostname mgcp1

aaa new-model

aaa group server radius sg1

 server 10.6.20.60 auth-port 1698 acct-port 1699

aaa group server radius sg4

 server 10.6.20.60 auth-port 1704 acct-port 1705

aaa group server radius sg6

 server 10.6.20.60 auth-port 1708 acct-port 1709

aaa authentication login sanjo_aaa1 group sg1

aaa authentication login sanjo_aaa4 group sg4

aaa authentication login sanjo_aaa6 group sg6

aaa authorization exec sanjo_aaa1 group sg1

aaa authorization exec sanjo_aaa4 group sg4

aaa authorization exec sanjo_aaa6 group sg6

aaa accounting connection sanjo_aaa1 start-stop group sg1

aaa accounting connection sanjo_aaa4 start-stop group sg4

aaa accounting connection sanjo_aaa6 start-stop group sg6

aaa session-id common

resource-pool disable

ip subnet-zero

ip host milp 10.223.254.255

trunk group  1

 carrier-id test

 hunt-scheme least-used both

isdn switch-type primary-5ess

voice class aaa 1

voice class aaa 6

 authentication method sanjo_aaa6

 authorization method sanjo_aaa6

 accounting method sanjo_aaa6

fax interface-type modem

mta receive maximum-recipients 0

controller T1 0

 framing sf

 linecode ami

controller T1 1

 framing sf

 clock source line secondary 1

 linecode ami

controller T1 2

 framing sf

 linecode ami

controller T1 3

 framing esf

 clock source line primary

 linecode b8zs

 pri-group timeslots 1-24

gw-accounting aaa

interface Ethernet0

 ip address 10.0.254.255

 no ip redirects

 no ip mroute-cache

 no cdp enable

interface Serial3:23

 no ip address

 trunk-group 1

 isdn switch-type primary-5ess

 isdn incoming-voice modem

 isdn T321 0

 no cdp enable

interface FastEthernet0

 ip address 10.1.2.3  254.254.255.0

 duplex auto

 speed auto

ip classless

ip route 254.255.1.0  223.254.10.0.1.5.0.1

no ip http server

radius-server host 10.6.20.60 auth-port 1708 acct-port 1709

radius-server host 10.6.20.60 auth-port 1704 acct-port 1705

radius-server host 10.6.20.60 auth-port 1698 acct-port 1699

radius-server host 10.6.43.255 auth-port 1645 acct-port 1646

radius-server host 10.6.37.10 auth-port 1645 acct-port 1646

radius-server retransmit 3

radius-server key cisco

radius-server vsa send accounting

radius-server vsa send authentication

call rsvp-sync

call accounting-template voice cdr1 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr1.cdr

call accounting-template voice cdr2 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr2.cdr

call language voice en tftp://milp/doe/scripts/multi-lang/en_translate.tcl

call application voice acct_redirect_debit 
tftp://10.6.20.50/sanjose/apps/debitcard_acct_redirect.tcl

call application voice acct_redirect_debit uid-len 6

call application voice acct_redirect_debit language 1 en

call application voice acct_redirect_debit language 2 sp

call application voice acct_redirect_debit set-location en 0 tftp://10.6.20.50/prompts/

call application voice acct_redirect_debit set-location sp 0 tftp://10.6.20.50/prompts/

call application voice integ_debit 
tftp://10.223.254.255/johndoe/sanjose/apps/debitcard_int_redirect.tcl

call application voice integ_debit uid-len 6

call application voice integ_debit language 1 en

call application voice integ_debit language 2 sp

call application voice integ_debit set-location en 0 
tftp://10.223.254.255/johndoe/prompts/en/

call application voice integ_debit set-location sp 0 tftp://10.6.20.50/prompts/

call application voice plain_debit 
tftp://10.223.254.255/johndoe/sanjose/apps/debitcard.tcl

call application voice plain_debit uid-len 6

call application voice plain_debit language 1 en

call application voice plain_debit language 2 sp

call application voice plain_debit set-location en 0 
tftp://10.223.254.255/johndoe/prompts/en/

call application voice plain_debit set-location sp 0 tftp://10.6.20.50/prompts/

voice-port 3:D

mgcp profile default

dial-peer cor custom

dial-peer voice 100 pots

 debitcard_acct_redirect.tcl

 incoming called-number .

dial-peer voice 101 voip

 destination-pattern 1111234567

 session target ipv4:10.0.0.1

dial-peer voice 102 voip

 destination-pattern 408.......

 session target ipv4:10.0.0.1

line con 0

 exec-timeout 0 0

line aux 0

line vty 0 4

end

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

© 2007-2009 Cisco Systems, Inc. All rights reserved.

	Configuring AAA for Cisco Voice Gateways, Release 12.4
	Examples
Configuring AAA for Cisco Voice Gateways, Release 12.4 Overview of AAA on Voice Gateways Cisco IOS Configuration Examples Cisco IOS Troubleshooting ASCII Table Glossary	Download this chapter Examples Download the complete book Configuring AAA for Cisco Voice Gateways, Release 12.4 (PDF - 460 KB) Table Of Contents Examples Directing a AAA Request Based on Trunk Grouping Directing a AAA Request Using an Account Number Debit Card Application for Directing AAA Requests Using an Account Number Directing AAA Traffic Using Called Number Directing Accounting Templates Using Called Number Examples This chapter includes Cisco IOS configuration examples and application scenarios of p sending customized accounting templates to billing servers and directing AAA requests based on account number, called number, and trunk grouping. This chapter includes the following examples: •Directing a AAA Request Based on Trunk Grouping •Directing a AAA Request Using an Account Number •Directing AAA Traffic Using Called Number •Directing Accounting Templates Using Called Number Directing a AAA Request Based on Trunk Grouping A Cisco IOS configuration example for directing a AAA request based on trunk grouping is shown below: aaa new-model aaa group server radius sg1 server 10.1.0.1 auth-port 1645 acct-port 1646 ! aaa group server radius sg2 server 10.20.0.1 auth-port 1645 acct-port 1646 ! aaa group server radius sg-def server 10.0.50.50 auth-port 1645 acct-port 1646 ! aaa authentication login abc group sg1 aaa authentication login def group sg2 aaa authentication login h323 group sg-def aaa authorization exec abc group sg1 aaa authorization exec def group sg2 aaa authorization exec h323 group sg-def aaa accounting connection abc start-stop group sg1 aaa accounting connection def start-stop group sg2 aaa accounting connection h323 start-stop group sg-def ! gw-accounting aaa ! radius-server host 10.1.0.1 auth-port 1645 acct-port 1646 key abc radius-server host 10.20.0.1 auth-port 1645 acct-port 1646 key ghi radius-server host 10.0.50.50 auth-port 1645 acct-port 1646 key ghi ! trunk group 101 ! interface Serial1/0/0:23 no ip address no ip directed-broadcast isdn switch-type primary-ni isdn protocol-emulate network isdn incoming-voice modem no cdp enable trunk-group 101 ! interface Serial1/0/1:23 no ip address no ip directed-broadcast isdn switch-type primary-ni isdn protocol-emulate network isdn incoming-voice modem no cdp enable trunk-group 101 ! voice-class aaa 1 authentication abc authorization abc accounting abc ! voice-class aaa 1 authentication def authorization def accounting def ! dial-peer voice 700 pots destination-pabcern 1700....... voice-class aaa 1 trunkgroup 101 ! dial-peer voice 900 pots destination-pabcern 1900....... voice-class aaa 2 trunkgroup 202 ! Directing a AAA Request Using an Account Number In Figure 1, the caller places a call to MGCP 1 with a modified debit card application applied to an incoming POTS dial peer. After the caller enters the card number (for example, 5555550001), AAA requests are directed to RADIUS 4. Figure 1 AAA Redirect Using An Account Number : Scenario 1 A Cisco IOS configuration example for the topology in Figure 1 is shown below: Radius protocol debugging is on Radius packet hex dump debugging is off Radius packet protocol debugging is on mgcp1# 02:27:24: %ISDN-6-CONNECT: Interface Serial3:22 is now connected to 4111234567 02:27:30: %ISDN-6-CONNECT: Interface Serial3:22 is now connected to 4111234567 02:27:44: RADIUS/ENCODE(00000024): Unsupported AAA abcribute timezone 02:27:44: RADIUS(00000024): Encoding nas-port...Only port-type avlbl 02:27:44: RADIUS(00000024): sending 02:27:44: RADIUS(00000024): Encoding nas-port...Only port-type avlbl 02:27:44: RADIUS/ENCODE(00000024): acct_session_id: 36 02:27:44: RADIUS(00000024): sending 02:27:44: RADIUS(00000024): Encoding nas-port...Only port-type avlbl 02:27:44: RADIUS/ENCODE(00000024): acct_session_id: 36 02:27:44: RADIUS(00000024): sending 02:27:44: RADIUS: Send to unknown id 10 10.5.20.60:1234, Accounting-Request, len 480 <-- Accounting request sent 02:27:44: RADIUS: authenticator CD F1 66 D1 C1 CB A1 68 - B7 3F 5C 2B 21 D6 B7 4B to AAA server 4 instead 02:27:44: RADIUS: User-Name [1] 12 "4111234567" server 2. 02:27:44: RADIUS: Acct-Status-Type [40] 6 Start [1] 02:27:44: RADIUS: Acct-Session-Id [44] 10 "00000024" 02:27:44: RADIUS: Vendor, Cisco [26] 25 02:27:44: RADIUS: h323-gw-id [33] 19 "h323-gw-id=mgcp1." 02:27:44: RADIUS: Vendor, Cisco [26] 56 02:27:44: RADIUS: Conf-Id [24] 50 "h323-conf-id=2E17E6F2 8E6611D4 8048FAFD CD27A5B5" 02:27:44: RADIUS: Vendor, Cisco [26] 65 02:27:44: RADIUS: Cisco AVpair [1] 59 "h323-incoming-conf-id=2E17E6F2 8E6611D4 8048FAFD CD27A5B5" 02:27:44: RADIUS: Vendor, Cisco [26] 38 02:27:44: RADIUS: Cisco AVpair [1] 32 "h323-ivr-out=account range: 55" 02:27:44: RADIUS: Vendor, Cisco [26] 33 02:27:44: RADIUS: Cisco AVpair [1] 27 "h323-ivr-out=color:violet" 02:27:44: RADIUS: Vendor, Cisco [26] 41 02:27:44: RADIUS: Cisco AVpair [1] 35 "h323-ivr-out=MethodName:sanjo_aaa4" 02:27:44: RADIUS: Vendor, Cisco [26] 38 02:27:44: RADIUS: Cisco AVpair [1] 32 "h323-ivr-out=account range: 55" 02:27:44: RADIUS: Vendor, Cisco [26] 33 02:27:44: RADIUS: Cisco AVpair [1] 27 "h323-ivr-out=color:red" 02:27:44: RADIUS: Vendor, Cisco [26] 41 02:27:44: RADIUS: Cisco AVpair [1] 35 "h323-ivr-out=MethodName:sanjo_aaa4" 02:27:44: RADIUS: NAS-Port-Type [61] 6 Async [0] 02:27:44: RADIUS: Vendor, Cisco [26] 19 02:27:44: RADIUS: cisco-nas-port [2] 13 "ISDN 0:D:23" 02:27:44: RADIUS: Calling-Station-Id [31] 12 "4111234567" 02:27:44: RADIUS: Called-Station-Id [30] 7 "13120" 02:27:44: RADIUS: Service-Type [6] 6 Login [1] 02:27:44: RADIUS: NAS-IP-Address [4] 6 10.6.20.500 02:27:44: RADIUS: Delay-Time [41] 6 0 02:27:44: RADIUS: Send to unknown id 20 10.6.20.60:1704, Access-Request, len 170 <-- Authentication request sent 02:27:44: RADIUS: authenticator 12 F5 47 5D 2D 07 74 A4 - 97 02 33 36 14 34 DE 07 to server specified in 02:27:44: RADIUS: User-Name [1] 8 "555555" application and defined in 02:27:44: RADIUS: User-Password [2] 18 * CLI. NOTE: authentication 02:27:44: RADIUS: Vendor, Cisco [26] 56 Is not used in standard debit app 02:27:44: RADIUS: Conf-Id [24] 50 "h323-conf-id=2E17E6F2 8E6611D4 8048FAFD CD27A5B5" 02:27:44: RADIUS: Vendor, Cisco [26] 37 but was included here to exercise 02:27:44: RADIUS: Cisco AVpair [1] 31 "h323-ivr-out=transactionID:20" AAA authentication tcl verb. 02:27:44: RADIUS: NAS-Port-Type [61] 6 Async [0] Also authentication 02:27:44: RADIUS: Vendor, Cisco [26] 19 done using account number 02:27:44: RADIUS: cisco-nas-port [2] 13 "ISDN 0:D:23" instead of ANI. 02:27:44: RADIUS: NAS-IP-Address [4] 6 10.6.20.500 02:27:44: RADIUS: Send to unknown id 21 10.6.20.60:1704, Access-Request, len 200 <-- Authorization request 02:27:44: RADIUS: authenticator CA 67 12 31 EE 78 19 F4 - 4E 4E 21 1B FB DB B2 06 02:27:44: RADIUS: User-Name [1] 8 "0555550" 02:27:44: RADIUS: User-Password [2] 18 * 02:27:44: RADIUS: Vendor, Cisco [26] 56 02:27:44: RADIUS: Conf-Id [24] 50 "h323-conf-id=2E17E6F2 8E6611D4 8048FAFD CD27A5B5" 02:27:44: RADIUS: Vendor, Cisco [26] 37 02:27:44: RADIUS: Cisco AVpair [1] 31 "h323-ivr-out=transactionID:21" 02:27:44: RADIUS: Calling-Station-Id [31] 12 "4111234567" 02:27:44: RADIUS: NAS-Port-Type [61] 6 Async [0] 02:27:44: RADIUS: Vendor, Cisco [26] 19 02:27:44: RADIUS: cisco-nas-port [2] 13 "ISDN 0:D:23" 02:27:44: RADIUS: Calling-Station-Id [31] 12 "4111234567" 02:27:44: RADIUS: Service-Type [6] 6 Login [1] 02:27:44: RADIUS: NAS-IP-Address [4] 6 10.6.20.500 02:27:44: RADIUS: Received from id 10 10.5.20.60:1234, Accounting-response, len 20 <-- AccountingResponse from 02:27:44: RADIUS: authenticator E8 35 04 32 38 3E 78 78 - F1 D4 38 10 41 F3 EE F3 Radius observed 02:27:44: RADIUS: Received from id 20 10.6.20.60:1704, Access-Accept, len 200 <-- Response from Radius 02:27:44: RADIUS: authenticator 46 30 66 55 18 DC 82 A0 - 05 14 ED D8 3B 17 0C E7 02:27:44: RADIUS: Vendor, Cisco [26] 27 02:27:44: RADIUS: Cisco AVpair [1] 21 "h323-ivr-in=sanjose" 02:27:44: RADIUS: Vendor, Cisco [26] 34 02:27:44: RADIUS: Cisco AVpair [1] 28 "h323-credit-amount=5555.55" 02:27:44: RADIUS: Vendor, Cisco [26] 26 02:27:44: RADIUS: Cisco AVpair [1] 20 "h323-return-code=0" 02:27:44: RADIUS: Vendor, Cisco [26] 30 02:27:44: RADIUS: h323-credit-time [102] 24 "h323-credit-time=54123" 02:27:44: RADIUS: Vendor, Cisco [26] 33 02:27:44: RADIUS: h323-billing-model [109] 27 "h323-billing-model=prepay" 02:27:44: RADIUS: Vendor, Cisco [26] 24 02:27:44: RADIUS: h323-currency [110] 18 "h323-currency=US" 02:27:44: RADIUS: Idle-Timeout [28] 6 30 02:27:44: RADIUS: Received from id 24 02:27:44: RADIUS: Received from id 21 10.6.20.60:1704, Access-Accept, len 200 02:27:44: RADIUS: authenticator 0F 13 36 EA B1 FC B3 95 - 85 FC CC FE 1F 2F 95 D0 02:27:44: RADIUS: Vendor, Cisco [26] 27 02:27:44: RADIUS: Cisco AVpair [1] 21 "h323-ivr-in=sanjose" 02:27:44: RADIUS: Vendor, Cisco [26] 34 02:27:44: RADIUS: Cisco AVpair [1] 28 "h323-credit-amount=5555.55" 02:27:44: RADIUS: Vendor, Cisco [26] 26 02:27:44: RADIUS: Cisco AVpair [1] 20 "h323-return-code=0" 02:27:44: RADIUS: Vendor, Cisco [26] 30 02:27:44: RADIUS: h323-credit-time [102] 24 "h323-credit-time=54123" 02:27:44: RADIUS: Vendor, Cisco [26] 33 02:27:44: RADIUS: h323-billing-model [109] 27 "h323-billing-model=prepay" 02:27:44: RADIUS: Vendor, Cisco [26] 24 02:27:44: RADIUS: h323-currency [110] 18 "h323-currency=US" 02:27:44: RADIUS: Idle-Timeout [28] 6 30 02:27:44: RADIUS: Received from id 24 In Figure 2, the caller places a call to MGCP 1 with a modified debit card application applied to an incoming POTS dial peer. After the caller enters the card number ( for example, 7777770001), the AAA requests are directed to RADIUS server 1. Figure 2 AAA Redirect Using An Account Number: Scenario 2 Shown below are some Cisco IOS configuration examples for the topology in Figure 2: version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname mgcp1 ! aaa new-model ! ! aaa group server radius sg1 server 10.6.20.60 auth-port 1698 acct-port 1699 ! aaa group server radius sg4 server 10.6.20.60 auth-port 1704 acct-port 1705 ! aaa group server radius sg6 server 10.6.20.60 auth-port 1708 acct-port 1709 ! aaa authentication login sanjo_aaa1 group sg1 aaa authentication login sanjo_aaa4 group sg4 aaa authentication login sanjo_aaa6 group sg6 aaa authorization exec sanjo_aaa1 group sg1 aaa authorization exec sanjo_aaa4 group sg4 aaa authorization exec sanjo_aaa6 group sg6 aaa accounting connection sanjo_aaa1 start-stop group sg1 aaa accounting connection sanjo_aaa4 start-stop group sg4 aaa accounting connection sanjo_aaa6 start-stop group sg6 aaa session-id common ! resource-pool disable ! ip subnet-zero ip host milp 10.223.254.255 ! isdn switch-type primary-5ess ! fax interface-type modem mta receive maximum-recipients 0 ! controller T1 3 framing esf clock source line secondary linecode b8zs pri-group timeslots 1-24 ! gw-accounting aaa ! interface Ethernet0 ip address 10.0.254.255 no ip redirects no ip mroute-cache no cdp enable ! interface Serial0:23 no ip address isdn switch-type primary-5ess isdn T321 0 isdn T310 4000 no cdp enable ! interface Serial3:23 no ip address trunk-group 1 isdn switch-type primary-5ess isdn incoming-voice modem isdn T321 0 no cdp enable ! interface FastEthernet0 ip address 10.1.2.3 254.254.255.0 duplex auto speed auto ! ip classless ip route 254.255.1.0 223.254.10.0.1.5.0.1 <- Route to tftp server no ip http server 10.223.254.255 radius-server host 10.6.20.60 auth-port 1704 acct-port 1705 radius-server host 10.6.20.60 auth-port 1698 acct-port 1699 radius-server retransmit 3 radius-server key cisco radius-server vsa send accounting radius-server vsa send authentication call rsvp-sync call accounting-template voice cdr1 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr1.cdr call accounting-template voice cdr2 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr2.cdr call language voice en tftp://milp/doe/scripts/multi-lang/en_translate.tcl ! call application voice integ_debit tftp://10.223.254.255/johndoe/sanjose/apps/debitcard_int_redirect.tcl call application voice integ_debit uid-len 6 call application voice integ_debit language 1 en call application voice integ_debit language 2 sp call application voice integ_debit set-location en 0 tftp://10.223.254.255/johndoe/prompts/en/ call application voice integ_debit set-location sp 0 tftp://10.6.20.50/prompts/ ! call application voice plain_debit tftp://10.223.254.255/johndoe/sanjose/apps/debitcard.tcl call application voice plain_debit uid-len 6 call application voice plain_debit language 1 en call application voice plain_debit language 2 sp call application voice plain_debit set-location en 0 tftp://10.223.254.255/johndoe/prompts/en/ call application voice plain_debit set-location sp 0 tftp://10.6.20.50/prompts/ ! voice-port 3:D ! voice-port 0:D ! dial-peer cor custom dial-peer voice 100 pots application integ_debit <----------- !Modified debit app to play incoming called-number 13120 new dynamic prompts, do dial-peer voice 101 voip authentication, destination-pabcern 510....... authorization, session target ipv4:10.0.0.1 accounting redirect ! and use accounting dial-peer voice 102 voip template. destination-pabcern 408....... session target ipv4:10.0.0.1 ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 ! end Debit Card Application for Directing AAA Requests Using an Account Number A debit card application for directing AAA requests using an account number is shown below: proc act_GotCardNumber { } { global count global retryCnt global promptFlag global account global pin global accountLen global cardLen global pinLen global ani global method global acct-template set status [infotag get evt_status] # Do we need to calculate len ??? if {$status == "cd_005"} { set number [infotag get evt_dcdigits] set numberLen [ string length $number ] if { $numberLen == $cardLen } { set account [ string range $number 0 [expr $accountLen -1]] set pin [ string range $number $accountLen [expr $cardLen -1]] ###################################### # Select Servertag based on first 2 # # digits of account number. # ###################################### set spcode [ string range $account 0 1] if { $spcode == 77 } { set method "sanjo_aaa1" set avList(h323-ivr-out,1) "account range: 77" set avList(h323-ivr-out,2) "color:violet" set avList(h323-ivr-out,3) "MethodName:sanjo_aaa1" puts "note that accounting template cdr1 needs to be defined in IOS CLI" set acct-template "cdr1" puts "$spcode" set method "sanjo_aaa4" set avList(h323-ivr-out,1) "account range: 55" set avList(h323-ivr-out,2) "color:red" set avList(h323-ivr-out,3) "MethodName:sanjo_aaa4" set acct-template "cdr2" } else { set method "h323" set acct-template "none" } puts "THIS IS THE METHOD LIST USED: $method \r" puts "THIS IS THE TEMPLATE USED : $template \r" #Do accounting if { $method != "h323" } { aaa accounting start leg_incoming -a avList -s $method -t $template set avList(h323-ivr-out,2) "color:purple" aaa accounting update leg_incoming -a avList -s $method -t $template # supppress service provide module automatically generating # accounting records on outgoing call leg infotag set leg_suppress_outgoing_auto_acct 1 #Do authenticate puts "\r DOING AUTHENTICATION on account number and pin \r" aaa authenticate $account $pin -s $method puts "\r DOING AUTHORIZATION \r" # DO authorize aaa authorize $account $pin $ani "" leg_incoming -s $method } else { aaa accounting start leg_incoming -a avList -s $method set avList(h323-ivr-out,2) "color:indigo" aaa accounting update leg_incoming -a avList -s $method # supppress service provide module automatically generating # accounting records on outgoing call leg infotag set leg_suppress_outgoing_auto_acct 1 infotag set leg_suppress_outgoing_auto_acct 1 #Do authenticate puts "\r DOING AUTHENTICATION on account number and pin \r" aaa authenticate $account $pin -s $method puts "\r DOING AUTHORIZATION \r" # DO authorize aaa authorize $account $pin $ani "" leg_incoming -s $method } else { aaa accounting start leg_incoming -a avList -s $method set avList(h323-ivr-out,2) "color:indigo" aaa accounting update leg_incoming -a avList -s $method # supppress service provide module automatically generating # accounting records on outgoing call leg infotag set leg_suppress_outgoing_auto_acct 1 #Do authenticate for using default h323 method list puts "\r DOING AUTHENTICATION \r" aaa authenticate $account $pin -s $method puts "\r DOING AUTHORIZATION \r" aaa authorize $account $pin $ani "" leg_incoming -s $method } Directing AAA Traffic Using Called Number In Figure 3, the caller places a phone call to MGCP 1. A modified debit card application is applied to an incoming POTS dial peer. The caller enters the card number and the destination number sequence which is completed at MGCP 1. The destination number (for example 408-428-xxxx) is now dialed and directed to MGCP 2. Accounting information based on the called number is directed from MGCP 2 to RADIUS server 5. Figure 3 Directing AAA Traffic Using Called Number An example of a AAA redirect using the called number is shown below: version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname mgcp2 ! aaa new-model ! ! aaa group server radius sg2 server 10.6.20.60 auth-port 1700 acct-port 1701 ! aaa group server radius sg5 server 10.6.20.60 auth-port 1706 acct-port 1707 ! aaa group server radius sg6 server 10.6.20.60 auth-port 1708 acct-port 1709 ! aaa accounting connection sanjo_aaa5 start-stop group sg5 aaa accounting connection sanjo_aaa2 start-stop group sg2 aaa session-id common ! username lab password 0 lab ! ! resource-pool disable ! ip subnet-zero ! isdn switch-type primary-5ess voice class aaa 2 accounting method sanjo_aaa2 ! voice class aaa 5 accounting method sanjo_aaa5 ! ! fax interface-type modem mta receive maximum-recipients 0 ! controller T1 0 framing sf clock source line primary linecode ami ! controller T1 1 framing sf clock source line secondary 1 linecode ami ! controller T1 2 framing sf linecode ami ! controller T1 3 framing esf linecode b8zs pri-group timeslots 1-24 ! gw-accounting aaa ! ! ! interface Ethernet0 ip address 10.6.20.501 254.255.1.0 no cdp enable interface Serial3:23 no ip address isdn switch-type primary-5ess isdn incoming-voice modem no cdp enable ! interface FastEthernet0 ip address 10.0.0.1 255.255.255.0 duplex auto speed auto ! ip classless ip route 254.255.1.0 223.254.10.0.1.5.0.1 no ip http server ! ! ! radius-server host 10.6.20.60 auth-port 1700 acct-port 1701 key cisco radius-server host 10.6.20.60 auth-port 1706 acct-port 1707 key cisco radius-server retransmit 3 radius-server key cisco radius-server vsa send accounting radius-server vsa send authentication voice-port 3:D ! ! mgcp profile default ! On the terminating side, the incoming dial peers are VoIP. In this configuration, if the incoming called number begins with 510, VoIP dial peer 101 is applied. If the incoming called number begins with 408, VoIP dial peer 102 is applied. dial-peer voice 100 pots destination-pabcern 510 ...... port 3:D prefix 91510 ....... ! dial-peer voice 101 voip incoming called-number 510 ....... voice-class aaa 5 ! dial-peer voice 200 pots destination-pabcern 408...... port 3:D prefix 9 ! dial-peer voice 102 voip incoming called-number 408....... voice-class aaa 2 ! dial-peer voice 300 pots application integ_debit incoming called-number . port 3:D ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 ! end Directing Accounting Templates Using Called Number In Figure 4 below, accounting template cdr1 allows h323-gw-id av pair but does not allow h323-call-origin. Accounting template cdr2 allows h323-call-origin but does not allow h323-gw-id av pair. The caller places a phone call to MGCP 1. A modified debit card application is applied to an incoming POTS dial peer. Accounting template cdr1 is selected using an account number ( for example 7777770001). To verify that cdr1 was applied correctly, examine the accounting record on RADIUS server 1. Accounting template cdr2 is selected using an account number ( for example 5555550001). To verify that cdr2 was applied correctly, examine the accounting record on RADIUS server 2. Figure 4 Selecting Accounting Templates Using an Account Number Shown below is an example of directing an accounting template using an incoming called number: version 12.2 service timestamps debug uptime service timestamps log uptime no service password-encryption ! hostname mgcp1 ! aaa new-model ! ! aaa group server radius sg1 server 10.6.20.60 auth-port 1698 acct-port 1699 ! aaa group server radius sg4 server 10.6.20.60 auth-port 1704 acct-port 1705 ! aaa group server radius sg6 server 10.6.20.60 auth-port 1708 acct-port 1709 ! aaa authentication login sanjo_aaa1 group sg1 aaa authentication login sanjo_aaa4 group sg4 aaa authentication login sanjo_aaa6 group sg6 aaa authorization exec sanjo_aaa1 group sg1 aaa authorization exec sanjo_aaa4 group sg4 aaa authorization exec sanjo_aaa6 group sg6 aaa accounting connection sanjo_aaa1 start-stop group sg1 aaa accounting connection sanjo_aaa4 start-stop group sg4 aaa accounting connection sanjo_aaa6 start-stop group sg6 aaa session-id common ! ! ! resource-pool disable ! ip subnet-zero ip host milp 10.223.254.255 trunk group 1 carrier-id test hunt-scheme least-used both ! isdn switch-type primary-5ess ! voice class aaa 1 ! voice class aaa 6 authentication method sanjo_aaa6 authorization method sanjo_aaa6 accounting method sanjo_aaa6 ! ! ! fax interface-type modem mta receive maximum-recipients 0 ! controller T1 0 framing sf linecode ami ! controller T1 1 framing sf clock source line secondary 1 linecode ami ! controller T1 2 framing sf linecode ami ! controller T1 3 framing esf clock source line primary linecode b8zs pri-group timeslots 1-24 ! gw-accounting aaa ! interface Ethernet0 ip address 10.0.254.255 no ip redirects no ip mroute-cache no cdp enable ! interface Serial3:23 no ip address trunk-group 1 isdn switch-type primary-5ess isdn incoming-voice modem isdn T321 0 no cdp enable ! interface FastEthernet0 ip address 10.1.2.3 254.254.255.0 duplex auto speed auto ! ip classless ip route 254.255.1.0 223.254.10.0.1.5.0.1 no ip http server ! radius-server host 10.6.20.60 auth-port 1708 acct-port 1709 radius-server host 10.6.20.60 auth-port 1704 acct-port 1705 radius-server host 10.6.20.60 auth-port 1698 acct-port 1699 radius-server host 10.6.43.255 auth-port 1645 acct-port 1646 radius-server host 10.6.37.10 auth-port 1645 acct-port 1646 radius-server retransmit 3 radius-server key cisco radius-server vsa send accounting radius-server vsa send authentication call rsvp-sync call accounting-template voice cdr1 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr1.cdr call accounting-template voice cdr2 tftp://10.223.254.255/johndoe/sanjose/cdr/cdr2.cdr call language voice en tftp://milp/doe/scripts/multi-lang/en_translate.tcl ! call application voice acct_redirect_debit tftp://10.6.20.50/sanjose/apps/debitcard_acct_redirect.tcl call application voice acct_redirect_debit uid-len 6 call application voice acct_redirect_debit language 1 en call application voice acct_redirect_debit language 2 sp call application voice acct_redirect_debit set-location en 0 tftp://10.6.20.50/prompts/ call application voice acct_redirect_debit set-location sp 0 tftp://10.6.20.50/prompts/ ! call application voice integ_debit tftp://10.223.254.255/johndoe/sanjose/apps/debitcard_int_redirect.tcl call application voice integ_debit uid-len 6 call application voice integ_debit language 1 en call application voice integ_debit language 2 sp call application voice integ_debit set-location en 0 tftp://10.223.254.255/johndoe/prompts/en/ call application voice integ_debit set-location sp 0 tftp://10.6.20.50/prompts/ ! call application voice plain_debit tftp://10.223.254.255/johndoe/sanjose/apps/debitcard.tcl call application voice plain_debit uid-len 6 call application voice plain_debit language 1 en call application voice plain_debit language 2 sp call application voice plain_debit set-location en 0 tftp://10.223.254.255/johndoe/prompts/en/ call application voice plain_debit set-location sp 0 tftp://10.6.20.50/prompts/ ! voice-port 3:D ! ! mgcp profile default ! dial-peer cor custom ! dial-peer voice 100 pots debitcard_acct_redirect.tcl incoming called-number . ! dial-peer voice 101 voip destination-pattern 1111234567 session target ipv4:10.0.0.1 ! dial-peer voice 102 voip destination-pattern 408....... session target ipv4:10.0.0.1 ! ! line con 0 exec-timeout 0 0 line aux 0 line vty 0 4 ! end CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. © 2007-2009 Cisco Systems, Inc. All rights reserved.
	© 1992-2009 Cisco Systems, Inc. All rights reserved. Terms & Conditions \| Privacy Statement \| Cookie Policy \| Trademarks of Cisco Systems, Inc.

Table Of Contents

Examples

Directing a AAA Request Based on Trunk Grouping

Directing a AAA Request Using an Account Number

Debit Card Application for Directing AAA Requests Using an Account Number

Directing AAA Traffic Using Called Number

Directing Accounting Templates Using Called Number

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)