Table Of Contents
Configuring H.323 VoIP Gateway for Cisco Access Platforms
H.323 VoIP Gateway Feature Summary
Additional Keyword for the Session Target Command
Configure Voice Port Parameters
Configure POTS and VoIP Dial Peers
Verify Dial Peer Configuration
Enable VoIP Gateway Functionality
Configure Gateway Interface Parameters
Verify the Gateway Interface Configuration
RADIUS Accounting with Overloaded Session ID
Interactive Voice Response (IVR)
Dial Peer Configuration Restrictions for ISDNRedirect
ISDNRedirect Call Flow Example
aaa authentication login h323 radius
aaa accounting connection h323
Configuring H.323 VoIP Gateway for Cisco Access Platforms
Feature History
H.323 VoIP Gateway Feature Summary
The Cisco AS5300 voice service provider features include enhancements made to the functionality and configuration of both the gateway and the Voice over IP (VoIP) gatekeeper. The architecture of these features provides the Quality of Service (QoS), stability, and functionality necessary for carrier class, real-time IP communications services.
This document contains a basic description of the H.323 VoIP gateway in addition to features required to implement the applications to run VoIP in a service provider environment. The features address the service provider needs to offer security, billing, scaling, and reliability.
The Cisco AS5300 VoIP gateway is a high performance H.323-compliant gateway optimized for VoIP applications. Supporting up to two T1/E1 digital channels, it connects with existing telephones and fax machines through the Public Switched Telephone Network (PSTN), key systems, and PBXs, making the process of placing calls over the IP network transparent to users.
The gateway capability allows the Cisco AS5300 to function as an H.323 endpoint. Therefore, the gateway provides admission control, address lookup and translation, and accounting services.
Benefits
•
Carrier-class voice quality
•
•
•
•
List of Terms
AAA—Authentication, Authorization, and Accounting. AAA is a suite of network security services which provides the primary framework through which access control can be set up on your Cisco router or access server.
ANI—Automatic number identification.
ARQ—Admission request.
CAS—Channel associated signaling.
CCAPI—Call control applications programming interface.
CLI—Command line interface.
CO—Central office.
CPE—Customer premises equipment. Terminating equipment, such as terminals, telephones, and modems, supplied by the telephone company, installed at the customer sites, and connected to the telephone company network.
CSM—Call switching module.
dial peer—An addressable call endpoint. In Voice over IP (V0IP), there are two types of dial peers: POTS and VoIP.
DNS—Domain name system used to address translation to convert H.323 IDs, URLs, or e-mail IDs to IP addresses. DNS is also used to assist in the location of remote gatekeepers and to reverse-map raw IP addresses to host names of administrative domains.
DNIS—Dialed number identification service (the called number).
DSP—Digital signal processor.
DTMF—Dual tone multi-frequency.
E.164—The international public telecommunications numbering plan. A standard set by ITU-T which addresses telephone numbers.
E&M—Ear and mouth RBS signaling.
endpoint—A H.323 terminal or gateway. An endpoint can call and be called. It generates and/or terminates the information stream.
gatekeeper—A gatekeeper maintains a registry of devices in the multimedia network. The devices register with the gatekeeper at startup, and request admission to a call from the gatekeeper.
The gatekeeper is a H.323 entity on the LAN that provides address translation and control access to the LAN for H.323 terminals and gateways. The gatekeeper may provide other services to the H.323 terminals and gateways, such as bandwidth management and locating gateways.
gateway—A gateway allows H.323 terminals to communicate with non-H.323 terminals by converting protocols. A gateway is the point at which a circuit-switched call is encoded and repackaged into IP packets.
A H.323 gateway is an endpoint on the LAN that provides real-time, two-way communications between H.323 terminals on the LAN and other ITU-T terminals in the WAN, or to another H.323 gateway.
H.323—An International Telecommunication Union (ITU-T) standard that describes packet-based video, audio, and data conferencing. H.323 is an umbrella standard that describes the architecture of the conferencing system, and refers to a set of other standards (H.245, H.225.0, and Q.931) to describe its actual protocol.
H.323 RAS—Registration, admission, and status. The RAS signaling function performs registration, admissions, bandwidth changes, status and disengage procedures between the VoIP gateway and the gatekeeper.
HSRP—Hot Standby Routing Protocol. HSRP is a Cisco-proprietary protocol which provides a redundancy mechanism when more than one router is connected to the same segment/subnet of an Ethernet/FDDI/Token Ring network.
IVR—Integrated voice response. When someone dials in, it responds with a prompt to get a personal identification number (PIN), and so on.
LEC—Local exchange carrier.
LRQ—Location request.
MCU—Multipoint control unit
MF—Multi-frequency tones are made of six frequencies that provide 15 two frequency combinations for indication digits 0-9 and KP/ST signals.
multicast—A process of transmitting PDUs from one source to many destinations. The actual mechanism (that is, IP multicast, multi-unicast, and so forth) for this process might be different for LAN technologies.
multipoint-unicast—A process of transferring PDUs (Protocol Data Units) where an endpoint sends more than one copy of a media stream to different endpoints. This might be necessary in networks which do not support multicast.
node—A H.323 entity that uses RAS to communicate with the gatekeeper. For example, an endpoint such as a terminal, proxy, or gateway.
PDU—Protocol data units used by bridges to transfer connectivity information.
POTS—Plain old telephone service. Basic telephone service supplying standard single line telephones, telephone lines, and access to the PSTN.
PSTN—Public switched telephone network. PSTN refers to the local telephone company.
QoS—Quality of service, which refers to the measure of service quality provided to the user.
RAS—Registration, admission, and status protocol. This is the protocol that is used between endpoints and the gatekeeper to perform management functions.
RBS—Robbed bit signaling.
RRQ—Registration request.
SPI—Service provider interface.
TCL—Tool command language.
TDM—Time division multiplexing. Technique in which information from multiple channels can be allocated bandwidth on a single wire based on preassigned time slots. Bandwidth is allocated to each channel regardless of whether the station has data to transmit.
VoIP—Voice over IP. The ability to carry normal telephone-style voice over an IP-based internet with POTS-like functionality, reliability, and voice quality. VoIP is a blanket term which generally refers to Cisco's standards based (for example, H.323) approach to IP voice traffic.
VTSP—Voice telephony service provider.
zone—A collection of all terminals (tx), gateways (GW), and Multipoint Control Units (MCU) managed by a single gatekeeper (GK). A zone includes at least one terminal, and can include gateways or multipoint control units (MCUs). A zone has only one gatekeeper. A zone may be independent of LAN topology and can be comprised of multiple LAN segments which are connected using routes or other devices.
Note
Restrictions
•
•
•
•
Platforms
This feature is supported on the following platforms:
•
•
•
•
Determining Platform Support Through Cisco Feature Navigator
Cisco IOS software is packaged in feature sets that support specific platforms. To get updated information regarding platform support for this feature, access Cisco Feature Navigator. Cisco Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.
Cisco Feature Navigator is a web-based tool that enables you to determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image. You can search by feature or release. Under the release section, you can compare releases side by side to display both the features unique to each software release and the features in common.
To access Cisco Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions at http://www.cisco.com/register.
Cisco Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Cisco Feature Navigator home page at the following URL:
Availability of Cisco IOS Software Images
Platform support for particular Cisco IOS software releases is dependent on the availability of the software images for those platforms. Software images for some platforms may be deferred, delayed, or changed without prior notice. For updated information about platform support and availability of software images for each Cisco IOS software release, refer to the online release notes or, if supported, Cisco Feature Navigator.
Perquisites
Before you can configure your platform to serve as an H.323 VoIP gateway, you must first:
•
•
•
Supported MIBS and RFCs
The SNMP MIBS are available on CCO. The CISCO-VOICE-DIAL-CONTROL-MIB supports the QoV and QoS of VoIP calls. Refer to the online support reference listed at the following location:
•
•
•
•
•
•
•
•
Functional Description
The functionality of the H.323 VoIP gateway is dependent on the interaction of the following features:
•
Note
Gateway RAS Implementation
The Registration, Admission, and Status (RAS) signaling function performs registration, admissions, status, and disengage procedures between the H.323 VoIP gateway and the H.323 VoIP gatekeeper.
The following additions have been made to basic gateway functionality to implement RAS:
•
•
Note
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_serv/5300/5300swbk/index.htmTwo new fields have been added to the dial-peer entry. The gateway relies on Cisco IOS command line interface commands, outside of gateway configuration mode, to configure handling of the AAA servers.
The following additions have been made to basic gateway functionality to implement RAS:
Technology Prefixes
Technology prefixes are used to distinguish between gateways having specific capabilities within a given zone. In the exchange between the gateway and the gatekeeper, the technology prefix is used to select a gateway after the zone has been selected. You use the tech-prefix dial-peer configuration command to define technology prefixes.
In most cases, there is a dynamic protocol exchange between the gateway and the gatekeeper that enables the gateway to inform the gatekeeper about technology prefixes and where to forward calls. If, for some reason, that dynamic registry feature is not in effect, you can statically configure the gatekeeper to query the gateway for this information by configuring the gw-type-prefix command on the gatekeeper. Use the show gatekeeper gw-type-prefix to display how the gatekeeper has mapped the technology prefixes to local gateways.
For more information about configuring H.323 gatekeepers, refer to Cisco IOS Release 11.3(6) 2 Configuring H.323 VoIP Gatekeeper for Cisco Access Platforms.
Additional Keyword for the Session Target Command
The session target dial-peer command indicates the address of the remote gateway where the call is terminated. A new keyword has been added to the session target command to indicate that the RAS protocol is being used—meaning that a gatekeeper will be consulted to translate the E164 address to an IP address.
You can now define the address of a remote gateway in the following ways:
•
•
•
For more information about this revised command, refer to the AAA Accounting section.
Configuration Task List
To configure a Cisco 3600 or Cisco 2600 series router to perform as an H.323 VoIP gateway using RAS, perform the following tasks:
•
Configure Voice Port Parameters
To configure voice port parameters for an E&M voice port, use the following commands:
For more information about configuring voice ports, refer to the "Configuring Voice Ports" chapter in the Cisco IOS Release 12.0 Voice, Video, and Home Applications Configuration Guide.
Verify Voice Port Parameters
To verify voice port parameters, use the show voice port command.
The following is sample output from the show voice port command for an E&M voice port on the Cisco 3600 series:
router# show voice port 1/0/0E&M Slot is 1, Sub-unit is 0, Port is 0Type of VoicePort is E&MOperation State is UPAdministrative State is UP<--snip-->Voice card specific Info Follows:Signal Type is wink-startOperation Type is 4-wireImpedance is set to 600r OhmE&M Type is 5Dial Type is dtmf<--snip-->For more information about the show voice port command, refer to the Cisco IOS Release 12.0 Voice, Video, and Home Applications Command Reference.
Configure the H.323 Gateway
To configure the H.323 Gateway, you need to perform the tasks:
•
•
•
Configure POTS and VoIP Dial Peers
The first step in configuring the H.323 gateway is to define the applicable POTS and VoIP dial peers. The POTS dial peer informs the system which voice port to direct incoming VoIP calls to and (optionally) defines that RAS-initiated calls will have a technology prefix prepended to the destination telephone number. The VoIP dial peer defines how to direct calls that originate from a local voice port into the VoIP cloud to the session target. The session target indicates the address of the remote gateway where the call is terminated. As mentioned, there are several different ways to define the destination gateway address: by statically configuring the IP address of the gateway, by defining the DNS of the gateway, or by using RAS. If you use RAS, that gateway determines the destination target by querying the RAS gatekeeper.
To configure POTS dial peer for the H.323 gateway, use the following commands:
For more information about POTS dial peers, refer to the Cisco IOS Release 12.0 Voice, Video, and Home Applications Configuration Guide. For more information about any of the commands used to configure VoIP dial peers, refer to the Cisco IOS Release 12.0 Voice, Video, and Home Applications Command Reference.
To configure VoIP dial peer for the H.323 gateway, use the following commands:
For more information about POTS dial peers, refer to the Cisco IOS Release 12.0 Voice, Video, and Home Applications Configuration Guide. For more information about any of the commands used to configure POTS dial peers, refer to the Cisco IOS Release 12.0 Voice, Video, and Home Applications Command Reference.
Verify Dial Peer Configuration
Verify the POTS and VoIP dial peer configuration by using the show dial-peer voice command.
The following example shows output from the show dial-peer voice command for a VoIP dial peer using RAS:
5300-1# show dial-peer voice 1234VoiceOverIpPeer1234tag = 1234, destination-pattern = 1234',answer-address = ',group = 1234, Admin state is up, Operation state is up,incoming called-number = ', connections/maximum = 0/unlimited,application associated:type = voip, session-target = ras',technology prefix: 8#ip precedence = 0, UDP checksum = disabled,session-protocol = cisco, req-qos = controlled-load,acc-qos = best-effort,fax-rate = voice, codec = g729r8,Expect factor = 10, Icpif = 30,VAD = enabled, Poor QOV Trap = disabled,<--snip-->Enable VoIP Gateway Functionality
The next step in configuring an H.323 gateway is to enable VoIP gateway functionality. You do this by using the gateway command.
To enable gateway functionality, use the following commands:
1
configure terminal
Enter global configuration mode.
2
gateway
Enable the VoIP Gateway.
Configure Gateway Interface Parameters
The next step in configuring an H.323 gateway is configure the gateway interface parameters. You do this by first defining which interface will be presented to the VoIP network as this gateway's H.323 interface. Only one interface is allowed to be the gateway interface. You can select either the interface that is connected to the gatekeeper or a loopback interface. The interface that is connected to the gatekeeper is usually a LAN interface (for example, Fast Ethernet, Ethernet, FDDI, or Token-Ring).
After you define the gateway interface, you configure the gateway to discover the gatekeeper either through multicasting or by directing it to a specific host. Finally, you configure the gateway's H.323 identification number and any technology prefixes that this gateway should register with the gatekeeper.
To define the interface to be used as the H.323 gateway interface and configure the H.323 gateway interface parameters, use the following commands, beginning in global configuration mode:
Verify the Gateway Interface Configuration
•
In the following example, gateway GW13.cisco.com has successfully registered itself with gatekeeper GK15.cisco.com:
3640GW.13#show gatewayGateway GW13.cisco.com is registered to Gatekeeper GK15.cisco.com•
In the following example gatekeeper 'GK15.cisco.com' has four tech-prefixes. Prefix 31# is statically defined on the gatekeeper, while 23#, 22#, and 13# have been dynamically registered by gateways.
3640GK.15#show gatekeeper gw-type-prefixGATEWAY TYPE PREFIX TABLE=========================Prefix:31#*Statically-configured gateways (not necessarily currently registered):1.9.53.13:1720Zone:GK15.cisco.com Registered gateways for this prefix:1.9.53.13:1720 GW13Prefix:23#*Zone:GK15.cisco.com Registered gateways for this prefix:1.9.74.23:1720 GW23-c2611Prefix:22#*Zone:GK15.cisco.com Registered gateways for this prefix:1.9.74.22:1720 GW22-c2611Prefix:13#*Zone:GK15.cisco.com Registered gateways for this prefix:1.9.53.13:1720 GW13Tips
•
In the following example, gateway GW13.cisco.com sends a RAS registration request message (RRQ) to gatekeeper GK15.cisco.com at IP address 1.9.53.15. GW13.cisco.com then receives a registration confirmation (RCF) message from the gatekeeper. If there is no response, it could mean that the gatekeeper is offline or improperly addressed. If you receive a reject message (RRJ), it could mean that the gatekeeper is unable to handle another gateway or that the registration information is incorrect.
3640GW.13#debug ras*Mar 13 19:53:34.231: RASlib::ras_sendto:msg length 105 from1.9.53.13:8658 to 1.9.53.15:1719*Mar 13 19:53:34.231: RASLib::RASSendRRQ:RRQ (seq# 36939) sentto 1.9.53.15*Mar 13 19:53:34.247: RASLib::RASRecvData:successfully rcvdmessage of length 105 from 1.9.53.15:1719*Mar 13 19:53:34.251: RASLib::RASRecvData:RCF (seq# 36939) rcvdfrom [1.9.53.15:1719] on sock [0x6168356C•
In the following example, the debug h225 asn1 command displays the actual contents of the RAS registration message exchange between gateway GW13.cisco.com and gatekeeper GK15.cisco.com. The debug h225 asn1 command also displays the tech-prefixes that gateway GW13.cisco.com is registering:
3640GW.13#debug h225 asn1H.225 ASN1 Messages debugging is on3640GW.13#value RasMessage ::= registrationRequest :*Mar 13 20:16:45.295: {*Mar 13 20:16:45.295: requestSeqNum 037001,*Mar 13 20:16:45.295: protocolIdentifier { 0 0 8 2250 0 1 },*Mar 13 20:16:45.295: discoveryComplete TRUE,*Mar 13 20:16:45.295: callSignalAddress*Mar 13 20:16:45.295: {*Mar 13 20:16:45.295: ipAddress :*Mar 13 20:16:45.295: {*Mar 13 20:16:45.295: ip '0109350D'H,*Mar 13 20:16:45.295: port 01720*Mar 13 20:16:45.295: }*Mar 13 20:16:45.295: },*Mar 13 20:16:45.295: rasAddress*Mar 13 20:16:45.295: {*Mar 13 20:16:45.295: ipAddress :*Mar 13 20:16:45.295: {*Mar 13 20:16:45.295: ip '0109350D'H,*Mar 13 20:16:45.299: port 04635*Mar 13 20:16:45.299: }*Mar 13 20:16:45.299: },*Mar 13 20:16:45.299: terminalType*Mar 13 20:16:45.299: {*Mar 13 20:16:45.299: gateway*Mar 13 20:16:45.299: {*Mar 13 20:16:45.299: protocol*Mar 13 20:16:45.299: {*Mar 13 20:16:45.299: voice :*Mar 13 20:16:45.299: {*Mar 13 20:16:45.299: supportedPrefixes*Mar 13 20:16:45.299: {*Mar 13 20:16:45.299: {*Mar 13 20:16:45.299: prefix e164 :"13#"*Mar 13 20:16:45.299: }*Mar 13 20:16:45.299: }*Mar 13 20:16:45.299: }*Mar 13 20:16:45.299: }*Mar 13 20:16:45.299: },*Mar 13 20:16:45.299: mc FALSE,*Mar 13 20:16:45.299: undefinedNode FALSE*Mar 13 20:16:45.299: },*Mar 13 20:16:45.299: terminalAlias*Mar 13 20:16:45.303: {*Mar 13 20:16:45.303: h323-ID :"GW13.cisco.com"*Mar 13 20:16:45.303: },*Mar 13 20:16:45.303: gatekeeperIdentifier "GK15.cisco.com",*Mar 13 20:16:45.303: endpointVendor*Mar 13 20:16:45.303: {*Mar 13 20:16:45.303: vendor*Mar 13 20:16:45.303: {*Mar 13 20:16:45.303: t35CountryCode 0181,*Mar 13 20:16:45.303: t35Extension 00,*Mar 13 20:16:45.303: manufacturerCode 018*Mar 13 20:16:45.303: }*Mar 13 20:16:45.303: }*Mar 13 20:16:45.303: }*Mar 13 20:16:45.303:0CC09088 06000891 4A000180 01000109 350D06B8 01000109 350D121B 0880013C05050100 40460000 01400D00 47005700 31003300 40006300 69007300 63006F002E006300 6F006D1A 0047004B 00310035 002E0063 00690073 0063006F 002E0063006F006D 00B50000 1210C09088 06000891 4A000100 01400D00 47005700 31003300 40006300 6900730063006F00 2E006300 6F006D1A 0047004B 00310035 002E0063 00690073 0063006F002E0063 006F006D 1E003600 30004400 37004500 37003300 43003000 3000300030003000 30003000 46value RasMessage ::= registrationConfirm :*Mar 13 20:16:45.335: {*Mar 13 20:16:45.335: requestSeqNum 037001,*Mar 13 20:16:45.335: protocolIdentifier { 0 0 8 2250 0 1 },*Mar 13 20:16:45.335: callSignalAddress*Mar 13 20:16:45.335: {*Mar 13 20:16:45.335: },*Mar 13 20:16:45.335: terminalAlias*Mar 13 20:16:45.335: {*Mar 13 20:16:45.335: h323-ID :"GW13.cisco.com"*Mar 13 20:16:45.339: },*Mar 13 20:16:45.339: gatekeeperIdentifier "GK15.cisco.com",*Mar 13 20:16:45.339: endpointIdentifier "60D7E73C0000000F"*Mar 13 20:16:45.339: }*Mar 13 20:16:45.339:3640GW.13#Configuration Examples
This section contains the following configuration examples:
Configuring an H.323 Gateway
The following example shows how to configure a Cisco 3600 series router as an H.323 gateway:
! Configure the voice-port parameters.! This voice-port is an analog E&M-wink port using 4-wire, type 5 interface!voice-port 2/0/0operation 4-wiretype 5!! Setup a pots dial peer to direct calls incoming VoIP calls to the voice-port.! This dial peer defines that the RAS initiated call will be received with a tech! prefix of 13#!dial-peer voice 13200 potsdestination-pattern 13#13200port 2/0/0!! Setup a VoIP dial-peer to direct calls originated from a local voice-port! into the VoIP cloud. In this example, the session target indicates! that the destination target is determined by querying the RAS gatekeeper.! The tech-prefix command means that the H.323 gateway will ask the RAS gatekeeper to! direct calls using the technology prefix of 14#.!dial-peer voice 14 voipdestination-pattern 14...tech-prefix 14#session target ras!! Enable Gateway functionality with global config command.!gateway!! Choose an interface to be this gateway's H.323 interface. In this example, the! gateway is directed toward a specific host. Then define this gateway's H.323 ID, and! configure any tech prefixes that this gateway should register with the gatekeeper.! In this example, gateway GW13 tells gatekeeper GK15 to route any calls with a pattern! than begins with 13# to GW13. Dial-peer 14 expects that some other gateway has! register tech-prefix 14#.!interface Ethernet0/0ip address 172.9.53.13 255.255.255.0h323-gateway voip interfaceh323-gateway voip id GK15.cisco.com ipaddr 172.9.53.15 1719h323-gateway voip h323-id GW13@cisco.comh323-gateway voip tech-prefix 13#!Configuring a RAS Gatekeeper
For RAS to work on an H.323 gateway, you need to configure a corresponding RAS gatekeeper. The following example configures a Cisco 3600 series router as a RAS gatekeeper. For more information about configuring gatekeepers, refer to the Cisco IOS Release 11.3(6)NA2 document, Configuring the Cisco AS5300 for Voice Service Provider Features.
! Define this Ethernet port as the RAS gatekeeper.interface Ethernet0/0ip address 172.9.53.15 255.255.255.0!gatekeeper!! Specify the name of the local zone that this gatekeeper managers. Specify the IP! address that the gatekeeper advertises.zone local GK15.cisco.com cisco.com 172.9.53.15!! Statically define a remote zone and the associated gatekeeper's IP address.zone remote GK21.cisco.com cisco.com 172.9.74.21 1719!! Statically define the E.164 prefixes that a remote zone handles. This causes GK15 to! direct any call with a called number that matches 22* (22 and any number of trailing! digits) to GK21. This is not the same as a tech prefix. If a call comes in with an! E.164 pattern of (220) 555-1234, it will be routed to GK21 because the pattern! matches 22*.zone prefix GK21.cisco.com 22*zone prefix GK21.cisco.com 23*!! Statically define a tech prefix routing. Any call that comes in to the gatekeeper! with a technology prefix of 88# (the * catches any following E.164 address), is! directed to the gateway at IP address 172.9.53.13. This is a static technology prefix! definition. The gateway can also dynamically register its tech-prefixes with the! gatekeeper.gw-type-prefix 88#* gw ipaddr 172.9.53.13 1720!! ACtivate the gatekeeper function by activating the port.no shutdown!AAA Accounting
Authentication, Authorization, and Accounting (AAA) features are required in the VoIP gateway. The standard Cisco AAA accounting functionality is enhanced to collect digits during the call processing process. Processes such as:
•
•
The AAA authentication feature permits RADIUS to be used to authenticate users (typically incoming calls) on the gateway. It is normally used with IVR to check the legitimacy of a prospective gateway user based on an account number (collected by IVR) or based on answer number identification (ANI).
Note
http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113t/113t_3/aaalists.htm.
Note: URLs are subject to change without notice.New AAA commands are described in the Command Reference.
Authentication
Authentication is based on RADIUS and is performed on the gateway (as opposed to the gatekeeper).
User account and PIN information is collected by the IVR application and passed to the AAA interface. The AAA interface then makes a RADIUS authentication request with the given information and returns to the IVR application with a status of success or failure.
RADIUS is an IETF protocol based on UDP. It functions by exchanging a set of attribute/value pairs between the client (for example, a VoIP gateway and a RADIUS server). Standard RADIUS server implementations include CiscoSecure, Cisco UCP, Livingston, and Merit.
Authorization
An authenticated user is authorized. There is no authorization of specific user capabilities for the service provider voice applications.
Accounting
Accounting uses a basic start-stop method and standard RADIUS attributes where possible. Attributes that cannot be mapped to standard RADIUS are packed into the Acct-Session-Id attribute field as '/' separated ASCII string.
Data items are collected for each call leg created on the gateway. A call leg is the internal representation of a connection to the gateway. Each call that is made through the gateway consists of two call legs: one incoming and one outgoing. The call leg information that is emitted by the gateway(s) can be correlated by their connection ID, which is the same for all call legs of a connection.
Standard RADIUS attributes supported are as follows:
•
•
•
•
•
•
•
Nonstandard RADIUS attributes packed into the Acct-Session-Id are as follows:
•
•
•
•
•
•
•
•
RADIUS Accounting with Overloaded Session ID
To take advantage of standard RADIUS implementations that do not support vendor-specific attributes, a new method is defined which embeds the unsupported information elements in the RADIUS Acct-Session-id. The Acct-Session-id field has a maximum length of 256 characters. It is defined to contain the RADIUS account session ID which is a unique identifier that links accounting records associated with the same login session for a user. The internal representation of this field is long; therefore, the value of this session ID can become very large as the number of sessions on a router increases. To support additional fields, we have defined the following string format for this field:
<session id >/<call leg setup time>/<gateway id>/<connection id>/<call origin>/
<call type>/<connect time>/<disconnect time>/<disconnect cause>/<remote ip address>
Note
Usage Guidelines
NTP time formats are displayed as: %H:%M:%S.%k %Z %tw %tn %td %Y where:
•
•
•
•
•
•
•
•
•
Note that because of the limited size of the session id string it is not possible to embed very many information elements in it. Therefore, this feature supports only a limited set of accounting information elements. For implementations that would like to take advantage of more information elements, Cisco's VSA implementation is recommended.
Example 1—Start Record
Client-Id = 172.29.248.123NAS-Port-Type = 0User-Name = "4004"Called-Station-Id = "+111"Calling-Station-Id = "+222"Acct-Status-Type = StartUser-Service-Type = Login-UserAcct-Session-Id = "4/23:21:14.078 UTC Sat Jul 18 1998/ak3620-1.cisco.com/859BF275 D7C80001 0 3AFF4/originate/VoIP///"Acct-Delay-Time = 0Example 2—Stop Record
Client-Id = 172.29.248.123NAS-Port-Type = 0User-Name = "4004"Called-Station-Id = "+111"Calling-Station-Id = "+222"Acct-Status-Type = StopUser-Service-Type = Login-UserAcct-Session-Id = "4/23:21:14.078 UTC Sat Jul 18 1998/ak3620-1.cisco.com/859BF275 D7C80001 0 3AFF4/originate/VoIP/23:21:14.093 UTC Sat Jul 18 1998/23:21:23.084 UTC Sat Jul 18 1998/4" Acct-Input-Octets = 8340Acct-Output-Octets = 8900Acct-Input-Packets = 417Acct-Output-Packets = 445Acct-Session-Time = 9Acct-Delay-Time = 0Example 3—Update Record
Client-Id = 172.29.248.123NAS-Port-Type = 0User-Name = "4004"Called-Station-Id = "+111"Calling-Station-Id = "+222"Acct-Status-Type = 3User-Service-Type = Login-UserAcct-Session-Id = "4/21:54:17.052 UTC Mon Jul 201998/ak3620-1.cisco.com/BF1AC9CA 8DE60006 0 5ED24/originate/VoIP///"Acct-Delay-Time = 0Syslog Accounting
The syslog accounting option exports the information elements associated with each call leg through a system log message. The system log message can be captured by a syslog daemon that is present on the network. The syslog output consists of the following:
server_timestamp gateway_id message_number : message_label : list_of_AV_pairs
Example
%VOIPAAA-5-VOIP_CALL_HISTORY:CallLegType 2,ConnectionId 300094C0 60E0F3A0 60C894C0 60C90000,SetupTime 22:35:22.023UTC Tue Aug 11 1998, PeerAddress 999, PeerSubAddress , DisconnectCause 10 ,DisconnectText normal call clearing., ConnectTime 22:35:24.027 UTC Tue Aug 11 1998,DisconnectTime 22:35:29.028 UTC Tue Aug 11 1998, CallOrigin 1, ChargedUnits 0, InfoType 2,TransmitPackets 0, TransmitBytes 0, ReceivePackets 0, ReceiveBytes 0Example AAA Configuration
The authentication command line creates a method list named H.323 with RADIUS being its only member.
Note
Also note that the accounting command line looks like a regular RADIUS accounting command line for connection accounting. Connection accounting has to be globally enabled using this command line. Start-stop or stop only methods may be used.
The Cisco IOS software AAA user interface can be configured to use the H.323 accounting method as follows.
Guest
