AAA Engineering Rules

 

 

This section provides AAA engineering rules and guidelines that must be considered prior to configuring the system for AAA functionality.

 

AAA Interface Rules

The following engineering rules apply to the AAA interface including RADIUS and Diameter:

 

 

•	AAA interfaces are specified by assigning the IP address of a logical interface within a specific context as the RADIUS NAS IP Address (RFC-2865 and RFC-2866) within the same context. This is done using the radius attribute nas-ip-address command in the context configuration mode.

•	AAA interfaces in support of data services can be configured within any context.

Typically it exists in the:

•	Ingress context for PDSN and ASNGW services

•	Egress context for GGSN services

•	A AAA interface is selected in the following order:

•	NAI-based selection

•	Default AAA context

•	Last-resort AAA context

•	If all else fails defaults to the Ingress Context

•	AAA servers can be configured with “primary” and “backup” servers for any context.

•	Authentication and Accounting servers can be configured individually per context.

•	Multiple AAA contexts can be configured to support different accounting and authentication servers based on the domain where that the subscriber belongs.

•	AAA server group provides AAA functionality to the each subscriber separately with in the same context.

•	AAA server group for AAA functionality can be configured with following limits:

•	A total of 800 AAA server groups (including “default” server group) are available per context or system.

•	A maximum number of authentication/accounting servers per AAA server group is 128.

•	A maximum of 1600 servers can be configured in a context or a system, regardless of the number of server groups, with any combination for authentication and/or accounting.

•	A maximum of 800 NAS-IP addresses/NAS identifier (1 primary and 1 secondary per server group) can be configured per context.

 

 

Cisco Systems Inc.

Tel: 408-526-4000

Fax: 408-527-0883