Cisco IOS Intelligent Services Gateway Command Reference

aaa accounting redundancy

To set the Accounting, Authorization, and Authentication (AAA) platform redundancy accounting behavior, use the aaa accounting redundancy command in global configuration mode. To disable the accounting behavior, use the no form of this command.

aaa accounting redundancy { best-effort-reuse [send-interim] | new-session | suppress system-records }

no aaa accounting redundancy { best-effort-reuse [send-interim] | new-session | suppress system-records }

Syntax Description


best-effort-reuse	Tracks redundant accounting sessions as existing sessions after switchover.
send-interim	(Optional) Sends an interim accounting update after switchover.
new-session	Tracks redundant accounting sessions as new sessions after switchover.
suppress	Suppresses specific records upon switchover.
system-records	Suppresses system records upon switchover.

Command Default

A redundant session is set as a new session upon switchover.

Command Modes

Global configuration (config)

Command History


Release	Modification
15.0(1)M	This command was introduced in a release earlier than Cisco IOS Release 15.0(1)M.
Cisco IOS XE Release 2.6	This command was integrated into Cisco IOS XE Release 2.6.
Cisco IOS XE Release 3.5S	This command was modified. The send-interim keyword was added.

Usage Guidelines

Use the aaa accounting redundancy command to specify the AAA platform redundancy accounting behavior. This command also enables you to track the redundant sessions or existing sessions upon switchover.

Use the send-interim keyword to send the interim accounting record first after a switchover. The router sends the interim update for all sessions that survived the switchover as soon as the standby processor becomes active.

Examples

The following example shows how to set the AAA platform redundancy accounting behavior to track redundant sessions as existing sessions upon switchover:


Router(config)# aaa accounting redundancy best-effort-reuse

The following example shows how to enable the router to send the interim accounting record first after a switchover:


Router(config)# aaa accounting redundancy best-effort-reuse send-interim

Related Commands


Command	Description
aaa accounting delay-start	Specifies delay generation of accounting “start” records until the user IP address is established.
aaa authentication dot1x	Specifies one or more AAA methods for use on interfaces running IEEE 802.1X.

aaa authorization radius-proxy

To configure authentication, authorization, and accounting (AAA) authorization methods for Intelligent Services Gateway (ISG) RADIUS proxy subscribers, use the aaa authorization radius-proxy command in global configuration mode. To remove authorization methods for ISG RADIUS proxy subscribers, use the no form of this command.

aaa authorization radius-proxy { default | list-name } method1 [ method2 [ method3 . . . ] ]

no aaa authorization radius-proxy { default | list-name } method1 [ method2 [ method3 . . . ] ]

Syntax Description


default	Configures the specified method list as the default method list for ISG RADIUS proxy subscriber authorization.
`list-name`	Character string used to name the list of authorization methods.
`method1` , `method2` , `method3` , etc.	Specifies one or more authorization methods to be used for authorization. A method may be any of the following: group `group-name-` —Uses a subset of RADIUS servers for authorization as defined by the server group `group-name` command. group radius —Uses the list of all RADIUS servers for authentication as defined by the aaa group server radius command.

Command Default

A AAA method list for ISG RADIUS proxy clients is not specified.

Command Modes

Global configuration

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

Use the aaa authorization radius-proxy command to enable authorization and to create named method lists, which define authorization methods that are used to authorize ISG RADIUS proxy subscribers. Method lists for authorization define the ways in which authorization is performed and the sequence in which these methods are performed. A method list is a named list describing the authorization methods to be used, in sequence. Cisco IOS software uses the first method listed to authorize users for specific network services; if that method fails to respond, the Cisco IOS software selects the next method listed in the method list. This process continues until there is successful communication with a listed authorization method, or all methods defined are exhausted.

Examples

The following example configures an ISG RADIUS proxy authorization method list called “RP”. The server group called “EAP” is the method specified in that method list. The control policy called “PROXYRULE” contains a policy rule to send RADIUS proxy packets to the method list “RP”.


aaa group server radius EAP 
 server 10.2.36.253 auth-port 1812 acct-port 1813 
aaa authorization radius-proxy RP group EAP 
policy-map type control PROXYRULE
 class type control always event session-start
  1 proxy aaa list RP

Related Commands


Command	Description
aaa authorization	Sets parameters that restrict user access to a network.

aaa authorization subscriber-service

To specify one or more authentication, authorization, and accounting (AAA) service authorization method lists for the Cisco Intelligent Services Gateway (ISG) to use in providing subscriber service, use the aaa authorization subscriber-service command in global configuration mode. To remove this specification, use the no form of this command.

aaa authorization subscriber-service { default { cache | group | local } | list-name } method1 [ method2 . . . ]

no aaa authorization subscriber-service { default { cache | group | local } | list-name } method1 [ method2 . . . ]

Syntax Description


default	Used with either the cache , group or local keywords to select the default authorization method.
cache	Specifies the cached-group for the default authorization method.
group	Specifies the server-group for the default authorization method.
local	Specifies the local database for the default authorization method.
`list-name`	Character string used to name the list of authorization methods.
`method1` [`method2` ...]	Specifies an authorization method or (optionally) multiple authorization methods to be used for authorization. A method may be any one of the keywords listed in the table below.

Command Default

A method list is not specified.

Command Modes

Global configuration (config)

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

The table below lists the keywords that can be used with the aaa authorization subscriber-service command to specify authorization methods.

Table 1. aaa authorization subscriber-service Keywords
Keyword	Description
cache `name`	Uses the specified cache, which is located in the profile database, for authorization.
cache radius	Uses the cache for all RADIUS requests for subscriber service authorization.
cache tacacs	Uses the cache for all TACACS+ requests for subscriber service authorization.
group `name`	Uses a subset of RADIUS or TACACS+ servers for authorization as defined by the server group command.
group radius	Uses the list of all RADIUS servers for authentication as defined by the aaa group server radius command.
group tacacs	Uses the list of all TACACS+ servers for authorization as defined by the aaa group server tacacs+ command.
local	Uses the local database for authorization.

Cisco IOS software supports the following authorization methods for ISG subscriber services:

RADIUS--The network access server requests authorization information from the RADIUS security server group. RADIUS authorization defines specific rights for users by associating attributes, which are stored in a database on the RADIUS server, with the appropriate user.
TACACS+--The network access server exchanges authorization information with the TACACS+ security daemon. TACACS+ authorization defines specific rights for users by associating attribute-value (AV) pairs, which are stored in a database on the TACACS+ security server, with the appropriate user.
Local--The router or access server consults its local database, as defined by the username command, to authorize specific rights for users. Only a limited set of functions can be controlled via the local database.

When you create a named method list, you are defining a particular list of authorization methods for the indicated authorization type. Once defined, method lists must be applied to specific lines or interfaces before any of the defined methods will be performed.

If there is a method list configured for subscriber service authorization under the virtual template, then Cisco ISG will look for the method list configured using the aaa authorization subscriber-service command.

If the method list is not found, then Cisco ISG will look for a corresponding method list configured using the aaa authorization network command.

However, if the method list is not configured here too, then the subscriber service authorization is stopped.

The aaa authorization subscriber-service command causes a request packet containing a series of AV pairs to be sent to the RADIUS or TACACS daemon as part of the authorization process. The daemon can do one of the following:

Accept the request as is.
Make changes to the request.
Refuse the request and refuse authorization.

Examples

The following example defines the subscriber service authorization method list named “mygroup”, which specifies RADIUS authorization. If the RADIUS server fails to respond, local authorization will be performed.


aaa authorization subscriber-service mygroup group radius local

Related Commands


Command	Description
aaa group server radius	Groups different RADIUS server hosts into distinct lists and distinct methods.
aaa group server tacacs+	Groups different TACACS+ server hosts into distinct lists and distinct methods.
aaa new-model	Enables the AAA access control model.
radius-server host	Specifies a RADIUS server host.
tacacs-server host	Specifies a TACACS+ host.

aaa server radius dynamic-author

To configure a device as an authentication, authorization, and accounting (AAA) server to facilitate interaction with an external policy server, use the aaa server radius dynamic-author command in global configuration mode. To remove this configuration, use the no form of this command.

aaa server radius dynamic-author

no aaa server radius dynamic-author

Syntax Description

This command has no arguments or keywords.

Command Default

The device will not function as a server when interacting with external policy servers.

Command Modes

Global configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.
12.4	This command was integrated into Cisco IOS Release 12.4.
Cisco IOS XE Release 2.6	This command was integrated into Cisco IOS XE Release 2.6.
12.2(5)SXI	This command was integrated into Cisco IOS Release 12.2(5)SXI.
15.2(2)T	This command was integrated into Cisco IOS Release 15.2(2)T.

Usage Guidelines

Dynamic authorization allows an external policy server to dynamically send updates to a device. Once the aaa server radius dynamic-author command is configured, dynamic authorization local server configuration mode is entered. Once in this mode, the RADIUS application commands can be configured.

Dynamic Authorization for the Intelligent Services Gateway (ISG)

ISG works with external devices, referred to as policy servers, that store per-subscriber and per-service information. ISG supports two models of interaction between the ISG device and external policy servers: initial authorization and dynamic authorization.

The dynamic authorization model allows an external policy server to dynamically send policies to the ISG. These operations can be initiated in-band by subscribers (through service selection) or through the actions of an administrator, or applications can change policies on the basis of an algorithm (for example, change session quality of service (QoS) at a certain time of day). This model is facilitated by the Change of Authorization (CoA) RADIUS extension. CoA introduced peer-to-peer capability to RADIUS, enabling ISG and the external policy server each to act as a RADIUS client and server.

Examples

The following example configures the ISG to act as a AAA server when interacting with the client at IP address 10.12.12.12:


aaa server radius dynamic-author
 client 10.12.12.12 key cisco
 message-authenticator ignore

Related Commands


Command	Description
auth-type (ISG)	Specifies the server authorization type.
client	Specifies a RADIUS client from which a device will accept CoA and disconnect requests.
default	Sets a RADIUS application command to its default.
domain	Specifies username domain options.
ignore	Overrides a behavior to ignore certain paremeters.
port	Specifies a port on which local RADIUS server listens.
server-key	Specifies the encryption key shared with RADIUS clients.

aaa server radius policy-device

To enable Intelligent Services Gateway (ISG) RADIUS server configuration mode, in which the ISG RADIUS server parameters can be configured, use the aaa server radius policy-device command in global configuration mode. To remove the RADIUS server configuration, use the no form of this command.

aaa server radius policy-device

no aaa server radius policy-device

Syntax Description

This command has no arguments or keywords.

Command Default

RADIUS ISG parameters are not configured. No external policy device is configured.

Command Modes

Global configuration (config)

Command History


Release	Modification
12.2(33)SRC	This command was introduced.
12.2(33)SB	This command was integrated into Cisco IOS Release 12.2(33)SB

Usage Guidelines

The aaa server radius policy-device command enables ISG RADIUS server configuration mode, in which global ISG RADIUS server parameters can be configured.

Examples

The following example configures a shared encryption key for the RADIUS client and specifies authentication details.


Router(config)#aaa server radius policy-device
Router(config-locsvr-policy-device-radius)#key cisco
Router(config-locsvr-policy-device-radius)#client 10.1.1.13
Router(config-locsvr-policy-device-radius)#message-authenticator ignore

Related Commands


Command	Description
key	Configures a shared encryption key for the RADIUS clients.
client	Allows modification of RADIUS clients at run time.
message-authenticator	Authenticates messages from clients.

aaa server radius proxy

To enable Intelligent Services Gateway (ISG) RADIUS proxy configuration mode, in which ISG RADIUS proxy parameters can be configured, use the aaa server radius proxy command in global configuration mode. To remove the ISG RADIUS proxy configuration, use the no form of this command.

aaa server radius proxy

no aaa server radius proxy

Syntax Description

This command has no arguments or keywords.

Command Default

ISG RADIUS proxy parameters are not configured, and ISG does not serve as a RADIUS proxy.

Command Modes

Global configuration

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

The aaa server radius proxy command enables ISG RADIUS proxy server configuration mode, in which global RADIUS proxy parameters can be configured. The client command can be used in RADIUS proxy server configuration mode to specify a client for which RADIUS proxy parameters can be configured. Client-specific RADIUS proxy configurations take precedence over the global RADIUS proxy server configuration.

Examples

The following example configures the accounting port to be used by ISG for all RADIUS proxy clients:


aaa server radius proxy
 accounting port 1200

accounting aaa list

To enable Intelligent Services Gateway (ISG) accounting and specify an authentication, authorization, and accounting (AAA) method list to which accounting updates will be forwarded, use the accounting aaa list command in service policy-map configuration or service policy traffic class configuration mode. To disable ISG accounting, use the no form of this command.

accounting aaa list aaa-method-list

no accounting aaa list aaa-method-list

Syntax Description


`aaa-method-list`	AAA method list to which Accounting-Start, interim, and Accounting-Stop records will be sent.

Command Default

ISG accounting is not enabled.

Command Modes

Service policy-map configuration
Service policy traffic class configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

An ISG sends accounting records to the AAA method list specified by the accounting aaa list command. A AAA method list must also be configured by using the aaa accounting command. See the Cisco IOS Security Command Reference for more information.

Use the accounting aaa list command to enable per-session accounting by configuring the command in service policy-map configuration mode. Per-session accounting can also be configured on a remote AAA server by adding the ISG accounting attribute to a user profile or to a service profile that does not include a traffic class.

To enable per-flow accounting, enter the accounting aaa list command in service policy traffic class configuration mode. Per-flow accounting can also be configured on a remote AAA server by adding the ISG accounting attribute to a service profile that includes a traffic class.

Examples

The following example shows ISG per-session accounting configured for a service called “video1”:


policy-map type service video1
 accounting aaa list mlist1

The following example shows ISG per-flow accounting configured for a service called “video1”:


class-map type traffic match-any video1
 match access-group output 101
 match access-group input 100
!
policy-map type service video1
 class type traffic video1
  accounting aaa list mlist1

Related Commands


Command	Description
aaa accounting	Enables AAA accounting of requested services for billing or security purposes when you use RADIUS or TACACS+.

accounting method-list

To configure Intelligent Services Gateway (ISG) to forward accounting packets from RADIUS proxy clients to a specified server, use the accounting method-list command in RADIUS proxy server configuration mode or RADIUS proxy client configuration mode. To disable the forwarding of accounting packets from RADIUS proxy clients, use the no form of this command.

accounting method-list { list-name | default }

no accounting method-list { list-name | default }

Syntax Description


`list-name`	Name of the method list to which accounting packets are sent.
default	Specifies that accounting packets will be forwarded to the default RADIUS server.

Command Default

ISG RADIUS proxy handles accounting packets locally.

Command Modes

RADIUS proxy server configuration
RADIUS proxy client configuration

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

By default, ISG RADIUS proxy responds locally to accounting packets it receives. The accounting method-list command configures ISG to forward accounting packets from RADIUS proxy clients to a specified method list. Forwarding of accounting packets can be configured globally for all RADIUS proxy clients or on a per-client basis. The per-client configuration of this command overrides the global configuration.

The default method list is configured with the aaa accounting command.

Examples

The following example shows the ISG configured to forward accounting packets from all RADIUS proxy clients to the method list “RP-ACCT-MLIST”:


aaa group server radius RP-BILLING
 server 10.52.199.147 auth-port 1645 acct-port 1646
 server 10.52.199.148 auth-port 1812 acct-port 1813
!
aaa group server radius RP-BILLING-HOTSTANDBY
 server 10.52.200.20 auth-port 1645 acct-port 1646
 server 10.52.200.21 auth-port 1812 acct-port 1813
!
...
aaa accounting network RP-ACCT-MLIST start-stop broadcast group RP-BILLING group RP-BILLING-HOTSTANDBY
...
aaa server radius proxy
 key cisco
 accounting method-list RP-ACCT-MLIST
 client 10.52.100.20
 !
...
radius-server host 10.52.199.147 auth-port 1645 acct-port 1646 key troy
radius-server host 10.52.199.148 auth-port 1812 acct-port 1813 key tempest
radius-server host 10.52.200.20 auth-port 1645 acct-port 1646 key captain
radius-server host 10.52.200.21 auth-port 1812 acct-port 11813 key scarlet

Related Commands


Command	Description
aaa accounting	Enables AAA accounting of requested services for billing or security purposes when you use RADIUS or TACACS+.
aaa server radius proxy	Enables ISG RADIUS proxy configuration mode, in which ISG RADIUS proxy parameters can be configured.
client (ISG RADIUS proxy)	Enters ISG RADIUS proxy client configuration mode, in which client-specific RADIUS proxy parameters can be specified.

accounting port

To specify the port on which Intelligent Services Gateway (ISG) listens for accounting packets from RADIUS proxy clients, use the accounting port command in RADIUS proxy server configuration or RADIUS proxy client configuration mode. To return to the default value, use the no form of this command.

accounting port port-number

no accounting port

Syntax Description


`port-number`	Port on which ISG listens for accounting packets from RADIUS proxy clients. The default is 1646.

Command Default

ISG listens for accounting packets from RADIUS proxy clients on port 1646.

Command Modes

RADIUS proxy server configuration (config-locsvr-proxy-radius)
RADIUS proxy client configuration (config-locsvr-radius-client)

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

The accounting port can be specified globally for all RADIUS proxy clients, or it can be specified per client. The per-client configuration of this command overrides the global configuration.

Examples

The following example configures ISG to listen for accounting packets on port 1200 for all RADIUS proxy clients:


aaa server radius proxy
 accounting port 1200

The following example configures ISG to listen for accounting packets on port 1200 for the RADIUS proxy client with the IP address 10.10.10.10:


aaa server radius proxy
 client 10.10.10.10
  accounting port 1200

Related Commands


Command	Description
aaa server radius proxy	Enables ISG RADIUS proxy configuration mode, in which ISG RADIUS proxy parameters can be configured.
client (ISG RADIUS proxy)	Enters ISG RADIUS proxy client configuration mode, in which client-specific RADIUS proxy parameters can be specified.

arp ignore local

To prevent Intelligent Services Gateway (ISG) from replying to incoming Address Resolution Protocol (ARP) requests for destinations on the same interface, use the arp ignore local command in IP subscriber configuration mode. To reset to the default, use the no form of this command.

arp ignore local

no arp ignore local

Syntax Description

This command has no arguments or keywords.

Command Default

ISG replies to incoming ARP requests for destinations on the same interface.

Command Modes

IP subscriber configuration (config-subscriber)

Command History


Release	Modification
12.2(33)SRE1	This command was introduced.

Usage Guidelines

The arp ignore local command blocks ISG from replying to ARP requests received on an interface if the source and destination IP addresses for an ARP request are on the same VLAN that the interface is connected to, or if the destination IP address is in a different subnet but is routable from the interface where the ARP is received. ISG does, however, reply to ARP requests when the source and destination IP addresses are in the same subnet if the IP addresses belong to different VLANs.

If the arp ignore local command is configured and a subscriber session is in virtual routing and forwarding (VRF) transfer mode, ISG will reply to an ARP request from the customer premises equipment (CPE) if:

The ARP request is for an IP address on the access interface that is reachable by ISG within the VRF.
The destination IP address is not in the same VRF subnet as the VRF’s multiservice interface.

When the CPE receives the ARP reply and routes the corresponding IP packets to ISG, ISG routes the packets in the VRF domain.

Examples

The following example shows how to configure ISG to ignore ARP requests received on Ethernet interface 0/0.1 if the source and destination are in the same subnet:


Router(config)# interface ethernet 0/0.1
Router(config-subif)# ip subscriber l2-connected
Router(config-subscriber)# arp ignore local

Related Commands


Command	Description
show ip subscriber	Displays information about ISG IP subscriber sessions.

authenticate (control policy-map class)

To initiate an authentication request for an Intelligent Services Gateway (ISG) subscriber session, use the authenticate command in control policy-map class configuration mode. To remove an authentication request for an ISG subscriber session, use the no form of this command.

action-number authenticate [ variable varname ] [ aaa list { list-name | default } ]

no action-number authenticate [ variable varname ] [ aaa list { list-name | default } ]

Syntax Description


`action-number`	Number of the action. Actions are executed sequentially within the policy rule.
variable	(Optional) Authenticates using the contents of the `varname` value instead of the unauthenticated username. If you do not specify an aaa list , the default AAA authentication list is used.
`varname`	Specifies that user authentication will be performed on the contents of the `varname` value, if present.
aaa list	(Optional) Specifies that authentication will be performed using an authentication, authorization, and accounting (AAA) method list.
`list-name`	Specifies the AAA method list to which the authentication request will be sent.
`default`	Specifies the default AAA method list to which the authentication request will be sent.

Command Default

The control policy will not initiate authentication.

Command Modes

Control policy-map class configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.
12.2(31)SB2	The variable keyword and `varname` argument were added.

Usage Guidelines

The authenticate command configures an action in a control policy map.

Control policies define the actions the system will take in response to specified events and conditions. A control policy map is used to configure an ISG control policy. A control policy is made of one or more control policy rules. A control policy rule is an association of a control class and one or more actions. The control class defines the conditions that must be met before the actions will be executed. The actions are numbered and executed sequentially within the policy rule.

Note that if you specify the default method list, the default list will not appear in the output of the show running-config command. For example, if you configure the following command:


Router(config-control-policymap-class-control)# 1 authenticate aaa list default

the following will display in the output for the show running-config command:


1 authenticate

Named method lists will display in the show running-config command output.

Examples

The following example shows an ISG configured to initiate an authentication request upon account logon. The authentication request will be sent to the AAA method list called AUTH-LIST.


policy-map type control LOGIN
 class type control always event account-logon
  1 authenticate aaa list AUTH-LIST
  2 service-policy type service unapply BLIND-RDT

The following example shows the policy map configured to initiate an authentication request using a name stored in the variable NEWNAME, instead of unauthenticated-username, using the AAA list EXAMPLE. The authenticate statement is shown in bold:


policy-map type control REPLACE_WITH_example.com
 class type control always event session-start
  1 collect identifier unauthenticated-username
  2 set NEWNAME identifier unauthenticated-username
  3 substitute NEWNAME “(.*@).*” “\1example.com”
  4 authenticate variable NEWNAME aaa list EXAMPLE
  5 service-policy type service name example
policy-map type service abc
 service vpdn group 1
bba-group pppoe global
 virtual-template 1
!
interface Virtual-Template1
 service-policy type control REPLACE_WITH_example.com

Related Commands


Command	Description
class type control	Specifies a control class for which actions may be configured in an ISG control policy map.
policy-map type control	Creates or modifies a control policy map, which defines an ISG control policy.
set variable	Creates a temporary memory to hold the value of identifier types received by the policy manager.
substitute	Matches the contents, stored in temporary memory of identifier types received by the policy manager, against a specified `matching` `pattern` and performs the substitution defined in a `rewrite` `pattern.`

authenticate (service policy-map)

To specify authentication as a condition of service activation and initiate authentication requests for Intelligent Services Gateway (ISG) subscribers accessing a service, use the authenticate command in service policy-map configuration mode. To remove this specification, use the no form of this command.

authenticate aaa list name-of-list

no authenticate aaa list name-of-list

Syntax Description


aaa	Specifies that authentication will be performed using an authentication, authorization, and accounting (AAA) method list.
list `name-of-list`	Specifies the AAA method list to which the authentication request will be sent.

Command Default

Authentication is not specified as a condition of service activation.

Command Modes

Service policy-map configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

The authenticate (service policy-map) command specifies authentication as a condition of service activation in an ISG service policy map. Service policy maps define ISG subscriber services. Services can also be defined in service profiles. Service policy maps and service profiles serve the same purpose; the only difference between them is that a service policy map is defined on the local device using the policy-map type service command, and a service profile is configured on an external device, such as a AAA server.

Examples

The following example specifies authentication as a condition of service activation in the ISG service called “service1”:


policy-map type service service1
 authenticate aaa list mlist

Related Commands


Command	Description
policy-map type service	Creates or modifies a service policy map, which is used to define an ISG subscriber service.
show policy-map type service	Displays the contents of all service policy maps or a specific service policy map.

authentication port

To specify the port on which Intelligent Services Gateway (ISG) listens for authentication packets from RADIUS proxy clients, use the authentication port command in RADIUS proxy server configuration or RADIUS proxy client configuration mode. To return to the default setting in which ISG listens for accounting packets on port 1645, use the no form of this command.

authentication port port-number

no authentication port port-number

Syntax Description


`port-number`	Port on which ISG listens for authentication packets from RADIUS proxy clients. The default is 1645.

Command Default

ISG listens for authentication packets from RADIUS proxy clients on port 1645.

Command Modes

RADIUS proxy server configuration
RADIUS proxy client configuration

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

The authentication port can be specified globally for all RADIUS proxy clients, or it can be specified per client. The per-client configuration of this command overrides the global configuration.

Examples

The following example configures ISG to listen for authentication packets on port 1200 for all RADIUS proxy clients:


aaa server radius proxy
 authentication port 1200

The following example configures ISG to listen for authentication packets on port 1200 for the RADIUS proxy client with the IP address 10.10.10.10 :


aaa server radius proxy
 client 10.10.10.10
  authentication port 1200

Related Commands


Command	Description
aaa server radius proxy	Enables ISG RADIUS proxy configuration mode, in which ISG RADIUS proxy parameters can be configured.
client (ISG RADIUS proxy)	Enters ISG RADIUS proxy client configuration mode, in which client-specific RADIUS proxy parameters can be specified.

authorize identifier

To initiate a request for authorization based on a specified identifier in an Intelligent Services Gateway (ISG) control policy, use the authorize identifier command in control policy-map class configuration mode. To remove this action from the control policy map, use the no form of this command.

action-number authorize [ aaa { list-name | list { list-name | default } } [ password password ] ] [ upon network-service-found { continue | stop } ] [ use method authorization-type ] identifier identifier-type [ plus identifier-type ]

no action-number

Syntax Description


`action-number`	Sequential number of the action within the policy rule.
aaa	(Optional) Indicates that authorization is performed using authentication, authorization, and accounting (AAA).
`list-name`	(Optional) AAA method list to which the authorization request is sent.
default	Indicates that the default AAA method list is used.
password `password`	(Optional) Specifies the password used for AAA requests.
upon network-service-found continue	(Optional) Specifies that when a network service for the session is identified, actions in the policy rule will continue to be executed. The network service is applied later. This is the default.
upon network-service-found stop	(Optional) Specifies that when a network service for the session is identified, actions in the policy rule will no longer be executed, and the network service is applied.
use method `authorization-type`	(Optional) Specifies the authorization library to be used. Valid keywords for `authorization-type` are: aaa --AAA authorization. Default method. legacy --All authorization methods are attempted in the following order: Xconnect, SSG, RM, AAA, SGF. rm --Resource Manager (RM) authorization. sgf --Stack Group Forwarding (SGF) authorization. ssg --Service Selection Gateway (SSG) authorization. xconnect --Internal cross-connect authorization.
`identifier-type`	Item on which authorization is based. Valid keywords are: authenticated-domain --Authenticated domain name. authenticated-username --Authenticated username. auto-detect --Authorization is performed on the basis of circuit-ID or remote-ID, depending on the identifier provided by the edge device. circuit-id --Circuit ID. ctag-cos --Inner CoS tag associated with the service instance encapsulation. ctag-vlan-id --Specific inner tag (customer-VLAN tag) associated with the service instance encapsulation. dnis --Dialed Number Identification Service number (also referred to as the called-party number). mac-address --MAC address. nas-port --Network access server (NAS) port identifier. payload-etype --Ether type of the payload associated with the service instance encapsulation. peer-ip-address --Peer provider edge (PE) IP address, with tag for backup pseudowires. remote-id --Remote ID. source-ip-address --Source IP address. stag-cos --Outer CoS tag associated with the service instance encapsulation. stag-type --Outer tag type. stag-vlan-id --Outer tag (stacked-VLAN tag) associated with the service instance encapsulation. tunnel-name --Virtual Private Dialup Network (VPDN) tunnel name. unauthenticated-domain --Unauthenticated domain name. unauthenticated-username --Unauthenticated username. vendor-class-id `name` --Vendor class ID.
plus	(Optional) Separates identifiers if more than one is used for authorization. The circuit ID, remote ID, MAC address, and vendor class ID can be used in any combination.

Command Default

The control policy will not initiate authorization.

Command Modes

Control policy-map class configuration (config-control-policymap-class-control)

Command History


Release	Modification
12.2(28)SB	This command was introduced.
12.2(33)SRD	The vendor-class-id keyword was added.
Cisco IOS XE Release 2.2	This command was integrated into Cisco IOS XE Release 2.2.
15.1(2)S	This command was modified. The ctag-cos , ctag-vlan-id , stag-cos , stag-type , and stag-vlan-id keywords were added.

Usage Guidelines

The authorize identifier command configures an action in a control policy map. A control policy map is used to configure an ISG control policy, which defines the actions the system takes in response to specified events and conditions.

For sessions triggered by an unrecognized IP address, the MAC address should be used only when the subscriber is one hop away.

The auto-detect keyword allows authorization to be performed on Cisco Catalyst switches with remote-ID:circuit-ID and on DSL Forum switches with circuit-ID only.

Note that if you specify the default method list, the default list will not appear in the output of the show running-config command. For example, if you configure the following command:


Router(config-control-policymap-class-control)# 1 authorize aaa list default password ABC identifier nas-port

The following will be displayed in the output for the show running-config command:


1 authorize aaa password ABC identifier nas-port

Named method lists will be displayed in the show running-config command output.

When ISG automatic subscriber login is configured using the authorize identifier command, the ISG uses specified identifiers instead of the username in authorization requests, thus enabling a user profile to be downloaded from a AAA server as soon as packets are received from a subscriber.

Examples

In the following example, ISG is configured to send a request for authorization based on the source IP address. The system will perform this action at session start when the conditions that are defined in control class “CONDA” are met.


policy-map type control RULEA
 class type control CONDA event session-start
  1 authorize aaa list TAL_LIST password cisco identifier source-ip-address
  2 service-policy type service aaa list LOCAL service redirectprofile

Examples

In the following example, ISG is configured to send a request for authorization based on the source IP address. The system will perform this action at session start when the conditions that are defined in control class “CONDA” are met.


policy-map type control RULEA
 class type control CONDA event session-start
  1 authorize aaa list TAL_LIST password cisco identifier source-ip-address
  2 service-policy type service aaa list LOCAL service redirectprofile

Examples

In the following example, the ISG is configured to get the authorization data from an Accounting, Authentication, and Authorization (AAA) server.


policy-map type control SampleControlPolicyMap2
  class type control always event session-start
   1 authorize identifier stag-vlanid plus ctag-vlanid

Related Commands


Command	Description
class type control	Specifies a control class for which actions may be configured in an ISG control policy map.
policy-map type control	Creates or modifies a control policy map, which defines an ISG control policy.

auth-type (ISG)

To specify the type of authorization Intelligent Services Gateway (ISG) will use for RADIUS clients, use the auth-type command in dynamic authorization local server configuration mode. To return to the default authorization type, use the no form of this command.

auth-type { all | any | session-key }

no auth-type

Syntax Description

all

All attributes must match for authorization to be successful. This is the default.

any

Any attribute must match for authorization to be successful.

session-key

The session-key attribute must match for authorization to be successful.

Note

The only exception is if the session-id attribute is provided in the RADIUS Packet of Disconnect (POD) request, then the session ID is valid.

Command Default

All attributes must match for authorization to be successful.

Command Modes

Dynamic authorization local server configuration (config-locsvr-da-radius)

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

An ISG can be configured to allow external policy servers to dynamically send policies to the ISG. This functionality is facilitated by the Change of Authorization (CoA) RADIUS extension. CoA introduced peer to peer capability to RADIUS, enabling ISG and the external policy server each to act as a RADIUS client and server. Use the auth-type command to specify the type of authorization ISG will use for RADIUS clients.

Examples

The following example configures the ISG authorization type:


aaa server radius dynamic-author
 client 10.0.0.1
 auth-type any

Related Commands


Command	Description
aaa server radius dynamic-author	Configures an ISG as a AAA server to facilitate interaction with an external policy server.

available

To create a condition in an Intelligent Services Gateway (ISG) control policy that will evaluate true if the specified subscriber identifier is locally available, use the available command in control class-map configuration mode. To remove this condition, use the no form of this command.

available { authen-status | authenticated-domain | authenticated-username | dnis | media | mlp-negotiated | nas-port | no-username | protocol | service-name | source-ip-address | timer | tunnel-name | unauthenticated-domain | unauthenticated-username }

no available { authen-status | authenticated-domain | authenticated-username | dnis | media | mlp-negotiated | nas-port | no-username | protocol | service-name | source-ip-address | timer | tunnel-name | unauthenticated-domain | unauthenticated-username }

Syntax Description


authen-status	Subscriber authentication status.
authenticated-domain	Authenticated domain name.
authenticated-username	Authenticated username.
dnis	Dialed Number Identification Service number (called-party number).
media	Subscriber access media type.
mlp-negotiated	Identifier indicating that the session was established using multilink PPP negotiation.
nas-port	NAS port identifier.
no-username	Identifier indicating that the username is not available.
protocol	Subscriber access protocol type.
service-name	Service name currently associated with user.
source-ip-address	Source IP address.
timer	Policy timer name.
tunnel-name	Virtual Private Dial-Up Network (VPDN) tunnel name.
unauthenticated-domain	Unauthenticated domain name.
unauthenticated-username	Unauthenticated username.

Command Default

A condition that will evaluate true if the specified subscriber identifier is locally available is not created.

Command Modes

Control class-map configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

The available command is used to configure a condition within a control class map. A control class map, which is configured with the class-map type control command, specifies conditions that must be met for a control policy to be activated, and, optionally, the event that causes the class to be evaluated. A control class map can contain multiple conditions, each of which will evaluate to either true or false. Match directives can be used to specify whether all, any, or none of the conditions must evaluate true in order for the class as whole to evaluate true.

The class type control command is used to associate a control class map with a policy control map.

Examples

The following example shows a control class map called “class3” configured with three conditions. The match-all keyword indicates that all of the conditions must evaluate true before the class evaluates true. The class type control command associates “class3” with the control policy map called “rule4”.


class-map type control match-all class3
  match access-type pppoe
  match domain cisco.com
  available nas-port-id
!
policy-map type control rule4
  class type control class3
   authorize nas-port-id
!

Related Commands


Command	Description
class-map type control	Creates or modifies an ISG control class map.
class type control	Specifies a control class for which actions may be configured in an ISG control policy map.
policy-map type control	Create or modifies a control policy map, which defines an ISG control policy.

calling-station-id format

To specify the format — MAC address or MSISDN — of the Calling-Station-ID (attribute 31), use the calling-station-id format command in RADIUS proxy server configuration mode or RADIUS proxy client configuration mode. To return to the default format, use the no form of this command.

calling-station-id format { mac-address [ default | ietf | { one-byte | three-byte | two-byte } delimiter { colon | dot | hyphen } | none | unformatted ] [ lower-case | upper-case ] | msisdn }

no calling-station-id format { mac-address | msisdn }

calling-station-id format { mac-address { default | [ lower-case | upper-case ] | ietf [ lower-case | upper-case ] | none | one-byte delimiter | three-byte delimiter | two-byte delimiter { colon [ lower-case | upper-case ] | dot [ lower-case | upper-case ] | hyphen [ lower-case | upper-case ] } | unformatted [ lower-case | upper-case ] } | msisdn }

Syntax Description


mac-address	Specifies the MAC address in Calling-Station-ID (attribute 31).
none	Specifies an unspecified MAC address.
default	Specifies the MAC address in the default format (0000.4096.3e4a). The default is a two-byte format in lower case with dot as the delimiter.
ietf	Specifies the MAC address in the IETF format (00-00-40-96-3E-4A).
unformatted	Specifies an unformatted MAC address (000040963e4a).
one-byte	Specifies the MAC address in a one-byte format (00.00.40.96.3e.4a).
three-byte	Specifies the MAC address in a three-byte format (000040.963e4a).
two-byte	Specifies the MAC address in a two-byte format (0000.4096.3e4a).
delimiter	Specifies the delimiter used in the MAC address. The default is dot.
colon	Specifies colon (:) as the delimiter in the MAC address (00:00:40:96:3e:4a).
dot	Specifies dot (.) as the delimiter in the MAC address (00.00.40.96.3e.4a).
hyphen	Specifies hyphen (-) as the delimiter in the MAC address (00-00-40-96-3e-4a).
lower-case	(Optional) Specifies the alphabets in the MAC address in lower case.
upper-case	(Optional) Specifies the alphabets in the MAC address in upper case.
msisdn	Sets the Mobile Station Integrated Services Digital Network (MSISDN) in attribute 31.

Command Default

The default format of the Calling-station-ID is the MAC address.

Command Modes

RADIUS proxy server configuration (config-locsvr-proxy-radius)

RADIUS proxy client configuration (config-locsvr-radius-client)

Command History


Release	Modification
12.2(33)SRE	This command was introduced.
Cisco IOS XE Release 2.5	This command was integrated into Cisco IOS XE Release 2.5.
15.0(1)S	This command was integrated into Cisco IOS Release 15.0(1)S.
Cisco IOS XE Release 3.7S	This command was modified. The one-byte , three-byte , two-byte , delimiter , colon , dot , hyphen , lower-case , and upper-case keywords were added.
15.3(01)S	This command was modified. The none keyword was added.

Usage Guidelines

Use the calling-station-id format command to differentiate and identify the Intelligent Services Gateway (ISG) subscriber session based on the downstream device type and receive the session values in Calling-Station-ID (attribute 31). In a Public Wireless LAN (PWLAN) environment, attribute 31 is a MAC address and in a Gateway General Packet Radio Service (GPRS) Support Node (GGSN) environment, attribute 31 is a Mobile Station Integrated Services Digital Network (MSISDN).

If a format is not specified for the MAC address using the calling-station-id format command, the default format (0000.4096.3e4a) is automatically configured for the MAC address.

Examples

The following example shows how to configure ISG to specify MSISDN as the calling station ID for a RADIUS proxy server:


Device(config)# aaa new-model
Device(config)# aaa server radius proxy
Device(config-locsvr-proxy-radius)# calling-station-id format msisdn

Related Commands


Command	Description
aaa new-model	Enables the AAA access control model.
aaa server radius proxy	Enables ISG RADIUS proxy configuration mode, in which ISG RADIUS proxy parameters can be configured.
client (ISG RADIUS proxy)	Enters ISG RADIUS proxy client configuration mode, in which client-specific RADIUS proxy parameters can be specified.
client session-identifier	Correlates RADIUS server requests and identifies a session in the ISG RADIUS proxy.

class type control

To specify a control class for which actions may be configured in an Intelligent Services Gateway (ISG) control policy, use the class type control command in control policy-map configuration mode. To remove the control class from the control policy map, use the no form of this command.

class type control { control-class-name | always } [ event { access-reject | account-logoff | account-logon | acct-notification | credit-exhausted | dummy-event | flow-timeout | quota-depleted | radius-timeout | service-failed | service-start | service-stop | session-default-service | session-restart | session-service-found | session-start | timed-policy-expiry } ]

no class type control { control-class-name | always } [ event { access-reject | account-logoff | account-logon | acct-notification | credit-exhausted | dummy-event | quota-depleted | radius-timeout | service-failed | service-start | service-stop | session-default-service | session-restart | session-service-found | session-start | timed-policy-expiry } ]

Syntax Description


`control-class-name`	Name of the control class map.
always	Creates a control class that always evaluates true.
event	Causes the control class to be evaluated upon occurrence of a specific event.
access-reject	Event that fails the RADIUS authentication.
account-logoff	Event that occurs upon account logout.
account-logon	Event that occurs upon account login.
acct-notification	Event that occurs upon accounting notification.
credit-exhausted	Event that occurs when the prepaid billing server returns a quota of zero and a prepaid idle timeout greater than zero.
dummy-event	Event that tests suspendable actions.
flow-timeout	Event that occurs upon flow timeout of a service.
quota-depleted	Event that occurs when the allocated quota has been used up.
radius-timeout	Event that times out the RADIUS during authentication.
service-failed	Event that occurs when a service fails.
service-start	Event that occurs upon receipt of a request to start a service.
service-stop	Event that occurs upon receipt of a request to stop a service.
session-default-service	Event that occurs when ISG has provided a default service.
session-restart	Event that occurs upon a session restart following the recovery of a Dynamic Host Configuration Protocol (DHCP)-initiated IP session.
session-service-found	Event that occurs when a network policy has been determined for the session.
session-start	Event that occurs upon session start.
timed-policy-expiry	Event that occurs when a timed policy expires.

Command Default

A control class is not specified in a control policy map.

Command Modes

Control policy-map configuration (config-control-policymap)

Command History


Release	Modification
12.2(28)SB	This command was introduced.
12.2(31)SB2	This command was modified. The session-restart keyword was added.
12.2(33)SRC	This command was modified. The acct-notification keyword was added.
12.2(33)SB	This command was integrated into Cisco IOS Release 12.2(33)SB.
Cisco IOS XE Release 2.2	This command was integrated into Cisco IOS XE Release 2.2.
12.2(33)SRE	This command was modified. The access-reject and radius-timeout keywords were added.
Cisco IOS XE Release 2.5	This command was modified. The access-reject and radius-timeout keywords were added.

Usage Guidelines

A control class map defines the conditions that must be met and events that must occur before a set of actions will be executed. Use the class type control command to associate a control class map with one or more actions in a control policy map. The association of a control class and a set of actions is called a control policy rule.

Using the class type control command with the always keyword creates a control policy rule that will always be treated as the lowest-priority rule in a control policy map.

To create a named control class map, use the class-map type control command.

The session-restart keyword applies to DHCP-initiated IP sessions only.

Using the class type control command with the acct-notification keyword causes the control class to be evaluated upon occurrence of an accounting notification.

Examples

The following example shows the configuration of a class map called “class3”. The class type control command adds “class3” to the control policy map “policy1”. When “class3” evaluates true, the action associated with the class will be executed.


class-map type control match-all class3
  match access-type pppoe
  match domain cisco.com
  available nas-port-id
!
policy-map type control policy1
  class type control class3
   authorize nas-port-id
!
service-policy type control rule4

Related Commands


Command	Description
class-map type control	Creates an ISG control class map.
policy-map type control	Creates or modifies a control policy map, which defines an ISG control policy.
service-policy type control	Applies a control policy to a context.

class type traffic

To associate an Intelligent Services Gateway (ISG) traffic class map with a service policy map, use the class type traffic command in service policy-map configuration mode. To remove a traffic class from the service policy map, use the no form of this command.

[priority] class type traffic { class-map-name | default { in-out | input | output } }

no [priority] class type traffic { class-map-name | default { in-out | input | output } }

Syntax Description


`priority`	(Optional) Specifies the relative priority of the traffic class. Traffic class priority determines the order in which traffic policies are applied to a session. Range is 1 to 1000, where 1 is the highest priority and 1000 is the lowest. Default is 0 (undefined).
`class-map-name`	Name of a previously configured traffic class map.
default	Specifies the default traffic class.
in-out	Specifies the default traffic class for input and output traffic.
input	Specifies the default traffic class for input traffic.
output	Specifies the default traffic class for output traffic.

Command Default

A traffic class is not specified.

Command Modes

Service policy-map configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

Before you can specify a named traffic class map in a service policy map, the traffic class map must be configured using the class-map type traffic command.

The priority of a traffic class determines which class will be used first for a specified match in cases where more than one traffic policy has been activated for a single session. In other words, if a packet matches more than one traffic class, it will be classified to the class with the higher priority. The priority should be specified if packets must match a traffic class based on the order of the service policy.

The default traffic class map is applied if none of the other configured classes matches the traffic. At least one other traffic class must be configured. The default traffic class map is not applied if there are no other traffic classes configured. It cannot be assigned a priority because by default it is the lowest priority class. The default policy of the default traffic class is to pass traffic. You can also configure the default traffic class to drop traffic.

Examples

The following example shows the configuration of the traffic class “UNAUTHORIZED_TRAFFIC”:


class-map type traffic UNAUTHORIZED_TRAFFIC
 match access-group input 100
policy-map type service UNAUTHORIZED_REDIRECT_SVC
 class type traffic UNAUTHORIZED_TRAFFIC
  redirect to ip 10.0.0.148 port 8080

The following example shows the configuration of the default traffic class:


policy-map type service SERVICE1
 class type traffic CLASS1
  prepaid-config PREPAID
 class type traffic default in-out
  drop

Related Commands


Command	Description
class-map type traffic	Creates or modifies a traffic class map, which is used for matching packets to a specified ISG traffic class.
policy-map type service	Creates or modifies a service policy map, which is used to define an ISG subscriber service.
show class-map type traffic	Displays traffic class maps and their matching criteria.

class-map type control

To create an Intelligent Services Gateway (ISG) control class map, which defines the conditions under which the actions of a control policy map will be executed, use the class-map type control command in global configuration mode. To remove a control class map, use the no form of this command.

class-map type control [ match-all | match-any | match-none ] class-map-name

no class-map type control [ match-all | match-any | match-none ] class-map-name

Syntax Description


match-all	(Optional) The class map evaluates true if all of the conditions in the class map evaluates true.
match-any	(Optional) The class map evaluates true if any of the conditions in the class map evaluates true.
match-none	(Optional) The class map evaluates true if none of the conditions in the class map evaluates true.
`class-map-name`	Name of the class map.

Command Default

A control class map is not created.

Command Modes

Global configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

A control class map specifies conditions that must be met for a control policy to be activated, and, optionally, the event that causes the class to be evaluated. A control class map can contain multiple conditions, each of which will evaluate to either true or false. Use the match-any , match-all , and match-none keywords to specify which, if any, conditions must evaluate true before the control policy will be executed.

A control policy map, which is configured with the policy-map type control command, contains one or more control policy rules. A control policy rule associates a control class map with one or more actions. Use the class type control command to associate a control class map with a control policy map.

Examples

The following example shows how to configure a control policy in which virtual private dial-up network (VPDN) forwarding is applied to anyone dialing in from “xyz.com”:


class-map type control match-all MY-FORWARDED-USERS
 match unauthenticated-domain "xyz.com"
!
policy-map type control MY-POLICY
 class type control MY-FORWARDED-USERS event session-start
  1 apply identifier nas-port
  2 service local
!
interface Dialer1
 service-policy type control MY-POLICY

Related Commands


Command	Description
class type control	Specifies a control class for which actions may be configured in an ISG control policy map.
policy-map type control	Creates or modifies a control policy map, which defines an ISG control policy.

class-map type traffic

To create or modify a traffic class map, which is used for matching packets to a specified Intelligent Services Gateway (ISG) traffic class, use the class-map type traffic command in global configuration mode. To remove a traffic class map, use the no form of this command.

class-map type traffic match-any class-map-name

no class-map type traffic match-any class-map-name

Syntax Description


match-any	Indicates that packets must meet one of the match criteria in order to be considered a member of the class.
`class-map-name`	Name of the class map.

Command Default

A traffic class map is not created.

Command Modes

Global configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

Use the class-map type traffic command to create an ISG traffic class map that contains traffic class match criteria. The class-map type traffic command enables traffic class-map configuration mode, in which you can enter match commands to configure the match criteria for this class. Packets are checked against the match criteria configured for a class map to determine if the packet belongs to that traffic class.

ISG traffic classes allow subscriber session traffic to be subclassified so that ISG features can be applied to constituent flows. Traffic policies, which define the handling of data packets, contain a traffic class and one or more features.

After a traffic class map has been defined, use the class type traffic command to associate the traffic class map with a service policy map. A service can contain one traffic class and the default class.

Examples

The following example shows the configuration of a traffic class map called “CLASS-ACL-101”. The class map is defined so that input traffic matching access list 101 will match the class. The traffic class map is then referenced in service policy map “mp3”.


class-map type traffic match-any CLASS-ACL-101
 match access-group input 101
!
policy-map type service mp3
 class type traffic CLASS-ACL-101
  authentication method-list cp-mlist
  accounting method-list cp-mlist
  prepaid conf-prepaid

Related Commands


Command	Description
class type traffic	Associates a traffic class map with a service policy map.
match access-group (ISG)	Configures the match criteria for a class map on the basis of the specified access control list (ACL).

classname

To associate a Dynamic Host Configuration Protocol (DHCP) pool or remote DHCP server with an Intelligent Services Gateway (ISG) service policy map, use the classname command in service policy-map configuration mode. To remove this association, use the no form of this command.

classname class-name

no classname class-name

Syntax Description


`class-name`	Class name associated with a DHCP pool or remote server.

Command Default

An ISG service is not associated with a DHCP pool.

Command Modes

Service policy-map configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Usage Guidelines

ISG can influence the IP address pool and the DHCP server that are used to assign subscriber IP addresses. To enable ISG to influence the IP addresses assigned to subscribers, you associate a DHCP address pool class with an address domain. The DHCP address pool class must also be configured in a service policy map, service profile, or user profile, which is associated with a subscriber. When a DHCP request is received from a subscriber, DHCP uses the address pool class that is associated with the subscriber to determine which DHCP address pool should be used to service the request. As a result, on a per-request basis, an IP address is provided by the local DHCP server or relayed to a remote DHCP server that is defined in the selected pool.

Examples

In the following example, the DHCP class “blue” is specified in the service “my_service”. When “my_service” is activated, the local DHCP component will provide a new IP address from the pool “blue-pool” because (a) the classes match and (b) the subnet defined in “relay source” corresponds to one of the subnets defined at the interface. Hence the DHCP DISCOVER packet is relayed to the server at address 10.10.2.1, and the local DHCP component acts as a relay.


ip dhcp pool blue-pool
 relay source 10.1.0.0 255.255.0.0
 class blue
  relay destination 10.10.2.1 vrf blue
policy-map type service my_service
 classname blue

Related Commands


Command	Description
policy-map type service	Creates or modifies a service policy map, which is used to define an ISG service.

clear class-map control

To clear the Intelligent Services Gateway (ISG) control class map counters, use the clear class-map control command in privileged EXEC mode.

clear class-map control

Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Examples

The following example shows how to clear the control class map counters:


Router# clear class-map control

Related Commands


Command	Description
class-map type control	Creates an ISG control class map.
class type control	Specifies a control class for which actions may be configured in an ISG control policy map.
show class-map type control	Displays information about ISG control class maps.

clear ip subscriber

To disconnect and remove all or specified Intelligent Services Gateway (ISG) IP subscriber sessions, use the clear ip subscriber command in privileged EXEC mode.

Syntax Description


interface `interface-name`	(Optional) Clears IP subscriber sessions associated with the specified interface on the Cisco 7600 series router.
mac `mac-address`	(Optional) Clears IP subscriber sessions that have the specified MAC address.
slot `slot-number` no-hardware	(Optional) Clears IP subscriber sessions associated with the specified slot from which a line card is removed on the Cisco 7600 series router.
vrf `vrf-name`	(Optional) Clears IP subscriber sessions associated with the specified virtual routing and forwarding (VRF) instance.
dangling `seconds`	(Optional) Clears IP subscriber sessions that have remained unestablished for the specified number of seconds. Range: 1 to 3600.
ip `ip-address`	(Optional) Clears IP subscriber sessions that have the specified IP address.
statistics	(Optional) Clears statistics for IP subscriber sessions.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
12.2(31)SB2	This command was introduced.
12.2(33)SRC	Support was added for this command on Cisco 7600 series routers.
Cisco IOS XE Release 2.2	This command was integrated into Cisco IOS XE Release 2.2.
12.2(33)SRE1	This command was modified. The statistics keyword was added.

Usage Guidelines

A session that has not been fully established within a specified period of time is referred to as a dangling session. The clear ip subscriber command can be used with the dangling keyword to disconnect and remove dangling sessions. The seconds argument allows you to specify how long the session has to remain unestablished before it is considered dangling.

Session Removal: Cisco 7600 Series Routers Only

This command removes only IP sessions (MAC or IP), not IP interface sessions.

The interface and slot no-hardware keywords are available only on Cisco 7600 series routers.

Examples

The following example shows how to clear all dangling sessions that are associated with vrf1:


Router# clear ip subscriber vrf vrf1 dangling 10

Examples

The following example shows how to clear sessions that are associated with Gigabit Ethernet interface 0/1 on a Cisco 7600 series router:


Router# clear ip subscriber interface GigabitEthernet 0/1

The following example shows how to clear sessions that are associated with a line card that was removed from slot 1 on a Cisco 7600 series router:


Router# clear ip subscriber slot 1 no-hardware

Related Commands


Command	Description
show ip subscriber	Displays information about ISG IP subscriber sessions.

clear radius-proxy client

To clear all Intelligent Services Gateway (ISG) RADIUS proxy sessions for a specific client, use the clear radius-proxy client command in privileged EXEC mode.

clear radius-proxy client ip-address [ vrf vrf-name ]

Syntax Description

ip-address

IP address of the client device.

vrf vrf-name

(Optional) Virtual routing and forwarding instance (VRF) associated with the client.

Note

The vrf vrf-name option is not supported in Cisco IOS Release 12.2(31)SB2.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Examples

The following example clears all sessions associated with the RADIUS proxy client that has the IP address 10.10.10.10 and associated is with the VRF “blue”:


clear radius-proxy client 10.10.10.10 vrf blue

Related Commands


Command	Description
clear radius-proxy session	Clears specified ISG RADIUS proxy sessions.

clear radius-proxy session

To clear specific Intelligent Services Gateway (ISG) RADIUS proxy sessions, use the clear radius-proxy session command in privileged EXEC mode.

clear radius-proxy session { id radius-proxy-ID | ip ip-address [ vrf vrf-name ] }

Syntax Description

id radius-proxy-ID

ISG RADIUS proxy ID.

ip ip-address

IP address associated with the RADIUS proxy session.

vrf vrf-name

(Optional) Virtual routing and forwarding instance (VRF) associated with the session.

Note

The vrf vrf-name option is not supported in Cisco IOS Release 12.2(31)SB2.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

The RADIUS proxy session ID can be identified in the output of the show radius-proxy client command.

Examples

The following example shows how to identify the RADIUS proxy session ID by using the show radius-proxy client command:


show radius-proxy client 10.45.45.3
Configuration details for client 10.45.45.3
 Shared secret:     radprxykey           Msg Auth Ignore:   No
 Local auth port:   1111                 Local acct port:   1646
 Acct method list: FWDACCT
Session Summary:
      RP ID       IP Address
   1. 1694498816  unassigned ----> 1694498816 is the session id

The following example clears the ISG RADIUS proxy session with the ID 1694498816:


clear radius-proxy session id 1694498816

Related Commands


Command	Description
clear radius-proxy client	Clears all ISG RADIUS proxy sessions for a specific client.
show radius-proxy client	Displays information about ISG RADIUS proxy client devices.

clear subscriber policy dpm statistics

To clear the statistics for DHCP policy module (DPM) session contexts, use the clear subscriber policy dpm statistics command in privileged EXEC mode.

clear subscriber policy dpm statistics

Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
12.2(33)SB9	This command was introduced.

Usage Guidelines

The clear subscriber policy dpm statistics command resets all DPM event trace counters to zero. To display the cumulative statistics for DPM session contexts, use the show subscriber policy dpm statistics command.

Examples

The following example shows how to clear DPM event trace statistics:


Router# clear subscriber policy dpm statistics

Related Commands


Command	Description
show subscriber policy dpm context	Displays event traces for DPM session contexts.
show subscriber policy dpm statistics	Displays statistics for DPM event traces.

clear subscriber policy peer

To clear the display of the details of a subscriber policy peer connection, use the clear subscriber policy peer command in privileged EXEC mode.

clear subscriber policy peer { address ip-address | handle connection-handle-id | session | all }

Syntax Description


address	Clears the display of a specific peer connection, identified by its IP address.
`ip-address`	IP address of the peer connection to be cleared.
handle	Clears the display of a specific peer connection, identified by its handle.
`connection-handle-id`	Handle ID for the peer connection handle.
session	Clears the display of sessions with the given peer.
all	Clears the display of all peer connections.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
12.2(33)SRC	This command was introduced.
12.2(33)SB	This command was integrated into Cisco IOS Release 12.2(33)SB

Usage Guidelines

The clear subscriber policy peer command ends the peering relationship between the Intelligent Services Gateway (ISG) device and selected Service Control Engine (SCE) devices. However, the SCE will attempt to reconnect with the ISG device after a configured amount of time. The clear subscriber policy peer command can remove select session associations from a particular SCE device.

Examples

The following example shows how the clear subscriber policy peer command is used at the router prompt to clear the display of all details of the subscriber policy peer connection.


Router# clear subscriber policy peer all

Related Commands


Command	Description
show subscriber-policy peer	Displays the details of a subscriber policy peer.
subscriber-policy	Defines or modifies the forward and filter decisions of the subscriber policy.

clear subscriber policy peer session

To clear the display of the details of a subscriber policy peer session, use the clear subscriber policy peer session command in privileged EXEC mode.

clear subscriber policy peer session { guid guid-value | all } [ address ip-address | handle connection-handle-id | all ]

Syntax Description


guid	Clears the display of a specific policy peer session, identified by a globally unique identifier.
`guid-value`	Globally unique identifier of the peer session to be cleared.
all	Clears the display of all peer sessions.
address	Clears the display of a specific peer session, identified by its IP address.
`ip-address`	IP address of the peer session to be cleared.
handle	Clears the display of a specific peer session, identified by its handle.
`connection-handle-id`	Handle ID for the peer session handle.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
12.2(33)SRC	This command was introduced.
12.2(33)SB	This command was integrated into Cisco IOS Release 12.2(33)SB.

Usage Guidelines

The clear subscriber policy peer session command ends the peering relationship between the Intelligent Services Gateway (ISG) device and selected Service Control Engine (SCE) devices. However, the SCE will attempt to reconnect with the ISG device after a configured amount of time. The clear subscriber policy peer session command can remove select session associations from a particular SCE.

Examples

The following example shows how the clear subscriber policy peer session command is used at the router prompt to clear the display of all the details of a subscriber policy peer session.


Router# clear subscriber policy peer session all

Related Commands


Command	Description
clear subscriber-policy peer	Displays the details of a subscriber policy peer.
show subscriber-policy peer	Displays the details of a subscriber policy peer.
subscriber-policy	Defines or modifies the forward and filter decisions of the subscriber policy.

clear subscriber lite-session

To delete the displayed details of an Intelligent Service Gateway (ISG) subscriber lite session, use the clear subscriber lite-session command in privileged EXEC mode.

clear subscriber lite-session ip ip-address [ vrf vrf-name ]

Syntax Description


ip `ip-address`	Clears the ISG lite session that is associated with the specified IP address.
vrf `vrf-name`	(Optional) Clears the ISG lite session that is associated with the specified virtual routing and forwarding (VRF) instance.

Command Default

Information displayed about an ISG subscriber lite session is not cleared.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
Cisco IOS XE Release 3.7S	This command was introduced.

Usage Guidelines

A lite session or walk-by session is a light-weight unauthenticated Intelligent Services Gateway (ISG) session. Lite sessions are created on ISG to support walk-by users and optimize resource usage. A dedicated or a regular session is a full-fledged ISG subscriber session created for authenticated users. The clear subscriber lite-session command is used to clear the displayed details of a lite session.

Examples

The following example shows how to clear the lite session associated with IP address 203.0.113.1 and VRF v1. In the example given below, the first show subscriber lite-session command displays information about the lite session associated with IP address 203.0.113.1 and VRF v1. When you use the clear subscriber lite-session ip ip-address vrf vrf-name command, information about the lite session associated with IP address 203.0.113.1 and VRF v1 is cleared. The second show subscriber lite-session command output shows that the information about the lite session associated with IP address 203.0.113.1 and VRF v1 is cleared.

Device# show subscriber lite-session

Total lite sessions up: 1
Src-IP       VRF     Up-time(sec) Interface   PBHK
203.0.113.1   v1       21          Gi0/0/2     192.0.2.1:0

Device# clear subscriber lite-session ip 203.0.113.1 vrf v1
Device# show subscriber lite-session

Total lite sessions up: 0
Src-IP       VRF     Up-time(sec) Interface   PBHK

Related Commands


Command	Description
clear subscriber session	Clears the displayed details of an ISG subscriber default service session.
show subscriber lite-session	Displays information about ISG subscriber lite sessions.

clear subscriber session

To delete the displayed details of an Intelligent Service Gateway (ISG) subscriber service default session, use the clear subscriber session command in privileged EXEC mode.

clear subscriber session { all | identifier | uid unique-id | username username }

Syntax Description


all	Clears all ISG default sessions.
identifier `identifier`	Clears ISG default sessions that match the specified identifier. Valid keywords and arguments are: authen-status —Displays information for sessions with the specified authentication status. authenticated —Displays information for sessions that have been authenticated. unauthenticated —Displays information for sessions that have not been authenticated. authenticated-domain `domain-name` —Displays information for sessions with the specified authenticated domain name. authenticated-username `username` —Displays information for sessions with the specified authenticated username. auto-detect —Displays information for sessions that use auto-detect. (Authorization is performed on the basis of circuit-ID or remote-ID.) dnis `number` —Displays information for sessions with the specified Dialed Number Identification Service (DNIS) number. mac-address `mac-address` —Displays information for sessions with the specified MAC address. media `type` —Displays information for sessions that use the specified type of access media. Valid values for the `type` argument are: async —Async atm —ATM ether —Ethernet ip —IP isdn —ISDN mpls —Multiprotocol Label Switching (MPLS) sync —Serial nas-port `port-identifier` —Displays information for sessions with the specified network access server (NAS) port identifier. Valid keywords and arguments are one or more of the following: adapter `adapter-number` channel `channel-number` circuit-id `circuit-identifier` ipaddr `ip-address` port `port-number` remote-id `shelf-number` shelf `shelf-number` slot `slot number` sub-interface `sub-interface-number` type `interface type` vci `virtual-channel-identifier` vendor-class-id `vendor-class-identifier` vlan `virtual-lan-id` vpi `virtual-path-identifier` protocol —Displays information for sessions that use the specified type of access protocol. Valid values for the `type` argument are: atom —Any Transport over MPLS (ATOM) access protocol. ether —Ethernet access protocol. ip —IP access protocol. pdsn —Packet Data Serving Node (PDSN) access protocol. ppp —Point-to-Point Protocol (PPP) access protocol. vpdn —Virtual Private Dialup Network (VPDN) access protocol. source-ip-address `ip-address subnet-mask` —Displays information for sessions associated with the specified source IP address. timer `timer-name` —Displays information for sessions that use the specified timer. tunnel-name `tunnel-name` —Displays information for sessions associated with the specified VPDN tunnel. unauthenticated-domain `domain-name` —Displays information for sessions with the specified unauthenticated domain name. unauthenticated-username `username` —Displays information for sessions with the specified unauthenticated username. vrf `vrf-name` —Displays information for sessions with the specified virtual routing and forwarding (VRF) identifier.
uid `unique-id`	Clears the ISG default session that matches the specified unique ID.
username `username`	Clears the ISG default session that matches the specified username.

Command Default

Information displayed about an ISG subscriber default session is not cleared.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
Cisco IOS XE Release 3.7S	This command was introduced.

Examples

The following example shows how to clear a default session with unique ID 19. The fields in the show subscriber default-session output are self-explanatory.

In the example given below, the first show subscriber default-session command displays information about the default session with unique ID 19. When you use the clear subscriber session uid command, information about the default session with unique ID 19 is cleared.

The second show subscriber default-session command output shows that the information about the default session with unique ID 19 is cleared and a new default session with unique ID 20 is displayed.

Device# show subscriber default-session

UID     Lite-sessions  Interface
19      0              GigabitEthernet0/0/4

Device# clear subscriber session uid 19
Device# show subscriber default-session

UID     Lite-sessions  Interface
20      0              GigabitEthernet0/0/4

Related Commands


Command	Description
clear subscriber lite-session	Clears the displayed details of an ISG subscriber lite session.
show subscriber default-session	Displays information about ISG subscriber default sessions.

clear subscriber trace history

To clear the event trace history logs for Intelligent Services Gateway (ISG) subscriber sessions, use the clear subscriber trace history command in privileged EXEC mode.

clear subscriber trace history { dpm | pm }

Syntax Description


dpm	Clears DHCP policy module (DPM) trace history.
pm	Clears policy manager (PM) trace history.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
12.2(33)SB9	This command was introduced.

Usage Guidelines

The clear subscriber trace history command deletes all event traces that are stored in the specified module’s history log. This command also clears the current records counter and current log size counter for the show subscriber trace statistics command.

Examples

The following example shows how to clear the trace history for the DPM.


Router# clear subscriber trace history dpm

Related Commands


Command	Description
show subscriber trace history	Displays the event traces for ISG subscriber sessions that are saved in the trace history log.
show subscriber trace statistics	Displays statistics about the event traces for ISG subscriber sessions that were saved to the history log.
subscriber trace event	Enables event tracing for software modules involved in ISG subscriber sessions.
subscriber trace history	Enables saving the event traces for ISG subscriber sessions to the history log.

client

To specify a RADIUS client from which a device will accept Change of Authorization (CoA) and disconnect requests, use the client command in dynamic authorization local server configuration mode. To remove this specification, use the no form of this command.

client { name | ip-address } [ key [ 0 | 7 ] word ] [ vrf vrf-id ]

no client { name | ip-address } [ key [ 0 | 7 ] word ] [ vrf vrf-id ]

Syntax Description


`name`	Hostname of the RADIUS client.
`ip-address`	IP address of the RADIUS client.
key	(Optional) Configures the RADIUS key to be shared between a device and a RADIUS client.
0	(Optional) Specifies that an unencrypted key will follow.
7	(Optional) Specifies that a hidden key will follow.
`word`	(Optional) Unencrypted server key.
vrf `vrf-id`	(Optional) Virtual Routing and Forwarding (VRF) ID of the client.

Command Default

CoA and disconnect requests are dropped.

Command Modes

Dynamic authorization local server configuration

Command History


Release	Modification
12.2(28)SB	This command was introduced.
Cisco IOS XE Release 2.6	This command was integrated into Cisco IOS XE Release 2.6.

Usage Guidelines

A device (such as a router) can be configured to allow an external policy server to dynamically send updates to the router. This functionality is facilitated by the CoA RADIUS extension. CoA introduced peer-to-peer capability to RADIUS, enabling a router and external policy server each to act as a RADIUS client and server. Use the client command to specify the RADIUS clients for which the router will act as server.

Examples

The following example configures the router to accept requests from the RADIUS client at IP address 10.0.0.1:


aaa server radius dynamic-author
 client 10.0.0.1 key cisco

Related Commands


Command	Description
aaa server radius dynamic-author	Configures an ISG as a AAA server to facilitate interaction with an external policy server.

client (ISG RADIUS proxy)

To enter RADIUS proxy client configuration mode, in which client-specific RADIUS proxy parameters can be specified, use the client command in RADIUS proxy server configuration mode. To remove the RADIUS proxy client and configuration, use the no form of this command.

client { ip-address | hostname } [subnet-mask] [ vrf vrf-name ]

no client { ip-address | hostname } [subnet-mask] [ vrf vrf-name ]

Syntax Description

ip-address

IP address of the RADIUS proxy client.

hostname

Hostname of the RADIUS proxy client.

subnet-mask

(Optional) Subnet in which client resides.

vrf vrf-name

(Optional) Virtual routing and forwarding instance (VRF) associated with the session.

Note

The vrf vrf-name option is not supported in Cisco IOS Release 12.2(31)SB2.

Command Default

The global RADIUS proxy server configuration is used.

Command Modes

RADIUS proxy server configuration

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

Use the client command in RADIUS proxy server configuration mode to specify a client for which RADIUS proxy parameters can be configured. Client-specific RADIUS proxy configurations take precedence over the global RADIUS proxy server configuration.

In cases where Intelligent Services Gateway (ISG) is acting as a proxy for more than one client device, all of which reside on the same subnet, client-specific parameters may be configured using a subnet definition rather than a discrete IP address for each device. This configuration method results in the sharing of a single configuration by all the client devices on the subnet. ISG is able to differentiate traffic from these devices based on the source and NAS IP address of RADIUS packets. To configure a client subnet, use the client command with the subnet-mask argument.

Examples

The following example shows the configuration of global RADIUS proxy parameters and client-specific parameters for two RADIUS proxy clients. Client 10.1.1.1 is configured to listen for accounting packets on port 1813 and authentication packets on port 1812. Because a shared secret is not configured specifically for client 10.1.1.1, it will inherit the shared secret specification, which is “cisco”, from the global RADIUS proxy configuration. Client 10.2.2.2 will use “systems” as the shared secret and will use the default ports for listening for accounting and authentication packets.


aaa server radius proxy
 key cisco
 client 10.1.1.1
  accounting port 1813
  authentication port 1812
!
 client 10.2.2.2
  key systems
!

Related Commands


Command	Description
aaa server radius proxy	Enables ISG RADIUS proxy configuration mode, in which ISG RADIUS proxy parameters can be configured.

collect identifier

To enable a control policy map to collect subscriber identifiers, use the collect identifier command in control policy-map class configuration mode. To disable a control policy from collecting subscriber identifiers, use the no form of this command.

action-number collect [ aaa list list-name ] identifier { authen-status | authenticated-domain | authenticated-username | dnis | mac-address | media | mlp-negotiated | nas-port | no-username | protocol | service-name | source-ip-address | timer | tunnel-name | unauthenticated-domain | unauthenticated-username }

no action-number collect [ aaa list list-name ] identifier { authen-status | authenticated-domain | authenticated-username | dnis | media | mlp-negotiated | nas-port | no-username | protocol | service-name | source-ip-address | timer | tunnel-name | unauthenticated-domain | unauthenticated-username }

Syntax Description


`action-number`	Number of the action. Actions are executed sequentially within the policy rule.
aaa	(Optional) Specifies that authentication will be performed using an authentication, authorization, and accounting (AAA) method list.
list `list-name`	(Optional) Specifies the AAA method list to which the authentication request will be sent.
authen-status	Specifies the subscriber authentication status.
authenticated-domain	Specifies the authenticated domain name.
authenticated-username	Specifies the authenticated username.
dnis	Specifies the Dialed Number Identification Service (DNIS) number (also referred to as the called-party number).
media	Specifies the subscriber access media type.
mac-address	Specifies the MAC address to be used as an identity for Layer 3 IP sessions.
mlp-negotiated	Specifies the value indicating that the subscriber session was established using multilink PPP negotiation.
nas-port	Specifies the network access server (NAS) port identifier.
no-username	Specifies that the username is not available.
protocol	Specifies the subscriber access protocol type.
service-name	Specifies the service name currently associated with the user.
source-ip-address	Specifies the source IP address.
timer	Specifies the timer name.
tunnel-name	Specifies the Virtual Private Dialup Network (VPDN) tunnel name.
unauthenticated-domain	Specifies the unauthenticated domain name.
unauthenticated-username	Specifies the unauthenticated username.

Command Default

Control policies do not collect subscriber identifiers.

Command Modes

Control policy-map class configuration (config-control-policymap-class-control)

Command History


Release	Modification
12.2(28)SB	This command was introduced.
12.2(33)SRE	This command was integrated into Cisco IOS Release 12.2(33)SRE. The mac-address keyword was added.
Cisco IOS XE Release 2.5	This command was integrated into Cisco IOS XE Release 2.5.

Usage Guidelines

The collect identifier command configures an action in a control policy map.

Control policies define the actions the system will take in response to specified events and conditions. A control policy map is used to configure an Intelligent Services Gateway (ISG) control policy. A control policy is made of one or more control policy rules. A control policy rule is an association of a control class and one or more actions. The control class defines the conditions that must be met before the actions will be executed. The actions are numbered and executed sequentially within the policy rule.

Note that if you specify the default method list, the default list will not appear in the output of the show running-config command. For example, if you configure the following command:


Router(config-control-policymap-class-control)# 1 collect aaa list default

The following will display in the output for the show running-config command:


1 collect

Named method lists will display in the show running-config command output.

Examples

The following example shows how to configure ISG to collect a subscriber’s authentication status at session start:


Router(config)# policy-map type control policy1
Router(config-control-policymap)# class type control always event session-start
Router(config-control-policymap-class-control)# 1 collect identifier authen-status

Related Commands


Command	Description
class type control	Specifies a control class for which actions may be configured in an ISG control policy map.
policy-map type control	Creates or modifies a control policy map, which defines an ISG control policy.

debug diameter

To enable debugging information for all Diameter base and Gx applications, use the debug diameter all command in privileged EXEC mode. To disable debugging information, use the no form of this command.

debug diameter { all | connection | dcca | event | packet | fsm | failover }

no debug diameter { all | connection | dcca | event | packet | fsm | failover }

Syntax Description


all	Enables debugging information for all Diameter base and Gx applications.
connection	Enables debugging information for Diameter peer connection.
dcca	Enables debugging information for Diameter DCCA application.
event	Enables debugging information for Diameter base related events.
packet	Enables debugging information for Diameter packets.
fsm	Enables debugging information for Diameter peer fsm
failover	Enables debugging information for Diameter failover.

Command Default

No default behavior or values.

Command Modes

Privileged EXEC

Command History


Release	Modification
Cisco IOS XE Everest 16.6.1	This command was introduced.

debug diameter gx database

To display diagnostic information about Gx session database issues, use the debug diameter gx database command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug diameter gx database { event | error | fsm }

no debug diameter gx database

Syntax Description


event	Display information about Gx session details.
error	Displays error messages about Gx session details.
fsm	Displays information about fsm session details.

Command Default

No default behavior or values.

Command Modes

Privileged EXEC

Command History


Release	Modification
Cisco IOS XE Everest 16.6.1	This command was introduced.

debug gx-monitoring-DB

To display diagnostic information about Gx monitoring event details, use the debug gx-monitoring-DB command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug gx-monitoring-DB { event | error | details }

no debug gx-monitoring-DB

Syntax Description


event	Display information about Gx session details.
error	Displays error messages about Gx session details.
details	Displays information about fsm session details.

Command Default

No default behavior or values.

Command Modes

Privileged EXEC

Command History


Release	Modification
Cisco IOS XE Everest 16.6.1	This command was introduced.

debug ip subscriber

To enable Intelligent Services Gateway (ISG) IP subscriber session debugging, use the debug ip subscriber command in privileged EXEC mode. To disable debugging, use the no form of this command.

debug ip subscriber { all | error | event | fsm | packet }

no debug ip subscriber { all | error | event | fsm | packet }

Syntax Description


all	Displays all debugging messages related to IP subscriber sessions.
error	Displays debugging messages about IP subscriber session errors.
event	Displays debugging messages about IP subscriber session events.
fsm	Displays debugging messages related to session state changes for IP subscriber sessions.
packet	Displays debugging messages related to IP subscriber session packets.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(31)SB2	This command was introduced.
12.2(33)SRC	This command was integrated into Cisco IOS Release 12.2(33)SRC.
Cisco IOS XE Release 2.2	This command was integrated into Cisco IOS XE Release 2.2.

Examples

The following example show sample output for the debug ip subscriber command:


Router# debug ip subscriber packet
Packet debugs:
1d07h: IPSUB_DP: [Et0/0:I:CEF:0000.0000.0002] Rx driver forwarded packet via les, return code = 0
1d07h: IPSUB_DP: [Et0/0:I:PROC:0000.0000.0002] Packet classified, results = 0x18
1d07h: IPSUB_DP: [ms1:I:PROC:0000.0000.0002] Rx driver forwarded the packet
1d07h: IPSUB_DP: [ms1:I:PROC:0000.0000.0002] Packet classified, results = 0x42
1d07h: IPSUB_DP: [ms1:O:PROC:RED:50.0.0.3] Packet classified, results = 0x14
Router#
1d07h: IPSUB_DP: [ms1:O:PROC:RED:50.0.0.3] Subscriber features executed, return code = 0
1d07h: IPSUB_DP: [ms1:O:PROC:RED:50.0.0.3] Tx driver forwarding the packet
1d07h: IPSUB_DP: [Et0/0:O:PROC:RED:50.0.0.3] Packet classified, results = 0x14

Related Commands


Command	Description
show ip subscriber	Displays information about ISG IP subscriber sessions.

debug radius-proxy

To display debugging messages for Intelligent Services Gateway (ISG) RADIUS proxy functionality, use the debug radius-proxy command in privileged EXEC mode. To disable debugging, use the no form of this command.

debug radius-proxy { events | errors }

no debug radius-proxy { events | errors }

Syntax Description


events	Displays debug messages related to ISG RADIUS proxy events.
errors	Displays debug messages related to ISG RADIUS proxy errors.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

See the following caution before using debug commands.

Caution

Because debugging output is assigned high priority in the CPU process, it can render the system unusable. For this reason, only use debug commands to troubleshoot specific problems or during troubleshooting sessions with Cisco technical support staff. Moreover, it is best to use debug commands during periods of lower network flows and fewer users.

Examples

The following example shows output for the debug radius-proxy command with the events keyword:


Router# debug radius-proxy events
*Nov  7 07:53:11.411: RP-EVENT: Parse Request: Username = 12345679@cisco
*Nov  7 07:53:11.411: RP-EVENT: Parse Request: Caller ID = 12345679@cisco
*Nov  7 07:53:11.411: RP-EVENT: Parse Request: NAS id = localhost
*Nov  7 07:53:11.411: RP-EVENT: Found matching context for user Caller ID:12345679@cisco  Name:aa
*Nov  7 07:53:11.411: RP-EVENT: Received event client Access-Request in state activated
*Nov  7 07:53:11.411: RP-EVENT: User Caller ID:12345679@cisco  Name:12 re-authenticating
*Nov  7 07:53:11.411: RP-EVENT: Forwarding Request to method list (handle=1979711512)
*Nov  7 07:53:11.411: RP-EVENT: Sending request to server group EAP
*Nov  7 07:53:11.411: RP-EVENT: State changed activated --> wait for Access-Response

debug sgi

To debug Service Gateway Interface (SGI), use the debug sgi command in privileged EXEC mode. To disable debugging, use the no form of this command.

debug sgi [ error | info | xml | gsi | isg-api | all ]

no debug sgi

Syntax Description


error	Enables debugging at the error level, where all internal error messages are displayed.
info	Enables debugging at the informational level, where processing and progress information is displayed.
xml	Enables debugging at Extensible Markup Language (XML) parsing level.
gsi	Enables debugging for the Generic Service Interface (GSI) module.
isg-api	Enables debugging for the SGI Policy Manager interface operations.
all	Enables all debugging options.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
12.2(33)SRC	This command was introduced.

Usage Guidelines

The xml keyword turns on debugging for the Cisco Networking Services (CNS) XML parser and provides additional XML parsing debugging for SGI.

Examples

The following example shows all debugging options enabled and shows the output that is received when a message is sent.


Router# debug sgi all
Router# show debug
SGI:
SGI All debugging is on
SGI Errors debugging is on
SGI XML debugging is on
SGI Informational debugging is on
SGI Generic Service Interface debugging is on
SGI ISG_API Events debugging is on
SGI ISG_API Errors debugging is on
Router#
Router#
*Jul 1 20:55:11.364: SGI: Session created, session Id 7
*Jul 1 20:55:11.372: sgi beep listen app beep[0x66245188]: frame_available: type=M number=1 answer=-1 more=* size=1400
*Jul 1 20:55:11.372: sgi beep listen app beep[0x66245188]: Content-Type: application/xml
<?xml version="1.0" encoding="UTF-8"?>
...
*Jul 1 20:55:11.372: sgi beep listen app beep[0x66245188]: frame_available: type=M number=1 answer=-1 more=. size=111
*Jul 1 20:55:11.372: sgi beep listen app beep[0x66245188]: gitypes:policyGroup>
</objects>
</sgiops:insertPolicyObjectsRequest>
...
*Jul 1 20:55:11.372: SGI: GSI message received, msgid 1, session 7
*Jul 1 20:55:11.376: SGI: XML parsed successfully, request insertPolicyObjectsRequest, msgid 1
*Jul 1 20:55:11.376: SGI: authentication request sent to AAA
*Jul 1 20:55:11.376: SGI: req = [0x67454088] authentication succeeded
*Jul 1 20:55:11.376: SGI: Processing insertPolicyObjectsRequest
*Jul 1 20:55:11.376: SGI: insertPolicyObjectsRequest processing policyGroup:VPDN1, type 1, result: 0
*Jul 1 20:55:11.376: SGI: Processing insertPolicyObjectsResponse
*Jul 1 20:55:11.376: SGI: GSI message sent, msgid 1, session 7
*Jul 1 20:55:12.088: sgi beep listen app beep[0x66245188]: close confirmation: status=+ no error origin=L scope=C
*Jul 1 20:55:12.088: SGI: Session terminating, session Id 7
Router#

Related Commands


Command	Description
sgi beep listener	Enables SGI.
show sgi	Displays information about current SGI sessions or statistics.
text sgi xml	Allows onboard testing of SGI XML files when an external client is not available.

debug ssm

To display diagnostic information about the Segment Switching Manager (SSM) for switched Layer 2 segments, use the debug ssm command in privileged EXEC mode. To disable debugging, use the no form of this command.

debug ssm { cm errors | cm events | fhm errors | fhm events | sm errors | sm events | sm counters | xdr }

no debug ssm { cm errors | cm events | fhm errors | fhm events | sm errors | sm events | sm counters | xdr }

Syntax Description


cm errors	Displays Connection Manager (CM) errors.
cm events	Displays CM events.
fhm errors	Displays Feature Handler Manager (FHM) errors.
fhm events	Displays FHM events.
sm errors	Displays Segment Handler Manager (SM) errors.
sm events	Displays SM events.
sm counters	Displays SM counters.
xdr	Displays external data representation (XDR) messages related to traffic sent across the backplane between Router Processors and line cards.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.0(26)S	This command was introduced.
12.2(25)S	This command was integrated to Cisco IOS Release 12.2(25)S.
12.2(28)SB	This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(33)SRA	This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.4(11)T	This command was integrated into Cisco IOS Release 12.4(11)T.
12.2(33)SXH	This command was integrated into Cisco IOS Release 12.2(33)SXH.

Usage Guidelines

The SSM manages the data-plane component of the Layer 2 Virtual Private Network (L2VPN) configuration. The CM tracks the connection-level errors and events that occur on an xconnect. The SM tracks the per-segment events and errors on the xconnect.

Use the debug ssm command to troubleshoot problems in bringing up the data plane.

This command is generally used only by Cisco engineers for internal debugging of SSM processes.

Examples

The following example shows sample output for the debug ssm xdr command:


Router# debug ssm xdr
 
SSM xdr debugging is on
2w5d: SSM XDR: [4096] deallocate segment, len 16
2w5d: SSM XDR: [8193] deallocate segment, len 16
2w5d: %LINK-3-UPDOWN: Interface FastEthernet2/1, changed state to down
2w5d: %LINK-3-UPDOWN: Interface FastEthernet2/1, changed state to up
2w5d: SSM XDR: [4102] provision segment, switch 4101, len 106
2w5d: SSM XDR: [4102] update segment status, len 17
2w5d: SSM XDR: [8199] provision segment, switch 4101, len 206
2w5d: SSM XDR: [4102] update segment status, len 17
2w5d: %SYS-5-CONFIG_I: Configured from console by console
2w5d: %LINK-3-UPDOWN: Interface FastEthernet2/1, changed state to down
2w5d: SSM XDR: [4102] update segment status, len 17
2w5d: %LINK-3-UPDOWN: Interface FastEthernet2/1, changed state to up
2w5d: SSM XDR: [4102] deallocate segment, len 16
2w5d: SSM XDR: [8199] deallocate segment, len 16
2w5d: SSM XDR: [4104] provision segment, switch 4102, len 106
2w5d: SSM XDR: [4104] update segment status, len 17
2w5d: SSM XDR: [8201] provision segment, switch 4102, len 206
2w5d: SSM XDR: [4104] update segment status, len 17
2w5d: SSM XDR: [4104] update segment status, len 17
2w5d: %SYS-5-CONFIG_I: Configured from console by console

The following example shows the events that occur on the segment manager when an Any Transport over MPLS (AToM) virtual circuit (VC) configured for Ethernet over MPLS is shut down and then enabled:


Router# debug ssm sm events
 
SSM Connection Manager events debugging is on
Router(config)# interface fastethernet 0/1/0.1
 
Router(config-subif)# shutdown
 
09:13:38.159: SSM SM: [SSS:AToM:36928] event Unprovison segment 
09:13:38.159: SSM SM: [SSS:Ethernet Vlan:4146] event Unbind segment 
09:13:38.159: SSM SM: [SSS:AToM:36928] free segment class 
09:13:38.159: SSM SM: [SSS:AToM:36928] free segment 
09:13:38.159: SSM SM: [SSS:AToM:36928] event Free segment 
09:13:38.159: SSM SM: last segment class freed 
09:13:38.159: SSM SM: [SSS:Ethernet Vlan:4146] segment ready 
09:13:38.159: SSM SM: [SSS:Ethernet Vlan:4146] event Found segment data 
Router(config-subif)# no shutdown
 
09:13:45.815: SSM SM: [SSS:AToM:36929] event Provison segment 
09:13:45.815: label_oce_get_label_bundle: flags 14 label 16 
09:13:45.815: SSM SM: [SSS:AToM:36929] segment ready 
09:13:45.815: SSM SM: [SSS:AToM:36929] event Found segment data 
09:13:45.815: SSM SM: [SSS:AToM:36929] event Bind segment 
09:13:45.815: SSM SM: [SSS:Ethernet Vlan:4146] event Bind segment

The following example shows the events that occur on the CM when an AToM VC configured for Ethernet over MPLS is shut down and then enabled:


Router(config)# interface fastethernet 0/1/0.1
 
Router(config-subif)# shutdown
 
09:17:20.179: SSM CM: [AToM] unprovision segment, id 36929 
09:17:20.179: SSM CM: CM FSM: state Open - event Free segment 
09:17:20.179: SSM CM: [SSS:AToM:36929] unprovision segment 1 
09:17:20.179: SSM CM: [SSS:AToM] shQ request send unprovision complete event 
09:17:20.179: SSM CM: [SSS:Ethernet Vlan:4146] unbind segment 2 
09:17:20.179: SSM CM: [SSS:Ethernet Vlan] shQ request send ready event 
09:17:20.179: SSM CM: SM msg event send unprovision complete event 
09:17:20.179: SSM CM: SM msg event send ready event 
Router(config-subif)# no shutdown 
09:17:35.879: SSM CM: Query AToM to Ethernet Vlan switching, enabled 
09:17:35.879: SSM CM: [AToM] provision second segment, id 36930 
09:17:35.879: SSM CM: CM FSM: state Down - event Provision segment 
09:17:35.879: SSM CM: [SSS:AToM:36930] provision segment 2 
09:17:35.879: SSM CM: [AToM] send client event 6, id 36930 
09:17:35.879: SSM CM: [SSS:AToM] shQ request send ready event 
09:17:35.883: SSM CM: SM msg event send ready event 
09:17:35.883: SSM CM: [AToM] send client event 3, id 36930

The following example shows the events that occur on the CM and SM when an AToM VC is provisioned and then unprovisioned:


Router# debug ssm cm events
 
SSM Connection Manager events debugging is on
Router# debug ssm sm events 
SSM Segment Manager events debugging is on
Router# configure terminal 
Router(config)# interface ethernet1/0
 
Router(config-if)# xconnect 10.55.55.2 101 pw-class mpls 
16:57:34: SSM CM: provision switch event, switch id 86040
16:57:34: SSM CM: [Ethernet] provision first segment, id 12313
16:57:34: SSM CM: CM FSM: state Idle - event Provision segment
16:57:34: SSM CM: [SSS:Ethernet:12313] provision segment 1
16:57:34: SSM SM: [SSS:Ethernet:12313] event Provison segment
16:57:34: SSM CM: [SSS:Ethernet] shQ request send ready event
16:57:34: SSM CM: SM msg event send ready event
16:57:34: SSM SM: [SSS:Ethernet:12313] segment ready
16:57:34: SSM SM: [SSS:Ethernet:12313] event Found segment data
16:57:34: SSM CM: Query AToM to Ethernet switching, enabled
16:57:34: SSM CM: [AToM] provision second segment, id 16410
16:57:34: SSM CM: CM FSM: state Down - event Provision segment
16:57:34: SSM CM: [SSS:AToM:16410] provision segment 2
16:57:34: SSM SM: [SSS:AToM:16410] event Provison segment
16:57:34: SSM CM: [AToM] send client event 6, id 16410
16:57:34: label_oce_get_label_bundle: flags 14 label 19
16:57:34: SSM CM: [SSS:AToM] shQ request send ready event
16:57:34: SSM CM: SM msg event send ready event
16:57:34: SSM SM: [SSS:AToM:16410] segment ready
16:57:34: SSM SM: [SSS:AToM:16410] event Found segment data
16:57:34: SSM SM: [SSS:AToM:16410] event Bind segment
16:57:34: SSM SM: [SSS:Ethernet:12313] event Bind segment
16:57:34: SSM CM: [AToM] send client event 3, id 16410
Router# configure terminal
 
Router(config)# interface e1/0 
Router(config-if)# no xconnect
 
16:57:26: SSM CM: [Ethernet] unprovision segment, id 16387
16:57:26: SSM CM: CM FSM: state Open - event Free segment
16:57:26: SSM CM: [SSS:Ethernet:16387] unprovision segment 1
16:57:26: SSM SM: [SSS:Ethernet:16387] event Unprovison segment
16:57:26: SSM CM: [SSS:Ethernet] shQ request send unprovision complete event
16:57:26: SSM CM: [SSS:AToM:86036] unbind segment 2
16:57:26: SSM SM: [SSS:AToM:86036] event Unbind segment
16:57:26: SSM CM: SM msg event send unprovision complete event
16:57:26: SSM SM: [SSS:Ethernet:16387] free segment class
16:57:26: SSM SM: [SSS:Ethernet:16387] free segment
16:57:26: SSM SM: [SSS:Ethernet:16387] event Free segment
16:57:26: SSM SM: last segment class freed
16:57:26: SSM CM: unprovision switch event, switch id 12290
16:57:26: SSM CM: [SSS:AToM] shQ request send unready event
16:57:26: SSM CM: SM msg event send unready event
16:57:26: SSM SM: [SSS:AToM:86036] event Unbind segment
16:57:26: SSM CM: [AToM] unprovision segment, id 86036
16:57:26: SSM CM: CM FSM: state Down - event Free segment
16:57:26: SSM CM: [SSS:AToM:86036] unprovision segment 2
16:57:26: SSM SM: [SSS:AToM:86036] event Unprovison segment
16:57:26: SSM CM: [SSS:AToM] shQ request send unprovision complete event
16:57:26: SSM CM: SM msg event send unprovision complete event
16:57:26: SSM SM: [SSS:AToM:86036] free segment class
16:57:26: SSM SM: [SSS:AToM:86036] free segment
16:57:26: SSM SM: [SSS:AToM:86036] event Free segment
16:57:26: SSM SM: last segment class freed

Related Commands


Command	Description
show ssm	Displays SSM information for switched Layer 2 segments.

debug subscriber aaa authorization

To display diagnostic information about authentication, authorization, and accounting (AAA) authorization of Intelligent Services Gateway (ISG) subscriber sessions, use the debug subscriber aaa authorization command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug subscriber aaa authorization { event | fsm }

no debug sss aaa authorization { event | fsm }

Syntax Description


event	Display information about AAA authorization events that occur during ISG session establishment.
fsm	Display information about AAA authorization state changes for ISG subscriber sessions.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Examples

The following is sample output of several debug subscriber commands, including the debug subscriber aaa authorization command. The reports from these commands should be sent to technical personnel at Cisco Systems for evaluation.


Router# debug subscriber event
Router# debug subscriber error
Router# debug subscriber state
Router# debug subscriber aaa authorization event
Router# debug subscriber aaa authorization fsm
SSS:
  SSS events debugging is on
  SSS error debugging is on
  SSS fsm debugging is on
  SSS AAA authorization event debugging is on
  SSS AAA authorization FSM debugging is on
*Mar  4 21:33:18.248: SSS INFO: Element type is Access-Type, long value is 3
*Mar  4 21:33:18.248: SSS INFO: Element type is Switch-Id, long value is -1509949436
*Mar  4 21:33:18.248: SSS INFO: Element type is Nasport, ptr value is 6396882C
*Mar  4 21:33:18.248: SSS INFO: Element type is AAA-Id, long value is 7
*Mar  4 21:33:18.248: SSS INFO: Element type is AAA-ACCT_ENBL, long value is 1
*Mar  4 21:33:18.248: SSS INFO: Element type is AccIe-Hdl, ptr value is 78000006
*Mar  4 21:33:18.248: SSS MGR [uid:7]: Event service-request, state changed from wait-for-req to wait-for-auth
*Mar  4 21:33:18.248: SSS MGR [uid:7]: Handling Policy Authorize (1 pending sessions)
*Mar  4 21:33:18.248: SSS PM [uid:7]: Need the following key: Unauth-User
*Mar  4 21:33:18.248: SSS PM [uid:7]: Received Service Request
*Mar  4 21:33:18.248: SSS PM [uid:7]: Event <need keys>, State: initial-req to need-init-keys
*Mar  4 21:33:18.248: SSS PM [uid:7]: Policy reply - Need more keys
*Mar  4 21:33:18.248: SSS MGR [uid:7]: Got reply Need-More-Keys from PM
*Mar  4 21:33:18.248: SSS MGR [uid:7]: Event policy-or-mgr-more-keys, state changed from wait-for-auth to wait-for-req
*Mar  4 21:33:18.248: SSS MGR [uid:7]: Handling More-Keys event
*Mar  4 21:33:20.256: SSS INFO: Element type is Unauth-User, string value is nobody2@xyz.com
*Mar  4 21:33:20.256: SSS INFO: Element type is AccIe-Hdl, ptr value is 78000006
*Mar  4 21:33:20.256: SSS INFO: Element type is AAA-Id, long value is 7
*Mar  4 21:33:20.256: SSS INFO: Element type is Access-Type, long value is 0
*Mar  4 21:33:20.256: SSS MGR [uid:7]: Event service-request, state changed from wait-for-req to wait-for-auth
*Mar  4 21:33:20.256: SSS MGR [uid:7]: Handling Policy Authorize (1 pending sessions)
*Mar  4 21:33:20.256: SSS PM [uid:7]: Received More Initial Keys
*Mar  4 21:33:20.256: SSS PM [uid:7]: Event <rcvd keys>, State: need-init-keys to check-auth-needed
*Mar  4 21:33:20.256: SSS PM [uid:7]: Handling Authorization Check
*Mar  4 21:33:20.256: SSS PM [uid:7]: Event <send auth>, State: check-auth-needed to authorizing
*Mar  4 21:33:20.256: SSS PM [uid:7]: Handling AAA service Authorization
*Mar  4 21:33:20.256: SSS PM [uid:7]: Sending authorization request for 'xyz.com'
*Mar  4 21:33:20.256: SSS AAA AUTHOR [uid:7]:Event <make request>, state changed from idle to authorizing
*Mar  4 21:33:20.256: SSS AAA AUTHOR [uid:7]:Authorizing key xyz.com
*Mar  4 21:33:20.260: SSS AAA AUTHOR [uid:7]:AAA request sent for key xyz.com
*Mar  4 21:33:20.260: SSS AAA AUTHOR [uid:7]:Received an AAA pass
*Mar  4 21:33:20.260: SSS AAA AUTHOR [uid:7]:Event <found service>, state changed from authorizing to complete
*Mar  4 21:33:20.260: SSS AAA AUTHOR [uid:7]:Found service info for key xyz.com
*Mar  4 21:33:20.260: SSS AAA AUTHOR [uid:7]:Event <free request>, state changed from complete to terminal
*Mar  4 21:33:20.260: SSS AAA AUTHOR [uid:7]:Free request
*Mar  4 21:33:20.264: SSS PM [uid:7]: Event <found>, State: authorizing to end
*Mar  4 21:33:20.264: SSS PM [uid:7]: Handling Service Direction
*Mar  4 21:33:20.264: SSS PM [uid:7]: Policy reply - Forwarding
*Mar  4 21:33:20.264: SSS MGR [uid:7]: Got reply Forwarding from PM
*Mar  4 21:33:20.264: SSS MGR [uid:7]: Event policy-start-service-fsp, state changed from wait-for-auth to wait-for-service
*Mar  4 21:33:20.264: SSS MGR [uid:7]: Handling Connect-Forwarding-Service event
*Mar  4 21:33:20.272: SSS MGR [uid:7]: Event service-fsp-connected, state changed from wait-for-service to connected
*Mar  4 21:33:20.272: SSS MGR [uid:7]: Handling Forwarding-Service-Connected event

Related Commands


Command	Description
debug sss error	Displays diagnostic information about errors that may occur during Subscriber Service Switch call setup.
debug sss event	Displays diagnostic information about Subscriber Service Switch call setup events.
debug sss fsm	Displays diagnostic information about the Subscriber Service Switch call setup state.

debug subscriber classifier

To display debugging information about the Intelligent Services Gateway (ISG) classifier module, use the debug subscriber classifier command in privileged EXEC mode. To disable debugging of the classifier, use the no form of this command.

debug subscriber classifier { all | error | event | fsm | ha | packet }

no debug subscriber classifier { all | error | event | fsm | ha | packet }

Syntax Description


all	Displays all debugging messages related to the ISG classifier.
error	Displays messages about any errors that occur.
event	Displays messages about events that occur.
fsm	Displays messages related to session state changes for the ISG classifier.
ha	Displays messages related to high availability.
packet	Displays information about classifier packets.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
Cisco IOS XE Release 3.5S	This command was introduced.

Examples

The following is sample output from the debug subscriber classifier command:

*Nov 24 05:05:01.218: %SYS-5-CONFIG_I: Configured from console by console
*Nov 24 05:23:58.760: IC_DP: [Dir:N] IC DP debug flags updated
*Nov 24 05:24:03.650: IC: [uid:1]Event associate, state changed from idle to associated
*Nov 24 05:24:03.650: IC: [uid:1]Associate class successful: class id: 0x0 dir 1
*Nov 24 05:24:03.650: IC: [uid:1]Event associate, state changed from associated to associated
*Nov 24 05:24:03.651: IC: [uid:1]Associate class successful: class id: 0x1 dir 2
*Nov 24 05:24:03.651: IC: [uid:1]Notify classes [0x0,0x1] for handle 0xB1000001 were associated
*Nov 24 05:24:03.653: IC: [uid:1]IC successfully bind feature handle 0xB1000001, class id 0x0, type 11, layer 2, protocol 1
*Nov 24 05:24:03.653: IC: [uid:1]Event bind, state changed from associated to binding
*Nov 24 05:24:03.653: IC: [uid:1]IC successfully bind feature handle 0xB1000001, class id 0x1, type 11, layer 2, protocol 1
*Nov 24 05:24:03.653: IC: [uid:1]Event bind, state changed from binding to binding
*Nov 24 05:24:03.654: IC: [uid:1]Activate a target: handle 0xB1000001
*Nov 24 05:24:03.654: IC: [uid:1]Activate all classes on a target
*Nov 24 05:24:03.654: IC: [uid:1]Config block: 32, hw class size: 20,fo size: 16 offset: 32, buff len 104
*Nov 24 05:24:03.654: IC: [uid:1]Config msg sent to dp: total class 2, op = 0
*Nov 24 05:24:03.655: IC: [uid:1]Feature Object: C: 0x0 L: 2 T: 11 P: 1, Add
*Nov 24 05:24:03.655: IC: [uid:1]Config for: class 0x0, number of fo 1
*Nov 24 05:24:03.655: IC: [uid:1]Feature Object: C: 0x1 L: 2 T: 11 P: 1, Add
*Nov 24 05:24:03.655: IC: [uid:1]Config for: class 0x1, number of fo 1
*Nov 24 05:24:03.655: IC: [uid:1]Send provision info and activate target success rc = 5
*Nov 24 05:24:03.655: IC: [uid:1]Event activate, state changed from binding to connected
*Nov 24 05:24:03.672: IC_DP: [Dir:N] Received feature: total class 2
*Nov 24 05:24:03.672: IC_DP: [Dir:I] SIP and FSP are associated with IC
*Nov 24 05:24:03.673: IC_DP: [Dir:I] L2 IN: callpath associated
*Nov 24 05:24:03.673: IC_DP: [Dir:I] L3 IN: callpath associated
*Nov 24 05:24:03.673: IC_DP: [Dir:I] Data plane feature IC installed
*Nov 24 05:24:03.673: IC_DP: [Dir:O] SIP and FSP are associated with IC
*Nov 24 05:24:03.673: IC_DP: [Dir:O] L2 OUT: callpath associated
*Nov 24 05:24:03.673: IC_DP: [Dir:O] L3 OUT: callpath associated
*Nov 24 05:24:03.673: IC_DP: [Dir:O] Data plane feature IC installed
*Nov 24 05:24:03.674: IC_DP: [Dir:I] [0x0,0x1], feature object: 1, dir 1 op: 0
*Nov 24 05:24:03.674: IC_DP: [Dir:I] FO Received: class 0x0, type: 11, layer 2, prot IPv4 Apply/Update
*Nov 24 05:24:03.674: IC_DP: [Dir:I] Add FO for C:0x0 T:11 L:2 P:1
*Nov 24 05:24:03.674: IC_DP: [Dir:I] Add class to sess ctx 0x0
*Nov 24 05:24:03.674: IC_DP: [Dir:O] [0x1,0x0], feature object: 1, dir 2 op: 0
*Nov 24 05:24:03.674: IC_DP: [Dir:O] FO Received: class 0x1, type: 11, layer 2, prot IPv4 Apply/Update
*Nov 24 05:24:03.674: IC_DP: [Dir:O] Add FO for C:0x1 T:11 L:2 P:1
*Nov 24 05:24:03.675: IC_DP: [Dir:O] Add class to sess ctx 0x1
...

Related Commands


Command	Description
show subscriber session	Displays information about ISG subscriber sessions.

debug subscriber error

To display diagnostic information about errors that may occur during Intelligent Services Gateway (ISG) subscriber session setup, use the debug subscriber error command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug subscriber error

no debug subscriber error

Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Examples

The following sample output for the debug subscriber error command indicates that the session is stale since the session handle has already been destroyed.


Router# debug subscriber error
*Sep 20 22:39:49.455: SSS MGR: Session handle [EF000002] destroyed already

Related Commands


Command	Description
debug sss aaa authorization event	Displays messages about AAA authorization events that are part of normal call establishment.
debug sss event	Displays diagnostic information about Subscriber Service Switch call setup events.
debug sss fsm	Displays diagnostic information about the Subscriber Service Switch call setup state.

debug subscriber event

To display diagnostic information about Intelligent Services Gateway (ISG) subscriber session setup events, use the debug subscriber event command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug subscriber event

no debug subscriber event

Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC

Command History


Release	Modification
12.2(28)SB	This command was introduced.

Examples

The following sample output for the debug subscriber event commands indicates that the system has determined that the session should be locally terminated. The local termination module determines that an interface description block (IDB) is not required for this session, and it sets up the data plane for packet switching.


Router# debug subscriber event
*Sep 20 22:21:08.223: SSS MGR [uid:2]: Handling Connect Local Service action
*Sep 20 22:21:08.223: SSS LTERM [uid:2]: Processing Local termination request
*Sep 20 22:21:08.223: SSS LTERM [uid:2]: L3 session - IDB not required for setting up service
*Sep 20 22:21:08.223: SSS LTERM [uid:2]: Interface already present or not required for service
*Sep 20 22:21:08.223: SSS LTERM [uid:2]: Segment provision successful

Related Commands


Command	Description
debug sss aaa authorization event	Displays messages about AAA authorization events that are part of normal call establishment.
debug sss error	Displays diagnostic information about errors that may occur during Subscriber Service Switch call setup.
debug sss fsm	Displays diagnostic information about the Subscriber Service Switch call setup state.

debug subscriber feature

To display diagnostic information about the installation and removal of Intelligent Services Gateway (ISG) features on ISG subscriber sessions, use the debug subscriber feature command in privileged EXEC mode. To disable debugging output, use the no form of this command.

debug subscriber feature { all | detail | error | event | name feature-name { detail | error | event | packet } | packet [ detail | full ] [ issu { event | error } ] [ ccm { event | error } ] }

no debug subscriber feature { all | detail | error | event | name feature-name { detail | error | event | packet } | packet [ detail | full ] [ issu { event | error } ] [ ccm { event | error } ] }

Syntax Description


all	Displays information about all features.
detail	The detail keyword can be used in one of the following three ways: If used with no other keywords, displays detailed information about all features If a feature name is specified with the name `feature-name` keyword and argument, displays detailed information about the specific feature. The detail keyword can be used with the following `feature-name` values: accounting compression modem-on-hold policing traffic-classification If used with the packet keyword, displays a partial dump of packets as ISG features are being applied to the packets.
error	Displays information about errors for all features or a specified feature.
event	Displays information about events for all features or a specified feature.
name	Displays information specific to feature.
`feature-name`	Name of the ISG feature. Possible values are the following: access-list accounting compression filter idle-timer interface-config ip-config l4redirect modem-on-hold policing portbundle prepaid-idle session-timer static-routes time-monitor volume-monitor
issu	Displays information about events and errors for all features or a specified feature as they occur.
ccm	Displays information about a specific feature checkpointing activity. If the ccm keyword is not specified, event and error logging is specific to the feature’s interaction with the cluster control manager (CCM).
packet	Displays information about packets as ISG features are being applied to the packets. If a feature name is specified with the name `feature-name` keyword and argument, packet information about the specific feature is displayed. The packet keyword can be used with the following `feature-name` values: access-list l4redirect policing portbundle
full	(Optional) Displays a full dump of a packet as ISG features are being applied to it.

Command Modes

Privileged EXEC (#)

Command History


Release	Modification
12.2(28)SB	This command was introduced.
12.2(33)SRC	This command was integrated into Cisco IOS Release12.2(33)SRC.
Cisco IOS XE Release 3.5S	This command was modified. The traffic-classification keyword was removed as a choice for the `feature-name` argument.

Examples

The following sample output from the debug subscriber feature command indicates that the idle timeout feature has been successfully installed on the inbound segment.


Router# debug subscriber feature event

*Sep 20 22:28:57.903: SSF[myservice/uid:6/Idle Timeout]: Group feature install
*Sep 20 22:28:57.903: SSF[uid:6/Idle Timeout]: Adding feature to inbound segment(s)

Results

Chapter: A through L

A through L

aaa accounting redundancy

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

aaa authorization radius-proxy

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

aaa authorization subscriber-service

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

aaa server radius dynamic-author

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

aaa server radius policy-device

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

aaa server radius proxy

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

accounting aaa list

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

accounting method-list

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

accounting port

Syntax Description

Command Default

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

arp ignore local

Syntax Description

Command Default

Command Modes

Command History