The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The RADIUS Packet of Disconnect feature is used to terminate a connected voice call.
For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for RADIUS Packet of Disconnect" section.
Use Cisco Feature Navigator to find information about platform support and Cisco IOS XE software image support. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.
•Prerequisites for RADIUS Packet of Disconnect
•Restrictions for RADIUS Packet of Disconnect
•Information About RADIUS Packet of Disconnect
•How to Configure the RADIUS Packet of Disconnect
•Feature Information for RADIUS Packet of Disconnect
Configure AAA as described in the Cisco IOS XE Security Configuration Guide: Securing User Services, Release 2.
Proper matching identification information must be communicated by the following:
•Billing server and gateway configuration
•Gateway's original accounting start request
•Server's POD request
The Packet of Disconnect (POD) is a RADIUS access_request packet and is intended to be used in situations where the authenticating agent server wants to disconnect the user after the session has been accepted by the RADIUS access_accept packet.
This section includes the following topics:
The POD may be needed in at least two situations:
•Detection of fraudulent use, which cannot be performed before accepting the call. A price structure so complex that the maximum session duration cannot be estimated before accepting the call. This may be the case when certain types of discounts are applied or when multiple users use the same subscription simultaneously.
•To prevent unauthorized servers from disconnecting users, the authorizing agent that issues the POD packet must include three parameters in its packet of disconnect request. For a call to be disconnected, all parameters must match their expected values at the gateway. If the parameters do not match, the gateway discards the packet of disconnect packet and sends a NACK (negative acknowledgement message) to the agent.
The POD has the following parameters:
•An h323-conf-id vendor-specific attribute (VSA) with the same content as received from the gateway for this call.
•An h323-call-origin VSA with the same content as received from the gateway for the leg of interest.
•A 16-byte MD5 hash value that is carried in the authentication field of the POD request.
•Cisco IOS XE software allocates POD code 50 as the code value for the Voice POD Request based on RFC 3576 Dynamic Authorization Extensions to RADIUS, which extends RADIUS standards to officially support both a Disconnect Message (DM) and Change-of-Authorization (CoA) that are supported through the POD.
RFC 3576 specifies the following POD codes:
–40 - Disconnect-Request
–41 - Disconnect-ACK
–42 - Disconnect-NAK
–43 - CoA-Request
–44 - CoA-ACK
–45 - CoA-NAK
This section includes the following procedures:
•Configuring the RADIUS POD (required)
•Verifying the RADIUS POD Configuration (optional)
Use the following tasks to configure the RADIUS POD:
1. enable
2. configure terminal
3. aaa pod server [port port-number] [auth-type {any | all | session-key}] server-key [encryption-type] string
4. end
Use the following tips to troubleshoot POD issues:
•Ensure that the POD port is configured correctly in both the gateway (using aaa pod server command) and the radius server. Both should be the same.
•Ensure that the shared-secret key configured in the gateway (using aaa pod server command) and in the AAA server are the same.
•Turn on debug aaa pod command to see what's going on. This will let you know if the gateway receives the POD packet from the server and if so, it will display any errors encountered.
The following example shows output from a successful POD request, when using the show debug command.
Router# debug aaa pod
AAA POD packet processing debugging is on
Router# show debug
General OS:
AAA POD packet processing debugging is on
Router#
Apr 25 17:15:59.318:POD:172.19.139.206 request queued
Apr 25 17:15:59.318:voice_pod_request:
Apr 25 17:15:59.318:voip_populate_pod_attr_list:
Apr 25 17:15:59.318:voip_pod_get_guid:
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=50
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr=h323-conf-id
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=50 value_len=35
Apr 25 17:15:59.318:voip_pod_get_guid:conf-id=FFA7785F F7F607BB
00000000 993FB1F4 n_bytes=35
Apr 25 17:15:59.318:voip_pod_get_guid:GUID = FFA7785F F7F607BB 00000000
993FB1F4
Apr 25 17:15:59.318:voip_populate_pod_attr_list:
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=23
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr=h323-originate
Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=23 value_len=6
Apr 25 17:15:59.318:voip_get_call_direction:
Apr 25 17:15:59.318:voip_get_call_direction:returning answer
Apr 25 17:15:59.318:voip_eval_pod_attr:
Apr 25 17:15:59.318:cc_api_trigger_disconnect:
Apr 25 17:15:59.322:POD:Sending ACK to 172.19.139.206/1700
Apr 25 17:15:59.322:voip_pod_clean:
To verify the RADIUS POD configuration, use the show running configuration privileged EXEC command as shown in the following example:
Router# show running-configuration
!
aaa authentication login h323 group radius
aaa authorization exec h323 group radius
aaa accounting update newinfo
aaa accounting connection h323 start-stop group radius
aaa pod server server-key cisco
aaa session-id common
.
.
.
The following sections provide references related to the RADIUS Packet of Disconnect feature.
|
|
---|---|
AAA |
"Authentication, Authorization, and Accounting (AAA)" section of the Cisco IOS XE Security Configuration Guide, Securing User Services, Release 2. |
Security commands |
|
CLI Configuration |
Cisco IOS XE Configuration Fundamentals Configuration Guide, Release 2 |
|
|
---|---|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
— |
|
|
---|---|
RFC 2865 |
Remote Authentication Dial-in User Service |
RFC 3576 |
Dynamic Authorization Extensions to RADIUS |
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS XE software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp. An account on Cisco.com is not required.
Note Table 1 lists only the Cisco IOS XE software release that introduced support for a given feature in a given Cisco IOS XE software release train. Unless noted otherwise, subsequent releases of that Cisco IOS XE software release train also support that feature.
AAA—authentication, authorization, and accounting.
NACK—negative acknowledgement message.
POD—packet of disconnect. An access_reject packet sent from a RADIUS server to the gateway in order to disconnect a call which has been connected already. After validation of the packet, the gateway disconnects the user. The packet contains the information to disconnect the call.
POD server—a Cisco gateway configured to accept and process POD requests from a RADIUS authentication/authorization agent.
RADIUS—Remote Authentication Dial-In User Service. An authentication and accounting system used by many Internet service providers.
UDP—User Datagram Protocol. Connectionless transport layer protocol in the TCP/IP protocol stack. UDP is a simple protocol that exchanges datagrams without acknowledgments or guaranteed delivery, requiring that error processing and retransmission be handled by other protocols. UDP is defined in
RFC 768.
VoIP—voice over IP. The ability to carry normal telephony-style voice over an IP-based Internet with POTS-like functionality, reliability, and voice quality. VoIP is a blanket term that generally refers to the Cisco standards-based (for example, H.323) approach to IP voice traffic.
VSA—vendor-specific attribute.