User Guide for Cisco Prime Access Registrar 6.0

To view the next page

To return back to previous page

To view the last page

To return to the first page

To move a record from the Available List to the Selected List

To move a record from the Selected List to the Available List

To move all the records from the Available List to the Selected List

To move all the records from the Selected List to the Available List

To move the selected record one step above

To move the selected record one step below

To move the selected record to the first position

To move the selected record to the last position

Release

To release the selected session details

Release All

To release all the records from the list

Send CoA

To send the CoA packet to the client device

SendPoD

To send the disconnect packet to the NAS to clear sessions and an Accounting-Stop notification to the client listed in the session record

Query All Sessions

To query all the sessions in the server

Name

Required; must be unique in the list of servers in the cluster.

Version

Required; the currently installed version of Cisco Prime AR.

Description

Optional; description of the server.

DefaultSessionManager

Optional; Cisco Prime AR uses this property if none of the incoming scripts sets the environment dictionary variable Session-Manager.

IncomingScript

Optional; if there is a script, it is the first script Cisco Prime AR runs when it receives a request from any client and/or for any service.

OutgoingScript

Optional; if there is a script, it is the last script Cisco Prime AR runs before it sends a response to any client.

DefaultAuthenticationService

Optional; Cisco Prime AR uses this property when none of the incoming scripts sets the environment dictionary variable Authentication-Service.

DefaultAuthorizationService

Optional; Cisco Prime AR uses this property when none of the incoming scripts sets the environment dictionary variable Authorization-Service.

DefaultAccountingService

Optional; Cisco Prime AR uses this property when none of the incoming scripts sets the environment dictionary variable Accounting-Service.

DefaultSessionService

Optional; Cisco Prime AR uses this property when none of the incoming scripts sets the environment dictionary variable Session-Service.

Name

Required; must be unique in the Profiles list.

Description

Optional; description of the profile.

RADIUS

Optional; set Radius, if the attribute and value needs to be defined for Radius.

VENDOR

Optional; set Vendor, if the attribute and value needs to be defined for Vendor.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Value Attribute

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Radius and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

General Properties tab

Name

Required; must be unique in the UserGroup list.

Description

Optional; description of the group.

BaseProfile

Optional; when you set this to the name of a profile, Cisco Prime AR adds the properties in the Profile to the response dictionary as part of the authorization.

AuthenticationScript

Optional; when you set this property to the name of a script, you can use the Script to perform additional authentication checks to determine whether to accept or reject the user.

AuthorizationScript

Optional; when you set this property to the name of a script, you can use the script to add, delete, or modify the attributes of the Response dictionary.

Attribute List tab

RADIUS

Optional; set Radius, if the attribute and value needs to be defined for Radius.

VENDOR

Optional; set Vendor, if the attribute and value needs to be defined for Vendor.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Name and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

CheckItems List tab

RADIUS

Optional; set Radius, if the attribute and value needs to be defined for Radius.

VENDOR

Optional; set Vendor, if the attribute and value needs to be defined for Vendor.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Check Name and Check Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

UserList Name

Required; must be unique.

Description

Optional; description of the user.

General Properties tab

Name

Required; must be unique.

Enabled

Required; must be checked to allow user access. If Enabled is not checked, user is denied access.

Allow Null Pwd

During authentication, if the Allow NULL Password environment variable is set to TRUE, user authentication is bypassed. By default, the Allow NULL Password environment variable is not set.

UserGroup

Use the drop-down list to select a UserGroup and use the properties specified in the UserGroup to authenticate and/or authorize the user. The default is none.

Password

Required; length must be between 0-253 characters.

Base Profile

Optional; use the drop-down list to select a Profile. If the service-type is not equal to Authenticate Only, Cisco Prime AR adds the properties in the Profile to the Response dictionary as part of the authorization. This field is optional for the CLI, but required for the GUI. Use the menu to select a profile other than the default None.

Confirm Password

Required; must match password.

User Defined

Optional; you can use this property to store notational information which you can then use to filter the UserList. This property also sets the environment variable for UserDefined.

Authentication Script

Optional; use the drop-down list to select the name of a script to perform additional authentication checks to determine whether to accept or reject the user. This field is optional for the CLI, but required for the GUI. Use the menu to select an Authentication Script other than the default None.

Authorization Script

Optional; use the drop-down list to select the name of a script to add, delete, or modify the attributes of the Response dictionary. This field is optional for the CLI, but required for the GUI. Use the menu to select an Authorization Script other than the default None.

Description

Optional; description of the user.

Attribute List tab

RADIUS

Optional; set Radius, if the attribute and value needs to be defined for Radius.

VENDOR

Optional; set Vendor, if the attribute and value needs to be defined for Vendor.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Name and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

CheckItems List tab

RADIUS

Optional; set Radius, if the attribute and value needs to be defined for Radius.

VENDOR

Optional; set Vendor, if the attribute and value needs to be defined for Vendor.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Check Name and Check Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Script Name

Required; must be unique in the Scripts list.

Language

Required; specify either REX, Tcl, or Java.

Description

Optional; description of the script.

File/Class Name

Required; specifies either a relative or absolute path. When you specify a relative path, the path must be relative to the $INSTALL/scripts/radius/$Language directory. When you specify an absolute path, the server must be able to reach it.

For Java language scripts, the name of the class that implements the extension interface; the .class file should be placed in /cisco-ar/scripts/radius/java

Entry Point

Required; when not set, Cisco Prime AR uses the value specified in the Name property.

Init Entry Point

Optional; if set, it must be the name of the global symbol Cisco Prime AR should call when it initializes the shared library at system start up, and just before it unloads the shared library.

Init Entry Point Arg

Optional; when set, it provides the arguments to be passed to the InitEntryPoint in the environmental variable Arguments.

Name

Required; must be unique in the Policies list

Description

Optional; description of the Policy

Rules/Policies

Required; set the rules/polices to be grouped.

Operators

Required; set the operators to be grouped along with selected rules/policies. The selected rules and operators will be grouped and listed in the Grouping Box. To delete the available groups, select the relevant group from the Grouping list and click the Delete button below.

Service Name

Required; must be unique in the Services list.

Incoming Script

Optional; name of script to run when the service starts.

Type

Required; must set it to a valid Cisco Prime AR service.

Outgoing Script

Name of script to run when the service ends.

Description

Optional; description of the service.

Outage Script

Optional; if you set this property to the name of a script, Cisco Prime AR runs it when an outage occurs. This property allows you to create a script that notifies you when the RADIUS server detects a failure.

Outage Policy

Required; the default is RejectAll. This property defines how Cisco Prime AR handles requests if all servers listed in the RemoteServers properties are unavailable (that is, all remote RADIUS servers are not available). You must set it to one of the following: AcceptAll, DropPacket, or RejectAll.

Filename

Required; must be either a relative or an absolute path to the shared library containing the Service. When the pathname is relative, it must be relative to $INSTALL/Scripts/Radius/rex.

EntryPoint

Required; must be set to the function's global symbol.

InitEntryPoint

Required; must be the name of the global symbol Cisco Prime AR should call when it initializes the shared library and just before it unloads the shared library.

A rex service must have an InitEntryPoint even if the service only returns REX_OK.

InitEntryPointArgs

Optional; when set, it provides the arguments to be passed to the InitEntryPoint in the environmental variable Arguments.

FilenamePrefix

Required; a string that specifies where Cisco Prime AR writes the account records. It must be either a relative or absolute path. When you specify a relative path, it must be relative to the $INSTALL/logs directory. When you specify an absolute path, the server must be able to reach it. The default is Accounting.

MaxFileAge

Optional; stored as a string, but is composed of two parts, a number and a units indicator (<n> <units>) in which the unit is one of: H, Hour, Hours, D, Day, Days, W, Week, Weeks. The default is one day.

RolloverSchedule

Indicates the exact time including the day of the month or day of the week, hour and minute to roll over the accounting log file.

MaxFileSize

Optional; stored as a string, but is composed of two parts, a number and a units indicator (<n> <units>) in which the unit is one of: K, kilobyte, or kilobytes, M, megabyte, or megabytes, or G, gigabyte, or gigabytes. The default is ten megabytes.

UseLocalTimeZone

When set to TRUE, indicates the accounting records' TimeStamp is in local time. When set to FALSE, the default, accounting records' TimeStamp is in GMT.

UserService

Required; name of service that can be used to authenticate

SessionManager

Required; select the required session manager from the available list.

Result Rule

When set to AND (the default), the response from the GroupService is positive if each of the services referenced return a positive result. The response is negative if any of the services reference return a negative result.

When set to OR, the response from the GroupService is positive if any of the services referenced return a positive result. The response is negative if all the referenced services return a negative result.

The settings parallel-AND or parallel-OR are similar to AND and OR settings, except that each referenced service processes requests simultaneously instead of asking each reference service sequentially to save processing time.

InitEntryPoint

Required; must be the name of the global symbol Cisco Prime AR should call when it initializes the shared library and just before it unloads the shared library.

A rex service must have an InitEntryPoint even if the service only returns REX_OK.

GroupServices 

Optional; use the GroupServices subdirectory to specify the subservices in an indexed list to provide specific ordering control of which services to apply first. Each subservice listed must be defined in the Services section of the Radius configuration and cannot be a of type group, eap-leap, or eap-md5.

To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

UserList

Required; this object contains all of the individual UserLists, which in turn, contain the specific users stored within Cisco Prime AR. Cisco Prime AR references each specific UserList by name from a Service whose type is set to local.

When Cisco Prime AR receives a request, it directs it to a Service. When the Service has its type property set to local, the Service looks up the user's entry in the specific UserList and authenticates and/or authorizes the user against that entry.

Class name

Optional; set to the name of a class that implements the Extension interface.

InitializeArg

Optional; set to a string to be passed to the Initialize method if the class implements the optional ExtensionWithInitialization interface.

HARKKey

Required; used as the base key to generate random HARKKey for all the HAs that are configured in Cisco Prime AR.

By default, the value is cisco112.You can change this value.

WimaxAuthenticationService

Required; a valid EAP service which can be used for WiMAX authentication. By default, this value is none.

HARKLifeTime

Required; used as time (in minutes) to regenerate the HARKKeys based on its lifetime.

WimaxSessionManager

Required; set a valid session manager which has HA and HA Cache as resource managers. By default, this value is none.

WimaxQueryService

Required; set a valid RADIUS query service which is configured with WiMAX session manager. By default, this value is none.

WimaxPrepaidService

Optional; set a valid prepaid service to carry out the prepaid functionality of WiMAX. Otherwise this value is set to none.

AllowAAAToIncludeKeys

Optional; If this is set, the HAAA will include the hHA-RK-Key, hHA-RK-SPI and hHA-RK-Lifetime in the Access-Accept.

Otherwise, those attributes will not be in the Access-Accept. By default this value is True.

RequiredMSK

Optional; If this is set, the MSK will be provided by the AAA server as a result of successful EAP-Authentication. By default, this value is False.

Attribute List tab

Attribute type

Select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list. Select the attributes from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Session Manager tab

Session Manager

Select the required session manager from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Service Name

Required; name of the remote server service

Incoming Script

Optional; name of script to run when the service starts

Type

Required; Remote service Type must be set to one of the following: domain-auth, ldap, ldap-accounting, odbc-accounting, odbc, oci-accounting, oci, prepaid, radius, or radius-session.

Outgoing Script

Optional; name of script to run when the service ends.

Outage Script

Optional; if you set this property to the name of a script, Cisco Prime AR runs it when an outage occurs. This property allows you to create a script that notifies you when the RADIUS server detects a failure.

Outage Policy

The default is RejectAll. This property defines how Cisco Prime AR handles requests if all servers listed in the RemoteServers properties are unavailable (that is, all remote RADIUS servers are not available). You must set it to one of the following: AcceptAll, DropPacket, or RejectAll.

Description (optional)

Optional; description of the remote server service

MultipleServersPolicy

Required; must be set to either Failover or RoundRobin.

When you set it to Failover, Cisco Prime AR directs requests to the first server in the list until it determines the server is offline. At which time, Cisco Prime AR redirects all requests to the next server in the list until it finds a server that is online.

When you set it to RoundRobin, Cisco Prime AR directs each request to the next server in the RemoteServers list to share the resource load across all of the servers listed in the RemoteServers list.

RemoteServers

Select the required remote server from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Service Name

Required; service name

Incoming Script

Optional; script Cisco Prime AR server runs when it receives a request from a client.

Type

Required; must set it to a valid Cisco Prime AR service.

Outgoing Script

Optional; script Cisco Prime AR server runs before it sends a response to a client.

Maximum Message Size

Indicates the maximum length in bytes that a PEAP or EAP-TLS message can have before it is fragmented.

Server Certificate File

Required; the full pathname of the file containing the server's certificate or certificate chain used during the TLS exchange. The pathname can be optionally prefixed with a special string that indicates the type of encoding used for the certificate. The two valid encoding prefixes are PEM and DER. If an encoding prefix is not present, the file is assumed to be in PEM format.

The following example assumes that the subdirectory pki under /cisco-ar contains the server's certificate file. The file server-cert.pem is assumed to be in PEM format; note that the file extension .pem is not significant.

set ServerCertificateFile PEM:/cisco-ar/pki/server-cert.pem

Private Key Password

Required; the password used to protect the server's private key.

Server RSA Key File

Required; the full pathname of the file containing the server's RSA private key.

CRL Distribution URL

Optional; The URL that Cisco Prime AR should use to retrieve the CRL.You can specify a URL that uses HTTP or LDAP.

The following is an example for an HTTP URL: <http://crl.verisign.com/pca1.1.1.crl>.

The following is an example for an LDAP URL: ldap://209.165.200.225:388/CN=development-CA,CN=acs-westcoast2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cisco,DC=com

CA Certificate File

Optional; the full pathname of the file containing trusted CA certificates used for client verification. The file can contain more than one certificate, but all certificates must be in PEM format. DER encoding is not allowed.

Certificate Verification Mode

Optional; specifies the type of verification used for client certificates. Must be set to one of RequireCertificate, None, or Optional.

•RequireCertificate causes the server to request a client certificate and authentication fails if the client refuses to provide one.

•None will not request a client certificate.

Optional causes the server to request a client certificate but the client is allowed to refuse to provide one.

CA Certificate Path

Optional; the name of a directory containing trusted CA certificates (in PEM format) used for client verification. This parameter is optional, and if it is used there are some special preparations required for the directory it references.

Each certificate file in this directory must contain exactly one certificate in PEM format. The server looks up the certificate files using the MD5 hash value of the certificate's subject name as a key. The directory must therefore also contain a set of symbolic links each of which points to an actual certificate file. The name of each symbolic link is the hash of the subject name of the certificate.

For example, if a certificate file name ca-cert.pem is located in the CACertificatePath directory, and the MD5 hash of the subject name contained in ca-cert.path.pem is 1b96dd93, then a symbolic link named 1b96dd93 must point to the ca-cert.pem file.

If there are subject name collisions such as multiple certificates with the same subject name, each link name must be indexed with a numeric extension as in 1b96dd93.0 and 1b96dd93.1.

Verification Depth

Optional; specifies the maximum length of the certificate chain used for client verification.

Enable Session Cache

Optional; specifies whether TLS session caching (fast reconnect) is enabled or not. Set to True to enable session caching; otherwise set to False.

Tunnel Service

Required; must be the name of an existing EAP-MSCHAPv2 or EAP-SIM service.

Authentication Timeout

Required; specifies time (in seconds) to wait before an authentication request times out; defaults to 120.

Description (optional)

Optional; description of the PEAP service.

Session Timeout

Optional; if TLS session caching (fast reconnect) is enabled, SessionTimeout specifies the maximum lifetime of a TLS session. Expired sessions are removed from the cache and will require a subsequent full authentication.

SessionTimeout is specified as a string consisting of pairs of numbers and units, where units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks, as in the following:

Set SessionTimeout "1 Hour 45 Minutes"

Enable WPS

Optional; When set to TRUE, enables Windows Provisioning Service (WPS) and provides two other properties, MasterURL and WPSGuestUserProfile. The default value is FALSE.

Master URL

Optional; when using WPS, specifies the URL of the provisioning server which is modified with the appropriate fragment and sent to the client.

WPS Guest User Profile

Optional; when using WPS, specifies a profile to be used as a guest user profile; must be a valid profile under /Radius/Profiles.

This profile is used for guests and users whose account has expired. This profile normally contains attributes denoting the VLAN-id of the guest network (which has the provisioning server alone) and might contain IP-Filters that would restrict the access of the guest (to only the provisioning server).

Service Name

Required; service name

Incoming Script

Optional script Cisco Prime AR server runs when it receives a request from a client.

Type

Required; must set it to a valid Cisco Prime AR service

Outgoing Script

Optional script Cisco Prime AR server runs before it sends a response to a client

Description (optional)

Optional; description of the PEAP service.

Authentication Timeout

Mandatory; specifies time (in seconds) to wait before an authentication request times out; defaults to 120.

UserService

Required; name of service that can be used to authenticate using cleartext passwords.

ServiceList

List of preconfigured EAP authentication services. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Maximum Message Size

Required; indicates the maximum length in bytes that a PEAP message can have before it is fragmented.

Server Certificate File

Required; the full pathname of the file containing the server's certificate or certificate chain used during the TLS exchange. The pathname can be optionally prefixed with a special string that indicates the type of encoding used for the certificate. The two valid encoding prefixes are PEM and DER. If an encoding prefix is not present, the file is assumed to be in PEM format.

Private Key Password

Required; the password used to protect the server's private key.

Server RSA Key File

Required; the full pathname of the file containing the server's RSA private key. The pathname can be optionally prefixed with a special string that indicates the type of encoding used for the certificate. The two valid encoding prefixes are "PEM" and "DER". If an encoding prefix is not present, the file is assumed to be in PEM format.

The following example assumes that the subdirectory pki under /cisco-ar contains the server's certificate file. The file server-key.pem is assumed to be in PEM format. The file extension .pem is not significant.

set ServerRSAKeyFile PEM:/cisco-ar/pki/server-key.pem

CRL Distribution URL

Optional; enter the URL that Cisco Prime AR should use to retrieve the CRL.You can specify a URL that uses HTTP or LDAP.

The following is an example for an HTTP URL: <http://crl.verisign.com/pca1.1.1.crl>.

The following is an example for an LDAP URL: ldap://209.165.200.225:388/CN=development-CA,CN=acs-westcoast2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cisco,DC=com

CA Certificate File

Optional; the full pathname of the file containing trusted CA certificates used for client verification. The file can contain more than one certificate, but all certificates must be in PEM format. DER encoding is not allowed.

Certificate Verification Mode

The value is set to optional by default. If set to RequireCertificate, the client certificate will always be verified. If set to optional, client certificate verification happens optionally.

CA Certificate Path

The name of a directory containing trusted CA certificates (in PEM format) used for client verification. This parameter is optional and if it is used there are some special preparations required for the directory it references.

Each certificate file in this directory must contain exactly one certificate in PEM format. The server looks up the certificate files using the MD5 hash value of the certificate's subject name as a key. The directory must therefore also contain a set of symbolic links each of which points to an actual certificate file. The name of each symbolic link is the hash of the subject name of the certificate.

For example, if a certificate file named ca-cert.pem is located in the CACertificatePath directory, and the MD5 hash of the subject name contained in ca-cert.path.pem is 1b96dd93, then a symbolic link named 1b96dd93 must point to ca-cert.pem.

If there are subject name collisions such as multiple certificates with the same subject name, each link name must be indexed with a numeric extension as in 1b96dd93.0 and 1b96dd93.1.

Verification Depth

Optional; specifies the maximum length of the certificate chain used for client verification.

Enable Session Cache

Optional; specifies whether TLS session caching (fast reconnect) is enabled or not. Set to True to enable session caching; otherwise set to False.

Session Timeout

Required; if TLS session caching (fast reconnect) is enabled, SessionTimeout specifies the maximum lifetime of a TLS session. Expired sessions are removed from the cache and will require a subsequent full authentication.

SessionTimeout is specified as a string consisting of pairs of numbers and units, where units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks, as in the following:

Set SessionTimeout "1 Hour 45 Minutes"

UseECCCertificate

Determines the applicability of the authentication mechanism in SmartGrid Solutions.

When you select this check box, it can use the ECC, RSA, or combination of both certificate for certificate based verification.

When you uncheck this check box, it can only use the RSA certificate for certificate based verification. The default location to fetch the certificate file is /cisco-ar/pki.

Authentication Service

Specifies the name of the EAP-GTC service used for authentication. The named service must have the UseLabels parameter set to True.

User Prompt

Optional string the client might display to the user; default is Enter password:" Use the set command to change the prompt, as in the following:

set UserPrompt "Admin Password:"

UseLabels

Required; must be set to TRUE for EAP-FAST authentication and set to FALSE for PEAP authentication. Set to FALSE by default.

SystemID

Optional; string that identifies the sender of the MSChapV2 challenge message.

IsWindows7Client

Optional; must be set to TRUE for EAP-MSChapV2 authentication. Set to FALSE by default.

Authority Identifier

Required; a string that uniquely identifies the credential (PAC) issuer. The client uses this value to select the correct PAC to use with a particular server from the set of PACs it might have stored locally.

Authority Information

Required; a string that provides a descriptive text for this credential issuer. The value can be displayed to the client for identification purposes and might contain the enterprise or server names.

Credential Life Time

Optional; specifies the maximum lifetime of a Protected Access Credential (PAC). Clients that successfully authenticate with an expired PAC will be reprovisioned with a new PAC.

CredentialLifetime is specified as a string consisting of pairs of numbers and units, where units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks. Credentials that never expire should be specified as Forever.

Provision Service

Required; specifies the name of the EAP-MSChapV2 service used for provisioning.

Provision Mode

Required; specifies the TLS mode used for provisioning. Clients only support the default Anonymous mode.

Always Authenticate

Optional; indicates whether provisioning should always automatically rollover into authentication without relying on a separate session. Most environments, particularly wireless, will perform better when this parameter is set to True, the default value.

SubscriberDBLookup

Specifies the type of communication with the HLR/HSS server.

Based on the type selected, the communication happens with the HLR/HSS server using the diameter Wx interface, MAP protocol, or SIGTRAN-M3UA protocol.

This field is displayed when you select the eap-sim option in the Type field.

Subscriber_DBLookup

Specifies the type of communication with the HLR/HSS server.

Based on the type selected, the communication happens with the HLR/HSS server using the diameter Wx interface, SIGTRAN protocol, or SIGTRAN-M3UA protocol.

This field is displayed when you select the eap-aka option in the Type field.

DestinationRealm

Required. Need to configure the Diameter Remote Server for the Realm. The role of the remote server should be Relay.

PreRequestTranslationScript

Optional. Cisco Prime AR server runs before sending the request to the Diameter remote server. The script can modify the Radius packet dictionaries.

PostRequestTranslationScript

Optional. Cisco Prime AR server runs before sending the request to the Diameter remote server. The script can modify the Diameter packet dictionaries.

PreResponseTranslationScript

Optional. Cisco Prime AR server runs after receiving the response from the Diameter remote server. The script can modify the Diameter packet dictionaries.

PostResponseTranslationScript

Optional. Cisco Prime AR server runs after receiving the response from the Diameter remote server. The script can modify the Radius packet dictionaries.

FetchAuthorizationInfo

When you select this check box, it fetches MSISDN from HLR.

General tab
The details in the tab is displayed based on the eap-sim or eap-aka option you select in the Type field.

MultipleServersPolicy

Required. Must be set to either Failover or RoundRobin.

When set to Failover, Cisco Prime AR directs requests to the first server in the list until it determines the server is offline. At that time, Cisco Prime AR redirects all requests to the next server in the list until it finds a server that is online.

When set to RoundRobin, Cisco Prime AR directs each request to the next server in the RemoteServers list to share the resource load across all of the servers listed in the RemoteServers list.

NumberOfTriplets

Required; number of triplets (1, 2, or 3) to use for authentication; default is 2.

PseudonymSecret

Required; the secret string that is used as the basis for protecting identities when identity privacy is enabled. This should be at least 16 characters long and have a value that is impossible for an outsider to guess. The default value is secret.

Note It is very important to change PseudonymSecret from its default value to a more secure value when identity privacy is enabled for the first time.

PseudonymRenewtime

Required; specifies the maximum age a pseudonym can have before it is renewed. When the server receives a valid pseudonym that is older than this, it generates a new pseudonym for that subscriber. The value is specified as a string consisting of pairs of numbers and units, where the units might be of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks. The default value is "24 Hours".

Examples are: "8 Hours", "10 Hours 30 Minutes", "5 D 6 H 10 M"

PseudonymLifetime

Required; specifies the maximum age a pseudonym can have before it is rejected by the server, forcing the subscriber to authenticate using it's permanent identity. The value is specified as a string consisting of pairs of numbers and units, where the units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks. It can also be Forever, in which case, pseudonyms do not have a maximum age. The default value is "Forever".

Examples are: "Forever", "3 Days 12 Hours 15 Minutes", "52 Weeks"

ReauthenticationTimeout

Required; specifies the time in seconds that reauthentication identities are cached by the server. Subscribers that attempt to reauthenticate using identities that are older than this value will be forced to use full authentication instead. The default value is 3600 (one hour).

EnableReauthentication

Optional; when True, the fast reauthentication option is enabled. The default value is False.

UseProtectedResults

Optional; enables or disables the use of protected results messages. Results messages indicate the state of the authentication but are cryptographically protected.

ReauthenticationRealm

Optional; this information will be supplied later.

MaximumReauthentications

Required; specifies the maximum number of times a reauthentication identity might be reused before it must be renewed. The default value is 16.

TripletCacheTimeout

Required; time in seconds an entry remains in the triplet cache. A zero (0) indicates that triplets are not cached. The maximum is 28 days; the default is 0 (no caching).

Authentication Timeout

Required; time in seconds to wait for authentication to complete. The default is 2 minutes; range is 10 seconds to 10 minutes.

UseSimDemoTriplets

Optional; set to TRUE to enable the use of demo triplets. This must be disabled for release builds.

AlwaysRequestIdentity

Optional; when True, enables the server to obtain the subscriber's identity via EAP/SIM messages instead of relying on the EAP messages alone. This might be useful in cases where intermediate software layers can modify the identity field of the EAP-Response/Identity message. The default value is False.

EnableIdentityPrivacy

Optional; when True, the identity privacy feature is enabled. The default value is False.

Generate3GPPCompliantPseudonym

Optional; the value is set to False by default. If set to TRUE then Cisco Prime AR generates a 12 octet 3GPP compliant pseudonym identity. The Pseudonym username identities are used to protect the privacy of subscriber identities.

SendReAuthIDInAccept

Optional; the value is set to False by default. When set to True, Cisco Prime AR sends SN-Fast-ReAuth-UserName (Starent VSA) in access-accept message.

Outage Script

Optional; if you set this property to the name of a script, Cisco Prime AR runs it when an outage occurs. This property allows you to create a script that notifies you when the RADIUS server detects a failure.

Remote Servers tab

Attribute

Optional; list of remote RADIUS servers which are map gateways. The remote server type must be set to map-gateway. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Name

Required; name of the Diameter server.

Realm

Required; realm of the route. Must be unique for a route table.

Incoming Script

Optional; enabled when role is set to Proxy or Local. When set, must be the name of a known incoming script. Cisco Prime AR runs the IncomingScript before proxying the diameter packet to the remote diameter server.

Outgoing Script

Optional; enabled when role is set to Proxy or Local. When set, must be the name of a known outgoing script. Cisco Prime AR runs the OutgoingScript after it receives the response from the remote Diameter server.

Authentication Service

Required; used when service is configured to process the diameter requests locally. Set to valid service of type (local/ldap/odbc) to authenticate the user. This field is displayed when you select the role type as `Local' in the Role field.

AccountingService

Required; used when service is configured to process the accounting requests locally. Set to valid accounting service of type(file/odbc-accounting) to write the accounting records. This field is displayed when you select the role type as `Local' in the Role field.

Description

Optional; description of the Diameter server.

Role

Required; specifies the role that the diameter entity will play in resolving messages matching the realm.

The role can be any one of the following:

Relay - Application acting as a Relay Agent.

Redirect - Application acting as a Redirect Agent.

Proxy - Application acting as a Proxy Agent. When the role is set to Proxy, the IncomingScript and OutgoingScript points are enabled.

Local - Application processes the requests locally. When the role is set to Local, the AuthenticationService and AccountingService are enabled.

By default, the Proxy option is selected. However, you can select another option from the drop-down list.

Type

Required; specifies the service type.The service type `Diameter' is automatically displayed in this field.

PEER Statements
This is displayed when you select the `Local', `Relay', or `Redirect'option in the Role field.

Name

Required; name of the peer.

Host Name

Required; the hostname or IP address of the peer. The hostname must exist in the client list for the route to be active.

Metric

Required; metric value for the peer entry. The higher the value the lower the preference. The highest value of preference is 0.

VendorSpecific

Required; the default is FALSE. If set to FALSE, the application is ordinary application and user is prompted to enter the ApplicationID. If set to TRUE, the application is a VendorSpecific Application. User is prompted to enter VendorSpecificApplicationID and VendorID.

VendorID

Required; specifies the VendorID for the application.

Example:

DIAMETER 3GPP Cx APPLICATION

VendorSpecificApplicationID 16777216

VendorID 10415

VendorSpecificApplicationID

Required; specifies the integer value for the vendor specific application.

ApplicationID

Required; application used in the route. The application Id should be available in /Advanced/Diameter/Applications.

Applications

This is displayed when you select the `Proxy' option in the Role field.

Name

Required; name of the application.

Description

The description of the application.

ApplicationID

Required; specifies the unique integer value for the application. It represents the application id of the Application used for load balancing the diameter messages.

EnableSticky

Required; default is FALSE. If set to True, the sticky entries for load balancing is enabled and the user is prompted to enter the values for StickySessionKey, StickyCreationCmdList, and StickyDeletionCmdList.

MultiplePeersPolicy

Required; must be set to RoundRobin, FailOver, or IMSIRangeBased. Policy used by the Cisco Prime AR server to load balance the peers.

StickySessionKey

Required; used as the sticky key for mapping the sticky sessions. Set the value to a valid AVP in order to use the sticky key for maintaining diameter sessions. This ensures that Cisco Prime AR maps the request to the same server for all the subsequent messages using the sticky key. For example, set StickyAVP "Session-Id".

When the Cisco Prime AR server receives the CCR-I request, Cisco Prime AR extracts the Session-Id from the request packet, maps the Session to the peer configured in the list, and forwards the request to the chosen peer. Cisco Prime AR chooses the same peer for all the subsequent messages(CCR-Update/CCR-Terminate) with same Session-Id.

StickyCreationCmdList

Required; specifies the command list to create the sticky entries. Specify the list of `||' separated command code, AVP name, and its value to create the sticky sessions.

The following is the StickyCreationCmdList format:

<commandcode1>::<AVPName1=Value1> || <commandcode2<::<AVPName2=Value2>||<commandcode3>

For example, if the sticky session entries need to created based on command code `265'or based on command code `271' with Accounting-Record-Type value as 2, use the format below:

Set StickyCreationCmdList "265||271:: Accounting-Record-Type=2"

StickyDeletionCmdList

Required; specifies the command list to delete the sticky entries.Specify the list of `||' separated command code, AVP name, and its value to delete the sticky sessions.

The following is the StickyDeletionCmdList format:

<commandcode1>::<AVPName1=Value1> || <commandcode2<::<AVPName2=Value2>||<commandcode3>

For example, if the sticky session entries need to deleted based on command code `271' with Accounting-Record-Type value as 4, use the format below:

Set StickyDeletionCmdList "271:: Accounting-Record-Type=4"

PEER Definitions Proxy

Name

Required; name of the peer.

Host Name

Required; hostname or IP address of the peer. The HostName must exist in the client list for the route to be active.

Metric

Required; metric value for this peer entry. The higher the value the lower the preference. The highest value of preference is 0.

Weight

Required; default value is 0. Specifies the weight percentage for which the service needs to load balance the peer.

Note When you set the weight to a value other than 0, the weight should be in multiples of 10 and the sum of the weights configured in the peer list should be equal to 100.

IMSIRanges

Required; used for load balancing. The value is set to comma separated values of IMSI Ranges.

For example, set IMSIRanges "112156000000001-112156001000000,112156010000001-112156011000000"

Note Cisco Prime AR uses the AVP configured in StickyAVP property to check whether the IMSI is in valid range.

IsActive

Optional; if this is set to true, the new sessions will not go to the peer server. By default, this is set as false.

General Properties tab

Replication Type

Indicates the type of replication

Transaction Sync Interval (in ms)

Duration between periodic transmission of the TransactionSync message expressed in milliseconds. The default is 60000 or 1 minute.

Transaction Archive Limit

The default setting is 100.

The value set for RepTransactionArchiveLimit should be the same on the master and the slave.

Replication Secret

The value of this setting must be identical on both the master and the slave.

Is Master

On the master, set RepIsMaster to TRUE. On the slave, set it to FALSE.

Master IP Address

Specifies the IP Address of the master.

Master Port

Specifies the port to be used to send replication messages to the master.

Replication IP Address

The value is set to the IP Address of the machine containing the Cisco Prime AR installation.

Replication Port

Defaults to port1645.

Replication Members tab

Name

Name of the slave. The name must be unique.

IP Address

Indicates the IP Address of the slave.

Port

Port upon which the master will send replication messages to the slave.

Name

Required; must be unique in the Radius dictionary list

Description

Optional; description of the attribute

Attribute

Required; must be a number between 1-255. It must be unique within the Attribute dictionary list.

Type

Required; type governs how the value is interpreted and printed.

Minimum

Set to zero

Maximum

Set to 253

Enum Number

Enums allow you to specify the mapping between the value and the strings. After you have established this mapping, Cisco Prime AR then replaces the number with the appropriate string. The min/max properties represent the lowest to highest values of the enumeration.

Enum Equivalent

The value can range from 1 through 255. Click the Add button to save the details and list it in the Enums list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Tag

The tag number value can range from 0 through 31. The default value is zero.

Name

Required; must be unique in the Vendor dictionary list

Description

Optional; description of the attribute

Vendor ID

Required; must be a valid number and unique within the entire attribute dictionary

Type

Required; type governs how the value is interpreted and printed.

Minimum

Optional; set to zero

Maximum

Optional; set to 253

Enum Number

Optional; enums allow you to specify the mapping between the value and the strings. After you have established this mapping, Cisco Prime AR then replaces the number with the appropriate string. The min/max properties represent the lowest to highest values of the enumeration.

Enum Equivalent

Optional; the value can range from 1 through 255. Click the Add button to save the details and list it in the Enums list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Tag

Optional; the tag number value can range from 0 through 31. The default value is zero.

Vendor Size

Optional; set the vendor size to 8, 16, or 32 bit

HasSubAttributeLengthField

Optional; indicates that the value field of the attribute has the length field for the sub attribute.

Name

Required; must be unique in the Vendor attribute list

Description

Optional; description of the attribute

Attribute

Required; must be a valid number and unique within the entire attribute dictionary

Type

Required; type governs how the value is interpreted and printed.

Minimum

Optional; set to zero

Maximum

Optional; set to 253

Enum Number

Optional; enums allow you to specify the mapping between the value and the strings. After you have established this mapping, Cisco Prime AR then replaces the number with the appropriate string. The min/max properties represent the lowest to highest values of the enumeration.

Enum Equivalent

Optional; the value can range from 1 through 255. Click the Add button to save the details and list it in the Enums list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Tag

Optional; the tag number value can range from 0 through 31. The default value is zero.

Name

Required; must be unique in the Vendors list.

IncomingScript

Optional; when you specify an IncomingScript, Cisco Prime AR runs the script on all requests from clients that specify that vendor.

Description

Optional; description of the vendor.

OutgoingScript

Optional; when you specify an OutgoingScript, Cisco Prime AR runs the script on all responses to the Client.

General Properties tab

Name

Required; must be unique in the Translations list.

Description

Optional; description of the Translation

Attribute Type

Optional; select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list. Select the attributes from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Attributes tab

Attribute Type

Optional; select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Radius and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Name

Required; must be unique in the Translations list.

Description

Optional; description of the Translation Group.

Translations

Optional; lists of translation. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

General section

Product

Optional; name of the product.

AuthApplicationIdList

Specifies the list of AuthApplications that the Cisco Prime AR server registers to Diameter Base stack during start up. It is a combination of Auth ApplicationId's separated by colon.

Version

Optional; version number.

AcctApplicationIdList

Specifies the list of AcctApplications that the Cisco Prime AR server registers to Diameter Base stack during start up. It is a combination of Acct ApplicationId's separated by colon.

Transport Management section

Identity

Required; identity of the system on which Diameter application is running. Must be set to a valid resolvable string.

Realm

Required; must be set to a valid Realm in the domain.

EnableIPV6

Required; if set to TRUE it enables IPV6 for the Diameter application.

WatchdogTimeout

Required; specifies the time interval between watch dog messages.

ReconnectInterval

Required; specifies the time interval between which Cisco Prime AR server attempts to connect to a disconnected peer. If set to 0, then no attempt will be made to connect to a disconnected peer.

MaxReconnections

Required; specifies the number of times Cisco Prime AR server tries to make a reconnection attempt. If set to 0, then no attempt will be made to reconnect.

RequestRetransmissionInterval

Required; the time for which retransmission of pending requests will be done. If set to 0, then no attempt will be made to retransmit.

MaxRequestRetransmissionCount

Required, maximum number of times Cisco Prime AR server tries to retransmit a pending request. If set to 0, then no attempt will be made to retransmit.

Receive BufferSize

Required; initial size of buffer that is preallocated for message reception.

AdvertisedHostName

Optional, specifies the local hostname address that will be advertised by the Cisco Prime AR server to other peers during CER/CEA exchange.

For example:

AdvertisedHostNames = toby-ar1.cisco.com

TCPListenPort

Required; port number on which the Cisco Prime AR server listens for TCP peer connections.

SCTPListenPort

Required;  port number on which the Cisco Prime AR server listens for SCTP peer connections.

MaxNumberOfSessions

Required; specifies the maximum number of concurrent Diameter sessions the Cisco Prime AR server will maintain. These sessions include both Auth and Acct sessions.

AuthSessions section

EnableStatefulSessions

If set to TRUE, the server will enforce stateful sessions and the client will hint for stateful sessions. Default Value is TRUE. Set the property to FALSE to disable stateful sessions.

AuthSessionTimeout

Required; specifies the timeout in seconds before a session requires reauthentication.

LifeTimeTimeout

Required; specifies the timeout in seconds before a session is terminated regardless of whether the session has been reauthenticated.

GracePeriodTimeout

Required; specifies the grace period after the life timeout and before the full termination of the session.

AbortRetryTimeout

Required; specifies the timeout between the subsequent Abort Session Request (ASR) messages if the initial attempt fails.

AcctSessions section

AcctSessionTimeout

Required; specifies the timeout in seconds before a session requires reauthentication.

InterimInterval

Required; specifies the interim interval dictated to the client if the entity is a server or hint to the server if the entity is a client.

RealTime

Required; RealTime value dictated to the client.

Name

Required; name of the application.

Description

Optional; description of the application.

VendorSpecific

Required; the default is FALSE. If set to FALSE, the application is ordinary application and user is prompted to enter the ApplicationID. If set to TRUE, the application is a VendorSpecific Application. User is prompted to enter VendorSpecificApplicationID and VendorID.

AuthApplication

Required; if set to TRUE the application represents AuthApplication else it represents Accounting Application.

Application ID

Required; specifies the unique integer value for the application.

The following are examples of Diameter application:

NASREQ 1

Mobile-IP 2

Diameter Base Accounting 3

Note ApplicationId property must be set to 0 for Base Protocol.

VendorSpecificApplicationID

Required; specifies the integer value for the vendor specific application.

VendorID

Required; specifies the VendorID for the application.

Example:

DIAMETER 3GPP Cx APPLICATION

VendorSpecificApplicationID 16777216

VendorID 10415

ApplicationURI

Optional; specifies the URI of the Application.

Eg: "ftp://ftp.ietf.org/internet-drafts/draft-ietf-aaa-diameter-nasreq- 12.txt"

Commands

Required; an indexed list from 1 to <n>. Each entry in the list is the name of the command. It specifies the list of commands associated with the application.

To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Name

Required; name of the command.

Description

Optional; description of the command.

Command Code

Required; specifies the integer code of the command.

EnableProxyBit

Required; default is TRUE. When enabled it represents the message is proxiable.

RequestFixed tab

Defines the fixed position of AVP in a request message.

RequestRequired tab

The AVP must be present and can appear anywhere in the request message.

RequestOptional tab

The AVP name in optional cannot evaluate to any avp name which is included in a fixed or required directory. The avp can appear anywhere in the request message.

AnswerFixed tab

Defines the fixed position of AVP in the answer message.

AnswerRequired tab

The AVP must present and can appear anywhere in the answer message.

AnswerOptional tab

The AVP name in optional cannot evaluate to any avp name which is included in a fixed or required directory. The avp can appear anywhere in the answer message.

Name

Required; name of the AVP.

Description

Optional; description of the AVP.

Min

Specifies the minimum number of times AVP element may be present in a request. The default value is 0.

Max

Specifies the maximum number of times the element may present in a request. A value of zero implies AVP is not present in the request.

Default section

AAAFileServiceSyncInterval

Required; specified in milliseconds, the default is 75. This property governs how often the file AAA service processes accounting requests and writes the accounting records to the file. You can lower the number to reduce the delay in acknowledging the Account-Request at the expense of more frequent flushing of the accounting file to disk. You can raise the number to reduce the cost of flushing to disk, at the expense of increasing the delays in acknowledging the Accounting-Requests. The default value was determined to provide a reasonable compromise between the two alternatives.

RemoteRadiusServerInterface

When set, specifies the local interface to bind to when creating the RemoteRadiusServer socket. If not set, the Cisco Prime AR binds to IPADDR_ANY.

MaximumNumberOfXMLPackets

Required when using identity caching. Indicates the maximum number of XML packets to be sent or received. The minimum value is 1 and the maximum is a 32-bit unsigned integer. The default is 1024.

MaximumODBCResultSize

Required; specifies maximum size in bytes for an ODBC mapping. This parameter affects both ODBC result sizes and the trace log buffer for tracing script calls that access any of the dictionaries. (Default value is 256.)

XMLUDPPacketSize

Required when using identity caching. Indicates the maximum size of XML packets to be sent or received. The minimum value is 1 and the maximum is a 32-bit unsigned integer. The default is 4096.

InitialBackgroundTimerSleepTime

Required; the default is 5. This property specifies the amount of time the time queue should initially sleep before beginning processing. This property is only used for initial synchronization and should not be changed.

RemoteLDAPServerThreadTimerInterval

Required; specified in milliseconds, the default is 10. This property governs how often the ldap RemoteServer thread checks to see if any results have arrived from the remote LDAP server. You can modify it to improve the throughput of the server when it proxies requests to a remote LDAP server.

AdvancedDuplicateDetectionMemoryInterval

Required when the Advanced Duplicate Detection feature is enabled. This property specifies how long (in milliseconds) Cisco Prime AR should remember a request. You must specify a number greater than zero. The default is 10,000.

RollingEncryptionKeyChangePeriod

Used in conjunction with the session-cache ResourceManager, this property specifies the length of time a given EncryptionKey will be used before a new one is created. When the session-cache ResourceManager caches User-Password attributes, Cisco Prime AR encrypts the User-Password so it is not stored in memory or persisted on disk in clear text. Cisco Prime AR uses up to 255 encryption keys, using a new one after each RollingEncryptionKeyChangePeriod expires. If RollingEncryptionKeyChangePeriod is set to 2 days, Cisco Prime AR will create and begin using a new EncryptionKey every two days. The oldest key will be retired, and Cisco Prime AR will re-encrypt any User-Passwords that used the old key with the new key. This way, if the RollingEncryptionKeyChangePeriod is set to 1 day, no key will be older than 255 days.

DefaultReturnedSubnetSizeIfNoMatch

Optional; used with the ODAP feature and reflects the returned size of the subnet if no matched subnet is found. There are three options to select if an exactly matched subnet does not exist: Bigger, Smaller, and Exact. The default is Bigger.

ODBCEnvironmentMultiValueDelimiter

Optional; allows you to specify a character that separates multivalued attributes in the marker list when using Oracle (or ODBC) accounting

RemoteSigtranServerThreadTimerInterval

Required; specified in milliseconds, the default is 10. This property governs how often the sigtran RemoteServer thread checks to see if any results have arrived from the remote HLR/AuC server. You can modify it to improve the throughput of the server when it proxies requests to a remote sigtran server.

AdditionalNativeOracleErrors

Optional; 5 digit Oracle native error in order to disconnect the ODBC/OCI remote servers.

AR Flags section

HideSharedSecretAndPrivateKeys

Optional; the default value is TRUE.

The HideSharedSecretAndPrivateKeys property hides:

•The secret that is shared between a Radius Client and a Radius Server or between two radius servers in a radius proxy scenario.

•The PrivateKeyPassword under the certificate-based EAP services.

When this property is set to TRUE, the following properties are displayed as <encrypted>:

•PrivateKeyPasswords in:

–peap-v0 service

–peap-v1 service

–eap-tls service

–eap-ttls service

–eap-fast service

•SharedSecret in:

–RemoteServers of type radius

–RemoteServers of type map-gateway

–Clients object

–Resource Manager of type usr-vpn under Gateway subobject

•PseudonymSecret in eap-sim service

•DynamicAuthSecret under DynamicAuthorizationServer subject in Clients object

•RepSecret under Replication

•Secret in /radius/advanced/DDNS/TSIGKeys

When the value for this property is set to FALSE, all the above properties are displayed in clear text.

ListenForDynamicAuthorizationRequests

Must be set to TRUE when using the Change of Authorization (CoA) feature or Packet of Disconnect (POD) feature. Default is FALSE.

RequireNASsBehindProxyBeInClientList

Optional; the default is FALSE. If you accept the default, Cisco Prime AR only uses the source IP address to identify the immediate client that sent the request. Leaving it FALSE is useful when this RADIUS Server should only know about the proxy server and should treat requests as if they came from the proxy server. This might be the case with some environments that buy bulk dial service from a third party and thus do not need to, or are unable to, list all of the NASs behind the third party's proxy server. When you set it to TRUE, you must list all of the NASs behind the Proxy in the Clients list.

UseAdvancedDuplicateDetection

Required; the default is FALSE. Set this property to TRUE when you want Cisco Prime AR to use a more robust duplicate request filtering algorithm.

DetectOutOfOrderAccountingPackets

Optional; used to detect accounting packets that arrive out of sequential order. The default is FALSE. This property is useful when using accounting and session management in a RADIUS proxy service.

When the DetectOutOfOrderAccountingPacket property is enabled (set to TRUE), a new Class attribute is included in all outgoing Accept packets. The value for this Class attribute will contain the session magic number. The client will echo this value in the accounting packets, and this will be used for comparison.

The session magic number is a unique number created for all sessions when the session is created or reused and the DetectOutOfOrderAccountingPacket property is set to TRUE. The DetectOutOfOrderAccountingPacket property is used to detect out-of-order Accounting-Stop packets in roaming scenarios by comparing the session magic number value in the session with the session magic number value contained in the Accounting packet.

The value of 0xffffffff is considered by the Cisco Prime AR server to be a wild card magic number. If any accounting stop packets contain the value of 0xffffffff, it will pass the session magic validation even if the session's magic number is something else.

The format of the class attribute is as follows:

<4-byte Magic Prefix><4-byte server IP address><4-byte Magic value>

Java & EAP Parameters section

ClasspathForJavaExtensions

A string which is the classpath to be used to locate Java classes and jar files containing the classes required for loading the Java extensions, either Java extension points or services.

Note The classpath will always contain the directory $INSTALLDIR/scripts/radius/java and all of the jar files in that directory.

JavaVMOptions

A string that can contain options to be passed to the JRE upon startup. JavaVMOptions should be used only when requested by Cisco TAC.

EapBadMessagePolicy

Set to one of two values: SilentDiscard (the default) or RejectFailure.

When set to SilentDiscard, the Cisco Prime AR server silently discards and ignores bad EAP messages unless the protocol specification explicitly requires a failure message.

When set to RejectFailure, the Cisco Prime AR server sends RADIUS Access-Rejects messages with embedded EAP-Failure in response to bad EAP messages as described in Internet RFC 3579.

CertificateDBPath

Required if you are using an LDAP RemoteServer and you want Cisco Prime AR to use SSL when communicating with that LDAP RemoteServer. This property specifies the path to the directory containing the client certificates to be used when establishing an SSL connection to an LDAP RemoteServer. This directory must contain the cert7.db and cert5.db certificates and the key3.db and key.db files database used by Netscape Navigator 3.x (and above) or the ServerCert.db certificate database used by Netscape 2.x servers.

Backing Store section

SessionBackingStoreSyncInterval

Sessions will be written to the backing store at this interval

PacketBackingStoreSyncInterval

The minimum value is 1 and the maximum is a 32-bit unsigned integer. The default is 75.

SessionBackingStorePruneInterval

Required; specifies the sleep time interval of the session backing store pruning thread. The recommended and default value is 6 hours, but you can modify this based on the traffic patterns you experience.

With SessionBackingStorePruneInterval set to 6 hours, pruning will occur 6 hours after you restart or reload the Cisco Prime AR server and recur every 6 hours.

You can set a very low value for this property to make pruning continuous, but there might not be enough data accumulated for the pruning to occur and pruning might be less effective compared to the default setting.

PacketBackingStorePruneInterval

Required; specifies the sleep time interval of the packet backing store pruning thread. The recommended value is 6 hours, but you can modify this based on the traffic patterns you experience.

When PacketBackingStorePruneInterval is set to 6 hours, pruning will occur 6 hours after you restart or reload the Cisco Prime AR server and recur every 6 hours.

You can set a very low value for this property to make pruning continuous, but there might not be enough data accumulated for the pruning to occur and pruning might be less effective compared to the default setting.

BackingStoreDiscThreshold

Required; the default is 10 gigabytes. The value of BackingStoreDisc-
Threshold is made up of a number of units which can be K, kilobyte, or kilobytes, M, megabyte, or megabytes, or G, gigabyte, or gigabytes.

BackingStoreDiscThreshold is used with session management and ODBC accounting and ensures that any data log files generated will not cross the BackingStoreDiscThreshold.

SessionPurgeInterval

Optional; the SessionPurgeInterval property determines the time interval at which to check for timed-out sessions. If no value is set, the session timeout feature is disabled. The checks are performed in the background when system resources are available, so checks might not always occur at the exact time set.

The minimum recommended value for SessionPurgeInterval is 60 minutes. The SessionPurgeInterval value is comprised of a number and a units indicator, as in n units, where a unit is one of minutes, hours, days, or weeks.

StaleSessionTimeout

Required; the default value is "1 hour." Specifies the time interval to maintain a session when a client does not respond to Accounting-Stop notification.

When the Cisco Prime AR server does not receive an Accounting-Response from a client after sending an Accounting-Stop packet, Cisco Prime AR maintains the session for the time interval configured in this property before releasing the session.

This property is stored as a string composed of two parts: a number and a unit indicator (<n> <units>) similar to the MaxFileAge property where the unit is one of: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, or Weeks.

NumberOfRadiusIdentifiersPerSocket

This represents the number of RADIUS Identifiers that Cisco Prime AR can use per source port, while proxying requests to remote servers.

To use a different source port for every request that is proxied, you need to set the value of this property to one.

EnableStickySessionCount

Required; either True or False and the default value is True. When set to True, Cisco Prime AR displays the peer specific stats showing the number of sticky sessions associated with a peer for diameter proxy service in name_radius_log file.

StickySessionCountInterval

Required; specified in milliseconds and the default is 60000. When the EnableStickySessionCount is set to True, this field specifies how often the diameter proxy service will display the number of sticky sessions associated with a peer.

StickySessionSyncInterval

Required; specified in milliseconds and the default value is 500. Specifies how often the diameter proxy service will write the sticky sessions to a file located in /cisco-ar/temp/__sticky_sessions_store location.

Server Parameters section

MaximumNumberOfRadiusPackets

Required; the default is 8192. This is a critical property you should set high enough to allow for the maximum number of simultaneous requests. When more requests come in than there are packets allocated, Cisco Prime AR will drop those additional requests.

NumberOfRemoteUDPServerSocket

Required; the default value for this property is 4.

The NumberOfRemoteUDPServerSockets property allows you to configure the number of source ports used while proxying requests to a remote radius server. If the NumberOfRemoteUDPServerSockets property is set to a value n, all remote servers share and use n sockets.

The NumberOfRemoteUDPServerSockets value comprises a number, as in n, where n should be less than or equal to the current process file descriptor limit divided by 2.

Note By default, the Radius process supports up to 1024 file descriptors. To increase the file descriptors, stop the arserver; in the arserver script, specify the required value to "NUMBER_OF_FILE_DESCRIPTORS" and restart the server. The value for "NUMBER_OF_FILE_DESCRIPTORS" should be in the range between 1024 to 65535.

MemoryLimitForRadiusProcess

This property is used to avoid crashing of the radius process.

UDPPacketSize

Required; the default is 4096. RFC 2138 specifies the maximum packet length can be 4096 bytes. Do not change this value.

PerPacketHeapSize

Required; the default is 6500. This property sets the size of the initial heap for each packet. The heap is the dynamic memory a request can use during its lifetime. By preallocating the heap size at the beginning of request processing, we can minimize the cost of memory allocations. If PerPacketHeapSize is too low, Cisco Prime AR will ask the system for memory more often. If PerPacketHeapSize is too high, Cisco Prime AR will allocate too much memory for the request causing the system to use more memory than required.

MinimumSocketBufferSize

Required; the default is 65536 (64 K). This property governs how deep the system's buffer size is for queueing UDP datagrams until Cisco Prime AR can read and process them. The default is probably sufficient for most sites. You can, however, raise or lower it as necessary.

MaximumOutstandingRequests

Optional; the default value for this property is 0.

The MaximumOutstandingRequests property is used to limit the incoming traffic in terms of "requests processed". Serves as a hard limit.

The MaximumOutstandingRequests property comprises a number n, where n can be any nonzero value.

MaximumIncomingRequests

Optional; the default value for this property is 0.

ARIsCaseInsensitive

When set to FALSE, requires that you provide exact pathnames with regard to upper and lower case for all objects, subobjects, and properties. The default setting, TRUE, allows you to enter paths such as /rad/serv instead of /Rad/Serv.

Note Cisco Prime AR always authenticates the RADIUS attribute User-Name with regard to upper and lower case, regardless of the setting of this flag.

KeyStores -> EAP-FAST section

EnableDiameter

Optional; Either TRUE or FALSE; default is TRUE. Set to True when you want to use the Diameter protocol in Cisco Prime AR.

NumberOfKeys

Number (from 1-1024) that specifies the maximum number of keys stored for EAP-FAST.

RolloverPeriod

Specifies the amount of time between key updates.

RemoteSessionServer section

ReactivateTimerInterval

Mandatory time interval (in milliseconds) to activate an inactive server; defaults to 300000 ms.

Timeout

Mandatory time interval (in seconds) to wait for SQL operation to complete; defaults to 15 seconds

DataSourceConnections

Mandatory number of connections to be established; defaults to 8

ODBCDataSource

Name of the ODBCDataSource to use and must refer to one entry in the list of ODBC datasources configured under /Radius/Advanced/ODBCDataSources. Mandatory; no default.

KeepAliveTimerInterval

Mandatory time interval (in milliseconds) to send a keepalive to keep the idle connection active; defaults to zero (0) meaning the option is disabled

MaximumBufferFileSize

Mandatory if BufferAccountingPackets is set to TRUE, determines the maximum buffer file size, defaults to 10 Megabyte)

CacheLimit

Default is 250000; This represents the overall limit on cache of all 'remote' session managers. This value is interpreted as the maximum number of packets that can be present in cache. When the number of sessions hits this limit, sessions will be 'cached out'. This cache out operation will continue, until the cache is at least 20% free.

BufferAccountingPackets

Mandatory, TRUE or FALSE, determines whether to buffer the accounting packets to local file, defaults to TRUE which means that packet buffering is enabled.

Note When set to TRUE, a constant flow of incoming accounting packets can fill the buffer backing store files in /cisco-ar/data/odbc beyond the size configured in MaximumBufferFileSize. Configure BackingStoreDiscThreshold in /Radius/Advanced when using ODBC accounting.

UseCacheIndex

Mandatory; If set to 1, it enables a fast cache based lookup index for the items in the database. This optimizes the number of queries to the database hence will improve performance, but limits the number of sessions that can be scaled.

If set to 0, it disables fast cache based lookup index.

SNMP Info section

InputQueueHighThreshold

An integer; default is 90.

InputQueueLowThreshold

An integer; default is 60.

Enabled

Either TRUE or FALSE; default is FALSE. To disable SNMP setting, uncheck the Enabled check box.

TracingEnabled

Either TRUE or FALSE; default is FALSE.

MasterAgentEnabled

Either TRUE or FALSE; default is TRUE.

RFC Compliance Info section

AllowRejectAttrs

When AllowRejectAttrs is set to FALSE, Reply-Message attributes will not be passed in an Access Reject packet. When AllowRejectAttrs is set to TRUE, attributes will be allowed to pass in an Access Reject packet.

AllowEAPRejectAttrs

When AllowEAPRejectAttrs is set to FALSE, Reply-Message attributes will not be passed in an Access Reject packet if the packet contains EAP-Message attribute. When AllowEAPRejectAttrs is set to TRUE, attributes will be allowed to pass in an Access Reject packet even if the packet contains EAP-Message attribute.

Reply Messages section

Default

Optional; when you set this property, Cisco Prime AR sends this value when the property corresponding to the reject reason is not set.

UnknownUser

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever Cisco Prime AR cannot find the user specified by User-Name.

UserNotEnabled

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever the user account is disabled.

UserPasswordInvalid

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever the password in the Access-Request packet did not match the password in the database.

UnableToAcquireResource

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever one of the Resource Managers was unable to allocate the resource for this request.

ServiceUnavailable

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever a service the request needs (such as a RemoteServer) is unavailable.

InternalError

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever an internal error caused the request to be rejected.

MalformedRequest

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever a required attribute (such as User-Name) is missing from the request.

ConfigurationError

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever the request is rejected due to a configuration error. For example, if a script sets an environment variable to the name of an object such as Authentication-Service, and that object does not exist in the configuration, the reason reported is ConfigurationError.

IncomingScriptFailed

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever one of the IncomingScripts fails to execute.

OutgoingScriptFailed

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever one of the OutgoingScripts fails to execute.

IncomingScriptRejectedRequest

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever one of the IncomingScripts rejects the Access-Request.

TerminationAction

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever Cisco Prime AR processes the Access-Request as a Termination-Action and is being rejected as a safety precaution.

OutgoingScriptRejectedRequest

Optional; when you set this property, Cisco Prime AR sends back this value in the Reply-Message attribute whenever one of the OutgoingScripts rejects the Access-Request.

Name

Name of the TSIG Key.

Secret

Set to the same base64-encoded string as defined in the DNS server.

Description

Description of the TSIG Key

Name

Name of the ODBCDataSource

Description

Optional; Description of the ODBC Data Source

Type

Required; must be Oracle_es

Driver

Required; liboarodbc.so (default value)

Note This attribute is supported only for OBDC.

UserID

Required; database username (no default value)

Password

Optional; user password; shown encrypted

DataBase

Required; Oracle Client configuration database name (no default value)

Server

Set the name of the server

Port

Set the port details.

GUI Log Settings section

LOG LEVEL

Select either debug level or Error.

MaxFileSize

Set the maximum size of the log file.

Advance Details section

LogFileSize

Required; the default is 1 megabyte. This property specifies the maximum size of the RADIUS server log file. The value for the LogFileSize field is a string composed of two parts; a number, and a units indicator (<n> <units>) in which the unit is one of: K, kilobyte, kilobytes, M, megabyte, megabytes, G, gigabyte, or gigabytes.

The LogFileSize property does not apply to the config_mcd_1_log or agent_server_1_log files.

Note This does not apply to the trace log.

LogFileCount

Required; the default is 2. This property specifies the number of log files to be kept on the system. A new log file is created when the log file size reaches LogFileCount.

The LogFileCount property does not apply to the config_mcd_1_log or agent_server_1_log files.

TraceFileSize

Required; the default is 1 GB. This property specifies the size of the trace files to be kept on the system. A new trace file is created when the trace file size reaches TraceFileSize. The value for the TraceFileSize field is a string composed of two parts; a number, and a units indicator (<n> <units>) in which the unit is one of: K, kilobyte, kilobytes, M, megabyte, megabytes, G, gigabyte, or gigabytes.

TraceFileCount

Required; this value can be set from 1-100, and the default is 2. This property specifies the number of trace files to maintain. A value of 1 indicates that no file rolling occurs.

LogServerActivity

Required; the default is FALSE, which means Cisco Prime AR logs all responses except Access-Accepts and Access-Challenges. Accepting the default reduces the load on the server by reducing that amount of information it must log. Note, the client is probably sending accounting requests to an accounting server, so the Access-Accept requests are being indirectly logged. When you set it to TRUE, Cisco Prime AR logs all responses to the server log file.

TraceLevel

Set the trace level.

Port

Required; allows you to use ports other than the default, 1645 and 1646. You can use this option to configure Cisco Prime AR to use other ports,. If you add additional ports, however, Cisco Prime AR will use the added ports and no longer use ports 1645 and 1646. These ports can still be used by adding them to the list of ports to use.

Type

Set the port type.

Description

Optional; description of the port.

Name

Name of the attribute group.

Description

Optional; description of the attribute group.

Attribute type

Select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected. Click the Add button to save the details and list it in Attribute list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.