configure
     context <context_name>
          radius server <ipv4/ipv6_address> key <shared_secret> [ max <value> ] [ oldports | port <tcp_port> ] [ priority <priority> ]
          radius [ mediation-device ] accounting server <ipv4/ipv6_address> key <shared_secret> [ acct-on { enable | disable } ] [ acct-off { enable | disable } ] [ max <msgs> ] [ oldports ] [ port <port_number> ] [ priority <priority> ] [ type standard ]
          radius attribute nas-identifier <identifier>
          radius attribute nas-ip-address address <primary_ipv4/ipv6_address> [ backup <secondary_ipv4/ipv6_address> ]
          radius strip-domain [ authentication-only | accounting-only ]
          end

• Optional. If you want to support more than 320 server configurations system-wide, in the Global Configuration Mode, use the following command:

  aaa large-configuration

• <context_name> must be the system context designated for AAA configuration.

• For information on GGSN-specific additional configurations using RADIUS accounting see the Creating and Configuring APNs section of the GGSN Administration Guide.

• In this release, the configuration of NAS IP address with IPv6 prefix is currently not supported.

• <identifier> must be the name designated to identify the system in the Access Request message(s) it sends to the RADIUS server.

• Optional. Multiple RADIUS attribute dictionaries have been created for the system. Each dictionary consists of a set of attributes that can be used in conjunction with the system. As a result, users could take advantage of all of the supported attributes or only a subset. To specify the RADIUS attribute dictionary that you want to implement, in the Context Configuration Mode, use the following command:

  radius dictionary { 3gpp | 3gpp2 | 3gpp2-835 | customXX | standard | starent | starent-835 | starent-vsa1 | starent-vsa1-835 }

• Optional. Configure the system to support NAI-based authentication in the event that the system cannot authenticate the subscriber using a supported authentication protocol. To enable NAI-construction, in the Context Configuration Mode, use the following command:

  aaa constructed-nai authentication [ encrypted ] password <password>

• Optional. If RADIUS is configured for GGSN service, the system can be configured to support NAI-based authentication to use RADIUS shared secret as password. To enable, in the Context Configuration Mode, use the following command:

  aaa constructed-nai authentication use-shared-secret-password

  If authentication type is set to allow-noauth or msid-auth and aaa constructed-nai authentication use-shared-secret-password is issued then the system will use RADIUS shared secret as password. In case the authentication type is msid-auth it will always send RADIUS shared secret as password by default in ACCESS-REQUEST.

• Optional. To configure the system to allow a user session even when all authentication servers are unreachable, in the Context Configuration Mode, use the following command. When enabled, the session is allowed without authentication. However, the accounting information is still sent to the RADIUS accounting server, if it is reachable.

  radius allow authentication-down

• Optional. To configure the maximum number of times RADIUS authentication requests must be re-transmitted, in the Context Configuration Mode, use the following command:

  radius max-transmissions <transmissions>

• Optional. If RADIUS is configured for PDSN service, to configure the accounting trigger options for R-P originated calls to generate STOP immediately or to wait for active-stop from old PCF on handoff, in the Context Configuration Mode, use the following command:

  radius accounting rp handoff-stop { immediate | wait-active-stop }

  For more information on configuring additional accounting trigger options for R-P generated calls for a PDSN service, refer to the radius accounting rp command in the Command Line Interface Reference.

• Optional. To configure the system to check for failed RADIUS AAA servers, in the Context Configuration Mode, use the following command:

  radius detect-dead-server { consecutive-failures <count> | keepalive | response-timeout <seconds> }

  After a server's state is changed to "Down", the deadtime timer is started. When the timer expires, the server's state is returned to "Active". If both consecutive-failures and response-timeout are configured, then both parameters have to be met before a server's state is changed to "Down". For a complete explanation of RADIUS server states, refer to RADIUS Server State Behavior appendix.

• Optional. To configure the system to check for failed RADIUS accounting servers, in the Context Configuration Mode, use the following command:

  radius accounting detect-dead-server { consecutive-failures <count> | response-timeout <seconds> }

  After a server's state is changed to "Down", the deadtime timer is started. When the timer expires, the server's state is returned to "Active". If both consecutive-failures and response-timeout are configured, then both parameters have to be met before a server's state is changed to "Down". For a complete explanation of RADIUS server states, refer to RADIUS Server State Behavior.

• Optional. If required, users can configure the dynamic redundancy for HA as described in the HA Redundancy for Dynamic Home Agent Assignment chapter of the Home Agent Administration Guide.

configure
     context <context_name>
          diameter endpoint <endpoint_name>
               origin host <host_name> address <ipv4/ipv6_address> [ port <port_number> ] [ accept-incoming-connections ] [ address <ipv4/ipv6_address_secondary> ] 
               peer <peer_name> [ realm <realm_name> ] address <ipv4/ipv6_address> [ [ port <port_number> ] [ connect-on-application-access ] [ send-dpr-before-disconnect [ disconnect-cause <disconnect_cause> ] ] [ sctp ] ]+
               end

• Optional. To support Diameter proxy server on per-PAC/PSC or per-system basis, in the Global Configuration Mode, use the following command:

  require diameter-proxy { master-slave | multiple | single }

• <context_name> must be the name of the system context designated for AAA configuration.

• Optional. To enable Diameter proxy for the endpoint, in the Diameter Endpoint Configuration Mode, use the following command:

  use-proxy

• Optional. To set the realm for the Diameter endpoint, in the Diameter Endpoint Configuration Mode, use the following command:

  origin realm <realm_name>

• <realm_name> is typically a company or service name. The realm is the Diameter identity and will be present in all Diameter messages.

• Optional. To create an entry in the route table for the Diameter peer, in the Diameter Endpoint Configuration Mode, use the following command:

  route-entry { [ host <host_name> ] [ peer <peer_id> ] [ realm <realm_name> ] } [ application credit-control ] [ weight <value> ]

• Optional. To specify the port for the Diameter endpoint, in the Diameter Endpoint Configuration Mode, use the following command:

  origin host host_name address ipv4/ipv6_address [ port port_number ] [ accept-incoming-connections ] [ address ipv4/ipv6_address_secondary ]

  Port number in the origin host should be configured only when the chassis is running in server mode, i.e. when accept-incoming-connections is configured.

  In this case it will open a listening socket on the specified port. For configurations where chassis is operating as a client, port number should not be included. In this case, a random source port will be chosen for outgoing connections. This is applicable for both with or without multi-homing.

  Note

  Currently if multi-homing is configured, then the specified port is used instead of randomly chosen port. This is done so that application knows which port is used by the kernel as it will have to use the same port while adding/removing IP address from the association. Nevertheless, configuring port number in origin host for client mode is not supported.

• Optional. To set how the action after failure, or recovery after failure is performed for the route table, in the Diameter Endpoint Configuration Mode, use the following command:

  route-failure { deadtime <seconds> | recovery-threshold percent <percent> | result-code <result_code> | threshold <counter> }

• Optional. To enable/disable the Transport Layer Security (TLS) support between Diameter client and Diameter server node, in the Diameter Endpoint Configuration Mode, use the following command:

  tls { certificate <cert_string> | password <password> | privatekey <private_key> }

• Optional. To set the connection timeout, in seconds, in the Diameter Endpoint Configuration Mode, use the following command:

  connection timeout <timeout>

• Optional. To set the connection retry timeout, in seconds, in the Diameter Endpoint Configuration Mode, use the following command:

  connection retry-timeout <retry_timeout>

• Optional. To set the number of Device Watchdog Requests (DWRs) to be sent before the connection with a Diameter endpoint is closed, in the Diameter Endpoint Configuration Mode, use the following command:

  device-watchdog-request max-retries <retry_count>

• Optional. To set the maximum number of Diameter messages that any ACS Manager (ACSMgr)/Session Manager (SessMgr) may send to any one peer awaiting responses, in the Context Configuration Mode, use the following command:

  max-outstanding <msgs>

• Optional. To set the response timeout for the Diameter endpoint, in seconds, in the Diameter Endpoint Configuration Mode, use the following command:

  response-timeout <duration>

• Optional. To set the watchdog timeout for the Diameter endpoint, in seconds, in the Diameter Endpoint Configuration Mode, use the following command:

  watchdog-timeout <duration>

configure
    context <context_name>
         diameter authentication endpoint <endpoint_name>
         diameter authentication server <host_name> priority <priority>
         diameter authentication dictionary <dictionary>
         diameter accounting endpoint <endpoint_name>
         diameter accounting server <host_name> priority <priority>
         diameter accounting dictionary <dictionary>
         end

• <context_name> must be the name of the system context designated for AAA configuration.

• <endpoint_name> must be the same Diameter endpoint name configured in the Configuring Diameter Endpoint section.

• Optional. To configure the number of retry attempts for a Diameter authentication request with the same server, if the server fails to respond to a request, in the Context Configuration Mode, use the following command:

  diameter authentication max-retries <tries>

• Optional. To configure the maximum number of transmission attempts for a Diameter authentication request, in the Context Configuration Mode, use the following command. Use this in conjunction with the max-retries <tries> option to control how many servers will be attempted to communicate with.

  diameter authentication max-transmissions <transmissions>

• Optional. To configure how long the system must wait for a response from a Diameter server before re-transmitting the authentication request, in the Context Configuration Mode, use the following command:

  diameter authentication request-timeout <duration>

• Optional. To configure how many times a Diameter accounting request must be retried with the same server, if the server fails to respond to a request, in the Context Configuration Mode, use the following command:

  diameter accounting max-retries <tries>

• Optional. To configure the maximum number of transmission attempts for a Diameter accounting request, in the Context Configuration Mode, use the following command. You can use this in conjunction with the max-retries tries option to control how many servers will be attempted to communicate with.

  diameter accounting max-transmissions <transmissions>

• Optional. To configure how long the system will wait for a response from a Diameter server before re-transmitting the accounting request, in the Context Configuration Mode, use the following command:

  diameter accounting request-timeout <duration>

configure
     failure-handling <template_name>
          msg-type { any | authentication info request | authorization-request | check-identity-request | credit-control-initial | credit-control-terminate | credit-control-update | eap-request | eap-termination-request | notify-request | profile-update-request | purge-ue-request | update-location-request | user-data-request } failure-type { any | diabase-error | diameter result-code { any-error | result-code [ to end-result-code ] } | diameter exp-result-code { any-error | result-code [ to end-result-code ] } | resp-timeout | tx-expiry } action { continue [ local-fallback | send-ccrt-on-call-termination | without-retry ] | retry-and-terminate | terminate }
          end

• A maximum of 64 templates can be configured on the system.

• Diameter applications (Gx, Gy) must be associated with the template. For example, using associate failure-handling-template command in Credit Control Configuration Mode will bind the Diameter Credit Control Application (DCCA) service to the configured failure handling template. When an association is made to the template, in the event of a failure, the system takes the action as defined in the failure handling template.

• For information on the commands, refer to the Diameter Failure Handling Template Configuration Mode Commands chapter of the Command Line Interface Reference.

configure
     diameter dynamic-dictionary <dict_name> <url>
     end

• A maximum of 10 dynamic dictionaries can be configured and loaded in to the system.

• The dynamically loaded dictionaries can be configured under application group or AAA group using the option dynamic-load in the diameter accounting dictionary or diameter authentication dictionary command.

• For more information on the command, refer to the Global Configuration Mode (A-K) Commands chapter of the Command Line Interface Reference.

configure
      rlf-template <template_name>
            delay-tolerance tolerance_value [ -noconfirm ]
            msg-rate tps_value burst-size size [ -noconfirm ]
            threshold { lower lowerThreshold_value | upper upperThreshold_value } [ -noconfirm ]
            end

configure
     context <context_name>
          aaa group <group_name>
          end

• Up to 128 authentication and/or accounting servers can be configured per AAA server group. A maximum of 1600 servers can be configured system-wide regardless of the number of groups unless aaa large-configuration is enabled.

• Optional. If you want to support more than 64 server groups system-wide, in the Global Configuration Mode, use the following command:

  aaa large-configuration

• <context_name> must be the name of the system context designated for AAA functionality configuration.

• <group_name> must be the name of the AAA group designated for AAA functionality within the specific context. A total of 800 server groups can be configured system-wide including default server-group unless aaa large-configuration is enabled.

• The same AAA server with IP address and port number can be configured with multiple AAA server groups within a context.

• To configure and verify RADIUS authentication and accounting servers and parameters within the AAA server group, refer to the Configuring RADIUS AAA Functionality section.

• To configure and verify Diameter authentication and accounting servers and parameters within the AAA server group, refer to the Configuring Diameter AAA Functionality section.

configure
     context <context_name>
          subscriber name <subscriber_name>
               aaa group <group_name>
               end

• <context_name> must be the name of the system source context designated for subscriber configuration.

• <sub_name> must be the name of the subscriber template configured as the default template for the domain. For more information on creating contexts, refer to the Creating Contexts section of the System Element Configuration Procedures chapter in the System Administration Guide.

• <group_name> must be the name of the AAA server group designated for AAA functionality within the context as described in the AAA Server Group Configuration section.

configure
    context <context_name>
          apn <apn_name>
               aaa group <group_name>
               end

• <group_name> must be the name of the AAA server group previously configured for AAA functionality in a specific context as described in the AAA Server Group Configuration section.