如何在ASR9K上为BNG用户处理多操作CoA数据包

下载选项

PDF (464.9 KB)
在各种设备上使用 Adobe Reader 查看
ePub (87.4 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
Mobi (Kindle) (87.7 KB)
在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看

已更新: 2017 年 10 月 20 日

文档 ID:212353

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍如何在ASR9K平台上进行授权更改(CoA)处理，以及如何在ASR9K上对其进行故障排除。

先决条件

要求

Cisco 建议您了解以下主题：

ASR9K上的BNG功能
Radius属性

提示：有关详细信息，请参阅Broadband Network Gateway Configuration Guide。

使用的组件

本文档中的信息基于以下软件和硬件版本：

运行533版本的ASR9001。
Free-radius服务器。

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

背景信息

授权更改(CoA)是RADIUS标准的扩展，允许从RADIUS服务器向RADIUS客户端发送异步消息。CoA的主要原因是允许RADIUS服务器更改已授权用户的授权行为。IETF RFC 3576中定义了RADIUS的CoA扩展。

Multi-Action CoA(MA-CoA)功能扩展了当前BNG CoA功能，以支持单个CoA请求中的多个service activate和service deactivate命令：

572x408?v=1.0

多动作CoA(MA-CoA)的理念是，它将允许互联网服务提供商以从他们的角度看原子的方式激活/停用多种服务。

MA-COA使用案例

这是MA-CoA的示例，从非常高的功能级别。

PTA会话会启动重定向到服务门户（HTTP重定向）的Web流量。
通过服务门户，客户激活了第一级服务。这会导致具有以下功能的多操作CoA请求:

停用重定向
激活Turbo按钮1
例如，激活带有2个通道的VoIP

通过服务门户，客户激活二级服务。这会导致多操作CoA请求：

停用Turbo按钮1
激活Turbo按钮2
停用具有2个通道的VoIP
激活具有4个通道的VoIP

在MA-CoA中，如果CoA请求中的任何服务未能激活/停用，则作为该CoA请求的一部分激活/停用的任何服务都必须回滚回退。实质上，当激活/停用失败时，会话必须恢复到MA-CoA之前的状态。但是，在某些极少数情况下，可能无法完全回滚。例如，考虑在多操作CoA处理过程中放弃资源（例如内存、TCAM条目、IP地址等）的情况。如果随后的CoA发生故障，这些资源可能不再可用，因此可能无法完全回滚操作。如果发生回滚故障，将执行以下操作：

如果在控制策略中配置了coa-rollback-failure异常，则将执行为rollback-failure类指定的操作。例如，您可以断开会话。但是，MA-CoA回滚故障的默认操作是保留会话。

policy-map type control subscriber WDAAR_NOVA_POLICY
 event exception match-first
  class type control subscriber coa-rollback-failure do-all
   10 disconnect
  !
 !
 end-policy-map

如果未在控制策略中配置coa-rollback-failure异常，则控制台上将生成系统日志错误。

CoA处理的分配方式是，请求可在RP（用于基于捆绑的会话）或LC（用于基于LC的会话）上处理。

图1.显示较高级别的CoA消息流。

large?v=1.0&px=800

映像1:BNG路由器上的CoA架构

MA-CoA呼叫流

以下是处理MA-CoA请求时涉及的呼叫流程示例（非常高）：

CoA客户端使用以下命令发送MA-CoA请求：
- 停用服务服务 — 互联网
- 激活服务 — 音频
- 激活服务 — 视频
Radiusd将新定义的思科通用VSA转换为标准AAA_AT属性，并传递到策略平面。
策略平面命令处理程序向SubDB发起服务Service-Internet的取消关联请求和服务Service-Audio & Service-Video的关联请求，然后向SubDB发起生产 — 完成请求。
SubDB执行必要的取消关联/关联，并与其BPI客户端协调以将必要的配置应用到硬件。然后，SubDB将Produce Done(config applied)消息发送到策略平面。
策略平面命令处理程序通过radiusd将CoA ACK发送到CoA客户端。
如果已对服务Service-Internet启用服务级别记帐，则策略平面记帐协调器向RADIUS服务器发出记帐停止请求。同样，如果为服务Service-Audio或Service-Video启用服务级别记帐，则策略平面记帐协调器会为这些服务向RADIUS服务器发出记帐开始请求。

large?v=1.0&px=800

配置

使用本节中介绍的信息配置本文档中介绍的功能。

网络图

以下拓扑用于测试MA-CoA。

433x323?v=1.0

注意：在此拓扑中，Radius服务器和策略服务器/CoA客户端是同一个框。此设置使用拓扑中的Free Radius并使用radclient发送CoA数据包来模拟MA-CoA场景。

配置

ASR9K

interface Bundle-Ether1.200
 ipv4 point-to-point
 ipv4 unnumbered Loopback200
 service-policy type control subscriber WDAAR_NOVA_POLICY
 encapsulation dot1q 200
 ipsubscriber ipv4 l2-connected
  initiator dhcp
  initiator unclassified-source

以下控制策略用于启动IPoE会话。

policy-map type control subscriber WDAAR_NOVA_POLICY
 event session-start match-first
  class type control subscriber DHCP do-until-failure
   10 activate dynamic-template DT_NOVA_DHCP
   20 authorize aaa list WDAAR format WDAAR_USERNAME_NOVA password cisco
  !
  class type control subscriber WDAAR_STATIC do-until-failure
   10 activate dynamic-template DT_NOVA_STATIC
   20 authorize aaa list WDAAR format WDAAR_IP_STATIC password cisco
  !
 !
 event authentication-no-response match-first
  class type control subscriber class-default do-all
   10 activate dynamic-template WDAAR_NOVA_ACCT_START
   20 activate dynamic-template WDAAR_NOVA_NET50
  !
 !
 end-policy-map
!

dynamic-template
 type ipsubscriber DT_NOVA_DHCP
  ipv4 unnumbered Loopback201
 !
!
interface Loopback201
 ipv4 address 199.195.148.1 255.255.255.0
!

dynamic-template
 type ipsubscriber WDAAR_NOVA_ACCT_START
  accounting aaa list WDAAR type session periodic-interval 5
 !
!
dynamic-template
 type service WDAAR_NOVA_NET50
  service-policy input WDAAR_10Mbps
  service-policy output WDAAR_Upload
 !
!

注：为了模拟IPoE用户，IXIA客户端用于模拟DHCP客户端。

为了模拟MA-CoA行为，配置了两个QoS策略，限制入站和出站方向的流量。

WDAAR_DAY_PACKAGE
WDAAR_NIGHT_PACKAGE

dynamic-template
 type service WDAAR_DAY_PACKAGE
  service-policy input WDAAR_Internet_Service_10Mbps_IN
  service-policy output WDAAR_Internet_Service_10Mbps_OUT
  accounting aaa list WDAAR type service periodic-interval 10
 !
!
dynamic-template
 type service WDAAR_NIGHT_PACKAGE
  service-policy input WDAAR_Internet_Service_5Mbps_IN
  service-policy output WDAAR_Internet_Service_5Mbps_OUT
  accounting aaa list WDAAR type service periodic-interval 10
 !
!

对于DAY包和NIGHT包，策略配置为在入站和输出方向将流量管制到10Mpbs，限制为5Mpbs。

policy-map WDAAR_Internet_Service_5Mbps_IN
 class class-default
  police rate 5486 kbps
  !
!
policy-map WDAAR_Internet_Service_5Mbps_OUT
 class class-default
  police rate 5486 kbps
  !
 !

policy-map WDAAR_Internet_Service_10Mbps_IN
 class class-default
  police rate 10486 kbps
  !
 !
policy-map WDAAR_Internet_Service_10Mbps_OUT
 class class-default
  police rate 10486 kbps
  !
 !

确认

本节提供可用于验证MA-CoA是否正常工作的信息。

ASR9K上的IPoE用户会话。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail
Mon Jul 27 11:24:46.467 UTC
Interface:                Bundle-Ether1.200.ip18010
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 11:23:10 2015
IPv4 Address:             172.188.243.147, VRF: default
Mac Address:              0000.6602.0102
Account-Session Id:       00004729
Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label:         0x00000048
Created:                  Mon Jul 27 11:23:08 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Access-interface:         Bundle-Ether1.200
Policy Executed:
policy-map type control subscriber WDAAR_NOVA_POLICY
  event Session-Start match-first [at Mon Jul 27 11:23:08 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [Succeeded]
      20 authorize aaa list WDAAR [Succeeded]
Session Accounting:
  Acct-Session-Id:          00004729
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Never
    Next update in:         00:00:24 (dhms)
Service Accounting:         WDAAR_DAY_PACKAGE
  Acct-Session-Id:          0000472a
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 10 mins
    Last successful update: Never
    Next update in:         00:08:24 (dhms)
Last COA request received: unavailable

现在，如果您使用隐藏关键字internal检查会话的详细信息，您可以看到您从radius收到的AVP。如果在启动会话时在ASR9K上启用调试，也可以看到这一点。从会话输出中，您可以看到，当订户联机时，您应用了WDAAR_DAY_PACKAGE，并且还启用了会话记账和服务记账。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail internal
Mon Jul 27 11:27:10.554 UTC
Interface:                Bundle-Ether1.200.ip18010
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 11:23:10 2015
IPv4 Address:             172.188.243.147, VRF: default
IPv4 Up helpers:          0x00000040 {IPSUB}
IPv4 Up requestors:       0x00000040 {IPSUB}
Mac Address:              0000.6602.0102
Account-Session Id: 00004729 Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label: 0x00000048
Created:                  Mon Jul 27 11:23:08 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Ifhandle: 0x000abc20 Session History ID:       1
Access-interface:         Bundle-Ether1.200
SRG Flags:                0x00000000
Policy Executed:

  event Session-Start match-first [at Mon Jul 27 11:23:08 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [cerr: No error][aaa: Success]
      20 authorize aaa list WDAAR [cerr: No error][aaa: Success]
Session Accounting:
  Acct-Session-Id:          00004729
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Mon Jul 27 11:25:10 2015
    Next update in:         00:02:00 (dhms)
    Last update sent:       Mon Jul 27 11:25:10 2015
    Updates sent:           1
    Updates accepted:       1
    Updates rejected:       0
    Update send failures:   0
Service Accounting:         WDAAR_DAY_PACKAGE
  Acct-Session-Id:          0000472a
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 10 mins
    Last successful update: Never
    Next update in:         00:06:00 (dhms)
    Last update sent:       Never
    Updates sent:           0
    Updates accepted:       0
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Last COA request received: unavailable
User Profile received from AAA:
 Attribute List: 0x50105e7c
1: acct-interval len= 4 value= 120(78) 2: accounting-list len= 5 value= WDAAR Pending Callbacks: InterimAcct>StatsD,
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
  Name        : WDAAR_DAY_PACKAGE
  Service-ID  : 0x400001a
  Type        : Multi Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 11:23:08.672 IPv4 Start
   Jul 27 11:23:10.080 SUBDB produce done
   Jul 27 11:23:10.080 IPv4 Up

如果要查看用户会话的CoA和radius数据包，可以启用这些调试。

debug radius
debug radius dynamic-author

注意：您可以启用debug radius filter mac-address，以仅过滤特定的mac-address radius流量。

RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Send Access-Request to 10.48.88.121:56777 id 229, len 218
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: authenticator D0 EF B5 50 DD 9A 1A 84 - FB 36 5C FB 5C DB 96 FE
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 41
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Cisco AVpair [1] 35 client-mac-address=0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Acct-Session-Id [44] 10 00004729
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: NAS-Port-Id [87] 11 0/0/1/200
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 17
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: cisco-nas-port [2] 11 0/0/1/200
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: User-Name [1] 16 0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Service-Type [6] 6 Outbound[0]
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: User-Password [2] 18 *
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: NAS-Port-Type [61] 6 VIRTUAL_IPOEOVLAN[0]
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Event-Timestamp [55] 6 1437996188
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 23
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Cisco AVpair [1] 17 dhcp-client-id=
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Nas-Identifier [32] 16 acdc-asr9000-4
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: RADIUS: NAS-IP-Address [4] 6 10.48.88.54
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: RADIUS: NAS-IPv6-Address [95] 22 1a 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: RADIUS: 00 00 00 00
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Got global deadtime 0
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Using global deadtime = 0 sec
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Start timer thread rad_ident 229 remote_port 56777 remote_addr 10.48.88.121, socket 1342510940 rctx 0x50258020
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Successfully sent packet and started timeout handler for rctx 0x50258020
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: Radius packet decryption complete with rc = 0
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Received from id 229 10.48.88.121:56777, Access-Accept, len 105
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: authenticator 9D 27 8C A5 28 C8 AE 2B - 58 56 08 DF C2 BA 06 28
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Acct-Interim-Interval[85] 6 120
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 40
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Cisco AVpair [1] 34 subscriber:accounting-list=WDAAR
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 39
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Cisco AVpair [1] 33 subscriber:sa=WDAAR_DAY_PACKAGE
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: Freeing server group transaction_id (3D000000)

不同组件的用户身份和凭证AAA属性存储在SADB(用户属性数据库)中。SADB不保存用户配置。您可以使用以下show命令查看该会话的所有属性。

show subscriber manager sadb

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager sadb
Mon Jul 27 12:13:36.273 UTC
Sublabel: 0x00000048 Node_ID: 00000001 Signature: 0xabcdef12 Version: 1 Rev: 21
Length: 297
Attribute list: 1343184692
1:  protocol-type   len=  4  dhcp
2:  dhcp-client-id  len= 15
3:  port-type       len=  4  Virtual IP over VLAN
4:  outer-vlan-id   len=  4  200(c8)
5:  client-mac-address len= 14  0000.6602.0102
6:  parent-if-handle len=  4  1568(620)
7:  string-session-id len=  8  00004729
8:  interface       len=  9  0/0/1/200
9:  formatted-username len= 14  0000.6602.0102
10:  username        len= 14  0000.6602.0102
11:  author_status   len=  1  true
12:  addr            len=  4  172.188.243.147
13:  if-handle       len=  4  703520(abc20)
14:  vrf-id          len=  4  1610612736(60000000)
15:  ipv4-session-state len=  1  true
16:  accounting-list len=  5  WDAAR
17:  start_time      len=  4  Mon Jul 27 11:23:10 2015

还有另一个名为Subscriber Database(SubDB)的数据库存储配置以及配置与会话的关联。SubDB(用户数据库)用于管理BNG用户的动态配置。用户配置是一组预定义功能及其特定值。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber database association
Mon Jul 27 12:26:38.186 UTC

Location 0/RSP0/CPU0

Bundle-Ether1.200.ip18010, subscriber label 0x48
  Name                            Template Type
  --------                        -------------
  U00000048                       User profile
  WDAAR_DAY_PACKAGE Service DT_NOVA_DHCP                    IP subscriber

您还可以使用过滤器subscriber-label来查看一个用户的信息。

show subscriber database association subscriber-label <SUBSCRIBER-LABEL>

MA-CoA测试

因为您已经应用了服务 WDAAR_DAY_PACKAGE在会话中，作为测试，您首先要从会话中删除WDAAR_DAY_PACKAGE服务。现在您可以看到没有服务WDAAR_DAY_PACKAGE 在会话中处于活动状态。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail internal
Mon Jul 27 13:47:55.881 UTC
Interface:                Bundle-Ether1.200.ip18012
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 13:33:22 2015
IPv4 Address:             172.188.243.147, VRF: default
IPv4 Up helpers:          0x00000040 {IPSUB}
IPv4 Up requestors:       0x00000040 {IPSUB}
Mac Address:              0000.6602.0102
Account-Session Id:       0000472d
Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label:         0x0000004a
Created:                  Mon Jul 27 13:33:21 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Ifhandle:                 0x000abca0
Session History ID:       1
Access-interface:         Bundle-Ether1.200
SRG Flags:                0x00000000
Policy Executed:

  event Session-Start match-first [at Mon Jul 27 13:33:21 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [cerr: No error][aaa: Success]
      20 authorize aaa list WDAAR [cerr: No error][aaa: Success]
Session Accounting:
  Acct-Session-Id:          0000472d
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 13:33:22 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Mon Jul 27 13:47:24 2015
    Next update in:         00:01:27 (dhms)
    Last update sent:       Mon Jul 27 13:47:24 2015
    Updates sent:           7
    Updates accepted:       7
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Last COA request: Mon Jul 27 13:47:50 2015
COA Request  Attribute List: 0x50105f70
1: sd len= 17 value= WDAAR_DAY_PACKAGE 2: command len= 18 value= deactivate-service 3: service-info len= 17 value= WDAAR_DAY_PACKAGE 4: service-name len= 17 value= WDAAR_DAY_PACKAGE Last COA response: Result ACK
COA Response  Attribute List: 0x50106180
1:  sd              len= 17  value= WDAAR_DAY_PACKAGE
User Profile received from AAA:
 Attribute List: 0x50106390
1:  acct-interval   len=  4  value= 120(78)
2:  accounting-list len=  5  value= WDAAR
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 13:33:21.152 IPv4 Start
   Jul 27 13:33:22.560 IPv4 Up
   Jul 27 13:47:50.528 CoA request
   Jul 27 13:47:50.784 SUBDB produce done [many]

如前所述，当服务取消关联时，ASR9K上的radiusd进程将记账停止发送到radius服务器。在调试中，此行为也得到了证实。

RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS: Send Accounting-Request to 10.48.88.121:56778 id 48, len 391
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  authenticator 6C E1 D2 2B 49 1A EE E4 - 6D 36 FD FA 7A 84 26 50
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Interim-Interval[85]    6       10
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Session-Time   [46]    6       868
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Terminate-Cause[49]    6       admin-reset[0]
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Status-Type    [40]    6       Stop[0]
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Event-Timestamp     [55]    6       1438004870
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    23
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    17      dhcp-client-id=
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  NAS-Port-Type       [61]    6       VIRTUAL_IPOEOVLAN[0]
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    41
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    35      client-mac-address=0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  NAS-Port-Id         [87]    11      0/0/1/200
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    17
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   cisco-nas-port      [2]    11      0/0/1/200
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  User-Name           [1]     16      0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Framed-IP-Address   [8]     6       172.188.243.147
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    22
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    16      vrf-id=default
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    29
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    23      accounting-list=WDAAR
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  AAA Unsupported Attr: user-maxlinks [196]    6
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    32
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    26      connect-progress=Call Up
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    34
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    28      parent-session-id=0000472d
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    38
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    32      service-name=WDAAR_DAY_PACKAGE
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Acct-Session-Id     [44]    10      0000472e
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Nas-Identifier      [32]    16      acdc-asr9000-4
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  NAS-IP-Address      [4]     6       10.48.88.54
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  NAS-IPv6-Address    [95]    22      1a 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:                                      00 00 00 00
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Acct-Delay-Time     [41]    6       0

此show命令还显示成功的CoA的统计信息。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager statistics AAA COA
Mon Jul 27 13:53:49.627 UTC

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/RSP0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff 1 1 0 Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
Responses to COA with unknown session identifier = 3

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff            0            0            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
  None

现在，您在订户会话上应用了服务WDAAR_NIGHT_PACKAGE,并再次查看统计信息。

Last COA request: Mon Jul 27 13:57:48 2015
COA Request  Attribute List: 0x501060c8
1:  sa              len= 19  value= WDAAR_NIGHT_PACKAGE
2:  command         len= 16  value= activate-service
3:  service-info    len= 19  value= WDAAR_NIGHT_PACKAGE
4:  service-name    len= 19  value= WDAAR_NIGHT_PACKAGE
Last COA response: Result ACK
COA Response  Attribute List: 0x501062d8
1:  sa              len= 19  value= WDAAR_NIGHT_PACKAGE
User Profile received from AAA:
 Attribute List: 0x501064e8
1:  acct-interval   len=  4  value= 120(78)
2:  accounting-list len=  5  value= WDAAR
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
  Name        : WDAAR_NIGHT_PACKAGE
  Service-ID  : 0x4000019
  Type        : Multi Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 13:33:21.152 IPv4 Start
   Jul 27 13:33:22.560 IPv4 Up
   Jul 27 13:57:48.800 CoA request [many]
   Jul 27 13:57:48.928 SUBDB produce done [many]

应用服务，这样您会看到Service Logon计数器已增加，并且您也可以在上述用户输出中看到它已被应用。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager statistics AAA COA
Mon Jul 27 13:58:00.410 UTC

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/RSP0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon 1 1 0
Single Service Logoff            1            1            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
Responses to COA with unknown session identifier = 3

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff            0            0            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
  None

到目前为止，您一次只对单个CoA数据包应用一个服务，对单个CoA数据包删除一个服务，现在您将发送CoA数据包，该数据包将删除服务，并将服务应用于单个CoA数据包。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail internal
Mon Jul 27 14:03:40.255 UTC
Interface:                Bundle-Ether1.200.ip18012
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 13:33:22 2015
IPv4 Address:             172.188.243.147, VRF: default
IPv4 Up helpers:          0x00000040 {IPSUB}
IPv4 Up requestors:       0x00000040 {IPSUB}
Mac Address:              0000.6602.0102
Account-Session Id:       0000472d
Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label:         0x0000004a
Created:                  Mon Jul 27 13:33:21 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Ifhandle:                 0x000abca0
Session History ID:       1
Access-interface:         Bundle-Ether1.200
SRG Flags:                0x00000000
Policy Executed:

  event Session-Start match-first [at Mon Jul 27 13:33:21 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [cerr: No error][aaa: Success]
      20 authorize aaa list WDAAR [cerr: No error][aaa: Success]
Session Accounting:
  Acct-Session-Id:          0000472d
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 13:33:22 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Mon Jul 27 14:03:24 2015
    Next update in:         00:01:43 (dhms)
    Last update sent:       Mon Jul 27 14:03:24 2015
    Updates sent:           15
    Updates accepted:       15
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Service Accounting:         WDAAR_DAY_PACKAGE
  Acct-Session-Id:          00004730
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 14:03:35 2015
  Interim accounting:       On, interval 10 mins
    Last successful update: Never
    Next update in:         00:09:56 (dhms)
    Last update sent:       Never
    Updates sent:           0
    Updates accepted:       0
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Last COA request: Mon Jul 27 14:03:35 2015
COA Request  Attribute List: 0x50106248
1: sd len= 19 value= WDAAR_NIGHT_PACKAGE 2: command len= 18 value= deactivate-service 3: service-info len= 19 value= WDAAR_NIGHT_PACKAGE 4: service-name len= 19 value= WDAAR_NIGHT_PACKAGE 5: sa len= 17 value= WDAAR_DAY_PACKAGE 6: command len= 16 value= activate-service 7: service-info len= 17 value= WDAAR_DAY_PACKAGE 8: service-name len= 17 value= WDAAR_DAY_PACKAGE Last COA response: Result ACK
COA Response  Attribute List: 0x50106458
1:  sd              len= 19  value= WDAAR_NIGHT_PACKAGE
2:  sa              len= 17  value= WDAAR_DAY_PACKAGE
User Profile received from AAA:
 Attribute List: 0x50106668
1:  acct-interval   len=  4  value= 120(78)
2:  accounting-list len=  5  value= WDAAR
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
  Name        : WDAAR_DAY_PACKAGE
  Service-ID  : 0x400001a
  Type        : Multi Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 13:33:21.152 IPv4 Start
   Jul 27 13:33:22.560 IPv4 Up
   Jul 27 14:03:35.296 CoA request [many]
   Jul 27 14:03:35.680 SUBDB produce done [many]

通过MA-CoA，您可以看到多服务计数器也增加了。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager statistics AAA COA
Mon Jul 27 14:05:04.724 UTC

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/RSP0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            1            1            0
Single Service Logoff            1            1            0
Single Service Modify            0            0            0
     Multiple Service 1 1 0

Errors:
Responses to COA with unknown session identifier = 3

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff            0            0            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
  None

如果ASR9K收到一个CoA数据包以在用户会话上执行任何操作，但CoA数据包中的ASR9K接收的标识符不属于任何活动的用户会话，则如果启用上述建议的调试，日志中将显示以下消息。

RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS: Received from id 159 , CoA Request, len 69
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:  authenticator 0D 52 11 54 B0 B7 37 07 - E1 9A 1D AF FA 1A 1A 09
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:  Acct-Session-Id     [44]    10      00004723
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    39
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    33      subscriber:sd=WDAAR_DAY_PACKAGE
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]: Processing Dynamic authorization request
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]: COA: Service-Name attribute is present in service profile push
RP/0/RSP0/CPU0:Jul 27 13:41:39.134 : radiusd[1133]: COA/POD:request processing underway.
RP/0/RSP0/CPU0:Jul 27 13:41:39.135 : iedged[245]: [IEDGE:TP83:COMMAND-HANDLER:ERROR:0x0] 0 matching session found for CoA request, rc 0
LC/0/0/CPU0:Jul 27 13:41:39.137 : iedged[209]: [IEDGE:TP83:COMMAND-HANDLER:ERROR:0x0] 0 matching session found for CoA request, rc 0

故障排除

可以在ASR9K上使用这些命令来检验CoA数据包的处理。如果CoA数据包已成功处理或正由ASR9K进行NACK处理。

show radius dynamic-author

以上输出显示了由ASR9K确认和确认的CoA的简要概述。

显示用户管理器统计信息AAA COA

输出包括如下统计信息： 单态子 服务激活（服务登录）和 单态子 已接收、ACK'd和NACK'd的服务停用（服务注销），还包括 多服务 跟踪计数器。

show subscriber manager statistics PRE event

输出显示已由策略平面策略规则引擎(PRE)处理的多服务事件的统计信息。

show subscriber manager statistics SVM events

如果为coa rollback配置了例外，则上述命令显示失败的MA-CoA请求后成功回滚的统计信息，以及失败的MA-CoA请求后失败的回滚。

show subscriber manager statistics perf not zero

上面的命令为您简要概述ASR9K上CoA的处理时间，并包括CoA事务的事务时间（平均值、标准偏差、最小值、最大值和计数）。

修订历史记录

版本	发布日期	备注
1.0	20-Oct-2017	初始版本

由思科工程师提供

Waqas Daar
思科TAC工程师