Enhancing The Scalability Of Per-User Configurations; Setting The Vrf And Ip Unnumbered Interface Configurations In User Profiles - Cisco ASR1000-RP1 - ASR 1000 Series Route Processor 1 Router Software Configuration Manual

Chapter 6 Broadband Scalability and Performance
Before configuring the virtual access subscriber interface using the lcp:interface-config command,
configure the aaa policy interface-config allow-subinterface command.
If the subinterface is not configured, the following error message is displayed when creating a session
with one of the RADIUS attributes:
*Mar 13 22:04:03.358: %FMANRP_ESS-4-FULLVAI: Session creation failed due to Full
Virtual-Access Interfaces not being supported. Check that all applied Virtual-Template and
RADIUS features support Virtual-Access sub-interfaces. swidb= 0x7FA35A42F218, ifnum= 30
To enhance the scalability of per-user configurations, in many cases, different Cisco AV-pairs are
available to place the subscriber interface in a Virtual Routing and Forwarding (VRF) instance or to
apply a policy map to the session. For example, use the ip:vrf-id and ip:ip-unnumbered VSAs to
reconfigure a user's VRF. For information about enhancing scalability see,
of Per-User Configurations" section on page

Enhancing the Scalability of Per-User Configurations

To enhance scalability of per-user configurations without changing the router configuration, use the
ip:vrf-id and ip:ip-unnumbered RADIUS attributes. These per-user vendor-specific attributes (VSAs)
are used to map sessions to VRFs and IP unnumbered interfaces. The VSAs are applied to virtual access
subinterfaces and are processed during PPP authorization.
The ip:vrf-id attribute is used to map sessions to VRFs. Any profile that uses the ip:vrf-id VSA must also
use the ip:ip-unnumbered VSA to install IP configurations on the VAI that is to be created. The PPP that
is used on a VAI to be created requires the ip:ip-unnumbered VSA. An Internet Protocol Control Protocol
(IPCP) session is not established if IP is not configured on the interface. You must configure either the
ip address command or the ip unnumbered command on the interface so that these configurations are
present on the VAI that is to be created. However, specifying the ip address and ip unnumbered
commands on a virtual template interface is not required because pre-existing IP configurations, if any,
are removed when the ip:ip-vrf VSA is installed on the VAI. Therefore, any profile that uses the ip:vrf-id
VSA must also use the ip:ip-unnumbered VSA to install IP configurations on the VAI that is to be
created.
These per-user VSAs can be applied to VAIs. Therefore, the per-user authorization process does not
require the creation of full VAIs, which improves scalability.

Setting the VRF and IP Unnumbered Interface Configurations in User Profiles

Although the Cisco ASR 1000 Series Router continues to support the lcp:interface-config VSA, the
ip:vrf-id and ip:ip-unnumbered VSAs provide another way to set the VRF and IP unnumbered interface
configurations in user profiles. The ip:vrf-id and ip:ip-unnumbered VSAs have the following syntax:
Cisco:Cisco-AVpair = "ip:vrf-id=vrf-name"
Cisco:Cisco-AVpair = "ip:ip-unnumbered=interface-name"
You should specify only one ip:vrf-id and one ip:ip-unnumbered value in a user profile. However, if the
profile configuration includes multiple values, the Cisco ASR 1000 Series Router applies the value of
the last VSA received, and creates a virtual access subinterface. If the profile includes the
lcp:interface-config VSA, the router always applies the value of the lcp:interface-config VSA.
OL-16506-10
Using the cisco-avpair="lcp:interface-config" RADIUS Attribute
6-7.
Cisco ASR 1000 Series Aggregation Services Routers Software Configuration Guide
"Enhancing the Scalability
6-7