Service Accounting - Cisco ASR 9000 Series Configuration Manual

Service Accounting

• When a request comes from the CoA to deactivate a non-parameterized service that is not applied to the
• When a request comes from the CoA to deactivate a parameterized service that is not applied to the
• When a duplicate request to apply a parameterized service is made with non-identical parameters from
• When a request with non-identical parameters comes from CoA to deactivate a parameterized service.
Service Update from CoA
The service update feature allows an existing service-profile to be updated with a new RADIUS attribute list
representing the updated service. This impacts any subscriber who is already activated with the service and
new subscriber who activate the service in the future. The new CoA service-update command is used for
activating this feature. The CoA request for the service update should have these attributes:
• "subscriber:command=service-update" Cisco VSA
• "subscriber:service-name=<service name>" Cisco VSA
• Other attributes that are part of the service profile
A service update CoA should have a minimum of these attributes:
• vsa cisco generic 1 string "subscriber:command=service-update"
• vsa cisco generic 1 string "subscriber:service-name=<service name>"
Web Logon with RADIUS Based CoA
To support Web Logon, a set of Policy Rule Events need to be configured in an ordered manner. These events
are as follows:
• session-start:
• account-logon — The Web portal collects the user credentials such as username and password and
• timer expiry — When the timer expires, the subscriber session is disconnected based on the configuration.
Service Accounting
Accounting records for each service enabled on a subscriber can be sent to the configured RADIUS server.
These records can include service-start, service-stop, and service-interim records containing the current state
Cisco ASR 9000 Series Aggregation Services Router Broadband Network Gateway Configuration Guide,
Release 4.3.x
58
session.
session.
the CoA.
• On the start of a session, a subscriber is setup to get internet connectivity. The service is activated
to redirect HTTP traffic to a Web portal for web-based logon.
• Start the timer with duration for the maximum waiting period for authentication.
triggers a CoA account-logon command. When this event is triggered, subscriber username and password
are authenticated by the RADIUS server. Once the authentication is successful, the HTTP redirect service
is deactivated, granting user access to already connected internet setup. Also, the timer established in
session-start must be stopped. However, if the authentication fails during account-logon, BNG sends a
NAK CoA request, allowing for further authentication attempts to take place.
Configuring Authentication, Authorization, and Accounting Functions
OL-28375-03