AAA High Availability Support for Local PPPoX Sessions

Table Of Contents

AAA High Availability Support for Local PPPoX Sessions

Contents

Prerequisites for AAA High Availability Support for Local PPPoX Sessions

Restrictions for AAA High Availability Support for Local PPPoX Sessions

Information About AAA High Availability Support for Local PPPoX Sessions

AAA HA Enhancement

HA and Authentication

HA and Authorization

HA and Accounting

System Accounting

Periodic Accounting

How to Configure AAA High Availibility Support for Local PPPoX Sessions

How to Troubleshoot an AAA High Availibility Configuration

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

debug aaa redundancy

Feature Information for AAA High Availibility Support for Local PPPoX Sessions

AAA High Availability Support for Local PPPoX Sessions

---

First Published: November 20, 2006

Last Updated: November 20, 2006

This feature enhances the authentication, authorization, and accounting (AAA) capability to meet high availability (HA) criteria for locally terminated Point-to-Point Protocol over X (PPPoX) sessions, where X represents a transport technology, such as Ethernet or ATM.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for AAA High Availibility Support for Local PPPoX Sessions" section.

Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

•Prerequisites for AAA High Availability Support for Local PPPoX Sessions

•Restrictions for AAA High Availability Support for Local PPPoX Sessions

•Information About AAA High Availability Support for Local PPPoX Sessions

•How to Configure AAA High Availibility Support for Local PPPoX Sessions

•How to Troubleshoot an AAA High Availibility Configuration

•Additional References

•Command Reference

•Feature Information for AAA High Availibility Support for Local PPPoX Sessions

Prerequisites for AAA High Availability Support for Local PPPoX Sessions

AAA HA support for local PPPoX sessions is available only on Cisco 10000 series routers running Cisco IOS Release 12.2(31)SB or later images that support broadband remote access servers (BRAS).

Restrictions for AAA High Availability Support for Local PPPoX Sessions

This implementation of AAA HA supports only locally terminated PPPoX sessions, including the following:

•PPP over ATM (PPPoA)

•PPP over Ethernet (PPPoE)

•Routed Bridge Encapsulation (RBE)

•RBE over 802.1q (RBE o 802.1q)

•RFC 2684 (formerly RFC 1483) Routed

•PPPoA terminated into multiprotocol label switched (MPLS) virtual private network (VPN)

•PPPoE terminated into MPLS VPN

•PPPoEoE 802.1q into MPLS VPN

•PPPoEoE 802.1q-in-q into MPLS VPN

•Dynamic Host Configuration Protocol (DHCP) VPN ID option 82

•Per VPN AAA

•RFC 2684 Routed to MPLS VPN

---

Note IP sessions are not supported in this implementation of AAA HA.

---

The following Feature Manager features are supported in this implementation of AAA HA:

•Absolute (session) timeout

•Idle timeout

•Access control lists (ACL)

•ACL Filter

•Quality of service (QoS)

The following Feature Manager features are not supported in this implementation of AAA HA:

•Service Configuration

•Compression

•Modem-on-hold

•Internetwork Packet Exchange (IPX) Static Service Advertising Protocols (SAPs)

•Prepaid Time Monitor

•Prepaid Volume Monitor

•L4 Redirect

•Traffic Classification

•Portbundle Hostkey

•IPv6 DHCP from AAA

Information About AAA High Availability Support for Local PPPoX Sessions

You should understand the following concepts:

•AAA HA Enhancement

•HA and Authentication

•HA and Authorization

•HA and Accounting

AAA HA Enhancement

The Cisco HA program aims to deliver carrier grade reliability with Cisco devices running Cisco IOS software. "Carrier grade" means that end users very seldom experience service disruption because of outages, service upgrades, or other maintenance activities on Cisco IOS platforms. To achieve this level of service, Cisco uses two route processors to manage and control the sessions and services for each device. One processor is active and the other is in standby mode, ready to provide backup. Because the focus of HA is on availability of service to the end user, a transition from the active processor to the standby processor must be transparent to the end user, but not necessarily to the service provider, to meet the criteria for carrier grade performance.

This enhancement is designed to make carrier grade AAA services available for locally terminated PPPoX sessions. To achieve HA support for AAA, the router must maintain the following information during transient component failures:

•Authentication status of clients

•Authorization status

•Accounting and billing information

To maintain this information during transitions to the standby processor, Cisco IOS software uses an HA replay model to recreate as much state and database information as possible between the active and standby devices. The HA replay model works within existing external AAA server protocols to achieve the desired behavior.

HA and Authentication

For authentication, only the following state information has to be maintained: knowledge that a session authenticated on the active processor need not be reauthenticated on the standby processor. Each authentication protocol, such as local, TACACS+, or RADIUS, will respond in its protocol-specific way to an authentication request from a standby device. All AAA client authentication replies on a standby device should be successful.

---

Note If an administrator changes the protocol of a server group (for example, from RADIUS to TACACS+), HA will not be available for sessions configured to use that server group.

---

HA and Authorization

The HA process for authorization data is different from the authentication process. The AAA server caches the authorization responses for the sessions in order to provide the appropriate authorization attributes to the AAA clients during a session replay. The AAA clients use the authorization attributes to create a session copy on the standby route processor.

HA and Accounting

The AAA HA accounting framework takes advantage of existing AAA features such as system accounting and periodic accounting to limit the loss of accounting and billing information caused by a switchover between an active processor and a standby processor.

System Accounting

System accounting is a separate accounting capability that informs AAA servers about the state of a client device, such as a router. The AAA server receives a "System-Off" message when a controlled restart takes place on a client device. The message notifies the AAA server to clear any active sessions being managed for the specified client. When the client restarts and becomes available for new sessions, the AAA server receives a "System-On" message. The "System-On" message is also sent following uncontrolled restarts caused by device failures or other events that do not generate a "System-Off" message. In either case, the AAA server no longer maintains any active sessions for the specified client device. The server bills or accounts for the sessions prior to the "System-On" message and starts a new session.

AAA's accounting HA solution does not add any new requirements to system accounting for AAA servers. Any switchover will look like a very fast, minimally disruptive outage. Although end users do not experience any loss of service during an HA switchover, AAA servers reset their sessions and restart accounting for all switched-over sessions.

Periodic Accounting

You can use periodic accounting to dynamically update records of session utilization for billing purposes. Periodic accounting minimizes the loss of usage statistics. HA does not eliminate the need to configure periodic accounting on a device if you require dynamic usage statistics for billing purposes. To achieve the HA level of reliability, the existing network topology configuration must be maintained.

How to Configure AAA High Availibility Support for Local PPPoX Sessions

There are no configuration tasks associated with this feature. On a Cisco 10000 series router, running Cisco IOS Release 12.2(31)SB or a later release, if you maintain your network topology for HA, then the AAA functions will automatically participate in the HA feature for locally terminated PPPoX sessions.

How to Troubleshoot an AAA High Availibility Configuration

You can use the debug aaa redundancy command to troubleshoot the AAA HA configuration. This command displays the AAA synchronization data for the session synchronization to the standby device. You can use the data to troubleshoot AAA issues related to the session synchronization.

SUMMARY STEPS

1. enable

2. debug aaa redundancy

3. disable

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enters the privileged EXEC mode. •Enter your password, if prompted to do so.
Step 2	debug aaa redundancy Example: Router# debug aaa redundancy	Displays the AAA synchronization data for the session synchronization to the standby device.
Step 3	disable Example: Router# disable	Returns to user EXEC mode from privileged EXEC mode.

Additional References

The following sections provide references related to the AAA HA Support for Local PPPoX Sessions feature.

Related Documents

Related Topic	Document Title
Configuring AAA	Cisco IOS Security Configuration Guide, Release 12.2 Part 1: "Authentication, Authorization, and Accounting (AAA)"
Configuring Authentication	Cisco IOS Security Configuration Guide, Release 12.2 Part 1: "Authentication, Authorization, and Accounting (AAA), Configuring Authentication"
Configuring Authorization	Cisco IOS Security Configuration Guide, Release 12.2 Part 1: "Authentication, Authorization, and Accounting (AAA), Configuring Authorization"
Configuring Accounting	Cisco IOS Security Configuration Guide, Release 12.2 Part 1: "Authentication, Authorization, and Accounting (AAA), Configuring Accounting"

Standards

Standard	Title
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.	—

MIBs

MIB	MIBs Link
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.	To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs

RFCs

RFC	Title
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.	—

Technical Assistance

Description	Link
The Cisco Technical Support & Documentation website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, tools, and technical documentation. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/techsupport

Command Reference

This section documents a new command only:

•debug aaa redundancy

debug aaa redundancy

To view debug output that displays authentication, authorization, and accounting (AAA) redundancy events during session activation, session synchronization to the standby device, and dynamic session updates to the standby device, use the debug aaa redundancy command in privileged EXEC mode. To disable debugging for AAA redundancy, use the no form of this command.

debug aaa redundancy

no debug aaa redundancy

Syntax Description

This command has no arguments or keywords.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.2(31)SB2	This command was introduced.

Usage Guidelines

This command displays the AAA synchronization data for the session synchronization to the standby device. This information might be useful for diagnosing any AAA issues related to the session synchronization.

Examples

The following example shows sample output of the debug aaa redundancy command collected while activating a session and synchronizing the session to the standby device:

Router# debug aaa redundancy

Logs on Active

==============

01:31:55: CCM: New State[Not Ready]

01:31:55: CCM: PPPoE Required

01:31:55: CCM: PPP Required

01:31:55: CCM: LTERM Required

01:31:55: CCM: PPPoE is Initiator

01:31:55: AAA/BIND(0000000B): Bind i/f Virtual-Template1 

01:31:55: CCM: AAA Ready

01:31:55: AAA/CCM/(0000000B): AAA sso init completed successfully

01:31:55: SSS INFO: Element type is Access-Type = 3 (PPPoE)

01:31:55: SSS INFO: Element type is Protocol-Type = 0 (PPP)

01:31:55: SSS INFO: Element type is Media-Type = 1 (Ethernet)

01:31:55: SSS INFO: Element type is Switch-Id = 4105 (00001009)

01:31:55: SSS INFO: Element type is Segment-Hdl = 4114 (00001012)

01:31:55: SSS INFO: Element type is AAA-Id = 11 (0000000B)

01:31:55: SSS INFO: Element type is AccIe-Hdl = 33554441 (02000009)

01:31:55: SSS INFO: Element type is SHDB-Handle = 1476395017 (58000009)

01:31:55: SSS INFO: Element type is Input Interface = "GigabitEthernet6/0/0"

01:31:55: SSS MGR [uid:10]: Sending a Session Assert ID Mgr event

01:31:55: SSS MGR [uid:10]: Updating ID Mgr with the following keys:

  aaa-unique-id        11 (0xB)

01:31:55: SSS MGR [uid:10]: Handling Policy Service Authorize action (1 pending sessions)

01:31:55: SSS PM [uid:10][63D5D594]: RM/VPDN disabled: RM/VPDN author not needed

01:31:55: SSS PM [uid:10][63D5D594]: AAA author needed for registered user

01:31:55: SSS MGR [uid:10]: Got reply Need More Keys from PM

01:31:55: SSS MGR [uid:10]: Handling Need More Keys action

01:31:57: SSS INFO: Element type is Unauth-User = "user1"

01:31:57: SSS INFO: Element type is AccIe-Hdl = 33554441 (02000009)

01:31:57: SSS INFO: Element type is AAA-Id = 11 (0000000B)

01:31:57: SSS INFO: Element type is Access-Type = 0 (PPP)

01:31:57: SSS INFO: Element type is Protocol-Type = 0 (PPP)

01:31:57: SSS MGR [uid:10]: Sending a Session Update ID Mgr event

01:31:57: SSS MGR [uid:10]: Updating ID Mgr with the following keys:

  username             "user1"

  aaa-unique-id        11 (0xB)

01:31:57: SSS MGR [uid:10]: Handling Policy Send More Keys action

01:31:57: SSS PM [uid:10][63D5D594]: AAA author needed for registered user

01:31:57: SSS PM [uid:10][63D5D594]: SGBP disabled: SGF author not needed

01:31:57: SSS MGR [uid:10]: Got reply Local Terminate from PM

01:31:57: SSS MGR [uid:10]: Handling Connect Local Service action

01:31:57: SSS MGR [uid:10]: Need the resource type determined key

01:31:57: SSS MGR [uid:10]: Handling Need More Keys action

01:31:57: SSS MGR [uid:10]: Not yet ready to start the Local service

01:31:57: AAA/AUTHEN/PPP (0000000B): Pick method list 'default' 

01:31:57: RADIUS/ENCODE(0000000B):Orig. component type = PPoE

01:31:57: RADIUS:  AAA Unsupported Attr: client-mac-address[42]  14  

01:31:57: RADIUS:   30 30 30 61 2E 34 32 37 64 2E 65 63      [ 000a.427d.ec]

01:31:57: RADIUS:  AAA Unsupported Attr: interface         [171] 7   

01:31:57: RADIUS:   36 2F 30 2F 30             [ 6/0/0]

01:31:57: RADIUS(0000000B): Config NAS IP: 0.0.0.0

01:31:57: RADIUS/ENCODE(0000000B): acct_session_id: 11

01:31:57: RADIUS(0000000B): sending

01:31:57: RADIUS/ENCODE: Best Local IP-Address 9.2.76.2 for Radius-Server 9.2.36.253

01:31:57: RADIUS(0000000B): Send Access-Request to 9.2.36.253:1645 id 1645/10, len 86

01:31:57: RADIUS:  authenticator FD E8 32 9A 71 15 50 44 - BE FF 19 D0 09 D4 8D 15

01:31:57: RADIUS:  Framed-Protocol     [7]   6   PPP                       [1]

01:31:57: RADIUS:  User-Name           [1]   9   "user1"

01:31:57: RADIUS:  User-Password       [2]   18  *

01:31:57: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]

01:31:57: RADIUS:  NAS-Port            [5]   6   0                         

01:31:57: RADIUS:  NAS-Port-Id         [87]  9   "6/0/0/0"

01:31:57: RADIUS:  Service-Type        [6]   6   Framed                    [2]

01:31:57: RADIUS:  NAS-IP-Address      [4]   6   9.2.76.2                  

01:31:57: RADIUS: Received from id 1645/10 9.2.36.253:1645, Access-Accept, len 32

01:31:57: RADIUS:  authenticator E4 68 43 2C 2F E7 B4 57 - 05 70 FF B1 22 13 E8 0F

01:31:57: RADIUS:  Idle-Timeout        [28]  6   200                       

01:31:57: RADIUS:  Service-Type        [6]   6   Framed                    [2]

01:31:57: RADIUS(0000000B): Received from id 1645/10

01:31:57: SSS INFO: Element type is Auth-User = "user1"

01:31:57: SSS INFO: Element type is AAA-Attr-List = C5000100

01:31:57: SSS INFO: Element type is   idletime             200 (0xC8)

01:31:57: SSS INFO: Element type is   service-type         2 [Framed]

01:31:57: SSS INFO: Element type is Resource-Determined = 1 (YES)

01:31:57: SSS INFO: Element type is Access-Type = 0 (PPP)

01:31:57: SSS INFO: Element type is Protocol-Type = 0 (PPP)

01:31:57: SSS INFO: Element type is Final = 1 (YES)

01:31:57: SSS MGR [uid:10]: Handling Connect Local Service action

01:31:57: SSS MGR [uid:10]: Rcvd an AAA attr list from SIP, pushing it to the PM

01:31:57: SSS MGR [uid:10]: Handling Send Policy Push Cng action

01:31:57: SSS AAA AUTHOR [uid:10]: Root SIP PPPoE

01:31:57: SSS AAA AUTHOR [uid:10]:  Enable PPPoE parsing

01:31:57: SSS AAA AUTHOR [uid:10]:  Enable PPP parsing

01:31:57: SSS AAA AUTHOR [uid:10]: Active key set to Unauth-User

01:31:57: SSS AAA AUTHOR [uid:10]: Authorizing key user1

01:31:57: SSS AAA AUTHOR [uid:10]: Spoofed AAA reply sent for key user1

01:31:57: SSS MGR [uid:10]: Not yet ready to start the Local service

01:31:57: SSS AAA AUTHOR [uid:10]: Received an AAA pass

01:31:57: SSS AAA AUTHOR [uid:10]: SIP PPP[60A0504C] parsed as Success

01:31:57: SSS AAA AUTHOR [uid:10]: SIP PPP[61571560] parsed as Ignore

01:31:57: SSS AAA AUTHOR [uid:10]: SIP PPPoE[61599FB0] parsed as Success

01:31:57: SSS AAA AUTHOR [uid:10]: SIP Root parser not installed

01:31:57: SSS AAA AUTHOR [uid:10]: No service authorization info found

01:31:57: SSS AAA AUTHOR [uid:10]: Active Handle present

01:31:57: SSS AAA AUTHOR [uid:10]: Freeing Active Handle; SSS Policy Context Handle = 
63D5D594

01:31:57: SSS AAA AUTHOR [uid:10]: Free request

01:31:57: SSS MGR [uid:10]: Got reply Apply Config from PM

01:31:57: SSS MGR [uid:10]: Successfully applied policy config

01:31:57: SSS MGR [uid:10]: Handling Connect Local Service action

01:31:57: CCM: LTERM Required

01:31:57: SSS LTERM [uid:10]: Processing Local termination request

01:31:57: SSS LTERM [uid:10]: Sent create-clone request to vtemplate manager

01:31:57: SSS LTERM [uid:10]: Created vaccess interface Vi3

01:31:57: CCM: LTERM Ready

01:31:57: SSS LTERM [uid:10]: Segment provision successful

01:31:57: SSS MGR [uid:10]: Handling Local Service Connected action

01:31:57: SSS MGR [uid:10]: Apply for Vi3: segment 4114, owner 3825205277

01:31:57: SSS MGR [uid:10]:   Interface config 212C27B8

01:31:57: SSS MGR [uid:10]:   Per-user config 2146BD48

01:31:57: SSS LTERM [uid:10]: Switching session provisioned

01:31:57: SSS MGR [uid:10]: Handling Local Service Connected, Features Applied action

01:31:57: %LINK-3-UPDOWN: Interface Virtual-Access3, changed state to up

01:31:57: SSS LTERM [uid:10]: Installed Vi3 process path switching vector

01:31:57: SSS LTERM [uid:10]: Installed Vi3 fastsend path switching vector

01:31:57: AAA/BIND(0000000B): Bind i/f Virtual-Access3 

01:31:57: CCM: PPPoE Ready

01:31:57: CCM: PPP Ready

01:31:57: CCM: PPP Old State[Not Ready] Event[All Ready]

01:31:57: CCM: New State[Ready]

01:31:57: AAA/CCM/(0000000B): No of sync avps = 4 Total sync data len = 94

01:31:57: CCM: PPP Adding Data Type[6] Subtype[0] Length[14] 

01:31:57: CCM: PPP Adding Data Type[5] Subtype[0] Length[10] 

01:31:57: CCM: PPP Adding Data Type[8] Subtype[0] Length[6] 

01:31:57: CCM: PPP Adding Data Type[7] Subtype[0] Length[0] 

01:31:57: CCM: PPP Adding Data Type[1] Subtype[0] Length[8] 

01:31:57: CCM: PPP Adding Data Type[41] Subtype[0] Length[4] 

01:31:57: CCM: PPPoE Adding Data Type[1] Subtype[0] Length[54] 

01:31:57: CCM: PPPoE Adding Data Type[2] Subtype[0] Length[2] 

01:31:57: CCM: PPPoE Adding Data Type[5] Subtype[0] Length[4] 

01:31:57: CCM: PPPoE Adding Data Type[6] Subtype[0] Length[4] 

01:31:57: CCM: PPPoE Adding Data Type[7] Subtype[0] Length[20] 

01:31:57: CCM: PPPoE Adding Data Type[8] Subtype[0] Length[16] 

01:31:57: CCM: AAA Adding Data Type[1] Subtype[0] Length[4] 

01:31:57: AAA/CCM/(0000000B): Adding sync avp [AAA Unique Id] Length = 4

01:31:57: CCM: AAA Adding Data Type[2] Subtype[0] Length[2] 

01:31:57: AAA/CCM/(0000000B): Adding sync avp [AAA Authen Method Index] Length = 2

01:31:57: CCM: AAA Adding Data Type[3] Subtype[0] Length[4] 

01:31:57: AAA/CCM/(0000000B): Adding sync avp [AAA Acct Sess id] Length = 4

01:31:57: CCM: AAA Adding Data Type[4] Subtype[0] Length[84] 

01:31:57: AAA/CCM/(0000000B): Adding sync avp [AAA Author Data] Length = 84

01:31:57:  AAA/CCM: Adding author data entry 32

01:31:57: CCM: LTERM Adding Data Type[1] Subtype[0] Length[4] 

01:31:57: SSS LTERM [uid:10]: LTERM segment handle synced

01:31:57: CCM:  Send[Sync Session] Length[240] NumItems[17] Event[0x0]

01:31:57:      Client[PPP] Type[6] Subtype[0] Length[14] 

01:31:57:       01 04 05 D4 03 04 C0 23 05 06 03 F4 37 79

01:31:57:      Client[PPP] Type[5] Subtype[0] Length[10] 

01:31:57:       01 04 05 D4 05 06 9A 6B 68 FE

01:31:57:      Client[PPP] Type[8] Subtype[0] Length[6] 

01:31:57:       03 06 07 01 01 01

01:31:57:      Client[PPP] Type[7] Subtype[0] Length[0] 

01:31:57:      

01:31:57:      Client[PPP] Type[1] Subtype[0] Length[8] 

01:31:57:       73 75 6D 61 6E 74 68 00

01:31:57:      Client[PPP] Type[41] Subtype[0] Length[4] 

01:31:57:       00 00 00 02

01:31:57:      Client[PPPoE] Type[1] Subtype[0] Length[54] 

01:31:57:       00 03 A0 10 22 90 00 0A 42 7D EC 38 88 63 11 19

01:31:57:       00 00 00 22 01 02 00 06 61 61 61 5F 68 61 01 04

01:31:57:       00 10 98 99 BB 6D 59 B8 35 33 0B FB 14 B9 07 EB

01:31:57:       83 B4 01 01 00 00

01:31:57:      Client[PPPoE] Type[2] Subtype[0] Length[2] 

01:31:57:       00 0A

01:31:57:      Client[PPPoE] Type[5] Subtype[0] Length[4] 

01:31:57:       00 00 10 09

01:31:57:      Client[PPPoE] Type[6] Subtype[0] Length[4] 

01:31:57:       00 00 10 12

01:31:57:      Client[PPPoE] Type[7] Subtype[0] Length[20] 

01:31:57:       00 02 06 00 00 00 A6 B8 00 00 00 00 00 00 00 2A

01:31:57:       00 00 FF FF

01:31:57:      Client[PPPoE] Type[8] Subtype[0] Length[16] 

01:31:57:       00 00 00 03 00 00 00 00 00 00 00 19 00 00 00 1D

01:31:57:      

01:31:57:      Client[AAA] Type[1] Subtype[0] Length[4] 

01:31:57:       00 00 00 0B

01:31:57:      Client[AAA] Type[2] Subtype[0] Length[2] 

01:31:57:       00 00

01:31:57:      Client[AAA] Type[3] Subtype[0] Length[4] 

01:31:57:       00 00 00 0B

01:31:57:      Client[AAA] Type[4] Subtype[0] Length[84] 

01:31:57:       00 00 00 00 00 00 00 00 63 E8 73 D0 00 00 00 0B

01:31:57:       64 02 FE 71 00 00 00 00 00 00 00 00 00 00 00 00

01:31:57:       00 00 00 04 00 00 00 01 00 00 00 20 00 00 00 00

01:31:57:       58 00 00 09 02 0A 00 20 E4 68 43 2C 2F E7 B4 57

01:31:57:       05 70 FF B1 22 13 E8 0F 1C 06 00 00 00 C8 06 06

01:31:57:       00 00 00 02

01:31:57:      Client[LTERM] Type[1] Subtype[0] Length[4] 

01:31:57:       00 00 20 13

01:31:57: CCM: New State[Dyn Sync]

01:31:58: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access3, changed state 
to up

Logs on Standby

================

01:21:16: CCM ISSU: Received negotiation message type [ISSU_RC_USER_MESSAGE_COMP]

01:21:16: CCM: Receive[Sync Session] Length[240] NumItems[17] Flags[0x0]

01:21:16: CCM: New State[Not Ready]

01:21:16:      Client[PPP] Type[6] Subtype[0] Length[14] 

01:21:16:       01 04 05 D4 03 04 C0 23 05 06 03 F4 37 79

01:21:16:      Client[PPP] Type[5] Subtype[0] Length[10] 

01:21:16:       01 04 05 D4 05 06 9A 6B 68 FE

01:21:16:      Client[PPP] Type[8] Subtype[0] Length[6] 

01:21:16:       03 06 07 01 01 01

01:21:16:      Client[PPP] Type[7] Subtype[0] Length[0] 

01:21:16:      

01:21:16:      Client[PPP] Type[1] Subtype[0] Length[8] 

01:21:16:       73 75 6D 61 6E 74 68 00

01:21:16:      Client[PPP] Type[41] Subtype[0] Length[4] 

01:21:16:       00 00 00 02

01:21:16:      Client[PPPoE] Type[1] Subtype[0] Length[54] 

01:21:16:       00 03 A0 10 22 90 00 0A 42 7D EC 38 88 63 11 19

01:21:16:       00 00 00 22 01 02 00 06 61 61 61 5F 68 61 01 04

01:21:16:       00 10 98 99 BB 6D 59 B8 35 33 0B FB 14 B9 07 EB

01:21:16:       83 B4 01 01 00 00

01:21:16:      Client[PPPoE] Type[2] Subtype[0] Length[2] 

01:21:16:       00 0A

01:21:16:      Client[PPPoE] Type[5] Subtype[0] Length[4] 

01:21:16:       00 00 10 09

01:21:16:      Client[PPPoE] Type[6] Subtype[0] Length[4] 

01:21:16:       00 00 10 12

01:21:16:      Client[PPPoE] Type[7] Subtype[0] Length[20] 

01:21:16:       00 02 06 00 00 00 A6 B8 00 00 00 00 00 00 00 2A

01:21:16:       00 00 FF FF

01:21:16:      Client[PPPoE] Type[8] Subtype[0] Length[16] 

01:21:16:       00 00 00 03 00 00 00 00 00 00 00 19 00 00 00 1D

01:21:16:      

01:21:16:      Client[AAA] Type[1] Subtype[0] Length[4] 

01:21:16:       00 00 00 0B

01:21:16:      Client[AAA] Type[2] Subtype[0] Length[2] 

01:21:16:       00 00

01:21:16:      Client[AAA] Type[3] Subtype[0] Length[4] 

01:21:16:       00 00 00 0B

01:21:16:      Client[AAA] Type[4] Subtype[0] Length[84] 

01:21:16:       00 00 00 00 00 00 00 00 63 E8 73 D0 00 00 00 0B

01:21:16:       64 02 FE 71 00 00 00 00 00 00 00 00 00 00 00 00

01:21:16:       00 00 00 04 00 00 00 01 00 00 00 20 00 00 00 00

01:21:16:       58 00 00 09 02 0A 00 20 E4 68 43 2C 2F E7 B4 57

01:21:16:       05 70 FF B1 22 13 E8 0F 1C 06 00 00 00 C8 06 06

01:21:16:       00 00 00 02

01:21:16:      Client[LTERM] Type[1] Subtype[0] Length[4] 

01:21:16:       00 00 20 13

01:21:16: CCM:PPPoE Recreate Session  Active[0x58000009] Standby[0x98000009]

01:21:16: CCM: PPPoE Required

01:21:16: CCM: PPP Required

01:21:16: CCM: LTERM Required

01:21:16: CCM: PPPoE is Initiator

01:21:16: AAA/CCM/: return checkpointed aaa id = 0000000B 

01:21:16:  Adding cache entry for id B

01:21:16:  Author cache len 84 84 84

01:21:16: AAA/CCM/(0000000B):return acct_sess_id = 11

01:21:16: CCM: AAA Ready

01:21:16: AAA/CCM/(0000000B): AAA sso init completed successfully

01:21:16: SSS INFO: Element type is Access-Type = 3 (PPPoE)

01:21:16: SSS INFO: Element type is Protocol-Type = 0 (PPP)

01:21:16: SSS INFO: Element type is Media-Type = 1 (Ethernet)

01:21:16: SSS INFO: Element type is Switch-Id = 4105 (00001009)

01:21:16: SSS INFO: Element type is Segment-Hdl = 4114 (00001012)

01:21:16: SSS INFO: Element type is AAA-Id = 11 (0000000B)

01:21:16: SSS INFO: Element type is AccIe-Hdl = 4127195145 (F6000009)

01:21:16: SSS INFO: Element type is SHDB-Handle = 2550136841 (98000009)

01:21:16: SSS INFO: Element type is Input Interface = "GigabitEthernet6/0/0"

01:21:16: SSS MGR [uid:10]: Sending a Session Assert ID Mgr event

01:21:16: SSS MGR [uid:10]: Updating ID Mgr with the following keys:

  aaa-unique-id        11 (0xB)

01:21:16: SSS MGR [uid:10]: Handling Policy Service Authorize action (1 pending sessions)

01:21:16: SSS PM [uid:10][63D6963C]: RM/VPDN disabled: RM/VPDN author not needed

01:21:16: SSS MGR [uid:10]: Got reply Need More Keys from PM

01:21:16: SSS MGR [uid:10]: Handling Need More Keys action

01:21:16: SSS INFO: Element type is Unauth-User = "user1"

01:21:16: SSS INFO: Element type is AccIe-Hdl = 4127195145 (F6000009)

01:21:16: SSS INFO: Element type is AAA-Id = 11 (0000000B)

01:21:16: SSS INFO: Element type is Access-Type = 0 (PPP)

01:21:16: SSS INFO: Element type is Protocol-Type = 0 (PPP)

01:21:16: SSS MGR [uid:10]: Sending a Session Update ID Mgr event

01:21:16: SSS MGR [uid:10]: Updating ID Mgr with the following keys:

  username             "user1"

  aaa-unique-id        11 (0xB)

01:21:16: SSS MGR [uid:10]: Handling Policy Send More Keys action

01:21:16: SSS PM [uid:10][63D6963C]: SGBP disabled: SGF author not needed

01:21:16: SSS MGR [uid:10]: Got reply Local Terminate from PM

01:21:16: SSS MGR [uid:10]: Handling Connect Local Service action

01:21:16: SSS MGR [uid:10]: Need the resource type determined key

01:21:16: SSS MGR [uid:10]: Handling Need More Keys action

01:21:16: SSS MGR [uid:10]: Not yet ready to start the Local service

01:21:16: AAA/CCM/(0000000B):return authen_method_index = 0

01:21:16: RADIUS/ENCODE(0000000B):Orig. component type = PPoE

01:21:16: RADIUS:  AAA Unsupported Attr: client-mac-address[42]  14  

01:21:16: RADIUS:   30 30 30 61 2E 34 32 37 64 2E 65 63      [ 000a.427d.ec]

01:21:16: RADIUS:  AAA Unsupported Attr: interface         [171] 7   

01:21:16: RADIUS:   36 2F 30 2F 30             [ 6/0/0]

01:21:16: RADIUS(0000000B): Config NAS IP: 0.0.0.0

01:21:16: RADIUS/ENCODE(0000000B): acct_session_id: 11

01:21:16: RADIUS(0000000B): sending

01:21:16: RADIUS/ENCODE: Best Local IP-Address 2.1.1.1 for Radius-Server 9.2.36.253

01:21:16: RADIUS(0000000B): Send Access-Request to 9.2.36.253:1645 id 1645/10, len 86

01:21:16: RADIUS:  authenticator 14 48 25 90 A5 7B 53 02 - 11 05 01 13 6D 34 E2 04

01:21:16: RADIUS:  Framed-Protocol     [7]   6   PPP                       [1]

01:21:16: RADIUS:  User-Name           [1]   9   "user1"

01:21:16: RADIUS:  User-Password       [2]   18  *

01:21:16: RADIUS:  NAS-Port-Type       [61]  6   Virtual                   [5]

01:21:16: RADIUS:  NAS-Port            [5]   6   0                         

01:21:16: RADIUS:  NAS-Port-Id         [87]  9   "6/0/0/0"

01:21:16: RADIUS:  Service-Type        [6]   6   Framed                    [2]

01:21:16: RADIUS:  NAS-IP-Address      [4]   6   2.1.1.1                   

01:21:16: RADIUS: Cached response

01:21:16: RADIUS:  authenticator E4 68 43 2C 2F E7 B4 57 - 05 70 FF B1 22 13 E8 0F

01:21:16: RADIUS:  Idle-Timeout        [28]  6   200                       

01:21:16: RADIUS:  Service-Type        [6]   6   Framed                    [2]

01:21:16: RADIUS(0000000B): Received from id 1645/10

01:21:16: SSS INFO: Element type is Auth-User = "user1"

01:21:16: SSS INFO: Element type is AAA-Attr-List = 20000100

01:21:16: SSS INFO: Element type is   idletime             200 (0xC8)

01:21:16: SSS INFO: Element type is   service-type         2 [Framed]

01:21:16: SSS INFO: Element type is Resource-Determined = 1 (YES)

01:21:16: SSS INFO: Element type is Access-Type = 0 (PPP)

01:21:16: SSS INFO: Element type is Protocol-Type = 0 (PPP)

01:21:16: SSS INFO: Element type is Final = 1 (YES)

01:21:16: SSS MGR [uid:10]: Handling Connect Local Service action

01:21:16: SSS MGR [uid:10]: Rcvd an AAA attr list from SIP, pushing it to the PM

01:21:16: SSS MGR [uid:10]: Handling Send Policy Push Cng action

01:21:16: SSS MGR [uid:10]: Not yet ready to start the Local service

01:21:16: SSS MGR [uid:10]: Got reply Apply Config from PM

01:21:16: SSS MGR [uid:10]: Successfully applied policy config

01:21:16: SSS MGR [uid:10]: Handling Connect Local Service action

01:21:16: CCM: LTERM Required

01:21:16: SSS LTERM [uid:10]: Processing Local termination request

01:21:16: SSS LTERM [uid:10]: Sent create-clone request to vtemplate manager

01:21:16: SSS LTERM [uid:10]: Created vaccess interface Vi3

01:21:16: CCM: LTERM Ready

01:21:16: SSS LTERM [uid:10]: Segment provision successful

01:21:16: SSS MGR [uid:10]: Handling Local Service Connected action

01:21:16: SSS MGR [uid:10]: Apply for Vi3: segment 4114, owner 2566914077

01:21:16: SSS MGR [uid:10]:   Interface config 218170B8

01:21:16: SSS MGR [uid:10]:   Per-user config 63E06550

01:21:16: SSS LTERM [uid:10]: Switching session provisioned

01:21:16: SSS MGR [uid:10]: Handling Local Service Connected, Features Applied action

01:21:16: SSS LTERM [uid:10]: Installed Vi3 process path switching vector

01:21:16: SSS LTERM [uid:10]: Installed Vi3 fastsend path switching vector

01:21:16: CCM: PPPoE Ready

01:21:16: CCM: PPP Ready

01:21:16: CCM: PPP Old State[Not Ready] Event[All Ready]

01:21:16: CCM: New State[Ready]

Table 1 describes the significant fields shown in the display.

Table 1 debug aaa redundancy Field Descriptions 

Field	Description
(0000000B)	AAA unique id for the session.
Adding sync avp	Adding synchronization attribute value pair (AVP).
[AAA Unique Id]	The AAA synchronization data type.

Related Commands

Command	Description
debug ccm-manager	Displays debugging information about Cisco CallManager.

Feature Information for AAA High Availibility Support for Local PPPoX Sessions

Table 2 lists the release history for this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

---

Note Table 2 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

---

Table 2 Feature Information for AAA HA Support for Local PPPoX Sessions 

Feature Name	Releases	Feature Information
AAA High Availibility Support for Local PPPoX Sessions	12.2(31)SB2	This feature enhances the AAA capability to meet HA criteria for locally terminated PPPoX sessions.

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2006 Cisco Systems, Inc. All rights reserved.