AAA Per VC QoS Policy Support


First Published: June 27, 2005
Last Updated: November 20, 2009

The AAA Per VC QoS Policy Support feature provides the ability to modify an existing quality of service (QoS) profile applied to a session while that session remains active using new Cisco attribute-value (AV) pairs that specify service policy output and service policy input.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for AAA Per VC QoS Policy Support" section.

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

Prerequisites for AAA Per VC QoS Policy Support

Restrictions for AAA Per VC QoS Policy Support

Information About AAA Per VC QoS Policy Support

Configuration Examples for AAA Per VC QoS Policy Support

Additional References

Feature Information for AAA Per VC QoS Policy Support

Prerequisites for AAA Per VC QoS Policy Support

You should be familiar with defining policy maps for managing subscriber sessions, and with configuring QoS traffic conditioning. See the "Additional References" section for information on these topics.

Restrictions for AAA Per VC QoS Policy Support

Although there are no specific restrictions for using the AAA Per VC QoS Policy Support feature, defect report CSCef69140 describes a problem whereby in PPPoA sessions, an input service policy cannot be applied at the ATM virtual circuit (VC) level. Instead, an input service policy, and therefore an input policy AV pair, must be applied under interface virtual template mode.

Also, read through the configuration guidelines in the "Interface Policy Map AAA Attributes" section before using the attributes described in this document.

Information About AAA Per VC QoS Policy Support

Familiarize yourself with the following information before using the attributes described in this document:

RADIUS Push and Pull

Interface Policy Map AAA Attributes

RADIUS Push and Pull

Cisco Systems software offers applications for the DSL aggregation market and service providers that make powerful use of dynamic policy maps. Policy maps govern user services to be deployed in the network and are triggered by a service or by a user—concepts referred to as push and pull. Pull refers to a policy applied during authentication. Push refers to the dynamic change of policy on the session using Change of Authorization (CoA) message. Before the AAA Per VC QoS Policy Support feature introduced in Cisco IOS Release 12.4(2)T, there was no RADIUS push and pull capability for a policy map at the ATM VC level. RADIUS only supported dynamic bandwidth selection and virtual access interface policy maps applied during the establishment of a PPP session. The AAA Per VC QoS Policy Support feature provides support for RADIUS push and pull capability for a policy map at the ATM VC level.

RADIUS pull of policy maps on a VC means that a policy map can be applied on the VC while a PPP over ATM (PPPoA) session is being established. PPPoA sessions are established between a policy server and a routing gateway.

Service policies are applied only when a subscriber first authenticates the VC. Software creates an identifier that is used as the session unique identifier between the router and the RADIUS server using RADIUS Internet Engineering Task Force (IETF) attribute 44. This identifier is sent with an Access Request message and all accounting records for that session.

RADIUS push functionality provides the ability to modify an existing QoS profile applied to a session while that session remains active. A policy server governs the authorization of active sessions with its ability to send a Change of Authorization (CoA) message (see Figure 1). Specific events can trigger the CoA message and allow modification of the QoS configuration. Implementation of RADIUS push eliminates the need to preprovision subscribers, allowing QoS policies to be transparently applied where and when required without the disruption of session reauthentication.

Figure 1 RADIUS Push

These abilities provide a high degree of flexibility, smaller configuration files, and more efficient use of queueing resources. And perhaps more importantly, RADIUS push and pull eliminates the need to statically configure a policy map on every VC or VLAN.

This feature is implemented by Cisco AV pairs that identify QoS policies configured on the router from a RADIUS server by defining service policy output and service policy input. The AV pairs place the appropriate policy map, which is identified by name, directly on the interface. The interface can be either an ATM VC or Ethernet VLAN.

After the initial subscriber authentication, authorization process, RADIUS returns the appropriate AV name for the policy maps to be applied at the VC and virtual-access interface level. The QoS policy maps define the subscriber user experience for broadband service and can be leveraged to deliver higher value services such as VoIP and video.

Interface Policy Map AAA Attributes

Two new generic Cisco RADIUS VSA attributes are introduced by the AAA Per VC QoS Policy Support feature, as follows:

cisco-avpair = "atm:vc-qos-policy-in=in-policy-name"
cisco-avpair = "atm:vc-qos-policy-out=out-policy-name"

Use these attributes in the RADIUS server profile to define service policy output and service policy input. The AV pairs place the appropriate policy map, which is identified by name, directly on the interface. The interface can be either an ATM VC or Ethernet VLAN.

The AAA Per VC QoS Policy Support feature also replaces the following generic Cisco RADIUS vendor-specific attribute (VSA) attributes:

cisco-avpair = "ip:sub-policy-In=in-policy-name"
cisco-avpair = "ip:sub-policy-Out=out-policy-name"

with the following new attributes:

cisco-avpair = "ip:sub-qos-policy-in=in-policy-name"
cisco-avpair = "ip:sub-qos-policy-out=out-policy-name"

The replaced attributes will be supported for several more software releases, but profiles should be updated with the new attributes as soon as it is feasible to do so.

Remember the following guidelines as you configure these attributes:

A policy map pulled or pushed from the RADIUS server has a higher precedence than a policy map configured under a permanent virtual circuit (PVC).

The Cisco IOS show policy-map interface EXEC command will display the policy map pushed or pulled from the RADIUS server. This policy map is actually used by the driver, even though the policy map was configured using the service-policy command under PVC configuration mode.

Once a policy map is pushed or pulled on the VC and successfully installed or updated, any configuration or removal of the configuration would affect only the running configuration, and not the driver and actual policy map used by the VC.

You must enable dynamic bandwidth selection using the dbs enable command. Dynamic policies that are pulled and pushed from the RADIUS server must be specifically disabled using the no dbs enable command.

Configuration Examples for AAA Per VC QoS Policy Support

This section contains the following examples:

RADIUS Interface Policy Map Profile: Example

Define the Policy Map on the Router: Example

Display the Service Policy: Example

RADIUS Interface Policy Map Profile: Example

Following is an example of a RADIUS profile defining an input service policy named test_vc:

radius subscriber 2
 vsa cisco generic 1 string "atm:vc-qos-policy-in=test_vc"
 attribute 1 string "user@cisco.com"
 attribute 44 string "00000002"
!
radius client 192.168.1.4 access-ports 1645 1645 accounting-ports 1646 1646
radius host 192.168.1.3 auth-port 1645 acct-port 1646 key 0 cisco 
radius host 192.168.1.4 auth-port 1645 acct-port 1646
radius retransmit 0
radius timeout 15
radius key 0 cisco
radius server 192.168.1.4
 client 192.168.1.3 shared-secret word

Define the Policy Map on the Router: Example

The following example shows the Cisco IOS commands that are used to define the service policy on the router:

!
interface ATM4/0
 no ip address
 no atm ilmi-keepalive
 pvc 1/101 
  dbs enable
  service-policy input test_vc
 !
end

Display the Service Policy: Example

The following example shows the report from the show policy-map interface command when the policy map named test_vc has been pushed on PVC 1/101:

Router# show policy interface atm 4/0

 ATM4/0: VC 1/101 -

  Service-policy input: test_vc

    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any 

Additional References

The following sections provide references related to the AAA Per VC QoS Policy Support feature.

Related Documents

Related Topic
Document Title

Service policies and policy maps

ISA Configuration Guide

ISA Command Reference

Cisco VSA attributes

Cisco IOS Security Configuration Guide

QoS traffic conditioning

Cisco IOS Quality of Service Solutions Configuration Guide

Cisco IOS Quality of Service Solutions Command Reference


Standards

Standard
Title

No new or modified standards are supported, and support for existing standards has not been modified.


MIBs

MIB
MIBs Link

No new or modified MIBs are supported, and support for existing MIBs has not been modified.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFC
Title

No new or modified RFCs are supported, and support for existing RFCs


Technical Assistance

Description
Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html


Feature Information for AAA Per VC QoS Policy Support

Table 1 lists the release history for this feature.

Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.


Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.


Table 1 Feature Information for AAA Per VC QoS Policy Support 

Feature Name
Releases
Feature Information

AAA Per VC QoS Policy Support

12.4(2)T
12.2(33)SRE

The AAA Per VC QoS Policy Support feature provides the ability to modify an existing quality of service (QoS) profile applied to a session while that session remains active using new Cisco attribute-value (AV) pairs that specify service policy output and service policy input.

In 12.4(2)T, this feature was introduced on the Cisco 10000.

In Cisco IOS Release 12.2(33)SRE, the AAA Per VC QoS Policy Support feature was added for the Cisco 7600 series router.



CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.