Cisco software allows you to assign a DNIS number to a particular AAA server group so that the server group can process authentication, authorization, and accounting requests for users dialing in to the network using that particular DNIS. Any phone line (a regular home phone or a commercial T1/PRI line) can be associated with several phone numbers. The DNIS number identifies the number that was called to reach you.

For example, suppose you want to share the same phone number with several customers, but you want to know which customer is calling before you pick up the phone. You can customize how you answer the phone because DNIS allows you to know which customer is calling when you answer.

Cisco devices with either ISDN or internal modems can receive the DNIS number. This functionality allows users to assign different RADIUS server groups for different customers (that is, different RADIUS servers for different DNIS numbers). Additionally, using server groups, you can specify the same server group for AAA services or a separate server group for each AAA service.

Cisco software provides the flexibility to implement authentication and accounting services in several ways:

• Globally—AAA services are defined using global configuration access list commands and applied in general to all interfaces on a specific network access server.

• Per interface—AAA services are defined using interface configuration commands and applied specifically to the interface being configured on a specific network access server.

• DNIS mapping—You can use DNIS to specify an AAA server to supply AAA services.

Because each of these AAA configuration methods can be configured simultaneously, Cisco has established an order of precedence to determine which server or groups of servers provide AAA services. The order of precedence is as follows:

• Per DNIS—If you configure the network access server to use DNIS to identify or determine which server group provides AAA services, this method takes precedence over any additional AAA selection method.

• Per interface—If you configure the network access server per interface to use access lists to determine how a server provides AAA services, this method takes precedence over any global configuration AAA access lists.

• Globally—If you configure the network access server by using global AAA access lists to determine how the security server provides AAA services, this method has the least precedence.

Configuring AAA preauthentication with ISDN PRI or channel-associated signaling (CAS) allows service providers to better manage ports using their existing RADIUS solutions and efficiently manage the use of shared resources to offer differing service-level agreements. With ISDN PRI or CAS, information about an incoming call is available to the network access server (NAS) before the call is connected. The available call information includes the following:

• The DNIS number, also referred to as the called number

• The Calling Line Identification (CLID) number, also referred to as the calling number

• The call type, also referred to as the bearer capability

The AAA preauthentication feature allows a Cisco NAS to decide--on the basis of the DNIS number, the CLID number, or the call type--whether to connect an incoming call. (With ISDN PRI, it enables user authentication and authorization before a call is answered. With CAS, the call must be answered; however, the call can be dropped if preauthentication fails.)

When an incoming call arrives from the public network switch, but before it is connected, AAA preauthentication enables the NAS to send the DNIS number, CLID number, and call type to a RADIUS server for authorization. If the server authorizes the call, the NAS accepts the call. If the server does not authorize the call, the NAS sends a disconnect message to the public network switch to reject the call.

In the event that the RADIUS server application becomes unavailable or is slow to respond, a guard timer can be set in the NAS. When the timer expires, the NAS uses a configurable parameter to accept or reject the incoming call that has no authorization.

The AAA preauthentication feature supports the use of attribute 44 by the RADIUS server application and the use of RADIUS attributes that are configured in the RADIUS preauthentication profiles to specify preauthentication behavior. They can also be used, for instance, to specify whether subsequent authentication should occur and, if so, what authentication method should be used.

The following restrictions apply to AAA preauthentication with ISDN PRI and CAS:

• Attribute 44 is available for CAS calls only when preauthentication or resource pooling is enabled.

• Multichassis Multilink PPP (MMP) is not available with ISDN PRI.

• AAA preauthentication is available only on some hardware platforms.

• ISDN PRI is supported only on some hardware platforms.

Because response times for preauthentication and authentication requests can vary, the guard timer allows you to control the handling of calls. The guard timer starts when the DNIS is sent to the RADIUS server. If the NAS does not receive a response from AAA before the guard timer expires, it accepts or rejects the calls on the basis of the configuration of the timer.

1.    enable


2.    configure terminal


3.    aaa preauthorization


4.    group {radius | tacacs+ | server-group}


5.    dnis [password string]


6.    end

Device> enable

Device# configure terminal

Device(config)# aaa preauthorization

Device(config-preauth)# group radius

Device(config-preauth)# dnis password dnispass

Device(config-preauth)# end

1.    enable


2.    configure terminal


3.    aaa dnis map enable


4.    aaa dnis map dnis-number authentication ppp group server-group-name


5.    aaa dnis map dnis-number authorization network group server-group-name


6.    aaa dnis map dnis-number accounting network [none | start-stop | stop-only] group server-group-name


7.    exit

Device> enable

Device# configure terminal

Device(config)# aaa dnis map enable

Device(config)# aaa dnis map 7777 authentication ppp group sg1

Device(config)# aaa dnis map 7777 authorization network group sg1

Device(config)# aaa dnis map 8888 accounting network stop-only group sg2

Device(config)# exit

1.    enable


2.    configure terminal


3.    aaa preauthorization


4.    group server-group


5.    clid [if-avail | required] [accept-stop] [password string]


6.    ctype [if-avail | required] [accept-stop] [password string]


7.    dnis [if-avail | required] [accept-stop] [password string]


8.    dnis bypass dnis-group-name


9.    end

Device> enable

Device# configure terminal

Device(config)# aaa preauthorization 

Device(config-preauth)# group sg2

Device(config-preauth)# clid required

Device(config-preauth)# ctype required

Device(config-preauth)# dnis required

Device(config-preauth)# dnis bypass group1

Device(config-preauth)# end

1.    enable


2.    configure terminal


3.    interface type number


4.    isdn guard-timer milliseconds [on-expiry {accept | reject}]


5.    call guard-timer milliseconds [on-expiry {accept | reject}]


6.    end

Device> enable

Device# configure terminal

Device(config)# interface serial 1/0/0:23

Device(config-if)# isdn guard-timer 8000 on-expiry reject

Device(config-if)# call guard-timer 2000 on-expiry accept 

Device(config-if)# end