Cisco Systems software offers applications for the DSL aggregation market and service providers that make powerful use of dynamic policy maps. Policy maps govern user services to be deployed in the network and are triggered by a service or by a user--concepts referred to as push and pull. Pull refers to a policy applied during authentication. Push refers to the dynamic change of policy on the session using Change of Authorization (CoA) message. Before the AAA Per VC QoS Policy Support feature introduced in Cisco IOS Release 12.4(2)T, there was no RADIUS push and pull capability for a policy map at the ATM VC level. RADIUS only supported dynamic bandwidth selection and virtual access interface policy maps applied during the establishment of a PPP session. The AAA Per VC QoS Policy Support feature provides support for RADIUS push and pull capability for a policy map at the ATM VC level.

RADIUS pull of policy maps on a VC means that a policy map can be applied on the VC while a PPP over ATM (PPPoA) session is being established. PPPoA sessions are established between a policy server and a routing gateway.

Service policies are applied only when a subscriber first authenticates the VC. Software creates an identifier that is used as the session unique identifier between the router and the RADIUS server using RADIUS Internet Engineering Task Force (IETF) attribute 44. This identifier is sent with an Access Request message and all accounting records for that session.

RADIUS push functionality provides the ability to modify an existing QoS profile applied to a session while that session remains active. A policy server governs the authorization of active sessions with its ability to send a Change of Authorization (CoA) message (see the figure below). Specific events can trigger the CoA message and allow modification of the QoS configuration. Implementation of RADIUS push eliminates the need to preprovision subscribers, allowing QoS policies to be transparently applied where and when required without the disruption of session reauthentication.

Figure 1

RADIUS Push

These abilities provide a high degree of flexibility, smaller configuration files, and more efficient use of queueing resources. And perhaps more importantly, RADIUS push and pull eliminates the need to statically configure a policy map on every VC or VLAN.

This feature is implemented by Cisco AV pairs that identify QoS policies configured on the router from a RADIUS server by defining service policy output and service policy input. The AV pairs place the appropriate policy map, which is identified by name, directly on the interface. The interface can be either an ATM VC or Ethernet VLAN.

After the initial subscriber authentication, authorization process, RADIUS returns the appropriate AV name for the policy maps to be applied at the VC and virtual-access interface level. The QoS policy maps define the subscriber user experience for broadband service and can be leveraged to deliver higher value services such as VoIP and video.

Two new generic Cisco RADIUS VSA attributes are introduced by the AAA Per VC QoS Policy Support feature, as follows:

cisco-avpair = "atm:vc-qos-policy-in=in-policy-name
"
cisco-avpair = "atm:vc-qos-policy-out=out-policy-name
"

Use these attributes in the RADIUS server profile to define service policy output and service policy input. The AV pairs place the appropriate policy map, which is identified by name, directly on the interface. The interface can be either an ATM VC or Ethernet VLAN.

The AAA Per VC QoS Policy Support feature also replaces the following generic Cisco RADIUS vendor-specific attribute (VSA) attributes:

cisco-avpair = "ip:sub-policy-In=in-policy-name
"
cisco-avpair = "ip:sub-policy-Out=out-policy-name
"

with the following new attributes:

cisco-avpair = "ip:sub-qos-policy-in=in-policy-name
"
cisco-avpair = "ip:sub-qos-policy-out=out-policy-name
"

The replaced attributes will be supported for several more software releases, but profiles should be updated with the new attributes as soon as it is feasible to do so.

Remember the following guidelines as you configure these attributes:

• A policy map pulled or pushed from the RADIUS server has a higher precedence than a policy map configured under a permanent virtual circuit (PVC).
• The Cisco IOS show policy-map interfaceEXEC command will display the policy map pushed or pulled from the RADIUS server. This policy map is actually used by the driver, even though the policy map was configured using the service-policy command under PVC configuration mode.
• Once a policy map is pushed or pulled on the VC and successfully installed or updated, any configuration or removal of the configuration would affect only the running configuration, and not the driver and actual policy map used by the VC.
• You must enable dynamic bandwidth selection using the dbs enablecommand. Dynamic policies that are pulled and pushed from the RADIUS server must be specifically disabled using the no dbs enable command.