- Overview of GPRS and UMTS
- Planning to Configure the GGSN
- Configuring GTP Services on the GGSN
- Configuring IPv6 Support on the GGSN
- Configuring GTP Session Redundancy on the GGSN
- Configuring Charging on the GGSN
- Configuring Enhanced Service-Aware Billing on the GGSN
- Configuring Network Access to the GGSN
- Configuring PPP Support on the GGSN
- Configuring QoS on the GGSN
- Configuring Security on the GGSN
- Configuring Dynamic Addressing on the GGSN
- Configuring Load Balancing on the GGSN
- Monitoring Notifications
- Overview of Security Support on the GGSN
- Configuring AAA Security Globally
- Configuring RADIUS Server Communication Globally
- Configuring RADIUS Server Communication at the GGSN Configuration Level
- Configuring Additional RADIUS Services
- Configuring RADIUS Attributes in Access Requests to the RADIUS Server
- Configuring the Vendor-Specific Attribute in Access Requests to the RADIUS Server
- Suppressing Attributes for RADIUS Authentication
- Obtaining DNS and NetBIOS Address Information from a RADIUS Server
- Configuring the RADIUS Packet of Disconnect
- Configuring the GGSN to Wait for a RADIUS Response
- Configuring Access to a RADIUS Server Using VRF
- Enabling AAA Globally
- Configuring a VRF-Aware Private RADIUS Server Group
- Configuring Authentication, Authorization, and Accounting Using Named Method Lists
- Configuring a VRF Routing Table
- Configuring VRF on an Interface
- Configuring VRF Under an Access Point for Access to the Private RADIUS Server
- Configuring a Route to the RADIUS Server Using VRF
- AAA Security Configuration Example
- RADIUS Server Global Configuration Example
- RADIUS Server Group Configuration Example
- RADIUS Response Message Configuration Example
- Address Verification and Mobile-to-Mobile Traffic Redirection Example
- Access to a Private RADIUS Server Using VRF Configuration Example
- Periodic Accounting Timer Example
Configuring Security on the GGSN
This chapter describes how to configure security features on the gateway GPRS support node (GGSN), including Authentication, Authorization, and Accounting (AAA), and RADIUS.
Note IPSec on the Cisco 7600 series router platform is performed on the IPSec VPN Acceleration Services module and requires no configuration on the GGSNs running on the Cisco SAMI.
For information about configuring IPSec on the Cisco 7600 series router platform, refer to the IPSEC VPN Acceleration Services Module Installation and Configuration Note.
The security configuration procedures and examples in this publication (aside from those related to GGSN-specific implementation) describe the basic commands that you can use to implement the security services.
For more detailed information about AAA, RADIUS, and IPSec security services in the Cisco IOS software, refer to the Cisco IOS Security Configuration Guide and Cisco IOS Security Command Reference publications. For information about IPSec security services on Cisco 7600 platform, see the IPSec VPN Acceleration Services Module Installation and Configuration Note.
For a complete description of the GGSN commands in this chapter, refer to the Cisco GGSN Command Reference for the Cisco GGSN release you are using. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
This chapter includes the following sections:
•Overview of Security Support on the GGSN
•Configuring AAA Security Globally (Required)
•Configuring RADIUS Server Communication Globally (Required)
•Configuring RADIUS Server Communication at the GGSN Configuration Level (Required)
•Configuring Additional RADIUS Services (Optional)
•Securing the GGSN Mobile (Gn) Interface (Optional)
•Configuring Simultaneous Broadcast and Wait Accounting (Optional)
•Periodic Accounting Timer (Optional)
Overview of Security Support on the GGSN
The GGSN supports many of the same levels of security that are available through the Cisco IOS software on the router, including the following types of security:
•Authentication, authorization, and accounting (AAA) network security services and server groups
•RADIUS security services
•IP Security Protocol (IPSec)
In addition, the GGSN software provides the ability to configure additional security features such as the following:
•Address verification
•Traffic redirection
•IP access lists
AAA and RADIUS support provides the security services to authenticate and authorize access by mobile users to the GGSN and its access point names (APNs). IPSec support allows you to secure your data between the GGSN and its associated peers.
In some cases, such as with AAA and IPSec support, the GGSN works with the standard Cisco IOS software configuration without requiring configuration of any additional GGSN commands.
In the case of RADIUS server configuration, the GGSN requires that you enable AAA security and establish RADIUS server communication globally on the router. From there, you can configure RADIUS security for all GGSN access points, or per access point, using new GGSN configuration commands.
Note In addition to the AAA, RADIUS, and IPSec security services, the GGSN also supports IP access lists to further control access to APNs. The Cisco IOS GGSN software implements the new ip-access-group access-point configuration command to apply IP access list rules at an APN.
AAA Server Group Support
The Cisco GGSN supports authentication and accounting at APNs using AAA server groups. By using AAA server groups, you gain the following benefits:
•You can selectively implement groups of servers for authentication and accounting at different APNs.
•You can configure different server groups for authentication services and accounting services in the same APN.
•You can control which RADIUS services you want to enable at a particular APN, such as AAA accounting.
For GPRS tunneling protocol (GTP)-PPP termination and GTP-PPP regeneration on the GGSN, transparent access mode is used to allow PPP to perform the appropriate AAA functions; however, you can still configure AAA server groups to specify the corresponding server groups for AAA support.
The GGSN supports the implementation of AAA server groups at both the global and access-point configuration levels. You can minimize your configuration by specifying the configuration that you want to support across most APNs, at the global configuration level. Then, at the access-point configuration level, you can selectively modify the services and server groups that you want to support at a particular APN. Therefore, you can override the AAA server global configuration at the APN configuration level.
To configure a default AAA server group to be used for all APNs on the GGSN, use the gprs default aaa-group global configuration command. To specify a different AAA server group to be used at a particular APN for authentication or accounting, use the aaa-group access-point configuration command.
If authentication is enabled on the APN, then the GGSN first looks for an authentication server group at the APN. If an authentication server group is not found at the APN, then the GGSN looks for a globally configured, General Packet Radio Service/Universal Mobile Telecommunication System (GPRS/UMTS) default authentication server group.
If accounting is enabled on the APN, then the GGSN looks for an accounting server group at the APN or globally in the following order:
•First, at the APN for an accounting server group—configured in the aaa-group accounting command.
•Second, for a global GPRS/UMTS default accounting server group—configured in the gprs default aaa-group accounting command.
•Third, at the APN for an authentication server group—configured in the aaa-group authentication command.
•Last, for a global GPRS/UMTS default authentication server group—configured in the gprs default aaa-group authentication command.
To complete the configuration, you also must specify the following configuration elements on the GGSN:
•Configure the RADIUS servers by using the radius-server host command.
•Define a server group with the IP addresses of the AAA servers in that group, using the aaa group server global configuration command.
•Enable the type of AAA services (accounting and authentication) to be supported on the APN.
–The GGSN enables accounting by default for non-transparent APNs.
You can disable accounting services at the APN by using the aaa-accounting disable command.
–You can enable authentication at the APN level by configuring the access-mode non-transparent command. When you enable authentication, the GGSN automatically enables accounting on the APN. There is no a global configuration command for enabling or disabling authentication.
•Configure AAA accounting and authentication using the aaa accounting and aaa authentication global configuration commands.
Note For more information about AAA and RADIUS global configuration commands, see the Cisco IOS Security Command Reference.
Configuring AAA Security Globally
Authentication, authorization, and accounting (AAA) network security services provide the primary framework through which you set up access control on your GGSN. This section provides information about the basic commands used to implement AAA security on a Cisco router.
To enable AAA and configure authentication and authorization, use the following commands, beginning in global configuration mode:
For more information about configuring AAA, refer to the Cisco IOS Security Configuration Guide and Cisco IOS Security Command Reference publications.
Configuring RADIUS Server Communication Globally
This section describes how to configure a global RADIUS server host that the GGSN can use to authenticate and authorize users. You can configure additional RADIUS server communication at the GGSN global configuration level.
To globally configure RADIUS server communication on the router, use the following commands, beginning in global configuration mode:
For more information about configuring RADIUS security, refer to the Cisco IOS Security Configuration Guide and Cisco IOS Security Command Reference publications. For an example, see the "RADIUS Server Global Configuration Example" section.
Note Although you can configure the radius-server host command multiple times, the Cisco IOS software supports only one RADIUS server at the same IP address.
Configuring RADIUS Server Communication at the GGSN Configuration Level
To complete the security configuration for the GGSN, you must configure non-transparent access for each access point. When you configure security at the GGSN global configuration level, you can also configure RADIUS server communication for all access points or for a specific access point.
Configuring RADIUS at the GGSN global configuration level includes the following tasks:
•Configuring Non-Transparent Access Mode (Required)
•Specifying an AAA Server Group for All Access Points (Optional)
•Specifying an AAA Server Group for a Particular Access Point (Optional)
•Configuring AAA Accounting Services at an Access Point (Optional)
Configuring Non-Transparent Access Mode
To support RADIUS authentication on the GGSN, you must configure the GGSN access points for non-transparent access. You must configure non-transparent access for every access point at which you want to support RADIUS services. There is no way to globally specify the access mode.
Note For GTP-PPP termination and GTP-PPP regeneration on the GGSN, transparent access mode is used to allow PPP to perform the appropriate AAA functions; however, you can still configure AAA server groups to specify the corresponding server groups for AAA support.
To configure non-transparent access for a GGSN access point, use the following commands, beginning in global configuration mode:
For more information about configuring GGSN access points, see the "Configuring Access Points on the GGSN" section.
Specifying an AAA Server Group for All Access Points
After you have configured RADIUS server communication at the global level, you can configure a default AAA server group to be used by all GGSN access points.
To specify a default AAA server group for all GGSN access points, use the following command in global configuration mode:
Specifying an AAA Server Group for a Particular Access Point
To override the default AAA server group configured for all access points, you can specify a different AAA server group for a particular access point. Or, if you choose not to configure a default AAA server group, you can specify an AAA server group at each access point.
To specify an AAA server group for a particular access point, use the following command in access-point configuration mode:
Configuring AAA Accounting Services at an Access Point
The Cisco GGSN has different defaults for enabling and disabling accounting services for transparent and non-transparent access points:
•If you configure an APN for non-transparent access using the access-mode command, the GGSN automatically enables accounting with authentication at the APN.
•If you configure an APN for transparent access, which is the default access mode, the GGSN automatically disables accounting at the APN.
Therefore, if you have configured a transparent access APN and you want to provide accounting at that APN, you need to configure the aaa-accounting enable command at the APN.
However, for accounting to occur, you also must complete the configuration by specifying the following other configuration elements on the GGSN:
•Enable AAA services by using the aaa new-model global configuration command.
•Define a server group with the IP addresses of the RADIUS servers in that group by using the aaa group server global configuration command.
•Configure the following AAA services:
–AAA authentication using the aaa authentication global configuration command
–AAA authorization using the aaa authorization global configuration command
–AAA accounting using the aaa accounting global configuration command
•Assign the type of services that the AAA server group should provide. If you want the server group to only support accounting services, then you need to configure the server for accounting only. You can assign the AAA services to the AAA server groups either at the GGSN global configuration level by using the gprs default aaa-group command, or at the APN by using the aaa-group command.
•Configure the RADIUS servers by using the radius-server host command.
Note For more information about AAA and RADIUS global configuration commands, see the Cisco IOS Security Command Reference.
To selectively disable accounting at specific APNs where you do not want that service, use the aaa-accounting disable access-point configuration command.
There is not a no form of this command.
Enabling and Disabling Accounting Services on an Access Point
The Cisco Systems GGSN has different defaults for enabling and disabling accounting services for transparent and non-transparent access points:
•If you configure an APN for non-transparent access using the access-mode command, the GGSN automatically enables accounting with authentication at the APN.
•If you configure an APN for transparent access, which is the default access mode, the GGSN automatically disables accounting at the APN.
To selectively disable accounting at specific APNs where you do not want that service, use the aaa-accounting disable access-point configuration command.
Configuring Interim Accounting on an Access Point
Using the aaa-accounting access-point configuration command with an interim keyword option specified, you can configure the GGSN to send Interim-Update Accounting requests to the AAA server.
Note Interim accounting support requires that accounting services be enabled for the APN and that the aaa accounting update newinfo global configuration command be configured.
To configure accounting services at an access point, use the following command in access-point configuration mode:
Configuring Additional RADIUS Services
This section describes how to configure RADIUS security services that the GGSN can use to authenticate and authorize users.
This section includes the following tasks:
•Configuring RADIUS Attributes in Access Requests to the RADIUS Server
•Configuring the Vendor-Specific Attribute in Access Requests to the RADIUS Server
•Suppressing Attributes for RADIUS Authentication
•Obtaining DNS and NetBIOS Address Information from a RADIUS Server
•Configuring the RADIUS Packet of Disconnect
•Configuring the GGSN to Wait for a RADIUS Response
•Configuring Access to a RADIUS Server Using VRF
Configuring RADIUS Attributes in Access Requests to the RADIUS Server
You configure the how the GGSN sends RADIUS attributes in access requests to the RADIUS server. This section includes the following tasks:
•Configuring the CHAP Challenge
•Configuring the NAS-Identifier
•Configuring the Charging ID in the Acct-Session-ID Attribute
•Configuring the MSISDN in the User-Name Attribute
Configuring the CHAP Challenge
To specify that the Challenge Handshake Authentication Protocol (CHAP) challenge always be included in the Challenge Attribute field (and not in the Authenticator field) in access requests to the RADIUS server, use the following command in global configuration mode:
|
|
---|---|
Router(config)# gprs radius attribute chap-challenge |
Specifies that the CHAP challenge is always included in the challenge attribute in a RADIUS request. |
Note When the gprs radius attribute chap-challenge command is configured, the CHAP challenge is always sent in the Challenge Attribute field of an access request to the RADIUS server and not in the Authenticator field. When the command is not configured, the CHAP challenge is sent in the Authenticator field unless the challenge exceeds 16 bytes, in which case, it is sent in the Challenge Attribute field of the Access Request.
Configuring the MSISDN IE
To specify that the first byte of the mobile station ISDN (MSISDN) information element (IE) is included in access requests to the RADIUS server, use the following command in global configuration mode:
|
|
---|---|
Router(config)# gprs radius msisdn first-byte |
Specifies that the first byte of the MSISDN IE is included in access requests. |
Configuring the NAS-Identifier
You can configure the GGSN to send the network access server (NAS)-Identifier (RADIUS attribute 32) in access requests to a RADIUS server at a global or APN level. The APN-level configuration overrides the global-level configuration.
To specify that the NAS-Identifier be included in all access requests, use the following command in global configuration mode:
To disable this global configuration, use the no form of this command while in global configuration mode.
To specify that the NAS-Identifier be included in all access requests at an APN, use the following command in access point configuration mode:
To disable this APN configuration, use the no form of this command while in access point configuration mode.
Configuring the Charging ID in the Acct-Session-ID Attribute
To specify that the GGSN include the charging ID in the Acct-Session-ID (attribute 44) in accounting requests at an APN, use the following command in access-point configuration mode:
|
|
---|---|
Router(config)# radius attribute acct-session-id charging-id |
Specifies that the charging ID in the Acct-Session-ID (attribute 44) is included in accounting requests. |
To disable this APN configuration, use the no form of this command while in access point configuration mode.
Configuring the MSISDN in the User-Name Attribute
To specify that the GGSN include the MSISDN in the User-Name attribute (attribute 1) in access requests at an APN, use the following command in access-point configuration mode:
|
|
---|---|
Router(config)# radius attribute user-name msisdn |
Specifies that the MSISDN is included in the User-Name (attribute 1) field in access requests. |
To disable this APN configuration, use the no form of this command while in access point configuration mode.
Configuring the Vendor-Specific Attribute in Access Requests to the RADIUS Server
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating vendor-specific information to the RADIUS server by using the vendor-specific attribute (attribute 26). Vendor-specific attributes (VSAs) make a larger set of information available for communication by allowing vendors to support their own extended attributes not suitable for general use.
Table 11-1 lists and describes the Third Generation Partnership Project (3GPP) VSA sub-attributes that the GGSN can send in authentication and accounting requests to a RADIUS server when the attribute 26 is configured.
To configure the GGSN to send and recognize VSAs as defined by RADIUS attribute 26, use the following command in global configuration mode:
|
|
---|---|
Router(config)#radius-server vsa send [accounting | authentication] |
(Optional) Enables the GGSN to send and recognized VSAs as defined by RADIUS IETF attribute 26. |
For more information on configuring the use of vendor-specific attributes, refer to the Cisco IOS Security Configuration Guide and Cisco IOS Security Command Reference publications.
Suppressing Attributes for RADIUS Authentication
You can configure the GGSN to suppress certain attributes in its access requests to a RADIUS server. The following sections describe the attributes you can suppress and how to do so.
The following topics are included in this section:
•Suppressing the MSISDN Number for RADIUS Authentication
•Suppressing the 3GPP-IMSI VSA Sub-Attribute for RADIUS Authentication
•Suppressing the 3GPP-GPRS-QoS Profile VSA Sub-Attribute for RADIUS Authentication
•Suppressing the 3GPP-GPRS-SGSN-Address VSA Sub-Attribute for RADIUS Authentication
Suppressing the MSISDN Number for RADIUS Authentication
Some countries have privacy laws that prohibit service providers from identifying the MSISDN number of mobile stations in authentication requests. Use the msisdn suppression command to specify a value that the GGSN sends instead of the MSISDN number in its authentication requests to a RADIUS server. If no value is configured, then no number is sent to the RADIUS server.
To use the msisdn suppression command, you must configure a RADIUS server either globally or at the access point and specify non-transparent access mode.
To specify that the GGSN override or suppress the MSISDN number in its access-requests sent to the RADIUS server, use the following command in access-point configuration mode:
|
|
---|---|
Router(config-access-point)# msisdn suppression [value] |
(Optional) Specifies that the GGSN overrides the MSISDN number with a preconfigured value in its access requests. |
To disable this APN configuration, use the no form of this command while in access point configuration mode.
Suppressing the 3GPP-IMSI VSA Sub-Attribute for RADIUS Authentication
To configure the GGSN to suppress the Third Generation Partnership Project (3GPP) vendor-specific attribute (VSA) 3GPP-International Mobile Subscriber Identity (3GPP-IMSI) number in its authentication and accounting requests to a RADIUS server, use the radius attribute suppress imsi access point configuration command.
To configure the GGSN to suppress the 3GPP VSA 3GPP-IMSI number in its authentication and accounting requests to a RADIUS server, use the following command in access-point configuration mode:
To disable this APN configuration, use the no form of this command while in access point configuration mode.
Suppressing the 3GPP-GPRS-QoS Profile VSA Sub-Attribute for RADIUS Authentication
To configure the GGSN to suppress the 3GPP-GPRS-Qos Profile in its authentication and accounting requests to a RADIUS server, use the radius attribute suppress qos access point configuration command.
To configure the GGSN to suppress the 3GPP-GPRS-Qos Profile in its authentication and accounting requests to a RADIUS server, use the following command in access-point configuration mode:
Suppressing the 3GPP-GPRS-SGSN-Address VSA Sub-Attribute for RADIUS Authentication
To configure the GGSN to suppress the 3GPP-GPRS-SGSN-Address in its authentication and accounting requests to a RADIUS server, use the radius attribute suppress sgsn-address access point configuration command.
To specify that the GGSN suppress the 3GPP-GPRS-SGSN-Address in its authentication and accounting requests to a RADIUS server, use the following command in access-point configuration mode:
|
|
---|---|
Router(config-access-point)# radius attribute suppress sgsn-address |
(Optional) Specifies that the GGSN suppresses the 3GPP-GPRS-SGSN-Address in its requests. |
Obtaining DNS and NetBIOS Address Information from a RADIUS Server
To obtain Domain Name System (DNS) address and Network Basic Input/Output System (NetBIOS) address information from a RADIUS server, configure the GGSN to send and recognize VSAs as defined by RADIUS attribute 26 using the following command in global configuration mode:
|
|
---|---|
Router(config)# radius-server vsa send [accounting | authentication]
|
(Optional) Enables the GGSN to send and recognize VSAs as defined by RADIUS IETF attribute 26. |
Note For the DNS and NetBIOS address information to be sent to an MS, the dynamic address allocation method using an IP address pool supplied by a RADIUS server must be configured for the access point by using the ip-address-pool radius-client command. For more information about configuring an access point, see the "Configuring Access Points on the GGSN" section.
Configuring the RADIUS Packet of Disconnect
The RADIUS Packet of Disconnect (PoD) feature is a method for terminating a user session after the session has been established. The PoD is a RADIUS Disconnect-Req packet and is intended to be used in situations when an authenticating agent server wants to disconnect a user after a session has been accepted by the RADIUS access-accept packet. For example, in the case of pre-paid billing, a typical use of this feature would be for the pre-paid billing server to send a PoD when the quota expires for a pre-paid user.
Upon receiving a PoD, the GGSN performs the following actions:
•Identifies the PDP context for which the PoD was generated by the attribute information present in the PoD. The VSA sub-attributes 3GPP-IMSI and 3GPP-NSAPI uniquely identify a PDP context, and the presence of these sub-attributes in a POD also identifies that the POD is for a GPRS user session.
•Sends a Delete PDP Context request to the SGSN.
•Sends a Disconnect ACK or Disconnect NAK to the device that generated the POD. The GGSN sends a Disconnect ACK when it is able to terminate a user session and sends a Disconnect NAK when it is unable to terminate a user session. The Disconnect ACK/NAK requests are RADIUS packets that contain no attributes.
Note For the PoD feature to function properly on the GGSN, ensure that the IMSI attribute has not been suppressed using the radius attribute suppress imsi command.
To enable PoD support on the GGSN, use the following command in global configuration mode:
Configuring the GGSN to Wait for a RADIUS Response
Use the gtp response-message wait-accounting command to configure the GGSN to wait for a RADIUS accounting response from the RADIUS accounting server before sending a Create PDP Context response to the SGSN.
If the GGSN does not receive a response from the RADIUS accounting server when you have configured the gtp response-message wait-accounting command, it rejects the PDP context request.
When broadcast accounting is used (accounting requests are sent to multiple RADIUS servers), if a RADIUS server responds with an accounting response, the GGSN sends a create PDP context response and does not wait for the other RADIUS servers to respond.
The GGSN supports configuration of RADIUS response message waiting at both the global and access-point configuration levels. You can minimize your configuration by specifying the configuration that you want to support across most APNs, at the global configuration level. Then, at the access-point configuration level, you can selectively modify the behavior that you want to support at a particular APN. Therefore, at the APN configuration level, you can override the global configuration of RADIUS response message waiting.
To configure the GGSN to wait for a RADIUS accounting response as the default behavior for all APNs, use the gprs gtp response-message wait-accounting global configuration command. To disable this behavior for a particular APN, use the no gtp response-message wait-accounting access-point configuration command.
To verify whether RADIUS response message waiting is enabled or disabled at an APN, you can use the show gprs access-point command and observe the value reported in the wait_accounting output field.
To configure the GGSN to wait for a RADIUS accounting response globally, use the following command in global configuration mode:
To configure the GGSN to wait for a RADIUS accounting response for a particular access point, use the following command in access-point configuration mode:
Configuring Access to a RADIUS Server Using VRF
The Cisco IOS GGSN software supports access to a RADIUS server using VRF. This Cisco IOS software feature is called Per VRF AAA and using this feature, Internet service providers (ISPs) can partition AAA services based on VRF. This permits the GGSN to communicate directly with the customer RADIUS server associated with the customer Virtual Private Network (VPN) without having to go through a RADIUS proxy. Thus, ISPs can scale their VPN offerings more efficiently because they no longer need to proxy AAA to provide their customers the flexibility demanded.
To support this configuration, AAA must be VRF aware. ISPs must define multiple instances of the same operational parameters—such as AAA server groups, method lists, system accounting, and protocol-specific parameters—and secure the parameters to the VRF partitions.
Note VRF is not supported on the Cisco 7600 Supervisor II / MSFC2; therefore, if using the Supervisor II, you must tunnel encapsulated VRF traffic through the Supervisor via a GRE tunnel between the GGSN to RADIUS server. For more information on configuration a GRE tunnel, see "Configuring Access to a RADIUS Server With a Tunnel" section.
The Cisco 7600 Sup720 supports VRF.
If an AAA configuration, such as a method list, is uniquely defined many times, the specification of an AAA server that is based on IP addresses and port numbers might create an overlapping of private addresses between VRFs. Securing AAA method lists to a VRF can be accomplished from one or more of the following sources:
•Virtual Template—Used as a generic interface configuration.
•Service Provider AAA server—Used to associate a remote user with a specific VPN based on the domain name or Dialed Number Identification Service (DNIS). The server then provides the VPN-specific configuration for the virtual access interface, which includes the IP address and port number of the customer AAA server.
•Customer VPN AAA server—Used to authenticate the remote user and to provide user-specific configurations for the virtual access interface.
Note Global AAA accounting configurations and some AAA protocol-specific parameters cannot be logically grouped under the Virtual Template configuration.
When configuring the Per VRF feature, keep in mind the following:
•To prevent possible overlapping of private addresses between VRFs, AAA servers must be defined in a single global pool that is to be used in the server groups.
•Servers can no longer be uniquely identified by IP addresses and port numbers.
•"Private" servers (servers with private addresses within the default server group that contains all the servers) can be defined within the server group and remain hidden from other groups. The list of servers in server groups includes references to the hosts in the global configuration as well as the definitions of private servers.
Note If private server parameters are not specified, global configurations are used. If global configurations are not specified, default values are used.
•All server operational parameters can be configured per host, per server group, or globally. Per-host configurations have precedence over per-server group configurations. Per-server group configurations have precedence over global configurations.
Note For complete information on configuring access to a RADIUS server using VRF, refer to the Per VRF AAA feature module.
This section describes configuring and establishing access to a private RADIUS server using VRF. For global RADIUS services, ensure that you have configured a globally located server.
To configure access to a RADIUS server using VRF, complete the following tasks:
•Enabling AAA Globally (Required)
•Configuring a VRF-Aware Private RADIUS Server Group (Required)
•Configuring Authentication, Authorization, and Accounting Using Named Method Lists (Required)
•Configuring a VRF Routing Table (Required)
•Configuring VRF on an Interface (Required)
•Configuring VRF Under an Access Point for Access to the Private RADIUS Server (Required)
•Configuring a Route to the RADIUS Server Using VRF (Optional)
Enabling AAA Globally
If AAA has not been enabled globally on the GGSN, you will need to enable it before configuring access to a private RADIUS server via VRF.
To enable AAA globally, use the following command in global configuration mode:
|
|
|
---|---|---|
Step 1 |
Router(config)# aaa new-model |
Enables AAA globally. |
Configuring a VRF-Aware Private RADIUS Server Group
To configure private server operational parameters, use the following commands, beginning in global configuration mode:
Configuring Authentication, Authorization, and Accounting Using Named Method Lists
To configure AAA using named method lists, perform the following tasks, beginning in global configuration mode:
Configuring a VRF Routing Table
To configure a VRF routing table on the GGSN for access to the private RADIUS server, use the following commands, beginning in global configuration mode:
Configuring VRF on an Interface
To access the private RADIUS server, VRF must be configured on the interface to the server.
On the Cisco 7600 series router platform, this interface is a logical one (on which IEEE 802.1Q-encapsulation has been configured) to a Layer 3 routed VLAN configured on the supervisor engine.
For more information about required VLANs on the supervisor engine, see the "Platform Prerequisites" section.
For more information about configuring interfaces, refer to the Cisco IOS Interface Configuration Guide and the Cisco IOS Interface Command Reference.
Configuring 802.1Q-Encapsulated Subinterfaces
To configure a subinterface that supports IEEE 802.1Q encapsulation to the associated VLAN on the supervisor engine, use the following commands, beginning in global configuration mode:
Configuring VRF Under an Access Point for Access to the Private RADIUS Server
After you have completed the prerequisite configuration tasks, you can configure access to a RADIUS server with a tunnel or without a tunnel.
The following sections describe the different methods you can use to configure access a RADIUS server:
•Configuring Access to a RADIUS Server Without a Tunnel
•Configuring Access to a RADIUS Server With a Tunnel
Configuring Access to a RADIUS Server Without a Tunnel
To configure access to the RADIUS server without a tunnel, you need to configure the vrf access point configuration command.
Note To configure access to a RADIUS server in the GPRS access point list, use the following commands, beginning in global configuration mode:
|
|
|
---|---|---|
Step 1 |
Router(config)# gprs access-point-list list-name |
Specifies a name for a new access point list, or references the name of the existing access point list, and enters access-point list configuration mode. |
Step 2 |
Router(config-ap-list)# access-point access-point-index |
Specifies an index number for a new access point definition, or references an existing access point definition, and enters access point configuration mode. |
Step 3 |
Router(config-access-point)# access-point-name apn-name |
Specifies the network (or domain) name for a PDN that users can access from the GGSN at a defined access point. Note The apn-name must match the APN that has been provisioned at the MS, HLR, and DNS server. |
Step 4 |
Router(config-access-point)# aaa-group authentication server-group |
Specifies a default AAA server group and assigns the type of AAA services to be supported by the server group for a particular access point on the GGSN, where: •authentication—Assigns the selected server group for authentication services on the APN. •server-group—Specifies the name of a AAA server group to be used for AAA services on the APN. Note The name of the AAA server group that you specify must correspond to a server group that you configure using the aaa group server command. |
Step 5 |
Router(config-access-point)# access-mode non-transparent |
Specifies for the GGSN to act as a proxy for authentication. |
Step 6 |
Router(config-access-point)# ip-address-pool radius-client |
Specifies for the RADIUS server to provide the IP address pool for the current access point. Note If you are using a dynamic address allocation method, then you must configure this command according to the appropriate IP address pool source. |
Step 7 |
Router(config-access-point)# vrf vrf-name |
Configures VPN routing and forwarding at a GGSN access point, and associates the access point with a particular VRF instance. Note The vrf-name argument should match the name of the VRF that you configured using the ip vrf command in the "Configuring Authentication, Authorization, and Accounting Using Named Method Lists" section. |
Step 8 |
Router(config-access-point)# exit |
Exits access point configuration mode. |
Configuring Access to a RADIUS Server With a Tunnel
If you have only a single interface to a RADIUS server from which you need to access one or more private RADIUS servers, you can configure an IP tunnel to access those private servers.
To configure access to the RADIUS server using a tunnel, perform the following tasks:
•Configuring the Private RADIUS Server Access Point (Required)
•Configuring the IP Tunnel (Required)
Configuring the Private RADIUS Server Access Point
To configure access to a private RADIUS server in the GPRS access point list, use the following commands, beginning in global configuration mode:
Configuring the IP Tunnel
When you configure a tunnel, you might consider using loopback interfaces as the tunnel endpoints instead of real interfaces because loopback interfaces are always up.
To configure an IP tunnel to a private network, use the following commands, beginning in global configuration mode:
Configuring a Route to the RADIUS Server Using VRF
Be sure a route exists between the VRF instance and the RADIUS server. You can verify connectivity by using the ping command from the VRF to the RADIUS server. To configure a route, you can use a static route or a routing protocol.
Configuring a Static Route Using VRF
To configure a static route using VRF, use the following command, beginning in global configuration mode:
Verifying a Static Route Using VRF
To verify the static VRF route that you configured, use the show ip route vrf privileged EXEC command as shown in the following example:
GGSN# show ip route vrf vpn1 static
172.16.0.0/16 is subnetted, 1 subnets
C 172.16.0.1 is directly connected, Ethernet5/1
C 10.100.0.3/8 is directly connected, Virtual-Access5
Configuring an OSPF Route Using VRF
To configure an OSPF route using VRF, use the following command, beginning in global configuration mode:
Securing the GGSN Mobile (Gn) Interface
The following features provide additional security for the GGSN mobile interface against attacks that can lead to illegal access to a network or even network downtime: address verification and mobile-to-mobile traffic redirection. The following tasks are necessary for configuring these features:
•Configuring Address Verification
•Configuring Mobile-to-Mobile Traffic Redirection
Configuring Address Verification
Use the security verify source (IPv4 address verification) and ipv6 security verify source (IPv6 address verification) access point configuration command to configure the GGSN to verify the source IP address of an upstream TPDU against the address previously assigned to an MS.
When the security verify source or ipv6 security verify source commands are configured on an APN, the GGSN verifies the source address of a TPDU before GTP will accept and forward it. If the GGSN determines that the address differs from that previously assigned to the MS, it drops the TPDU and regards it as an illegal packet in its PDP context and APN. Configuring the security verify source and ipv6 security verify source access point configuration commands protects the GGSN from faked user identities.
Use the security verify destination access point configuration command (IPv4 address verification only) to have the GGSN verify the destination addresses of upstream TPDUs against global lists of PLMN addresses specified using the gprs plmn ip address command. If the GGSN determines that a destination address of a TPDU is within the range of a list of addresses, it drops the TPDU. If it determines that the TPDU contains a destination address that does not fall within the range of a list, it forwards the TPDU to its final destination.
Note The security verify destination command is not applied to APNs using VRF or IPv6 address verification. In addition, the verification of destination addresses does not apply to GTP-PPP regeneration or GTP-PPP with L2TP.
To configure IPv4 address verification on an access point, use the following command in access-point configuration mode:
|
|
---|---|
Router(config-access-point)# security verify {source | destination} |
(Optional) Specifies that the GGSN verify the source or destination address in TPDUs received from a Gn interface. |
Note Both the verification of IPv4 destination addresses and source addresses can be configured on an APN.
To configure IPv6 source address verification on an access point, use the following command in access-point configuration mode:
Configuring Mobile-to-Mobile Traffic Redirection
Mobile-to-mobile traffic enters and exits through a Gn interface. Therefore, it is switched by the GGSN without ever going through a Gi interface on the network side. Because of this, firewalls deployed on the network side of a GGSN do not have an opportunity to verify this level of traffic.
Use the redirect intermobile ip access-point command to redirect mobile-to-mobile traffic to an external device (such as an external firewall) for verification.
Note On the Cisco 7600 series internet router platform, the mobile-to-mobile redirection feature requires that policy based routing (PBR) is configured on the supervisor engine and incoming VLAN interface from the Cisco SAMI, and that the next hop to route the packets that match the criteria is set using the set ip next-hop command.
Note Redirection of intermobile traffic does not occur on an ingress APN unless the TPDUs are exiting the same APN. In addition, redirection of TPDUs tunneled by L2TP from the ingress APN to the LNS of the PDN does not occur.
Redirecting All Traffic
The redirect all traffic feature enables you to do the following:
•Redirect all packets to a specified destination regardless of whether the destination address belongs to a mobile station (MS) on the same GGSN or not. If redirecting traffic using the Mobile-to-Mobile Redirect feature, only packets for which the destination address belongs to an MS that is active on the same GGSN can be redirected. If the receiving MS has no PDP context in the GGSN where the sending MS PDP context is created, the packets are dropped.
•Redirect all traffic to a specific destination when aggregate routes are configured.
To redirect all traffic to a specific IP address, issue the following command while in access-point configuration mode:
Configuring Simultaneous Broadcast and Wait Accounting
With Cisco GGSN Release 8.0 and later, broadcast and wait accounting can be configured to work together. The wait accounting feature is configured at the APN level, while broadcast accounting is specified at the AAA method level.
Broadcast accounting sends start, stop and interim accounting records to all the server groups configured in a method list. Within a server group, the accounting records are sent to the first active server. If the active server cannot be reached, then the accounting records are sent to the next server within a group.
Additionally, one or more server groups within a method list can be configured as "mandatory," meaning that a server from that server group has to respond to the Accounting Start message. The APN-level wait accounting ensures that an accounting response has been received from all mandatory server groups before the PDP context is established.
The advantages of broadcasat and wait accounting together include:
•Accounting records are sent to multiple servers and once the entry is made, the user can start using different services.
•Records are sent to multiple AAA servers serve for redundancy purposes.
•A PDP context is established only when a valid Accounting Start record has been received by all essential servers, avoiding information loss.
•Broadcast records can be sent to as many as 10 server groups within a method-list.
When configuring broadcast and wait accounting together, note the following:
•Under the method list configuration, the mandatory keyword is available only if broadcast accounting is configured.
•If wait accounting is not required, broadcast accounting to all server groups is available without any mandatory groups defined.
•If you do not specify any mandatory server groups when configuring broadcast accounting, wait accounting will function as it does in Cisco GGSN Release 7.0 and prior releases.
•Wait accounting does not apply to PPP PDP contexts.
•A PDP is successfully created only when a Accounting response is received from all the mandatory servers.
•The periodic timer starts when an Accounting Response (PDP creation) is received.
Note More than one server-group can be defined as a mandatory server-group in a method list.
To configure broadcast and wait accounting on the GGSN, complete the following tasks, beginning in global configuration mode:
Periodic Accounting Timer
The Cisco IOS software supports a global AAA configuration command that enables the sending of periodic accounting records for AAA sessions. However, the GGSN does not use this configuration to send periodic accounting records for PDP contexts.
With Cisco GGSN Release 8.0 and later, the periodic accounting timer interval value is obtained using one of the following:
•Configured periodic timer at an APN level
•Configured periodic timer at the GGSN global configuration level
•An accounting-interim interval attribute in access-accept messages
When these configurations exist, "interim" type accounting records are sent at the configured interval for the applicable PDP contexts. The following precedence applies:
•The APN-level configuration
•GGSN global configuration
•Attribute 85 (in access-accept messages)
Note If the value is obtained through Attribute 85 in an access-accept message, the GGSN verifies that the minimum and maximum values are within range configured on the GGSN, and if not, the attribute is ignored. Additionally, if accounting is not enabled on the APN, Attribute 85 is ignored.
When the GGSN sends an interim update accounting (IAU) record, the periodic timer is reset so that next periodic accounting record will be sent after the periodic interval expires, starting from the instance when the IAU record is sent.
This limits the RADIUS accounting traffic as both types of records contain the same information. However, after a failover, the records sent out will be aligned with the original START record.
When configuring periodic accounting timers on the GGSN, note the following:
•Timers are supported for PPP-Regen, IPv4, and IPv6 PDP's. Timers do not apply to PPP PDPs.
•The send/receive byte counts for a PDP is reset to 0 upon failover.
•Redundant systems should have their clocks synchronised with a mechanism such as NTP to ensure that their timer intervals to be accurate
•Periodic accounting on a redundant configuration maintains intervals across switchovers.
•A timer is initiated only on successful PDP creation, for example, in the case of wait accounting after a successful accounting response has been received.
Configuring a Default GGSN Periodic Accounting Timer
To enable a default periodic accounting value, to use for all APNs, use the following command while in global configuration mode:
Configuring an APN-Level Periodic Accounting Timer
To configure the periodic accounting timer on an APN, complete the following tasks, beginning in global configuration mode:
Note AAA global configuration value (aaa accounting update periodic minutes) will be ignored always. Also, unless APN accounting is enabled, the periodic accounting will not take effect regardless of how it is configured.
Configuration Examples
This section includes the following configuration examples for security on the GGSN:
•AAA Security Configuration Example
•RADIUS Server Global Configuration Example
•RADIUS Server Group Configuration Example
•RADIUS Response Message Configuration Example
•Address Verification and Mobile-to-Mobile Traffic Redirection Example
•"Periodic Accounting Timer Example" section
AAA Security Configuration Example
The following example shows how to enable AAA security globally on the router and how to specify global RADIUS authentication and authorization:
! Enables AAA globally
aaa new-model
!
! Creates a local authentication list for use on
! serial interfaces running PPP using RADIUS
!
aaa authentication ppp abc group abc
!
! Enables authorization and creates an authorization
! method list for all network-related service requests
! and enables authorization using a RADIUS server
!
aaa authorization network network abc group abc
For more information about configuring AAA, refer to the Cisco IOS Security Configuration Guide and Cisco IOS Security Command Reference publications.
RADIUS Server Global Configuration Example
The following example shows how to globally configure RADIUS server communication on the router:
! Specifies a global RADIUS server host at IP address 10.100.0.2
! Port 1645 is destination port for authentication requests
! Port 1646 is the destination port for accounting requests
! Specifies the key "abc" for this radius host only
!
radius-server host 10.100.0.2 auth-port 1645 acct-port 1646 key abc
!
! Sets the authentication and encryption key to mykey for all
! RADIUS communications between the router and the RADIUS daemon
!
radius-server key mykey
Note Although you can configure the radius-server host command multiple times, the Cisco IOS software supports only one RADIUS server at the same IP address.
For more information about configuring RADIUS security, refer to the Cisco IOS Security Configuration Guide and Cisco IOS Security Command Reference publications.
RADIUS Server Group Configuration Example
The following configuration example defines four AAA server groups on the GGSN: abc, abc1, abc2, and abc3, shown by the aaa group server commands.
Using the gprs default aaa-group command, two of these server groups are globally defined as default server groups: abc2 for authentication, and abc3 for accounting.
At access-point 1, which is enabled for authentication, the default global authentication server group of abc2 is overridden and the server group named abc is designated to provide authentication services on the APN. Notice that accounting services are not explicitly configured at that access point, but are automatically enabled because authentication is enabled. Because there is a globally defined accounting server-group defined, the server named abc3 will be used for accounting services.
At access-point 4, which is enabled for accounting using the aaa-accounting enable command, the default accounting server group of abc3 is overridden and the server group named abc1 is designated to provide accounting services on the APN.
Access-point 5 does not support any AAA services because it is configured for transparent access mode.
! Enables AAA globally
!
aaa new-model
!
! Defines AAA server groups
!
aaa group server radius abc
server 10.2.3.4 auth-port 1645 acct-port 1646
server 10.6.7.8 auth-port 1645 acct-port 1646
aaa group server radius abc1
server 10.10.0.1 auth-port 1645 acct-port 1646
aaa group server radius abc2
server 10.2.3.4 auth-port 1645 acct-port 1646
server 10.10.0.1 auth-port 1645 acct-port 1646
aaa group server abc3
server 10.6.7.8 auth-port 1645 acct-port 1646
server 10.10.0.1 auth-port 1645 acct-port 1646
!
! Configures AAA authentication
! and authorization
!
aaa authentication ppp abc group abc
aaa authentication ppp abc2 group abc2
aaa authorization network abc group abc
aaa accounting network abc start-stop group abc
aaa accounting network abc1 start-stop group abc1
aaa accounting network abc2 start-stop group abc2
aaa accounting network abc3 start-stop group abc3
!
gprs access-point-list gprs
access-point 1
access-mode non-transparent
access-point-name www.pdn1.com
!
! Specifies a RADIUS server group
! for use by the GGSN to authenticate
! mobile users at this access point
!
aaa-group authentication abc
!
access-point 4
access-point-name www.pdn2.com
!
! Enables AAA accounting services
!
aaa-accounting enable
!
! Specifies a RADIUS server group
! for use by the GGSN for accounting
! services at this access point
aaa-group accounting abc1
!
access-point 5
access-point-name www.pdn3.com
!
! Configures default AAA server
! groups for the GGSN for authentication
! and accounting services
!
gprs default aaa-group authentication abc2
gprs default aaa-group accounting abc3
!
! Configures global RADIUS server hosts
! and specifies destination ports for
! authentication and accounting requests
!
radius-server host 10.2.3.4 auth-port 1645 acct-port 1646 non-standard
radius-server host 10.6.7.8 auth-port 1645 acct-port 1646 non-standard
radius-server host 10.10.0.1 auth-port 1645 acct-port 1646 non-standard
radius-server key ggsntel
Note Although you can configure the radius-server host command multiple times, the Cisco IOS software supports only one RADIUS server at the same IP address.
RADIUS Response Message Configuration Example
The following example globally configures the GGSN to wait for a RADIUS accounting response from the RADIUS server before sending a Create PDP Context response to the SGSN. The GGSN waits for a response for PDP context requests received across all access points, except access-point 1. RADIUS response message waiting has been overridden at access-point 1 by using the no gtp response-message wait-accounting command:
! Enables AAA globally
!
aaa new-model
!
! Defines AAA server group
!
aaa group server radius abc
server 10.2.3.4 auth-port 1645 acct-port 1646
server 10.6.7.8 auth-port 1645 acct-port 1646
!
! Configures AAA authentication
! and authorization
!
aaa authentication ppp abc group abc
aaa authorization network abc group abc
aaa accounting network abc start-stop group abc
!
gprs access-point-list gprs
access-point 1
access-mode non-transparent
access-point-name www.pdn1.com
aaa-group authentication abc
!
! Disables waiting for RADIUS response
! message at APN 1
!
no gtp response-message wait-accounting
exit
access-point 2
access-mode non-transparent
access-point-name www.pdn2.com
aaa-group authentication abc
!
! Enables waiting for RADIUS response
! messages across all APNs (except APN 1)
!
gprs gtp response-message wait-accounting
!
! Configures global RADIUS server hosts
! and specifies destination ports for
! authentication and accounting requests
!
radius-server host 10.2.3.4 auth-port 1645 acct-port 1646 non-standard
radius-server host 10.6.7.8 auth-port 1645 acct-port 1646 non-standard
radius-server key ggsntel
Address Verification and Mobile-to-Mobile Traffic Redirection Example
The following examples show how to enable IPv4 address verification and specify that IPv4 mobile-to-mobile traffic be redirected to an external device.
GGSN Configuration
service gprs ggsn
!
hostname t7600-7-2
!
ip cef
!
ip vrf vpn4
description abc_vrf
rd 104:4
!
!
interface Loopback2
description USED FOR DHCP2 - range IN dup prot range
ip address 111.72.0.2 255.255.255.255
!
interface Loopback100
description GPRS GTP V-TEMPLATE IP ADDRESS
ip address 9.9.9.72 255.255.255.0
!
interface GigabitEthernet0/0
no ip address
!
interface GigabitEthernet0/0.2
description Ga/Gn Interface
encapsulation dot1Q 101
ip address 10.1.1.72 255.255.255.0
no cdp enable
!
interface GigabitEthernet0/0.3
encapsulation dot1Q 103
ip vrf forwarding vpn4
ip address 10.1.3.72 255.255.255.0
no cdp enable
!
interface GigabitEthernet0/0.95
description CNR and CAR
encapsulation dot1Q 95
ip address 10.2.25.72 255.255.255.0
!
interface Virtual-Template1
description GTP v-access
ip unnumbered Loopback100
encapsulation gtp
gprs access-point-list gprs
!
! In case the ms is on another SAMI GGSN
ip route vrf vpn4 0.0.0.0 0.0.0.0 10.1.3.1
!
gprs access-point-list gprs
access-point 7
access-point-name ms_redirect.com
ip-address-pool dhcp-proxy-client
aggregate auto
dhcp-server 10.2.25.90
dhcp-gateway-address 111.72.0.2
vrf vpn4
! In case the ms is on this GGSN.
redirect intermobile ip 10.1.3.1
!
Supervisor Engine Configuration
hostname 7600-a
interface FastEthernet9/15
description OUT to Firewall
no ip address
duplex half
switchport
switchport access vlan 162
!
interface FastEthernet9/16
description In from Firewall
no ip address
switchport
switchport access vlan 163
!
interface Vlan103
description Vlan to GGSN redirect to FW
ip address 10.1.3.1 255.255.255.0
ip policy route-map REDIRECT-TO-FIREWALL
!
interface Vlan162
ip address 162.1.1.1 255.255.255.0
!
interface Vlan163
ip address 163.1.1.1 255.255.255.0
!
ip route 111.72.0.0 255.255.0.0 10.1.3.72
ip route 111.73.0.0 255.255.0.0 10.1.3.73
ip route 111.74.0.0 255.255.0.0 10.1.3.74
ip route 111.75.0.0 255.255.0.0 10.1.3.75
ip route 111.76.0.0 255.255.0.0 10.1.3.76
!
access-list 102 permit ip any any
!
route-map REDIRECT-TO-FIREWALL permit 10
match ip address 102
set ip next-hop 162.1.1.11
!
Access to a Private RADIUS Server Using VRF Configuration Example
The following examples shows an example of configuring access to a private RADIUS server using VRF.
GGSN Configuration
aaa new-model
!
aaa group server radius vrf_aware_radius
server-private 99.100.0.2 auth-port 1645 acct-port 1646 key cisco
ip vrf
!
aaa authentication ppp vrf_aware_radius group vrf_aware_radius
aaa authorization network default local group radius
aaa authorization network vrf_aware_radius group vrf_aware_radius
aaa accounting network vrf_aware_radius start-stop group vrf_aware_radius
aaa session-id common
!
ip vrf vpn2
rd 101:1
!
interface Loopback1
ip address 150.1.1.72 255.255.0.0
!
interface Tunnel2
ip vrf forwarding vpn2
ip address 80.80.72.72 255.255.255.0
tunnel source 150.1.1.72
tunnel destination 167.2.1.12
!
ip local pool vpn2_pool 100.72.0.1 100.72.255.255
ip route vrf vpn2 0.0.0.0 0.0.0.0 Tunnel2
!
gprs access-point-list gprs
access-point 1
access-point-name apn.vrf2.com
access-mode non-transparent
aaa-group authentication vrf_aware_radius
aaa-group accounting vrf_aware_radius
ip-address-pool local vpn2_pool
aggregate 100.72.0.0 255.255.0.0
vrf vpn2
!
Supervisor Engine Configuration
...
!
interface FastEthernet9/5
switchport
switchport access vlan 167
!
interface Vlan167
ip address 167.1.1.1 255.255.0.0
!
ip route 150.1.1.72 255.255.255.255 10.1.1.72
ip route 167.2.0.0 255.255.0.0 167.1.1.12
!
...
Periodic Accounting Timer Example
The following example shows a period accounting timer configured at the APN level and globally.
gprs default aaa-accounting interim periodic 60 ! gprs access-point-list APLIST access-point 100 access-point-name peracct.com access-mode non-transparent aaa-accounting interim update aaa-accounting interim periodic 15 aaa-group authentication radaccess aaa-group accounting default ip-address-pool radius-client gtp response-message wait-accounting !