A global filter cache is maintained on the NAS of recently downloaded ACLs; thus, users no longer have to repeatedly request the same ACL configuration information from a potentially overloaded RADIUS server. Users are required to flush the cache when the following criteria have been met:

• After an entry becomes associated with a newly active call, the idle timer that is associated with that entry will be reset, if configured to do so.

• After the idle-time stamp of an entry expires, the entry will be removed.

• After the global cache of entries reaches a specified maximum number, the entry whose idle-timer is closest to the idle time limit will be removed.

A single timer is responsible for managing all cache entries. The timer is started after the first cache entry is created, and it runs periodically until reboot. The period of the timer will correspond to the minimum granularity offered when configuring cache idle timers, which is one expiration per minute. A single timer prevents users from having to manage individual timers per cache entry.

Note

The single timer introduces a lack of precision in timer expiration. There is an average error of approximately 50 percent of the timer granularity. Although decreasing the timer granularity will decrease the average error, the decreased timer granularity will negatively impact performance. Because precise timing is not required for cache management, the error delay should be acceptable.

This feature introduces support for three new vendor-specific attributes (VSAs), which can be divided into the following two categories:

• User profile extensions

  • Filter-Required (50)--Specifies whether the call should be permitted if the specified filter is not found. If present, this attribute will be applied after any authentication, authorization, and accounting (AAA) filter method-list.
• Pseudo-user profile extensions

  • Cache-Refresh (56)--Specifies whether cache entries should be refreshed each time an entry is referenced by a new session. This attribute corresponds to the cache refresh command.
  • Cache-Time (57)--Specifies the idle time out, in minutes, for cache entries. This attribute corresponds to the cache clear age command.

Note	All RADIUS attributes will override any command-line interface (CLI) configurations.

To enable the RADIUS ACL filter server, use the following command in global configuration mode:

Router(config)# aaa authorization cache filterserver default   methodlist[methodlist2...] 

To display the cache status, use the show aaa cache filterserver EXEC command. The following is sample output for the show aaa cache filterserver command:

Router# show aaa cache filterserver
Filter     Server          Age Expires Refresh Access-Control-Lists
--------------------------------------------------------------------------------
aol        10.2.3.4           0    1440     100 ip in icmp drop
                                               ip out icmp drop
                                               ip out forward tcp dstip 1.2.3...
msn        10.3.3.4         N/A   Never       2 ip in tcp drop
msn2       10.4.3.4         N/A   Never       2 ip in tcp drop
vone       10.5.3.4         N/A   Never       0 ip in tcp drop

Note	The show aaa cache filterserver command shows how many times a particular filter has been referenced or refreshed. This function may be used in administration to determine which filters are actually being used.

To help troubleshoot your filter cache configurations, use the privileged EXEC debug aaa cache filterserver command. To view sample output for the debug aaa cache filterserver command, refer to the section “Debug Output Example” later in this document.

To monitor and maintain filter caches, use at least one of the following EXEC commands:

Router# clear aaa cache filterserver  acl  [filter-name 

Router# show aaa cache filterserver