如何在ASR9K上為BNG使用者處理多操作CoA資料包

下載選項

PDF (492.6 KB)
在多種裝置上使用 Adobe Reader 檢視
ePub (87.5 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上的各種應用程式中檢視
Mobi (Kindle) (87.9 KB)
在 Kindle 裝置或多部裝置的 Kindle 應用程式上檢視

已更新: 2017 年 10 月 20 日

文件 ID:212353

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

簡介

本文檔介紹如何在ASR9K平台上為寬頻網路網關(BNG)處理授權更改(CoA)，以及如何在ASR9K上對其進行故障排除。

必要條件

需求

思科建議您瞭解以下主題：

ASR9K上的BNG功能
Radius屬性

提示：有關詳細資訊，請參閱寬頻網路網關配置指南。

採用元件

本文中的資訊係根據以下軟體和硬體版本：

運行533版本的ASR9001。
Free-radius伺服器。

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路正在作用，請確保您已瞭解任何指令可能造成的影響。

背景資訊

授權變更(CoA)是RADIUS標準的延伸，允許從RADIUS伺服器向RADIUS使用者端傳送非同步訊息。CoA的主要原因是允許RADIUS伺服器變更已授權使用者的授權行為。IETF RFC 3576中定義了RADIUS的CoA擴展。

多操作CoA(MA-CoA)功能擴展了當前BNG CoA功能，以支援單個CoA請求中的多個服務啟用和服務停用命令:

572x408?v=1.0

多行動協同行動(MA-CoA)的理念是，它將允許網際網路服務提供商以一種從他們的角度來看是原子的方式啟用/停用多種服務。

MA-COA使用案例

這是從非常高的功能級別對MA-CoA的一個使用示例。

PTA作業階段會產生重新導向至服務入口的Web流量（HTTP重新導向）。
通過服務門戶，客戶啟用了第一級服務。這將導致具有以下內容的多操作CoA請求:

停用重新導向
啟用Turbo按鈕1
例如，啟用具有2個通道的VoIP

通過服務門戶，客戶啟用二級服務。這會導致多操作CoA請求：

停用Turbo按鈕1
啟用Turbo按鈕2
停用具有2個通道的VoIP
啟用具有4個通道的VoIP

在MA-CoA中，如果CoA請求中的任何服務未能啟用/停用，則任何已作為該CoA請求的一部分啟用/停用的服務必須回滾。實質上，會話在啟用/停用失敗後必須恢復到MA-CoA之前的狀態。但是，某些極少數情況下可能無法完全回滾。例如，考慮在多動作CoA處理過程中放棄資源（例如記憶體、TCAM條目、IP地址等）的情況。如果隨後的CoA發生故障，這些資源可能不再可用，因此可能無法完全回滾。如果發生回滾故障，將採取以下措施：

如果在控制策略中配置了coa-rollback-failure異常，則將執行為rollback-failure類指定的操作。例如，您可以斷開會話連線。但是，MA-CoA回滾故障的預設操作是保留會話。

policy-map type control subscriber WDAAR_NOVA_POLICY
 event exception match-first
  class type control subscriber coa-rollback-failure do-all
   10 disconnect
  !
 !
 end-policy-map

如果在控制策略中未配置coa-rollback-failure異常，則控制檯上將生成系統日誌錯誤。

CoA處理的分佈如下：請求可在RP（用於基於捆綁的會話）或LC（用於基於LC的會話）上處理。

圖1.顯示高級別的CoA消息流。

large?v=1.0&px=800

圖1:BNG路由器上的CoA架構

MA-CoA呼叫流

以下舉例說明在非常高的級別處理MA-CoA請求所涉及的呼叫流程：

CoA客戶端使用以下命令傳送MA-CoA請求：
- 停用服務服務 — 網際網路
- 啟用服務 — 音訊
- 啟用服務 — 影片
Radiusd將新定義的思科通用VSA轉換為標準AAA_AT屬性，然後傳遞到策略平面。
策略平面命令處理程式向SubDB發起服務Service-Internet的取消關聯請求和服務Service-Audio & Service-Video的關聯請求，然後向SubDB發起Produce-Done請求。
SubDB執行必要的取消關聯/關聯，並與其BPI客戶端協調以將必要的配置應用到硬體。然後SubDB將Produce Done(config applied)消息傳送到策略平面。
策略平面命令處理程式通過radius將CoA ACK傳送到CoA客戶端。
如果已為服務Service-Internet啟用服務級別記帳，則策略平面記帳協調器向RADIUS伺服器發出記帳停止請求。同樣，如果為服務Service-Audio或Service-Video啟用服務級別記帳，則策略平面記帳協調器會為這些服務向RADIUS伺服器發出記帳啟動請求。

large?v=1.0&px=800

設定

使用本節所述的資訊來設定本檔案中所述的功能。

網路圖表

以下拓撲用於測試MA-CoA。

433x323?v=1.0

注意：在此拓撲中，Radius伺服器和策略伺服器/CoA客戶端是同一個框。此安裝程式在拓撲中使用自由Radius，並使用radclient傳送CoA資料包來模擬MA-CoA場景。

組態

ASR9K

interface Bundle-Ether1.200
 ipv4 point-to-point
 ipv4 unnumbered Loopback200
 service-policy type control subscriber WDAAR_NOVA_POLICY
 encapsulation dot1q 200
 ipsubscriber ipv4 l2-connected
  initiator dhcp
  initiator unclassified-source

以下控制策略用於啟動IPoE會話。

policy-map type control subscriber WDAAR_NOVA_POLICY
 event session-start match-first
  class type control subscriber DHCP do-until-failure
   10 activate dynamic-template DT_NOVA_DHCP
   20 authorize aaa list WDAAR format WDAAR_USERNAME_NOVA password cisco
  !
  class type control subscriber WDAAR_STATIC do-until-failure
   10 activate dynamic-template DT_NOVA_STATIC
   20 authorize aaa list WDAAR format WDAAR_IP_STATIC password cisco
  !
 !
 event authentication-no-response match-first
  class type control subscriber class-default do-all
   10 activate dynamic-template WDAAR_NOVA_ACCT_START
   20 activate dynamic-template WDAAR_NOVA_NET50
  !
 !
 end-policy-map
!

dynamic-template
 type ipsubscriber DT_NOVA_DHCP
  ipv4 unnumbered Loopback201
 !
!
interface Loopback201
 ipv4 address 199.195.148.1 255.255.255.0
!

dynamic-template
 type ipsubscriber WDAAR_NOVA_ACCT_START
  accounting aaa list WDAAR type session periodic-interval 5
 !
!
dynamic-template
 type service WDAAR_NOVA_NET50
  service-policy input WDAAR_10Mbps
  service-policy output WDAAR_Upload
 !
!

注意：為了模擬IPoE使用者，IXIA客戶端用於模擬DHCP客戶端。

為了模擬MA-CoA行為，配置了兩個QoS策略，以限制入站和出站方向的流量。

WDAAR_DAY_PACKAGE
WDAAR_NIGHT_PACKAGE

dynamic-template
 type service WDAAR_DAY_PACKAGE
  service-policy input WDAAR_Internet_Service_10Mbps_IN
  service-policy output WDAAR_Internet_Service_10Mbps_OUT
  accounting aaa list WDAAR type service periodic-interval 10
 !
!
dynamic-template
 type service WDAAR_NIGHT_PACKAGE
  service-policy input WDAAR_Internet_Service_5Mbps_IN
  service-policy output WDAAR_Internet_Service_5Mbps_OUT
  accounting aaa list WDAAR type service periodic-interval 10
 !
!

對於DAY包和NIGHT包，策略配置為在入站和輸出方向將流量管制到10Mpb，限製為5Mpb。

policy-map WDAAR_Internet_Service_5Mbps_IN
 class class-default
  police rate 5486 kbps
  !
!
policy-map WDAAR_Internet_Service_5Mbps_OUT
 class class-default
  police rate 5486 kbps
  !
 !

policy-map WDAAR_Internet_Service_10Mbps_IN
 class class-default
  police rate 10486 kbps
  !
 !
policy-map WDAAR_Internet_Service_10Mbps_OUT
 class class-default
  police rate 10486 kbps
  !
 !

驗證

本節提供的資訊可用於驗證MA-CoA是否正常工作。

ASR9K上的IPoE使用者會話。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail
Mon Jul 27 11:24:46.467 UTC
Interface:                Bundle-Ether1.200.ip18010
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 11:23:10 2015
IPv4 Address:             172.188.243.147, VRF: default
Mac Address:              0000.6602.0102
Account-Session Id:       00004729
Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label:         0x00000048
Created:                  Mon Jul 27 11:23:08 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Access-interface:         Bundle-Ether1.200
Policy Executed:
policy-map type control subscriber WDAAR_NOVA_POLICY
  event Session-Start match-first [at Mon Jul 27 11:23:08 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [Succeeded]
      20 authorize aaa list WDAAR [Succeeded]
Session Accounting:
  Acct-Session-Id:          00004729
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Never
    Next update in:         00:00:24 (dhms)
Service Accounting:         WDAAR_DAY_PACKAGE
  Acct-Session-Id:          0000472a
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 10 mins
    Last successful update: Never
    Next update in:         00:08:24 (dhms)
Last COA request received: unavailable

現在，如果您使用隱藏的關鍵字internal檢查會話的詳細資訊，您可以看到您從radius收到了什麼AVP。如果在啟動會話時在ASR9K上啟用調試，也可以看到這一點。從會話輸出中，您可以看到當訂戶聯機時，您應用了WDAAR_DAY_PACKAGE，並且還啟用了會話記賬和服務記賬。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail internal
Mon Jul 27 11:27:10.554 UTC
Interface:                Bundle-Ether1.200.ip18010
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 11:23:10 2015
IPv4 Address:             172.188.243.147, VRF: default
IPv4 Up helpers:          0x00000040 {IPSUB}
IPv4 Up requestors:       0x00000040 {IPSUB}
Mac Address:              0000.6602.0102
Account-Session Id: 00004729 Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label: 0x00000048
Created:                  Mon Jul 27 11:23:08 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Ifhandle: 0x000abc20 Session History ID:       1
Access-interface:         Bundle-Ether1.200
SRG Flags:                0x00000000
Policy Executed:

  event Session-Start match-first [at Mon Jul 27 11:23:08 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [cerr: No error][aaa: Success]
      20 authorize aaa list WDAAR [cerr: No error][aaa: Success]
Session Accounting:
  Acct-Session-Id:          00004729
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Mon Jul 27 11:25:10 2015
    Next update in:         00:02:00 (dhms)
    Last update sent:       Mon Jul 27 11:25:10 2015
    Updates sent:           1
    Updates accepted:       1
    Updates rejected:       0
    Update send failures:   0
Service Accounting:         WDAAR_DAY_PACKAGE
  Acct-Session-Id:          0000472a
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 11:23:10 2015
  Interim accounting:       On, interval 10 mins
    Last successful update: Never
    Next update in:         00:06:00 (dhms)
    Last update sent:       Never
    Updates sent:           0
    Updates accepted:       0
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Last COA request received: unavailable
User Profile received from AAA:
 Attribute List: 0x50105e7c
1: acct-interval len= 4 value= 120(78) 2: accounting-list len= 5 value= WDAAR Pending Callbacks: InterimAcct>StatsD,
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
  Name        : WDAAR_DAY_PACKAGE
  Service-ID  : 0x400001a
  Type        : Multi Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 11:23:08.672 IPv4 Start
   Jul 27 11:23:10.080 SUBDB produce done
   Jul 27 11:23:10.080 IPv4 Up

如果要檢視使用者會話的CoA和radius資料包，可以啟用這些調試。

debug radius
debug radius dynamic-author

注意：您可以啟用debug radius filter mac-address，以僅過濾特定的mac-address radius流量。

RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Send Access-Request to 10.48.88.121:56777 id 229, len 218
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: authenticator D0 EF B5 50 DD 9A 1A 84 - FB 36 5C FB 5C DB 96 FE
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 41
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Cisco AVpair [1] 35 client-mac-address=0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Acct-Session-Id [44] 10 00004729
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: NAS-Port-Id [87] 11 0/0/1/200
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 17
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: cisco-nas-port [2] 11 0/0/1/200
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: User-Name [1] 16 0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Service-Type [6] 6 Outbound[0]
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: User-Password [2] 18 *
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: NAS-Port-Type [61] 6 VIRTUAL_IPOEOVLAN[0]
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Event-Timestamp [55] 6 1437996188
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 23
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Cisco AVpair [1] 17 dhcp-client-id=
RP/0/RSP0/CPU0:Jul 27 11:23:08.706 : radiusd[1133]: RADIUS: Nas-Identifier [32] 16 acdc-asr9000-4
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: RADIUS: NAS-IP-Address [4] 6 10.48.88.54
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: RADIUS: NAS-IPv6-Address [95] 22 1a 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: RADIUS: 00 00 00 00
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Got global deadtime 0
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Using global deadtime = 0 sec
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Start timer thread rad_ident 229 remote_port 56777 remote_addr 10.48.88.121, socket 1342510940 rctx 0x50258020
RP/0/RSP0/CPU0:Jul 27 11:23:08.707 : radiusd[1133]: Successfully sent packet and started timeout handler for rctx 0x50258020
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: Radius packet decryption complete with rc = 0
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Received from id 229 10.48.88.121:56777, Access-Accept, len 105
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: authenticator 9D 27 8C A5 28 C8 AE 2B - 58 56 08 DF C2 BA 06 28
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Acct-Interim-Interval[85] 6 120
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 40
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Cisco AVpair [1] 34 subscriber:accounting-list=WDAAR
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Vendor,Cisco [26] 39
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: RADIUS: Cisco AVpair [1] 33 subscriber:sa=WDAAR_DAY_PACKAGE
RP/0/RSP0/CPU0:Jul 27 11:23:08.710 : radiusd[1133]: Freeing server group transaction_id (3D000000)

來自不同元件的訂戶標識和憑證AAA屬性儲存在SADB(訂戶屬性資料庫)中。SADB不儲存使用者配置。您可以使用以下show命令檢視該會話的所有屬性。

show subscriber manager sadb

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager sadb
Mon Jul 27 12:13:36.273 UTC
Sublabel: 0x00000048 Node_ID: 00000001 Signature: 0xabcdef12 Version: 1 Rev: 21
Length: 297
Attribute list: 1343184692
1:  protocol-type   len=  4  dhcp
2:  dhcp-client-id  len= 15
3:  port-type       len=  4  Virtual IP over VLAN
4:  outer-vlan-id   len=  4  200(c8)
5:  client-mac-address len= 14  0000.6602.0102
6:  parent-if-handle len=  4  1568(620)
7:  string-session-id len=  8  00004729
8:  interface       len=  9  0/0/1/200
9:  formatted-username len= 14  0000.6602.0102
10:  username        len= 14  0000.6602.0102
11:  author_status   len=  1  true
12:  addr            len=  4  172.188.243.147
13:  if-handle       len=  4  703520(abc20)
14:  vrf-id          len=  4  1610612736(60000000)
15:  ipv4-session-state len=  1  true
16:  accounting-list len=  5  WDAAR
17:  start_time      len=  4  Mon Jul 27 11:23:10 2015

還有一個名為Subscriber Database(SubDB)的資料庫儲存配置以及配置與會話的關聯。SubDB(Subscriber Database)用於管理BNG使用者的動態配置。使用者配置是一組預定義功能及其特定值。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber database association
Mon Jul 27 12:26:38.186 UTC

Location 0/RSP0/CPU0

Bundle-Ether1.200.ip18010, subscriber label 0x48
  Name                            Template Type
  --------                        -------------
  U00000048                       User profile
  WDAAR_DAY_PACKAGE Service DT_NOVA_DHCP                    IP subscriber

還可以使用過濾器subscriber-label來檢視一個訂戶的資訊。

show subscriber database association subscriber-label <SUBSCRIBER-LABEL>

MA-CoA測試

由於您已應用該服務 WDAAR_DAY_PACKAGE在會話中，作為測試，您首先要從會話中刪除WDAAR_DAY_PACKAGE服務。現在您可以看到沒有服務WDAAR_DAY_PACKAGE 會話中處於活動狀態。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail internal
Mon Jul 27 13:47:55.881 UTC
Interface:                Bundle-Ether1.200.ip18012
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 13:33:22 2015
IPv4 Address:             172.188.243.147, VRF: default
IPv4 Up helpers:          0x00000040 {IPSUB}
IPv4 Up requestors:       0x00000040 {IPSUB}
Mac Address:              0000.6602.0102
Account-Session Id:       0000472d
Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label:         0x0000004a
Created:                  Mon Jul 27 13:33:21 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Ifhandle:                 0x000abca0
Session History ID:       1
Access-interface:         Bundle-Ether1.200
SRG Flags:                0x00000000
Policy Executed:

  event Session-Start match-first [at Mon Jul 27 13:33:21 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [cerr: No error][aaa: Success]
      20 authorize aaa list WDAAR [cerr: No error][aaa: Success]
Session Accounting:
  Acct-Session-Id:          0000472d
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 13:33:22 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Mon Jul 27 13:47:24 2015
    Next update in:         00:01:27 (dhms)
    Last update sent:       Mon Jul 27 13:47:24 2015
    Updates sent:           7
    Updates accepted:       7
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Last COA request: Mon Jul 27 13:47:50 2015
COA Request  Attribute List: 0x50105f70
1: sd len= 17 value= WDAAR_DAY_PACKAGE 2: command len= 18 value= deactivate-service 3: service-info len= 17 value= WDAAR_DAY_PACKAGE 4: service-name len= 17 value= WDAAR_DAY_PACKAGE Last COA response: Result ACK
COA Response  Attribute List: 0x50106180
1:  sd              len= 17  value= WDAAR_DAY_PACKAGE
User Profile received from AAA:
 Attribute List: 0x50106390
1:  acct-interval   len=  4  value= 120(78)
2:  accounting-list len=  5  value= WDAAR
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 13:33:21.152 IPv4 Start
   Jul 27 13:33:22.560 IPv4 Up
   Jul 27 13:47:50.528 CoA request
   Jul 27 13:47:50.784 SUBDB produce done [many]

如前所述，當服務取消關聯時，ASR9K上的radiusd進程將記賬停止傳送到radius伺服器。在debug代碼中，這種行為也得到了證實。

RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS: Send Accounting-Request to 10.48.88.121:56778 id 48, len 391
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  authenticator 6C E1 D2 2B 49 1A EE E4 - 6D 36 FD FA 7A 84 26 50
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Interim-Interval[85]    6       10
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Session-Time   [46]    6       868
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Terminate-Cause[49]    6       admin-reset[0]
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Acct-Status-Type    [40]    6       Stop[0]
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Event-Timestamp     [55]    6       1438004870
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    23
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    17      dhcp-client-id=
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  NAS-Port-Type       [61]    6       VIRTUAL_IPOEOVLAN[0]
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    41
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    35      client-mac-address=0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  NAS-Port-Id         [87]    11      0/0/1/200
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    17
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   cisco-nas-port      [2]    11      0/0/1/200
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  User-Name           [1]     16      0000.6602.0102
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Framed-IP-Address   [8]     6       172.188.243.147
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    22
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    16      vrf-id=default
RP/0/RSP0/CPU0:Jul 27 13:47:50.687 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    29
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    23      accounting-list=WDAAR
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  AAA Unsupported Attr: user-maxlinks [196]    6
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    32
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    26      connect-progress=Call Up
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    34
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    28      parent-session-id=0000472d
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    38
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    32      service-name=WDAAR_DAY_PACKAGE
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Acct-Session-Id     [44]    10      0000472e
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Nas-Identifier      [32]    16      acdc-asr9000-4
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  NAS-IP-Address      [4]     6       10.48.88.54
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  NAS-IPv6-Address    [95]    22      1a 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:                                      00 00 00 00
RP/0/RSP0/CPU0:Jul 27 13:47:50.688 : radiusd[1133]:  RADIUS:  Acct-Delay-Time     [41]    6       0

此show命令還會顯示成功的CoA的統計資訊。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager statistics AAA COA
Mon Jul 27 13:53:49.627 UTC

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/RSP0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff 1 1 0 Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
Responses to COA with unknown session identifier = 3

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff            0            0            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
  None

現在，您在訂戶會話上應用了服務WDAAR_NIGHT_PACKAGE，並再次檢視統計資訊。

Last COA request: Mon Jul 27 13:57:48 2015
COA Request  Attribute List: 0x501060c8
1:  sa              len= 19  value= WDAAR_NIGHT_PACKAGE
2:  command         len= 16  value= activate-service
3:  service-info    len= 19  value= WDAAR_NIGHT_PACKAGE
4:  service-name    len= 19  value= WDAAR_NIGHT_PACKAGE
Last COA response: Result ACK
COA Response  Attribute List: 0x501062d8
1:  sa              len= 19  value= WDAAR_NIGHT_PACKAGE
User Profile received from AAA:
 Attribute List: 0x501064e8
1:  acct-interval   len=  4  value= 120(78)
2:  accounting-list len=  5  value= WDAAR
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
  Name        : WDAAR_NIGHT_PACKAGE
  Service-ID  : 0x4000019
  Type        : Multi Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 13:33:21.152 IPv4 Start
   Jul 27 13:33:22.560 IPv4 Up
   Jul 27 13:57:48.800 CoA request [many]
   Jul 27 13:57:48.928 SUBDB produce done [many]

應用服務，這樣您會看到Service Logon計數器已增加，而且在以上訂閱伺服器輸出上，您還會看到它已被應用。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager statistics AAA COA
Mon Jul 27 13:58:00.410 UTC

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/RSP0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon 1 1 0
Single Service Logoff            1            1            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
Responses to COA with unknown session identifier = 3

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff            0            0            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
  None

到目前為止，您一次只對單個CoA資料包應用一項服務，對單個CoA資料包刪除一項服務，現在，您將傳送一個CoA資料包，該資料包將刪除該服務並將該服務應用於單個CoA資料包。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber session all detail internal
Mon Jul 27 14:03:40.255 UTC
Interface:                Bundle-Ether1.200.ip18012
Circuit ID:               Unknown
Remote ID:                Unknown
Type:                     IP: DHCP-trigger
IPv4 State:               Up, Mon Jul 27 13:33:22 2015
IPv4 Address:             172.188.243.147, VRF: default
IPv4 Up helpers:          0x00000040 {IPSUB}
IPv4 Up requestors:       0x00000040 {IPSUB}
Mac Address:              0000.6602.0102
Account-Session Id:       0000472d
Nas-Port:                 Unknown
User name:                0000.6602.0102
Formatted User name:      0000.6602.0102
Client User name:         unknown
Outer VLAN ID:            200
Subscriber Label:         0x0000004a
Created:                  Mon Jul 27 13:33:21 2015
State:                    Activated
Authentication:           unauthenticated
Authorization:            authorized
Ifhandle:                 0x000abca0
Session History ID:       1
Access-interface:         Bundle-Ether1.200
SRG Flags:                0x00000000
Policy Executed:

  event Session-Start match-first [at Mon Jul 27 13:33:21 2015]
    class type control subscriber DHCP do-until-failure [Succeeded]
      10 activate dynamic-template DT_NOVA_DHCP [cerr: No error][aaa: Success]
      20 authorize aaa list WDAAR [cerr: No error][aaa: Success]
Session Accounting:
  Acct-Session-Id:          0000472d
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 13:33:22 2015
  Interim accounting:       On, interval 2 mins
    Last successful update: Mon Jul 27 14:03:24 2015
    Next update in:         00:01:43 (dhms)
    Last update sent:       Mon Jul 27 14:03:24 2015
    Updates sent:           15
    Updates accepted:       15
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Service Accounting:         WDAAR_DAY_PACKAGE
  Acct-Session-Id:          00004730
  Method-list:              WDAAR
  Accounting started:       Mon Jul 27 14:03:35 2015
  Interim accounting:       On, interval 10 mins
    Last successful update: Never
    Next update in:         00:09:56 (dhms)
    Last update sent:       Never
    Updates sent:           0
    Updates accepted:       0
    Updates rejected:       0
    Update send failures:   0
  Accouting stop state:     Final stats available
Last COA request: Mon Jul 27 14:03:35 2015
COA Request  Attribute List: 0x50106248
1: sd len= 19 value= WDAAR_NIGHT_PACKAGE 2: command len= 18 value= deactivate-service 3: service-info len= 19 value= WDAAR_NIGHT_PACKAGE 4: service-name len= 19 value= WDAAR_NIGHT_PACKAGE 5: sa len= 17 value= WDAAR_DAY_PACKAGE 6: command len= 16 value= activate-service 7: service-info len= 17 value= WDAAR_DAY_PACKAGE 8: service-name len= 17 value= WDAAR_DAY_PACKAGE Last COA response: Result ACK
COA Response  Attribute List: 0x50106458
1:  sd              len= 19  value= WDAAR_NIGHT_PACKAGE
2:  sa              len= 17  value= WDAAR_DAY_PACKAGE
User Profile received from AAA:
 Attribute List: 0x50106668
1:  acct-interval   len=  4  value= 120(78)
2:  accounting-list len=  5  value= WDAAR
Services:
  Name        : DT_NOVA_DHCP
  Service-ID  : 0x4000016
  Type        : Template
  Status      : Applied
-------------------------
  Name        : WDAAR_DAY_PACKAGE
  Service-ID  : 0x400001a
  Type        : Multi Template
  Status      : Applied
-------------------------
[Event History]
   Jul 27 13:33:21.152 IPv4 Start
   Jul 27 13:33:22.560 IPv4 Up
   Jul 27 14:03:35.296 CoA request [many]
   Jul 27 14:03:35.680 SUBDB produce done [many]

通過MA-CoA，您可以看到多服務計數器也增加了。

RP/0/RSP0/CPU0:acdc-asr9000-4#show subscriber manager statistics AAA COA
Mon Jul 27 14:05:04.724 UTC

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/RSP0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            1            1            0
Single Service Logoff            1            1            0
Single Service Modify            0            0            0
     Multiple Service 1 1 0

Errors:
Responses to COA with unknown session identifier = 3

[ CHANGE OF AUTHORIZATION STATISTICS ]

 Location: 0/0/CPU0

CoA Requests:
                 Type     Received        Acked        NAKed
                 ====     ========        =====        =====
        Account Logon            0            0            0
       Account Logoff            0            0            0
       Account Update            0            0            0
        Account-Query            0            0            0
           Disconnect            0            0            0
 Single Service Logon            0            0            0
Single Service Logoff            0            0            0
Single Service Modify            0            0            0
     Multiple Service            0            0            0

Errors:
  None

如果ASR9K收到一個CoA資料包以在訂戶會話上執行任何操作，但ASR9K在CoA資料包中收到的識別符號不屬於任何活動的訂戶會話，則如果啟用上述建議的調試，日誌中將顯示以下消息。

RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS: Received from id 159 , CoA Request, len 69
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:  authenticator 0D 52 11 54 B0 B7 37 07 - E1 9A 1D AF FA 1A 1A 09
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:  Acct-Session-Id     [44]    10      00004723
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:  Vendor,Cisco        [26]    39
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]:  RADIUS:   Cisco AVpair        [1]    33      subscriber:sd=WDAAR_DAY_PACKAGE
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]: Processing Dynamic authorization request
RP/0/RSP0/CPU0:Jul 27 13:41:39.133 : radiusd[1133]: COA: Service-Name attribute is present in service profile push
RP/0/RSP0/CPU0:Jul 27 13:41:39.134 : radiusd[1133]: COA/POD:request processing underway.
RP/0/RSP0/CPU0:Jul 27 13:41:39.135 : iedged[245]: [IEDGE:TP83:COMMAND-HANDLER:ERROR:0x0] 0 matching session found for CoA request, rc 0
LC/0/0/CPU0:Jul 27 13:41:39.137 : iedged[209]: [IEDGE:TP83:COMMAND-HANDLER:ERROR:0x0] 0 matching session found for CoA request, rc 0

疑難排解

可以在ASR9K上使用這些命令來檢驗CoA資料包的處理情況。如果CoA資料包處理成功或正由ASR9K進行NACK。

show radius dynamic-author

上面的輸出顯示了簡要概述ASR9K的ACK'd和NACK'd數量。

顯示使用者管理器統計資訊AAA COA

輸出包括總數的統計資訊 單個例項 服務啟用（服務登入）和 單個例項 已接收、ACK'd和NACK'd的服務停用（服務註銷），還包括 多重服務 跟蹤計數器。

show subscriber manager statistics PRE event

輸出顯示已由策略平面策略規則引擎(PRE)處理的多服務事件的統計資訊。

show subscriber manager statistics SVM事件

如果為coa rollback配置了異常，則上面的命令將顯示失敗的MA-CoA請求後成功回滾的統計資訊，以及失敗的MA-CoA請求後失敗的回滾的統計資訊。

show subscriber manager statistics perf not zero

上面的命令向您簡要概述了ASR9K上CoA的處理時間，並包括CoA事務的事務時間（平均值、標準偏差、最小值、最大值和計數）。

修訂記錄

修訂	發佈日期	意見
1.0	20-Oct-2017	初始版本

由思科工程師貢獻

Waqas Daar
Cisco TAC工程師