ISG provides two commands (each of which can be set independently) to maintain control over a session and its connection. The timeout absolute command controls how long a session can be connected before it is terminated. The timeout idle command controls how long a connection can be idle before it is terminated. Both commands detect both PPP and IP sessions and can be applied in a non-traffic-class-based service, on a per-session basis, or in a flow (traffic-class-based service). All subscriber traffic will reset the timers; however, non-network traffic such as PPP control packets will not reset the timers.

The scope of the session timers and connection timers is determined by the type of service within which the timer is specified. If specified in a service profile for which no traffic class is defined, the timer action will be to terminate the session or connection. If a traffic class specifier resides in the service profile, the timer action will be to deactivate the service.

The PPP idle timeout functionality has been replaced by the ISG idle timeout feature. The idle timer is a generic feature that can be set to detect idle traffic in both PPP and IP sessions.

You set the idle timer in a service profile that is installed on a session to control how long that service stays installed before it is removed from the session because no traffic is flowing through that service. If the service has traffic class parameters associated with it, that traffic class is terminated when this timer expires, or when the session itself is terminated.

The same is true for the session timer, except that this timer determines how long the session or service stays up, regardless of traffic flowing through it.

The IP subscriber session’s data traffic in the upstream direction can be monitored for idleness using a keepalive feature configured for the subscriber. If a session is idle for a configured period of time, keepalive requests are sent to the subscriber. This action verifies that the connection is still active. The protocol to use for the keepalive request and response can be configured based on the IP subscriber session type. If it is a directly connected host (Layer 2 connection), ARP is used. For routed host (Layer 3 connected) subscribers, ICMP is used. If the access interface does not support ARP, the keepalive protocol defaults to ICMP.

When a session is established and the keepalive feature is configured to use ARP, the keepalive feature saves the ARP entry as a valid original entry for verifying future ARP responses.

Note	In cases where the access interface does not support ARP, the protocol for keepalives defaults to ICMP.

When ARP is configured, the ARP unicast request is sent to the subscriber. After a configured interval of time, the ARP response (if received) is verified. If the response is correct and matches the original entry that was saved when the subscriber was initially established, the keepalive feature continues monitoring the data plane for the configured interval of time. If the response is not correct, the keepalive feature resends the ARP request until a correct response is received or the configured maximum number of attempts is exceeded.

If ICMP is configured, the ICMP “hello” request is sent to the subscriber and checked for a response, until the configured maximum number of attempts is exceeded.

For IP subnet sessions, the peer (destination) IP address to be used for ICMP “hello” requests will be all the IP addresses within the subnet. This means “hello” requests will be sent sequentially (not simultaneously) to all the possible hosts within that subnet. If there is no response from any host in that subnet, the session will be disconnected.

Another option is to configure ICMP directed broadcast for keepalive requests. If the subscriber hosts recognize the IP subnet broadcast address, the ISG can send the ICMP “hello” request to the subnet broadcast address. The subscribers need not be on the same subnet as the ISG for this configuration to work. A directed broadcast keepalive request can work multiple hops away as long as these conditions are satisfied:

• The group of subscribers identified by the subnet must have the same subnet mask provisioned locally as the subnet provisioned on the subnet subscriber session on the ISG. Otherwise, the subscriber hosts will not recognize the subnet broadcast address.

• The router directly connected to the hosts must enable directed-broadcast forwarding, so that the IP subnet broadcast gets translated into a Layer 2 broadcast.

When these two conditions are satisfied, you can optimize the ICMP keepalive configuration to minimize the number of ICMP packets.

Note	Because enabling directed broadcasts increases the risk of denial of service attacks, the use of subnet directed broadcasts is not turned on by default.

The SSO and ISSU feature provides high availability (HA) support for ISG timers including the connection timer, session timer, and the session keepalive. The timers and keepalive are restarted on the new standby Route Processor (RP) after a stateful switchover (SSO) or In Service Software Upgrade (ISSU) event.

For information about configuring HA on the ISG router, see the High Availability Configuration Guide, Cisco IOS XE Release 3S.

1.    enable


2.    configure terminal


3.    policy-map type service policy-map-name


4.    [priority] class type trafficclass-map-name

5.    timeout absolute duration-in-seconds


6.    end

Router> enable

Router# configure terminal

Router(config)# policy-map type service policy1

Router(config-control-policymap)# class type traffic class1

Router(config-control-policymap-class-control)# timeout absolute 30

Router(conf-subscriber-profile)# end

1.    Session-Timeout=duration-in-seconds

1.    enable


2.    configure terminal


3.    policy-map type service policy-map-name


4.    [priority] class type traffic class-map-name

5.    timeout idle duration-in-seconds [both | inbound]


6.    end

Router> enable

Router# configure terminal

Router(config)# policy-map type service policy1

Router(config-service-policymap)# class type traffic class1

Router(config-control-policymap-class-traffic)# timeout idle 3000 inbound

Router(config-control-policymap-class-traffic)# end

1.    idle-timeout= duration-in-seconds


2.    idle-timeout-direction= direction

simulator radius subscriber 999
attribute 28 numeric 100 
vsa cisco generic 1 string "subscriber:idle-timeout-direction=inbound"
attribute 44 string "00000008"

1.    enable


2.    show subscriber session all


3.    end

Router> enable

Router# show subscriber session all

Router# end

The following sections describe the debug commands that can be used to troubleshoot the session maintenance timers:

This task describes how to configure the keepalive feature on the router, using either ARP or ICMP.

Because the session keepalive feature is checking for the subscriber’s health and presence, this feature is applied only to the session as a whole and not per-flow.

Note

If a service profile includes an ISG traffic class configuration, the keepalive feature will be ignored. If this feature is applied to a non-IP session, for example, a PPP over Ethernet (PPPoE) or PPP over ATM (PPPoA) session, this feature application will fail and the following applies: If the feature is applied at a session-start event, both the feature application and the session will fail. If this feature is pushed onto a session after the session-start event, the push will fail.

1.    enable


2.    configure terminal


3.    policy-map type service policy-map-name


4.    keepalive [idle idle-seconds] [attempts max-retries] [interval retry-seconds] [protocol {ARP | ICMP [broadcast]}]


5.    exit

Router> enable

Router# configure terminal

Router(config)# policy-map type service policymap1

Router(config-service-policymap)# keepalive idle 7 attempts 3 interval 1 protocol arp

Router(config-service-policymap)# exit

policy-map type service accting_service
 class type traffic ALL
 !
 keepalive idle 7 attempts 3 interval 1 protocol arp
!

1.    Service-Name password = “cisco”

2.    Cisco-Avpair = “subscriber:keepalive = [idle period1] [attempts Max-retries] [interval period2] [protocol ICMP [broadcast] | ARP}”

1.    enable


2.    configure terminal


3.    aaa new-model


4.    aaa server radius dynamic-author


5.    client ip-address


6.    port port-number


7.    server-key word


8.    exit

Router> enable

Router# configure terminal

Router(config)# aaa new-model

Router(config)# aaa server radius dynamic-author

Router(config-locsvr-da-radius)# client 10.10.10.11

Router(config-locsvr-da-radius)# port 1650

Router(config-locsvr-da-radius)# server-key abc

Router(config-locsvr-da-radius)# exit