The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The RADIUS Packet of Disconnect feature is used to terminate a connected voice call.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Configure AAA as described in the Cisco IOS XE Security Configuration Guide: Securing User Services , Release 2.
Proper matching identification information must be communicated by the following:
The Packet of Disconnect (POD) is a RADIUS access_request packet and is intended to be used in situations where the authenticating agent server wants to disconnect the user after the session has been accepted by the RADIUS access_accept packet.
The POD may be needed in at least two situations:
The POD has the following parameters:
RFC 3576 specifies the following POD codes:
Use the following tasks to configure the RADIUS POD:
Use the following tips to troubleshoot POD issues:
The following example shows output from a successful POD request, when using the show debug command.
Router# debug aaa podAAA POD packet processing debugging is on Router# show debugGeneral OS: AAA POD packet processing debugging is on Router# Apr 25 17:15:59.318:POD:172.19.139.206 request queued Apr 25 17:15:59.318:voice_pod_request: Apr 25 17:15:59.318:voip_populate_pod_attr_list: Apr 25 17:15:59.318:voip_pod_get_guid: Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val: Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=50 Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr=h323-conf-id Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=50 value_len=35 Apr 25 17:15:59.318:voip_pod_get_guid:conf-id=FFA7785F F7F607BB 00000000 993FB1F4 n_bytes=35 Apr 25 17:15:59.318:voip_pod_get_guid:GUID = FFA7785F F7F607BB 00000000 993FB1F4 Apr 25 17:15:59.318:voip_populate_pod_attr_list: Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val: Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=23 Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr=h323-originate Apr 25 17:15:59.318:voip_pod_get_vsa_attr_val:attr_len=23 value_len=6 Apr 25 17:15:59.318:voip_get_call_direction: Apr 25 17:15:59.318:voip_get_call_direction:returning answer Apr 25 17:15:59.318:voip_eval_pod_attr: Apr 25 17:15:59.318:cc_api_trigger_disconnect: Apr 25 17:15:59.322:POD:Sending ACK to 172.19.139.206/1700 Apr 25 17:15:59.322:voip_pod_clean:
To verify the RADIUS POD configuration, use the show running configuration privileged EXEC command as shown in the following example:
Router# show running-configuration
!
aaa authentication login h323 group radius
aaa authorization exec h323 group radius
aaa accounting update newinfo
aaa accounting connection h323 start-stop group radius
aaa pod server server-key cisco
aaa session-id common
.
.
.
The following sections provide references related to the RADIUS Packet of Disconnect feature.
Related Topic |
Document Title |
---|---|
AAA |
Authentication, Authorization, and Accounting (AAA) section of the Cisco IOS XE Security Configuration Guide, Securing User Services, Release 2. |
Security commands |
Cisco IOS Security Command Reference |
CLI Configuration |
Cisco IOS XE Configuration Fundamentals Configuration Guide, Release 2 |
Standard |
Title |
---|---|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
-- |
MIB |
MIBs Link |
---|---|
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. |
To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFC |
Title |
---|---|
RFC 2865 |
Remote Authentication Dial-in User Service |
RFC 3576 |
Dynamic Authorization Extensions to RADIUS |
Description |
Link |
---|---|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 | Feature Information for RADIUS Packet of Disconnect |
Feature Name |
Releases |
Feature Information |
---|---|---|
RADIUS Packet of Disconnect |
Cisco IOS XE Release 2.1 |
The RADIUS Packet of Disconnect feature is used to terminate a connected voice call. In Cisco IOS XE Release 2.1, this feature was introduced on the on Cisco ASR 1000 Series Aggregation Services Routers. The following commands were introduced or modified: aaa pod server, debug aaa pod |
AAA --authentication, authorization, and accounting.
NACK --negative acknowledgement message.
POD --packet of disconnect. An access_reject packet sent from a RADIUS server to the gateway in order to disconnect a call which has been connected already. After validation of the packet, the gateway disconnects the user. The packet contains the information to disconnect the call.
POD server--a Cisco gateway configured to accept and process POD requests from a RADIUS authentication/authorization agent.
RADIUS --Remote Authentication Dial-In User Service. An authentication and accounting system used by many Internet service providers.
UDP --User Datagram Protocol. Connectionless transport layer protocol in the TCP/IP protocol stack. UDP is a simple protocol that exchanges datagrams without acknowledgments or guaranteed delivery, requiring that error processing and retransmission be handled by other protocols. UDP is defined in RFC 768.
VoIP-- voice over IP. The ability to carry normal telephony-style voice over an IP-based Internet with POTS-like functionality, reliability, and voice quality. VoIP is a blanket term that generally refers to the Cisco standards-based (for example, H.323) approach to IP voice traffic.
VSA --vendor-specific attribute.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.