Cisco Prime Access Registrar 9.1 User Guide

To view the next page

To return back to previous page

To view the last page

To return to the first page

To move a record from the Available List to the Selected List

To move a record from the Selected List to the Available List

To move all the records from the Available List to the Selected List

To move all the records from the Selected List to the Available List

To move the selected record one step above

To move the selected record one step below

To move the selected record to the first position

To move the selected record to the last position

Release

Click to release the selected session details.

Release All

Click to release all the records from the list.

Send CoA

Click to send the CoA packet to the client device.

SendPoD

Click to send the disconnect packet to the NAS to clear sessions and an Accounting-Stop notification to the client listed in the session record.

Query All Sessions

Click to query all the sessions in the server.

Name

Required; must be unique in the list of servers in the cluster.

Version

Required; the currently installed version of Prime Access Registrar.

Description

Optional; description of the server.

DefaultSessionManager

Cisco Prime Access Registrar uses this property if none of the incoming scripts sets the environment dictionary variable Session-Manager.

This field is mandatory if you are upgrading to a later version of Prime Access Registrar.

IncomingScript

Optional; if there is a script, it is the first script Cisco Prime Access Registrar runs when it receives a request from any client and/or for any service.

OutgoingScript

Optional; if there is a script, it is the last script Cisco Prime Access Registrar runs before it sends a response to any client.

DefaultAuthenticationService

Optional; Cisco Prime Access Registrar uses this property when none of the incoming scripts sets the environment dictionary variable Authentication-Service.

DefaultAuthorizationService

Optional; Cisco Prime Access Registrar uses this property when none of the incoming scripts sets the environment dictionary variable Authorization-Service.

DefaultAccountingService

Optional; Cisco Prime Access Registrar uses this property when none of the incoming scripts sets the environment dictionary variable Accounting-Service.

DefaultSessionService

Cisco Prime Access Registrar uses this property when none of the incoming scripts sets the environment dictionary variable Session-Service.

This field is mandatory if you are upgrading to a later version of Prime Access Registrar.

Name

Required; must be unique in the Profiles list.

Description

Optional; description of the profile.

RADIUS

Optional; set Radius, if the attribute and value need to be defined for RADIUS.

VENDOR

Optional; set Vendor, if the attribute and value need to be defined for Vendor.

DIAMETER

Optional; set Diameter, if the attribute and value need to be defined for Diameter.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Value Attribute

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Radius and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

UserGroup Name

Required; must be unique in the UserGroup list.

Description

Optional; description of the group.

BaseProfile

Optional; when you set this to the name of a profile, Cisco Prime Access Registrar adds the properties in the Profile to the response dictionary as part of the authorization.

AuthenticationScript

Optional; when you set this property to the name of a script, you can use the Script to perform additional authentication checks to determine whether to accept or reject the user.

AuthorizationScript

Optional; when you set this property to the name of a script, you can use the script to add, delete, or modify the attributes of the Response dictionary.

RADIUS

Optional; set Radius, if the attribute and value need to be defined for RADIUS.

VENDOR

Optional; set Vendor, if the attribute and value need to be defined for Vendor.

DIAMETER

Optional; set Diameter, if the attribute and value need to be defined for Diameter.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Name and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

RADIUS

Optional; set Radius, if the attribute and value need to be defined for RADIUS.

VENDOR

Optional; set Vendor, if the attribute and value need to be defined for Vendor.

DIAMETER

Optional; set Diameter, if the attribute and value need to be defined for Diameter.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Check Name and Check Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

UserList Name

Required; must be unique.

Description

Optional; description of the user list.

Name

Required; must be unique.

Enabled

Required; must be checked to allow user access. If Enabled is not checked, user is denied access.

Allow Null Pwd

During authentication, if the Allow NULL Password environment variable is set to TRUE, user authentication is bypassed. By default, the Allow NULL Password environment variable is not set.

UserGroup

Use the drop-down list to select a UserGroup and use the properties specified in the UserGroup to authenticate and/or authorize the user. The default is none.

Password

Required; length must be between 0-253 characters.

Base Profile

Optional; use the drop-down list to select a Profile. If the service-type is not equal to Authenticate Only, Prime Access Registrar adds the properties in the Profile to the Response dictionary as part of the authorization. This field is optional for the CLI, but required for the GUI. Use the menu to select a profile other than the default None.

Confirm Password

Required; must match password.

User Defined

Optional; you can use this property to store notational information which you can then use to filter the UserList. This property also sets the environment variable for UserDefined.

Authentication Script

Optional; use the drop-down list to select the name of a script to perform additional authentication checks to determine whether to accept or reject the user. This field is optional for the CLI, but required for the GUI. Use the menu to select an Authentication Script other than the default None.

Authorization Script

Optional; use the drop-down list to select the name of a script to add, delete, or modify the attributes of the Response dictionary. This field is optional for the CLI, but required for the GUI. Use the menu to select an Authorization Script other than the default None.

Description

Optional; description of the user.

RADIUS

Optional; set Radius, if the attribute and value need to be defined for RADIUS.

VENDOR

Optional; set Vendor, if the attribute and value need to be defined for Vendor.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Name and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

RADIUS

Optional; set Radius, if the attribute and value need to be defined for RADIUS.

VENDOR

Optional; set Vendor, if the attribute and value need to be defined for Vendor.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Check Name and Check Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Script Name

Required; must be unique in the Scripts list.

Language

Required; specify either REX, TCL, Java, or Internal.

Description

Optional; description of the script.

File/Class Name

Required; specifies either a relative or absolute path. When you specify a relative path, the path must be relative to the $INSTALL/scripts/radius/$Language directory. When you specify an absolute path, the server must be able to reach it.

For Java language scripts, the name of the class that implements the extension interface; the .class file should be placed in /cisco-ar/scripts/radius/java

Entry Point

Required; when not set, Prime Access Registrar uses the value specified in the Name property.

Init Entry Point

Optional; if set, it must be the name of the global symbol Prime Access Registrar should call when it initializes the shared library at system start up, and just before it unloads the shared library.

Init Entry Point Arg

Optional; when set, it provides the arguments to be passed to the InitEntryPoint in the environmental variable Arguments.

Note The InitEntryPoint properties allow you to perform initialization before processing and then cleanup before stopping the server. For example, when Prime Access Registrar unloads the script (when it stops the RADIUS server) it calls the InitEntryPoint again to allow it to perform any clean-up operations as a result of its initialization. One use of the function might be to allow the script to close an open Accounting log file before stopping the RADIUS server.

The following fields appear if the language is set as Internal

Protocol

Required; select RADIUS or Diameter to indicate the protocol for which the attributes are to be modified.

ActionStatements

Select one of following the options:

• Simple Attribute Operation—allows you to add, modify, or delete an attribute value to the request, response, or environment dictionary
• Copy an Attribute—allows you to copy an attribute value from one dictionary to another
• Concatenate Operation—allows you to concatenate an attribute value from one dictionary to another
• Replace Operation—allows you to replace an attribute value from one dictionary to another
• Value Based Manipulations—allows you to manipulate attribute values in a dictionary based on a given text
• Log or Trace Messages—allows you to create different levels of log or trace messages
• I can do it myself—allows you to create your own script for the selected protocol

Operation

Choose the operation to perform as Add, Modify, or Delete.

Dictionary

Choose Request, Response, or Environment to specify the RADIUS dictionary to apply the action to.

Attr Type

Applicable for RADIUS protocol; select RADIUS or VENDOR to indicate the attribute type.

Group AVP

Applicable for Diameter protocol; select the group AVP and its level to apply the action to.

Attribute

Based on the attribute type/group AVP selected, choose the appropriate attribute to apply the action to.

Env Attribute

Enter the environment attribute to apply the action to.

This field is available only if the Dictionary chosen is Environment.

Text

Enter the text that needs to be added, modified, or deleted to/from the given attribute in the selected dictionary.

Only this field is available if the action statement is Simple Attribute Operation or Replacement Operation.

This field is also available under the following circumstances:

• If the action statement is Copy an Attribute, Concatenate Operation, or Value Based Manipulations, and if the type is chosen as Custom Text

Type

Select Radius, Diameter, or Custom Text.

Dictionary

If the type is set as Radius or Diameter, choose Request, Response, or Environment to specify the dictionary to apply the action to.

Attr Type

Applicable for RADIUS protocol; select RADIUS or VENDOR to indicate the attribute type.

Group AVP

Applicable for Diameter protocol; select the group AVP and its level to apply the action to.

Attribute

Based on the attribute type/group AVP selected, choose the appropriate attribute to apply the action to.

Env Attribute

Enter the environment attribute to apply the action to.

This field is available only if the Dictionary chosen is Environment.

This section is available if the Action Statements field is set to Concatenate Operation or Replace Operation.

Type

Select Radius, Diameter, or Custom Text.

Text

Enter the text to concatenate to or replace the given attribute value in the selected dictionary.

Only this field is available if the action statement is Replace Operation.

This field is also available if the action statement is Concatenate Operation and if the type is chosen as Custom Text

Dictionary

If the type is Radius, choose Request, Response, or Environment to specify the RADIUS dictionary to apply the action to.

Attr Type

Applicable for RADIUS protocol; select RADIUS or VENDOR to indicate the attribute type.

Group AVP

Applicable for Diameter protocol; select the group AVP and its level to apply the action to.

Attribute

Based on the attribute type/group AVP selected, choose the appropriate attribute to apply the action to.

Env Attribute

Enter the environment attribute to apply the action to.

This field is available only if the Dictionary chosen is Environment.

This section is available if the Action Statements field is set to Value Based Manipulations.

Operation

Select one of the following options:

• Begins With—to manipulate the attribute value beginning with the given text
• Contains—to manipulate the attribute value that contains the given text
• Ends With—to manipulate the attribute value that ends with the given text
• Strip Text—to strip the given text from the attribute value

Text

The text you need to manipulate the attribute value with.

This following fields are available if the Action Statements field is set to Log or Trace Messages.

Log Type

Select one of the following options:

• log—to add a log message
• trace—to add a trace message

Level

Applicable only for logs; level of the log message to add.

Message

The log or trace message to add.

This following field is available if the Action Statements field is set to I can do it myself.

Statement

Enter the action statement as a free text.

Name

Required; must be unique in the Policies list

Description

Optional; description of the Policy

Rules/Policies

Required; set the rules/polices to be grouped.

Operators

Required; set the operators to be grouped along with selected rules/policies. The selected rules and operators will be grouped and listed in the Grouping Box. To delete the available groups, select the relevant group from the Grouping list and click the Delete button below.

Grouping

Optional; grouping of rules.

Name

Required; name of the group server.

MultiplePeersPolicy

Required; Policy used by the Prime Access Registrar server to load balance the peers within the group. This could be one of the following:

• FailOver—Traffic is directed towards first priority remote server within the group. When Prime Access Registrar loses connectivity with the first priority remote server, it directs the subsequent traffic towards the second priority remote server within the group.
• RoundRobin—Traffic is distributed across all the active remote servers within the group.

GroupTimeOutPolicy

Required; action to perform when there is a timeout with the group server. This could be FailOver, DropPacket, or SendError.

List of Diameter remote servers to add to the group.

Name

Required; name of the peer.

Metric

Required; metric value for this peer entry. The higher the value the lower the preference. The highest value of preference is 0.

Weight

Required; default value is 0. Specifies the weight percentage for which the server group needs to load balance the peer.

Note When you set the weight to a value other than 0, the weight should be in multiples of 10 and the sum of the weights configured in the peer list should be equal to 100.

IsActive

Optional; if this is checked, the new sessions will not go to the peer server. By default, this is unchecked.

Service Name

Required; must be unique in the Services list.

Incoming Script

Optional; name of script to run when the service starts.

Type

Required; must set it to a valid Prime Access Registrar service.

Outgoing Script

Name of script to run when the service ends.

Description

Optional; description of the service.

Outage Script

Optional; if you set this property to the name of a script, Cisco Prime Access Registrar runs it when an outage occurs. This property allows you to create a script that notifies you when the RADIUS server detects a failure.

Outage Policy

Required; the default is DropPacket. This property defines how Cisco Prime Access Registrar handles requests if all servers listed in the RemoteServers properties are unavailable (that is, all remote RADIUS servers are not available). You must set it to one of the following: AcceptAll , DropPacket , or RejectAll.

The following properties appear for the job type rex.

Filename

Required; must be either a relative or an absolute path to the shared library containing the Service. When the pathname is relative, it must be relative to $INSTALL/Scripts/Radius/rex.

EntryPoint

Required; must be set to the function’s global symbol.

InitEntryPoint

Required; must be the name of the global symbol Cisco Prime Access Registrar should call when it initializes the shared library and just before it unloads the shared library.

A rex service must have an InitEntryPoint even if the service only returns REX_OK.

InitEntryPointArgs

Optional; when set, it provides the arguments to be passed to the InitEntryPoint in the environmental variable Arguments.

The following properties appear for the job type file.

FilenamePrefix

Required; a string that specifies where Cisco Prime Access Registrar writes the account records. It must be either a relative or absolute path. When you specify a relative path, it must be relative to the $INSTALL/logs directory. When you specify an absolute path, the server must be able to reach it. The default is Accounting.

MaxFileAge

Optional; stored as a string, but is composed of two parts, a number and a units indicator ( <n> <units>) in which the unit is one of: H, Hour, Hours, D, Day, Days, W, Week, Weeks. The default is one day.

RolloverSchedule

Indicates the exact time including the day of the month or day of the week, hour and minute to roll over the accounting log file.

MaxFileSize

Optional; stored as a string, but is composed of two parts, a number and a units indicator (<n> <units>) in which the unit is one of: K, kilobyte, or kilobytes, M, megabyte, or megabytes, or G, gigabyte, or gigabytes. The default is ten megabytes.

UseLocalTimeZone

When set to TRUE, indicates the accounting records' TimeStamp is in local time. When set to FALSE, the default, accounting records' TimeStamp is in GMT.

FileType

Choose log or csv to indicate the file type to export the accounting records to. If you choose log, the Prime Access Registrar server writes accounting messages to the accounting.log file in the /opt/CSCOar/logs directory. If you choose csv, the Prime Access Registrar server writes accounting messages to the accounting.csv file in the /opt/CSCOar/logs directory.

EnableRollOverIntelligence

Check the box to enable rollover intelligence for the accounting records based on the accounting service properties. For more information, see Rolling Encryption Support for Pseudonym Generation in EAP-SIM, EAP-AKA, and EAP-AKA’ Services.

AttributesToBeLogged

The selected list of attributes that must be logged. If the list is empty, the accounting file service logs all the attributes of the packet.

Delimiter

The delimiter to use in the accounting file. This field is available if you set the FileType as csv. Delimiters could be ‘;’, ‘,’, and ‘:’ and default value is ‘,’.

The following properties appear for the job type trusted-id.

UserService

Required; name of service that can be used to authenticate.

SessionManager

Required; select the required session manager from the available list.

The following properties appear for the job type group.

Result Rule

When set to AND (the default), the response from the GroupService is positive if each of the services referenced return a positive result. The response is negative if any of the services reference return a negative result.

When set to OR, the response from the GroupService is positive if any of the services referenced return a positive result. The response is negative if all the referenced services return a negative result.

The settings parallel-AND or parallel-OR are similar to AND and OR settings, except that each referenced service processes requests simultaneously instead of asking each reference service sequentially to save processing time.

GroupServices

Optional; use the GroupServices subdirectory to specify the subservices in an indexed list to provide specific ordering control of which services to apply first. Each subservice listed must be defined in the Services section of the RADIUS configuration and cannot be a of type g roup, eap-leap, or eap-md5.

To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

The following properties appear for the job type local.

UserList

Required; this object contains all of the individual UserLists, which in turn, contain the specific users stored within Prime Access Registrar. Cisco Prime Access Registrar references each specific UserList by name from a Service whose type is set to local .

When Cisco Prime Access Registrar receives a request, it directs it to a Service. When the Service has its type property set to local, the Service looks up the user’s entry in the specific UserList and authenticates and/or authorizes the user against that entry.

Enable Device Access

Check the box to enable TACACS+ command authorization.

Note Device Access Rules are applicable for TACACS+ command authorization. For more information, see TACACS+ Support for AAA.

Device Access Rule

Select a device access rule and click Add. The selected access rule is displayed in the Device Access Rules list box.

Default Device Access Action

Select the default action to perform on the commands for all the access rules in the authorization service. Options are PermitAll and DenyAll.

The following properties appear for the job type java.

Class name

Optional; set to the name of a class that implements the Extension interface.

InitializeArg

Optional; set to a string to be passed to the Initialize method if the class implements the optional ExtensionWithInitialization interface.

The following properties appear for the job type wimax.

HARKKey

Required; used as the base key to generate random HARKKey for all the HAs that are configured in Prime Access Registrar.

By default, the value is cisco112.You can change this value.

WimaxAuthenticationService

Required; a valid EAP service which can be used for WiMAX authentication. By default, this value is none.

HARKLifeTime

Required; used as time (in minutes) to regenerate the HARKKeys based on its lifetime.

WimaxSessionManager

Required; set a valid session manager which has HA and HA Cache as resource managers. By default, this value is none.

WimaxQueryService

Required; set a valid RADIUS query service which is configured with WiMAX session manager. By default, this value is none.

WimaxPrepaidService

Optional; set a valid prepaid service to carry out the prepaid functionality of WiMAX. Otherwise this value is set to none.

AllowAAAToIncludeKeys

Optional; If this is set, the HAAA will include the hHA-RK-Key, hHA-RK-SPI and hHA-RK-Lifetime in the Access-Accept.

Otherwise, those attributes will not be in the Access-Accept. By default this value is True.

RequiredMSK

Optional; If this is set, the MSK will be provided by the AAA server as a result of successful EAP-Authentication. By default, this value is False.

The following properties appear for the job type radius-query.

Attribute type

Select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list. Select the attributes from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Session Manager

Select the required session manager from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

The following property appears for the job type dyn-auth.

Session Cache Query Service

Select the session cache query service to use for dynamic authorization.

The following properties appear for the job type diameter-radius or radius-diameter.

ProxyServiceName

Select the Diameter proxy service name.

DiameterApplicationID

Select the Diameter service application ID. This field appears only for radius-diameter service type.

EnableRequestCommandMappings

Check this box to enable command mapping.

SendRAR-ASRToClient

Check the box if the COA/POD packets received by Prime Access Registrar are to be translated and sent as Re-Auth-Request (RAR) / Abort Session Request (ASR) to a Diameter client. This field appears only for radius-diameter service type.

ClientHostName

Hostname of the Diameter client to which the translated RAR/ASR must be sent. If the session manager is configured, the client host name can be acquired from it using the Session-Manager AVP.

This field appears only for radius-diameter service type.

UseFor3GPPReverseAuthorizationService

Check the box to enable 3GPP authorization service in the translation framework. This field appears only for radius-diameter service type.

PreRequestTranslationScript

Select the scripting point to be called on the original request packet.

PostRequestTranslationScript

Select the scripting point to be called on the translated request packet.

PreResponseTranslationScript

Select the scripting point to be called on the response packet.

PostResponseTranslationScript

Select the scripting point to be called on the translated response packet.

CommandMappings

This tab allows you to map commands.

ResultCodeMappings

This tab allows you to map result codes.

RequestAVPMappings

This tab allows you to map request AVPs.

RequestAVPsToBeAdded

This tab allows you to map request AVPs to be added.

RequestEnvironmentMappings

This tab allows you to map request environment variables.

ResponseAVPMappings

This tab allows you to map response AVPs.

ResponseAVPsToBeAdded

This tab allows you to map response AVPs to be added.

ResponseEnvironmentMappings

This tab allows you to map response environment variables.

The following properties appear for the job type diameter-query.

UpdateSessionLastAccessTime

Check the box to update the timestamp when the Diameter session was last accessed or called.

Attribute type

Select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list. Select the attributes from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Session Manager

Select the required session manager from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

The following property appears for the job type 3gpp-authorization.

Protocol

Required; select RADIUS or Diameter to indicate the protocol to use for 3GPP authorization.

FetchLocationInformation

Check the box to fetch location related information of the RADIUS/Diameter client for the 3GPP authorization service.

Prime Access Registrar allows or blocks access of a subscriber to voice over Wi-Fi (VoWiFi) based on the location information. For more details on voice over Wi-Fi (VoWiFi) location-based authentication, see the “Wireless Support” chapter of the Cisco Prime Access Registrar 9.1 Reference Guide

TranslationService

Required if the protocol selected is RADIUS; translation service to use during 3GPP authorization.

DiameterProxyService

Required if the protocol selected in Diameter; diameter proxy service to use during 3GPP authorization.

The following properties appear for the job type 3gpp-reverse-authorization.

TranslationService

Required; the translation service to use for 3GPP reverse authorization.

Service Name

Required; name of the remote server service

Incoming Script

Optional; name of script to run when the service starts

Type

Required; Remote service Type must be set to one of the following: ldap, ldap-accounting, odbc-accounting, odbc, oci-accounting, oci, prepaid, radius, radius-session, m3ua, extended-eap, or rest.

Outgoing Script

Optional; name of script to run when the service ends.

Outage Script

Optional; if you set this property to the name of a script, Prime Access Registrar runs it when an outage occurs. This property allows you to create a script that notifies you when the RADIUS server detects a failure.

Outage Policy

The default is DropPacket. This property defines how Prime Access Registrar handles requests if all servers listed in the RemoteServers properties are unavailable (that is, all remote RADIUS servers are not available). You must set it to one of the following: AcceptAll, DropPacket, or RejectAll.

Description (optional)

Optional; description of the remote server service

MultipleServersPolicy

Required; must be set to either Failover or RoundRobin.

When you set it to Failover, Prime Access Registrar directs requests to the first server in the list until it determines the server is offline. At which time, Prime Access Registrar redirects all requests to the next server in the list until it finds a server that is online.

When you set it to RoundRobin, Prime Access Registrar directs each request to the next server in the RemoteServers list to share the resource load across all of the servers listed in the RemoteServers list.

NASIDList

Mandatory for extended-EAP service. Select a valid user list as configured under RADIUS > UserLists.

Extended-EAP is used as an authorization service to retrieve authorization information from the remote web server using the REST interface. To configure a REST remote server for extended-EAP service, see REST

RemoteServers

Select the required remote server from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

AuthorizationInfoLookUp

Applicable only for the m3ua service type. Choose one of the following from the drop-down list:

• MSISDN-IMSI—To fetch MSISDN in the request and send IMSI in the response to the HLR.
• IMSI-MSISDN—To fetch IMSI in the request and send MSISDN in the response to the HLR.
• MAP-RESTORE—To fetch the profile information of a subscriber from the HLR. For more information on configuring the M3UA service with Map Restore Data authorization, see Configuring M3UA Service with Map Restore Data Authorization.

MapVersion

Applicable only for the m3ua service type; select the map version that HLR supports.

This section is applicable for TACACS+ command authorization and is available only for service types local-user, oci, odbc, and ldap. For more information on TACACS+ command authorization, see TACACS+ Support for AAA.

Enable Device Access

Check the box to enable TACACS+ command authorization.

Device Access Rule

Select a device access rule and click Add. The selected access rule is displayed in the Device Access Rules list box.

Default Device Access Action

Select the default action to perform on the commands for all the access rules in the authorization service. Options are PermitAll and DenyAll.

IMSI

IMSI received in the response from HLR.

Naea-Preferred CI

North American Equal Access preferred Carrier ID List. A list of the preferred carrier identity codes that are subscribed to.

Roaming Restricted In Sgsn Due To Unsupported Feature

Indicates that a subscriber is not allowed to roam in the current Service GPRS Support Node (SGSN) or Cisco Mobility Management Entity (MME) area.

Network Access Mode

The Network Access Mode (NAM) defines if the subscriber is registered to get access to the CS (non-GPRS/EPS network), to the PS (GPRS/EPS) network, or to both networks. NAM describes the first level of the subscriber data pseudo-tree below the IMSIroot. It is permanent subscriber data stored in the HSS / HLR and the SGSN with the Gs interface option, and the MME with the SGs interface option.

LMU Indicator

Indicates the presence of an LMU.

IST Alert Timer

Indicates the IST alert timer value that must be used in the Mobile Switching Center (MSC) to inform the HLR about the call activities that the subscriber performs.

Super Charger Supported In HLR

Indicates whether super charger concept is supported in HLR.

CS Allocation Retention Priority

Allocation-retention priority for Circuit Switched (CS). This parameter specifies relative importance to compare with other bearers about allocation and retention of bearer.

ChargingCharacteristics

Subscribed charging characteristics.

Access Restriction Data

Allowed Recipient Access Table (RAT) according to subscription data.

UE Reachability Request Indicator

Indicates that the Home Subscriber Server (HSS) is awaiting a notification of user equipment (UE) reachability.

Category

Calling party category

LSA Information

These parameters refer to one or more localized service areas (LSAs) a subscriber may be a member of, together with the priority, the preferential access indicator, the active mode support indicator and active mode indication of each localized service area. The access right outside these localized service areas is also indicated.

MSISDN

MSISDN value in the subscriber data.

Subscriber Status

Barring status of the subscriber, which could be Service Granted or Operator Determined Barring.

Roaming Restriction Due To Unsupported Feature

Indicates that the subscriber is not allowed to roam in the current MSC area.

Bearer Service List

List of extensible bearer services subscribed.

Configure the index value to fetch only the required bearer services.

TeleService List

List of extensible teleservices subscribed.

Configure the index value to fetch only the required teleservices.

Provisioned SS

List of supplementary services provisioned.

Configure the index value to fetch only the required supplementary services.

ODB-Data

Operator Determined Barring (ODB) general data and ODB Home Public Land Mobile Network (HPLMN) specific data.

Regional Subscription Data

List of regional subscription areas (zones) in which the subscriber is allowed to roam.

Configure the index value to fetch only the required zones.

VBS Subscription Data

List of Voice Broadcast Services (VBS) subscribed.

Configure the index value to fetch only the required VBS.

VGCS Subscription Data

List of Voice Group Call Services (VGCS) subscribed.

Configure the index value to fetch only the required VGCS.

Live Communication Server (LCS) related information for the subscriber.

GMLC-List

List of Gateway Mobile Location Centers (GMLCs) that are permitted to issue a call/session unrelated or call/session related MT-LR request.

Configure the index value to fetch only the required GMLCs.

LCS-Privacy Exception List

Classes of LCS client that are allowed to locate any target Mobile Station (MS).

Configure the index value to fetch only the required classes.

MOLR-List

Code and status of Mobile Originating Location Request (MO-LR) subscribed.

Configure the index value to fetch only the required requests.

MC-SS-Code

Code of the MC SS.

MC-SS-Status

Status of the MC SS.

NbrSB

Maximum number of parallel bearers that may be used as defined by the user’s subscription.

NbrUser

Maximum number of parallel bearers that may be used as defined by the user at registration of the MC SS.

GPRS-CSI

Identifies the subscriber as having GPRS originating SMS CAMEL services.

MO-SMS-CSI

Identifies the subscriber as having mobile originating SMS CAMEL services.

MT-SMS-CSI

Identifies the subscriber as having mobile terminating SMS CAMEL services.

Attribute

Select an RADIUS attribute to map the fetched profile data.

Value:Profile

Enter a value for the attribute.

ProfileList

Select one of the profile lists and click Add. The entered profile details are displayed in the list box in the ProfileMappings section. You can delete a profile attribute from the list as required.

Service Name

Required; service name

Incoming Script

Optional; script Prime Access Registrar server runs when it receives a request from a client.

Type

Required; must set it to a valid Prime Access Registrar service.

Outgoing Script

Optional; script Prime Access Registrar server runs before it sends a response to a client.

Maximum Message Size

Indicates the maximum length in bytes that a PEAP or EAP-TLS message can have before it is fragmented.

Server Certificate File

Required; the full pathname of the file containing the server’s certificate or certificate chain used during the TLS exchange. The pathname can be optionally prefixed with a special string that indicates the type of encoding used for the certificate. The two valid encoding prefixes are PEM and DER. If an encoding prefix is not present, the file is assumed to be in PEM format.

The following example assumes that the subdirectory pki under /cisco-ar contains the server’s certificate file. The file server-cert.pem is assumed to be in PEM format; note that the file extension .pem is not significant.

set ServerCertificateFile PEM:/cisco-ar/pki/server-cert.pem

Private Key Password

Required; the password used to protect the server’s private key.

Server RSA Key File

Required; the full pathname of the file containing the server’s RSA private key.

CRL Distribution URL

Optional; The URL that Prime Access Registrar should use to retrieve the CRL.You can specify a URL that uses HTTP or LDAP.

The following is an example for an HTTP URL: <http://crl.verisign.com/pca1.1.1.crl>.

The following is an example for an LDAP URL: ldap://209.165.200.225:388/CN=development-CA,CN=acs-westcoast2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cisco,DC=com

CA Certificate File

Optional; the full pathname of the file containing trusted CA certificates used for client verification. The file can contain more than one certificate, but all certificates must be in PEM format. DER encoding is not allowed.

Certificate Verification Mode

Optional; specifies the type of verification used for client certificates. Must be set to one of RequireCertificate, None, or Optional.

• RequireCertificate causes the server to request a client certificate and authentication fails if the client refuses to provide one.
• None will not request a client certificate.

Optional causes the server to request a client certificate but the client is allowed to refuse to provide one.

CA Certificate Path

Optional; the name of a directory containing trusted CA certificates (in PEM format) used for client verification. This parameter is optional, and if it is used there are some special preparations required for the directory it references.

Each certificate file in this directory must contain exactly one certificate in PEM format. The server looks up the certificate files using the MD5 hash value of the certificate’s subject name as a key. The directory must therefore also contain a set of symbolic links each of which points to an actual certificate file. The name of each symbolic link is the hash of the subject name of the certificate.

For example, if a certificate file name ca-cert.pem is located in the CACertificatePath directory, and the MD5 hash of the subject name contained in ca-cert.path.pem is 1b96dd93, then a symbolic link named 1b96dd93 must point to the ca-cert.pem file.

If there are subject name collisions such as multiple certificates with the same subject name, each link name must be indexed with a numeric extension as in 1b96dd93.0 and 1b96dd93.1.

Verification Depth

Optional; specifies the maximum length of the certificate chain used for client verification.

Enable Session Cache

Optional; specifies whether TLS session caching (fast reconnect) is enabled or not. Set to True to enable session caching; otherwise set to False.

Tunnel Service

Required; must be the name of an existing EAP-MSCHAPv2 or EAP-SIM service.

Authentication Timeout

Required; specifies time (in seconds) to wait before an authentication request times out; defaults to 120.

Description (optional)

Optional; description of the PEAP service.

Session Timeout

Optional; if TLS session caching (fast reconnect) is enabled, SessionTimeout specifies the maximum lifetime of a TLS session. Expired sessions are removed from the cache and will require a subsequent full authentication.

SessionTimeout is specified as a string consisting of pairs of numbers and units, where units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks, as in the following:

Set SessionTimeout “1 Hour 45 Minutes”

Use ECC Certificates

Check this box, to use the ECC, RSA, or combination of both the certificates for certificate based verification.

When this field is disabled, only RSA is used for certificate based verification. The default location to fetch the certificate file is /cisco-ar/pki.

Enable Auto Chaining

When set to TRUE, Prime Access Registrar sends its server certificate chain (Server-Cert -> IntermediateCA -> RootCA) while presenting the server certificate to the client for server side authentication. When set to FALSE, Prime Access Registrar sends only the server certificate (Server-Cert) to the client.

Enable WPS

Optional; When set to TRUE, enables Windows Provisioning Service (WPS) and provides two other properties, MasterURL and WPSGuestUserProfile. The default value is FALSE.

Master URL

Optional; when using WPS, specifies the URL of the provisioning server which is modified with the appropriate fragment and sent to the client.

WPS Guest User Profile

Optional; when using WPS, specifies a profile to be used as a guest user profile; must be a valid profile under /Radius/Profiles.

This profile is used for guests and users whose account has expired. This profile normally contains attributes denoting the VLAN-id of the guest network (which has the provisioning server alone) and might contain IP-Filters that would restrict the access of the guest (to only the provisioning server).

Service Name

Required; service name

Incoming Script

Optional script Prime Access Registrar server runs when it receives a request from a client.

Type

Required; must set it to a valid Prime Access Registrar service

Outgoing Script

Optional script Prime Access Registrar server runs before it sends a response to a client

Description (optional)

Optional; description of the PEAP service.

Authentication Timeout

Mandatory; specifies time (in seconds) to wait before an authentication request times out; defaults to 120.

UserService

Required; name of service that can be used to authenticate using cleartext passwords.

ServiceList

List of preconfigured EAP authentication services. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Maximum Message Size

Required; indicates the maximum length in bytes that a PEAP message can have before it is fragmented.

Server Certificate File

Required; the full pathname of the file containing the server’s certificate or certificate chain used during the TLS exchange. The pathname can be optionally prefixed with a special string that indicates the type of encoding used for the certificate. The two valid encoding prefixes are PEM and DER. If an encoding prefix is not present, the file is assumed to be in PEM format.

Private Key Password

Required; the password used to protect the server’s private key.

Server Key File

Required; the full pathname of the file containing the server’s RSA private key. The pathname can be optionally prefixed with a special string that indicates the type of encoding used for the certificate. The two valid encoding prefixes are “PEM” and “DER”. If an encoding prefix is not present, the file is assumed to be in PEM format.

The following example assumes that the subdirectory pki under /cisco-ar contains the server’s certificate file. The file server-key.pem is assumed to be in PEM format. The file extension .pem is not significant.

set ServerRSAKeyFile PEM:/cisco-ar/pki/server-key.pem

CRL Distribution URL

Optional; enter the URL that Prime Access Registrar should use to retrieve the CRL.You can specify a URL that uses HTTP or LDAP.

The following is an example for an HTTP URL: <http://crl.verisign.com/pca1.1.1.crl>.

The following is an example for an LDAP URL: ldap://209.165.200.225:388/CN=development-CA,CN=acs-westcoast2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=cisco,DC=com

CA Certificate File

Optional; the full pathname of the file containing trusted CA certificates used for client verification. The file can contain more than one certificate, but all certificates must be in PEM format. DER encoding is not allowed.

Certificate Verification Mode

The value is set to optional by default. If set to RequireCertificate, the client certificate will always be verified. If set to optional, client certificate verification happens optionally.

CA Certificate Path

The name of a directory containing trusted CA certificates (in PEM format) used for client verification. This parameter is optional and if it is used there are some special preparations required for the directory it references.

Each certificate file in this directory must contain exactly one certificate in PEM format. The server looks up the certificate files using the MD5 hash value of the certificate’s subject name as a key. The directory must therefore also contain a set of symbolic links each of which points to an actual certificate file. The name of each symbolic link is the hash of the subject name of the certificate.

For example, if a certificate file named ca-cert.pem is located in the CACertificatePath directory, and the MD5 hash of the subject name contained in ca-cert.path.pem is 1b96dd93, then a symbolic link named 1b96dd93 must point to ca-cert.pem.

If there are subject name collisions such as multiple certificates with the same subject name, each link name must be indexed with a numeric extension as in 1b96dd93.0 and 1b96dd93.1.

Verification Depth

Optional; specifies the maximum length of the certificate chain used for client verification.

Enable Session Cache

Optional; specifies whether TLS session caching (fast reconnect) is enabled or not. Set to True to enable session caching; otherwise set to False.

Session Timeout

Required; if TLS session caching (fast reconnect) is enabled, SessionTimeout specifies the maximum lifetime of a TLS session. Expired sessions are removed from the cache and will require a subsequent full authentication.

SessionTimeout is specified as a string consisting of pairs of numbers and units, where units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks, as in the following:

Set SessionTimeout “1 Hour 45 Minutes”

UseECCCertificate

Determines the applicability of the authentication mechanism in SmartGrid Solutions.

When you check this check box, it can use the ECC, RSA, or combination of both certificate for certificate based verification.

When you uncheck this check box, it can only use the RSA certificate for certificate based verification. The default location to fetch the certificate file is /cisco-ar/pki.

EnableAutoChaining

When set to TRUE, Prime Access Registrar sends its server certificate chain (Server-Cert -> IntermediateCA -> RootCA) while presenting the server certificate to the client for server side authentication. When set to FALSE, Prime Access Registrar sends only the server certificate (Server-Cert) to the client.

Authentication Service

Specifies the name of the EAP-GTC service used for authentication. The named service must have the UseLabels parameter set to True.

User Prompt

Optional string the client might display to the user; default is Enter password:” Use the set command to change the prompt, as in the following:

set UserPrompt “Admin Password:”

UseLabels

Required; must be set to TRUE for EAP-FAST authentication and set to FALSE for PEAP authentication. Set to FALSE by default.

SystemID

Optional; string that identifies the sender of the MSChapV2 challenge message.

IsWindows7Client

Optional; must be set to TRUE for EAP-MSChapV2 authentication. Set to FALSE by default.

Authority Identifier

Required; a string that uniquely identifies the credential (PAC) issuer. The client uses this value to select the correct PAC to use with a particular server from the set of PACs it might have stored locally.

Authority Information

Required; a string that provides a descriptive text for this credential issuer. The value can be displayed to the client for identification purposes and might contain the enterprise or server names.

Credential Life Time

Optional; specifies the maximum lifetime of a Protected Access Credential (PAC). Clients that successfully authenticate with an expired PAC will be reprovisioned with a new PAC.

CredentialLifetime is specified as a string consisting of pairs of numbers and units, where units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks. Credentials that never expire should be specified as Forever.

Provision Service

Required; specifies the name of the EAP-MSChapV2 service used for provisioning.

Provision Mode

Required; specifies the TLS mode used for provisioning. Clients only support the default Anonymous mode.

Always Authenticate

Optional; indicates whether provisioning should always automatically rollover into authentication without relying on a separate session. Most environments, particularly wireless, will perform better when this parameter is set to True, the default value.

SubscriberDBLookup

Specifies the type of communication with the HLR/HSS server.

Based on the type selected, the communication happens with the HLR/HSS server using the diameter Wx interface, MAP protocol, or SIGTRAN-M3UA protocol.

This field is displayed when you select the eap-sim option in the Type field.

Subscriber_DBLookup

Specifies the type of communication with the HLR/HSS server.

Based on the type selected, the communication happens with the HLR/HSS server using the diameter Wx interface, SIGTRAN protocol, or SIGTRAN-M3UA protocol.

This field is displayed when you select the eap-sim, eap-aka, or eap-aka’ option in the Type field.

DestinationRealm

Required. Destination realm to send Diameter packets to the remote server. The role of the remote server should be Relay.

PreRequestTranslationScript

Optional. Prime Access Registrar server runs before sending the request to the Diameter remote server. The script can modify the RADIUS packet dictionaries.

PostRequestTranslationScript

Optional. Prime Access Registrar server runs before sending the request to the Diameter remote server. The script can modify the Diameter packet dictionaries.

PreResponseTranslationScript

Optional. Prime Access Registrar server runs after receiving the response from the Diameter remote server. The script can modify the Diameter packet dictionaries.

PostResponseTranslationScript

Optional. Prime Access Registrar server runs after receiving the response from the Diameter remote server. The script can modify the RADIUS packet dictionaries.

FetchAuthorizationInfo

When you check this check box, it fetches MSISDN from HLR.

The details in the tab are displayed based on the eap-sim, eap-aka, or eap-aka-prime option you select in the Type field.

MultipleServersPolicy

Required. Must be set to either Failover or RoundRobin.

When set to Failover, Prime Access Registrar directs requests to the first server in the list until it determines the server is offline. At that time, Prime Access Registrar redirects all requests to the next server in the list until it finds a server that is online.

When set to RoundRobin, Prime Access Registrar directs each request to the next server in the RemoteServers list to share the resource load across all of the servers listed in the RemoteServers list.

NumberOfTriplets

Required; number of triplets (1, 2, or 3) to use for authentication; default is 2.

PseudonymSecret

Required; the secret string that is used as the basis for protecting identities when identity privacy is enabled. This should be at least 16 characters long and have a value that is impossible for an outsider to guess. The default value is secret. This field is not available if EnableRollingPseudonymSecret field is checked.

Note It is very important to change PseudonymSecret from its default value to a more secure value when identity privacy is enabled for the first time.

PseudonymRenewtime

Required; specifies the maximum age a pseudonym can have before it is renewed. When the server receives a valid pseudonym that is older than this, it generates a new pseudonym for that subscriber. The value is specified as a string consisting of pairs of numbers and units, where the units might be of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks. The default value is “24 Hours”.

Examples are: “8 Hours”, “10 Hours 30 Minutes”, “5 D 6 H 10 M”

PseudonymLifetime

Required; specifies the maximum age a pseudonym can have before it is rejected by the server, forcing the subscriber to authenticate using it’s permanent identity. The value is specified as a string consisting of pairs of numbers and units, where the units might be one of the following: M, Minute, Minutes, H, Hour, Hours, D, Day, Days, W, Week, Weeks. It can also be Forever, in which case, pseudonyms do not have a maximum age. The default value is “Forever”.

Examples are: “Forever”, “3 Days 12 Hours 15 Minutes”, “52 Weeks”

NotificationService

(Optional); Notification service is an authorization service and is used to send a notification code to the client in case of an authorization failure. For more information about the Notification-Code variable, see the “Environment Dictionary” chapter of the Cisco Prime Access Registrar 9.1 Reference Guide.

This can be any of the services configured under /radius/services/ except eap services, accounting services, radius-session, radius-query, and diameter.

ReauthenticationTimeout

Required; specifies the time in seconds that reauthentication identities are cached by the server. Subscribers that attempt to reauthenticate using identities that are older than this value will be forced to use full authentication instead. The default value is 3600 (one hour).

EnableReauthentication

Optional; when True, the fast reauthentication option is enabled. The default value is False.

UseOutagePolicyforReauth

Default value is FALSE. When set to TRUE, Prime Access Registrar drops or rejects reauthentication requests as per outage policy when the remote server is down. This can be processed only when there is at least one failed full authentication before proceeding with reauthentication.

OutagePolicy

Required for EAP-SIM, EAP-AKA, and EAP-AKA’ services; the default is DropPacket. This property defines how Prime Access Registrar handles requests if all servers listed in the RemoteServers tab are unavailable (that is, all remote RADIUS servers are not available). You must set it to one of the following: AcceptAll, DropPacket, or RejectAll.

UseProtectedResults

Optional; enables or disables the use of protected results messages. Results messages indicate the state of the authentication but are cryptographically protected.

ReauthenticationRealm

Optional; realm to use for reauthentication.

MaximumReauthentications

Required; specifies the maximum number of times a reauthentication identity might be reused before it must be renewed. The default value is 16.

TripletCacheTimeout

Required for eap-sim service; time in seconds an entry remains in the triplet cache. A zero (0) indicates that triplets are not cached. The maximum is 28 days; the default is 0 (no caching).

QuintetCacheTimeout

Required for eap-aka or eap-aka’ service; time in seconds an entry remains in the quintet cache. A zero (0) indicates that quintets are not cached. The maximum is 28 days; the default is 0 (no caching).

QuintetGenerationScript

Available for eap-aka or eap-aka’ service; script required for quintet generation.

Authentication Timeout

Required; time in seconds to wait for authentication to complete. The default is 2 minutes; range is 10 seconds to 10 minutes.

UseSimDemoTriplets

Optional; set to TRUE to enable the use of demo triplets. This must be disabled for release builds.

AlwaysRequestIdentity

Optional; when True, enables the server to obtain the subscriber’s identity via EAP/SIM messages instead of relying on the EAP messages alone. This might be useful in cases where intermediate software layers can modify the identity field of the EAP-Response/Identity message. The default value is False.

EnableIdentityPrivacy

Optional; when True, the identity privacy feature is enabled. The default value is False.

Generate3GPPCompliantPseudonym

Optional; the value is set to False by default. If set to TRUE then Prime Access Registrar generates a 12 octet 3GPP compliant pseudonym identity. The Pseudonym username identities are used to protect the privacy of subscriber identities.

SendReAuthIDInAccept

Optional; the value is set to False by default. When set to True, Prime Access Registrar sends SN-Fast-ReAuth-UserName (Starent VSA) in access-accept message.

Outage Script

Optional; if you set this property to the name of a script, Prime Access Registrar runs it when an outage occurs. This property allows you to create a script that notifies you when the RADIUS server detects a failure.

NetworkName

Required for eap-aka-prime service type. Name of the access network for which the authentication is performed. This attribute is captured to ensure that the peer and the server know the name of the access network for performing the EAP authentication.

MapVersion

Required for SIGTRAN-M3UA remote server; select the map version HLR supports.

DiameterInterface

Select SWx or Wx to indicate the Diameter protocol to use for the service.

ProxyService

Select the diameter proxy service to use.

EnableRollingPseudonymSecret

Check this box to activate rolling encryption process that involves generating rolling pseudonym secrets for the service. This option is available only when EnableIdentityPrivacy check box is checked.

For more information about rolling encryption support, see Rolling Encryption Support for Pseudonym Generation in EAP-SIM, EAP-AKA, and EAP-AKA’ Services.

EnableEncryptedIMSI

Check this box to look out for encrypted IMSI in the incoming EAP response. For more information, see Support for Decrypting Encrypted-IMSI for EAP-SIM, EAP-AKA, and EAP-AKA’ Services.

The following three fields are available when you check this option.

EncryptedIMSIDelimiter

Delimiter value to identify whether the incoming EAP response is encrypted or not. Default value is ‘\0’ (NULL), which indicates the incoming message contains encrypted IMSI.

EncryptedIMSIKeyIdDelimiter

Delimiter value to indicate the key identifier from the incoming EAP response. Default value is ‘,’ (comma).

The data that exists between the IMSI delimiter (‘\0’) and Key ID delimiter (‘,’) in the incoming EAP response, is the encrypted IMSI.

The data that follows this Key ID delimiter (‘,’) helps the server to locate the private key that can be used to decrypt the incoming encrypted IMSI.

DefaultPrivateKey

Default private key to use for decryption if no private key is configured under Advanced > EncryptedIMSI-PrivateKeys. For more information, see Encrypted IMSI Private Keys

EnableStateStickiness

This field appears for eap-sim, eap-aka, and eap-aka-prime services.

Check this box to configure a state attribute value. If this box is unchecked, the Diameter remote server name will be carried as the state attribute value by default.

StateValue

This field appears if EnableStateStickiness is checked. Enter a state attribute value.

MEIdentityLookup

Check this box to enable Equipment Identity Registrar (EIR) check for the service. This is used for checking the mobile equipment’s identity status. For more details, see the “Mobile Equipment Identity Check Support in Cisco Prime Access Registrar” section in the “Wireless Support” chapter of the Cisco Prime Access Registrar 9.1 Reference Guide.

The following fields appear if MEIdentityLookup option is enabled.

IMEIUnavailable

Select one of the following options:

• Continue—Prime Access Registrar will continue the authentication/authorization even if the IMEI information is not received from the client.
• Terminate—Prime Access Registrar will terminate the authentication/authorization if the IMEI information is not received from the client.

GreyListPolicy

Select one of the following options:

• Accept—Prime Access Registrar will continue the authentication/authorization even if the equipment status is grey-listed from EIR check.
• Reject—Prime Access Registrar will reject the authentication/authorization if the equipment status is grey-listed from EIR check.

EIRProxyService

Separate proxy service for EIR that should be mapped with EIR remote servers.

EmergencyServiceMEIdentityLookup

Check this box to perform MEIdentityLookup during emergency services based on the EmergencyServicesPolicy set up under Radius/Advanced/Diameter/General.

MEIdentityLookupFailurePolicy

Select one of the following options:

• Continue—Prime Access Registrar will continue the authentication for emergency ME Identity Lookup EIR failure cases.
• Terminate—Prime Access Registrar will terminate the authentication for emergency ME Identity Lookup EIR failure cases.

This option is available only if EmergencyServiceMEIdentityLookup is checked.

Attribute

Optional; list of remote RADIUS servers which are map gateways. The remote server type must be set to map-gateway. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Name

Required; name of the Diameter server.

Description

Optional; description of the Diameter server.

Realm

Required; realm of the route. Must be unique for a route table.

Role

Required; specifies the role that the Diameter entity will play in resolving messages matching the realm.

The role can be any one of the following:

Relay - Application acting as a Relay Agent.

Redirect - Application acting as a Redirect Agent.

Proxy - Application acting as a Proxy Agent. When the role is set to Proxy, the IncomingScript and OutgoingScript points are enabled.

Local - Application processes the requests locally. When the role is set to Local, the AuthenticationService and AccountingService are enabled.

By default, the Proxy option is selected. However, you can select another option from the drop-down list.

Incoming Script

Optional; enabled when role is set to Proxy or Local. When set, must be the name of a known incoming script. Prime Access Registrar runs the IncomingScript before proxying the Diameter packet to the remote Diameter server.

Outgoing Script

Optional; enabled when role is set to Proxy or Local. When set, must be the name of a known outgoing script. Prime Access Registrar runs the OutgoingScript after it receives the response from the remote Diameter server.

Authentication Service

Required; used when service is configured to process the Diameter requests locally. Set to valid service of type (local/ldap/odbc) to authenticate the user. This field is displayed when you select the role type as ‘Local’ in the Role field.

AccountingService

Required; used when service is configured to process the accounting requests locally. Set to valid accounting service of type(file/odbc-accounting) to write the accounting records. This field is displayed when you select the role type as ‘Local’ in the Role field.

Type

Required; specifies the service type.The service type ‘Diameter’ is automatically displayed in this field.

This is displayed when you select the ‘Local’, ‘Relay’, or ‘Redirect’option in the Role field.

Name

Required; name of the peer.

Host Name

Required; the hostname or IP address of the peer. The hostname must exist in the client list for the route to be active.

Metric

Required; metric value for the peer entry. The higher the value the lower the preference. The highest value of preference is 0.

VendorSpecific

Required; the default is FALSE. If set to FALSE, the application is ordinary application and user is prompted to enter the ApplicationID. If set to TRUE, the application is a VendorSpecific Application. User is prompted to enter VendorSpecificApplicationID and VendorID.

VendorID

Required; specifies the VendorID for the application.

Example:

DIAMETER 3GPP Cx APPLICATION

VendorSpecificApplicationID 16777216

VendorID 10415

VendorSpecificApplicationID

Required; specifies the integer value for the vendor specific application.

ApplicationID

Required; application used in the route. The application Id should be available in /Advanced/Diameter/Applications.

This is displayed when you select the ‘Proxy’ option in the Role field.

Name

Required; name of the application.

Description

The description of the application.

ApplicationID

Required; specifies the unique integer value for the application. It represents the application id of the Application used for load balancing the Diameter messages.

EnableSticky

Required; default is FALSE. If set to True, the sticky entries for load balancing is enabled and the user is prompted to enter the values for StickySessionKey, StickyCreationCmdList, and StickyDeletionCmdList.

MultiplePeersPolicy

Required; Policy used by the Prime Access Registrar server to load balance the peers. Must be set to one of the following:

• RoundRobin—You can list the Diameter remote servers in the tab below.
• FailOver—You can list the Diameter remote servers in the tab below.
• GroupFailover—You can create individual groups of Diameter remote servers and list them in the tab below. This option allows you to perform group-based load balancing. For more information, see Group-Based Load Balancing.
• IMSIRangeBased—You can add the list of IMSI ranges in the tab below.

PeerTimeoutPolicy/GroupTimeoutPolicy

Required; action to perform when there is a timeout with the Diameter peer or group server.

StickySessionKey

Required; used as the sticky key for mapping the sticky sessions. Set the value to a valid attribute-value pair (AVP) in order to use the sticky key for maintaining Diameter sessions. This ensures that Prime Access Registrar maps the request to the same server for all the subsequent messages using the sticky key. For example, set StickyAVP “Session-Id”.

When the Prime Access Registrar server receives the CCR-I request, Prime Access Registrar extracts the Session-Id from the request packet, maps the Session to the peer configured in the list, and forwards the request to the chosen peer. Prime Access Registrar chooses the same peer for all the subsequent messages(CCR-Update/CCR-Terminate) with same Session-Id.

StickyCreationCmdList

Required; specifies the command list to create the sticky entries. Specify the list of ‘||’ separated command code, AVP name, and its value to create the sticky sessions.

The following is the StickyCreationCmdList format:

<commandcode1>::<AVPName1=Value1> || <commandcode2<::<AVPName2=Value2>||<commandcode3>

For example, if the sticky session entries need to created based on command code ‘265’or based on command code ‘271’ with Accounting-Record-Type value as 2, use the format below:

Set StickyCreationCmdList “265||271:: Accounting-Record-Type=2”

StickyDeletionCmdList

Required; specifies the command list to delete the sticky entries.Specify the list of ‘||’ separated command code, AVP name, and its value to delete the sticky sessions.

The following is the StickyDeletionCmdList format:

<commandcode1>::<AVPName1=Value1> || <commandcode2<::<AVPName2=Value2>||<commandcode3>

For example, if the sticky session entries need to deleted based on command code ‘271’ with Accounting-Record-Type value as 4, use the format below:

Set StickyDeletionCmdList “271:: Accounting-Record-Type=4”

Name

Required; name of the peer.

Host Name

Required; hostname or IP address of the peer. The HostName must exist in the client list for the route to be active.

Metric

Required; metric value for this peer entry. The higher the value the lower the preference. The highest value of preference is 0.

Weight

Required; default value is 0. Specifies the weight percentage for which the service needs to load balance the peer.

Note When you set the weight to a value other than 0, the weight should be in multiples of 10 and the sum of the weights configured in the peer list should be equal to 100.

IMSIRanges

Required; used for load balancing. The value is set to comma separated values of IMSI Ranges.

For example, set IMSIRanges “112156000000001-112156001000000,112156010000001-112156011000000”

Note Prime Access Registrar uses the AVP configured in StickyAVP property to check whether the IMSI is in valid range.

IsActive

Optional; if this is set to true, the new sessions will not go to the peer server. By default, this is set as false.

Action

Select Permit or Deny to indicate the action to be performed on the command during TACACS+ command authorization.

Command

The command to add in the set. Example:

Arguments

The arguments for the command. Example:

Note Prime Access Registrar supports POSIX Extended Regular Expression (ERE) for command arguments.

Name

Name of the expression to include in the device access rule.

Description

Description of the expression.

Attribute

Parameter to apply the condition on.

Value

Value of the parameter.

Note Prime Access Registrar supports POSIX Extended Regular Expression (ERE) for condition expression value property.

Name

Required; name of the fast rule.

Description

Optional; description of the fast rule.

Protocol

Required; select the type of packet that the fast rule is applicable for from one of the following options:

• Radius
• Diameter
• Tacacs

Condition

Condition based on which the fast rule will be run on the incoming packet.

If the condition is success, enter the action to be performed in the Success field. If the condition is failure, enter the action to be performed in the Failure field.

Name

Name of the attribute to include in the condition.

Description

Description of the attribute.

Dictionary

Select type of the dictionary variable as Environment, Request, or Response to map the attribute to.

Replication Type

Indicates the type of replication

Transaction Sync Interval (in ms)

Duration between periodic transmission of the TransactionSync message expressed in milliseconds. The default is 60000 or 1 minute.

Transaction Archive Limit

The default setting is 100.

The value set for RepTransactionArchiveLimit should be the same on the master and the slave.

Replication Secret

The value of this setting must be identical on both the master and the slave.

Is Master

On the master, set RepIsMaster to TRUE. On the slave, set it to FALSE.

Master IP Address

Specifies the IP Address of the master.

Master Port

Specifies the port to be used to send replication messages to the master.

Replication IP Address

The value is set to the IP Address of the machine containing the Prime Access Registrar installation.

Replication Port

Defaults to port1645.

Name

Name of the slave. The name must be unique.

IP Address

Indicates the IP Address of the slave.

Port

Port upon which the master will send replication messages to the slave.

Name

Required; must be unique in the RADIUS dictionary list

Description

Optional; description of the attribute

Attribute

Required; must be a number between 1-255. It must be unique within the Attribute dictionary list.

Type

Required; type governs how the value is interpreted and printed.

Minimum

Set to zero

Maximum

Set to 253

Enum Number

Enums allow you to specify the mapping between the value and the strings. After you have established this mapping, Prime Access Registrar then replaces the number with the appropriate string. The min/max properties represent the lowest to highest values of the enumeration.

Enum Equivalent

The value can range from 1 through 255. Click the Add button to save the details and list it in the Enums list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Tag

The tag number value can range from 0 through 31. The default value is zero.

Name

Required; must be unique in the Vendor dictionary list

Description

Optional; description of the attribute

Vendor ID

Required; must be a valid number and unique within the entire attribute dictionary

Type

Required; type governs how the value is interpreted and printed.

Minimum

Optional; set to zero

Maximum

Optional; set to 253

Enum Number

Optional; enums allow you to specify the mapping between the value and the strings. After you have established this mapping, Prime Access Registrar then replaces the number with the appropriate string. The min/max properties represent the lowest to highest values of the enumeration.

Enum Equivalent

Optional; the value can range from 1 through 255. Click the Add button to save the details and list it in the Enums list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Tag

Optional; the tag number value can range from 0 through 31. The default value is zero.

Vendor Size

Optional; set the vendor size to 8, 16, or 32 bit

HasSubAttributeLengthField

Optional; indicates that the value field of the attribute has the length field for the sub attribute.

Name

Required; must be unique in the Vendor attribute list

Description

Optional; description of the attribute

Attribute

Required; must be a valid number and unique within the entire attribute dictionary

Type

Required; type governs how the value is interpreted and printed.

Minimum

Optional; set to zero

Maximum

Optional; set to 253

Enum Number

Optional; enums allow you to specify the mapping between the value and the strings. After you have established this mapping, Prime Access Registrar then replaces the number with the appropriate string. The min/max properties represent the lowest to highest values of the enumeration.

Enum Equivalent

Optional; the value can range from 1 through 255. Click the Add button to save the details and list it in the Enums list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Tag

Optional; the tag number value can range from 0 through 31. The default value is zero.

Name

Required; must be unique in the Vendors list.

IncomingScript

Optional; when you specify an IncomingScript, Cisco Prime Access Registrar runs the script on all requests from clients that specify that vendor.

Description

Optional; description of the vendor.

OutgoingScript

Optional; when you specify an OutgoingScript, Cisco Prime Access Registrar runs the script on all responses to the Client.

Name

Required; must be unique in the Translations list.

Description

Optional; description of the Translation

Attribute Type

Optional; select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list. Select the attributes from the available list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Attribute Type

Optional; select either RADIUS or VENDOR. If Vendor is selected, specify the vendor type from the drop-down list.

Attribute Name

Optional; based on the Attribute Type selected, the attribute name is automated. Set the relevant name for the attribute type selected.

Attribute Value

Optional; set the value for the selected attribute. Click the Add button to save the details and list it in Radius and Value list. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details. To delete the available attributes, select the relevant attribute and click the Delete button below.

Name

Required; must be unique in the Translations list.

Description

Optional; description of the Translation Group.

Translations

Optional; lists of translation. To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Product

Optional; name of the product.

AuthApplicationIdList

Specifies the list of AuthApplications that the Prime Access Registrar server registers to Diameter Base stack during start up. It is a combination of Auth ApplicationId's separated by a colon.

Version

Optional; version number.

AcctApplicationIdList

Specifies the list of AcctApplications that the Prime Access Registrar server registers to Diameter Base stack during start up. It is a combination of Acct ApplicationId's separated by a colon.

EmergencyServicesPolicy

Emergency Services support is applicable for packets containing Emergency-Services AVP in the incoming Diameter-EAP-request. Choose one of the following:

• All—For all users. Prime Access Registrar skips authorization and authentication and generates EAP-Master-Session-Key using IMEI from user in Terminal-Information AVP.
• UnauthenticatedIMSI—When authentication is failed, EAP-Notification is skipped. It returns unknown user error and the next request comes with IMEI from the user.
• AuthenticatedIMSI—When authorization is failed, it returns Diameter-Success with the emergency information acquired from HSS.
• Authenticated-AuthorizedIMSI—When both are successful, only APN-Configuration is removed and emergency information from HSS is sent.

Identity

Required; identity of the system on which Diameter application is running. Must be set to a valid resolvable string.

Realm

Required; must be set to a valid Realm in the domain.

EnableIPV6

Required; if set to TRUE it enables IPV6 for the Diameter application.

ValidateIncomingMessages

Check the box to validate incoming messages.

ValidateOutgoingMessages

Check the box to validate outgoing messages.

MaximumNumberofDiameterPackets

Required; the maximum number of Diameter packets that can be processed.

DiameterPacketSize

Required; the Diameter packet size that can be processed.

An incoming Diameter packet with a packet size more than the value set in this field will be dropped.

WatchdogTimeout

Required; specifies the time interval between watch dog messages.

ReserveDiameterPacketPool

Percentage of the Diameter packet pool to reserve for the Diameter remote server responses.

TCPListenPort

Required; port number on which the Prime Access Registrar server listens for TCP peer connections.

SCTPListenPort

Required; port number on which the Prime Access Registrar server listens for SCTP peer connections.

ReconnectInterval

Required; specifies the time interval between which Prime Access Registrar server attempts to connect to a disconnected peer. If set to 0, then no attempt will be made to connect to a disconnected peer.

MaxReconnections

Required; specifies the number of times Prime Access Registrar server tries to make a reconnection attempt. If set to 0, then no attempt will be made to reconnect.

RequestRetransmissionInterval

Required; the time for which retransmission of pending requests will be done. If set to 0, then no attempt will be made to retransmit.

MaxRequestRetransmissionCount

Required, maximum number of times Prime Access Registrar server tries to retransmit a pending request. If set to 0, then no attempt will be made to retransmit.

Receive BufferSize

Required; initial size of buffer that is preallocated for message reception.

MaxInitRetry

Maximum number of retries for INIT message to open a connection. Valid range is 0 - 255. Set to 0 to retry indefinitely.

MaxInboundStream

Maximum number of incoming streams per connection. Valid range is 1 - 65545.

MaxOutboundstream

Maximum number of outgoing streams per connection. Valid range is 1 - 65545.

HeartbeatInterval

Default heartbeat interval for a connection.

EnableHeartbeat

Indicates whether to enable or disable heartbeat to monitor the connections and allow earlier detection of loss connections.

AdvertisedHostName

Optional, specifies the local hostname address that will be advertised by the Prime Access Registrar server to other peers during CER/CEA exchange.

For example:

AdvertisedHostNames = toby-ar1.cisco.com

MaxNumberOfSessions

Required; specifies the maximum number of concurrent Diameter sessions the Prime Access Registrar server will maintain. These sessions include both Auth and Acct sessions.

EnableStatefulSessions

If set to TRUE, the server will enforce stateful sessions and the client will hint for stateful sessions. Default Value is TRUE. Set the property to FALSE to disable stateful sessions.

AuthSessionTimeout

Required; specifies the timeout in seconds before a session requires reauthentication.

LifeTimeTimeout

Required; specifies the timeout in seconds before a session is terminated regardless of whether the session has been reauthenticated.

GracePeriodTimeout

Required; specifies the grace period after the life timeout and before the full termination of the session.

AbortRetryTimeout

Required; specifies the timeout between the subsequent Abort Session Request (ASR) messages if the initial attempt fails.

AcctSessionTimeout

Required; specifies the timeout in seconds before a session requires reauthentication.

InterimInterval

Required; specifies the interim interval dictated to the client if the entity is a server or hint to the server if the entity is a client.

RealTime

Required; RealTime value dictated to the client.

Name

Required; name of the application.

Description

Optional; description of the application.

VendorSpecific

Required; the default is FALSE. If set to FALSE, the application is ordinary application and user is prompted to enter the ApplicationID. If set to TRUE, the application is a VendorSpecific Application. User is prompted to enter VendorSpecificApplicationID and VendorID.

AuthApplication

Required; if set to TRUE the application represents AuthApplication else it represents Accounting Application.

ApplicationURI

Optional; specifies the URI of the Application.

Eg: "ftp://ftp.ietf.org/internet-drafts/draft-ietf-aaa-diameter-nasreq- 12.txt"

ApplicationID

Required; specifies the unique integer value for the application.

The following are examples of Diameter application:

NASREQ 1

Mobile-IP 2

Diameter Base Accounting 3

Note ApplicationURI property must be set to 0 for Base Protocol.

VendorSpecificApplicationID

Required; specifies the integer value for the vendor specific application.

VendorID

Required; specifies the VendorID for the application.

Example:

DIAMETER 3GPP Cx APPLICATION

VendorSpecificApplicationID 16777216

VendorID 10415

Commands

Required; an indexed list from 1 to <n>. Each entry in the list is the name of the command. It specifies the list of commands associated with the application.

To navigate between the listed attributes, use the navigation option available adjacent to the list. See Relocating Records for more details.

Name

Required; name of the command.

Description

Optional; description of the command.

Command Code

Required; specifies the integer code of the command.

EnableProxyBit

Required; default is TRUE. When enabled it represents the message is proxiable.

RequestFixed tab

Defines the fixed position of AVP in a request message.

RequestRequired tab

The AVP must be present and can appear anywhere in the request message.

RequestOptional tab

The AVP name in optional cannot evaluate to any avp name which is included in a fixed or required directory. The avp can appear anywhere in the request message.

AnswerFixed tab

Defines the fixed position of AVP in the answer message.

AnswerRequired tab

The AVP must present and can appear anywhere in the answer message.

AnswerOptional tab

The AVP name in optional cannot evaluate to any avp name which is included in a fixed or required directory. The avp can appear anywhere in the answer message.

Name

Required; name of the AVP.

Description

Optional; description of the AVP.

Min

Specifies the minimum number of times AVP element may be present in a request. The default value is 0.

Max

Specifies the maximum number of times the element may present in a request. A value of zero implies AVP is not present in the request.

Name

Required; name of the attribute.

Description

Optional; description of the attribute.

Attribute

Required; attribute value.

VendorID

Required; Vendor ID of the Diameter application.

Mandatory

Indicates whether the attribute is mandatory or not. Options are May, Must, and MustNot.

May-Encrypt

Choose Yes or No to indicate whether the attribute value can be encrypted or not.

Protected

Indicates whether the attribute value is protected or not. Options are May, Must, and MustNot.

Type

Choose the type of the attribute.

Minimum

Minimum value for the attribute.

Maximum

Maximum value for the attribute.