Subscriber AAA Accounting Messages

Accounting messages identify service provisions and use on a per-user or per-tunnel basis. These messages keep track of when a particular service is initiated and terminated for a specific user.

JUNOSe software supports the Acct-On message on startup or configuration of the first accounting server. Acct-Off messages are supported when the last RADIUS accounting server in a virtual router is removed, when the router is shut down, and when a virtual router that has configured RADIUS accounting servers is deleted.

The router supports the following types of accounting messages:

• Acct-Start
• Acct-Stop
• Interim-Acct
• Acct-On
• Acct-Off

Supported RADIUS IETF Attributes

Table 38 lists the RADIUS IETF attributes supported for Acct-Start, Acct-Stop, Interim-Acct, Acct-On, and Acct-Off messages.

The following notes are referred to in Table 38:

1. The attribute is used when terminating a PPP connection at the LNS or the initiating LAC.
2. For this attribute to be included, an IP address must be assigned to the subscriber.
3. The attribute is not included in Acct-Stop messages that are sent when a user session does not get established in one of the following situations.
   • The aaa accounting acct-stop on-access-deny command is enabled and the authentication server sends an Access-Reject (deny) message.
   • The aaa accounting acct-stop on-aaa-failure command is enabled and the authentication server issues an Access-Accept message (grant), but the AAA configuration denies access for the user. The aaa accounting acct-stop on-aaa-failure is enabled by default.
   • The aaa accounting acct-stop on-aaa-failure command is enabled and the user terminates before AAA receives the authentication response from the authentication server.
4. For this attribute to be included, an IPv6 interface ID must be assigned to the subscriber.
5. For this attribute to be included, at least one IPv6 prefix must be assigned to the subscriber.

   Table 38: AAA Accounting Message RADIUS IETF Attributes Supported

   Attribute Number	Attribute Name	Acct-Start	Acct-Stop	Interim-Acct	Acct-On	Acct-Off
   [1]	User-Name	✓	✓	✓	–	–
   [4]	NAS-IP-Address	✓	✓	✓	✓	✓
   [5]	NAS-Port	✓	✓	✓	–	–
   [6]	Service-Type	✓	✓	✓	–	–
   [7]	Framed-Protocol (See Note 3.)	✓	✓	✓	–	–
   [8]	Framed-IP-Address (See Note 2.)	✓	✓	✓	–	–
   [9]	Framed-IP-Netmask	✓	✓	✓	–	–
   [13]	Framed-Compression (See Note 3.)	✓	✓	✓	–	–
   [25]	Class	✓	✓	✓	–	–
   [30]	Called-Station-Id	✓	✓	✓	–	–
   [31]	Calling-Station-Id	✓	✓	✓	–	–
   [32]	NAS-Identifier	✓	✓	✓	✓	✓
   [40]	Acct-Status-Type	✓	✓	✓	✓	✓
   [41]	Acct-Delay-Time	✓	✓	✓	✓	✓
   [42]	Acct-Input-Octets	–	✓	✓	–	–
   [43]	Acct-Output-Octets	–	✓	✓	–	–
   [44]	Acct-Session-Id	✓	✓	✓	✓	✓
   [45]	Acct-Authentic	✓	✓	✓	✓	✓
   [46]	Acct-Session-Time	–	✓	✓	–	–
   [47]	Acct-Input-Packets	–	✓	✓	–	–
   [48]	Acct-Output-Packets	–	✓	✓	–	–
   [49]	Acct-Terminate-Cause	–	✓	–	–	✓
   [50]	Acct-Multi-Session-Id (See Note 3.)	✓	✓	✓	–	–
   [51]	Acct-Link-Count (See Note 3.)	✓	✓	✓	–	–
   [52]	Acct-Input-Gigawords	–	✓	✓	–	–
   [53]	Acct-Output-Gigawords	–	✓	✓	–	–
   [55]	Event-Timestamp	✓	✓	✓	✓	✓
   [61]	NAS-Port-Type	✓	✓	✓	–	–
   [64]	Tunnel-Type (See Note 1.)	✓	✓	✓	–	–
   [65]	Tunnel-Medium-Type (See Note 1.)	✓	✓	✓	–	–
   [66]	Tunnel-Client-Endpoint (See Note 1.)	✓	✓	✓	–	–
   [67]	Tunnel-Server-Endpoint (See Note 1.)	✓	✓	✓	–	–
   [68]	Acct-Tunnel-Connection (See Note 1.)	✓	✓	✓	–	–
   [77]	Connect-Info	✓	✓	✓	–	–
   [82]	Tunnel-Assignment-Id (LAC only) (See Note 1.)	✓	✓	✓	–	–
   [83]	Tunnel-Preference (LAC only)	✓	✓	✓	–	–
   [87]	NAS-Port-Id	✓	✓	✓	–	–
   [90]	Tunnel-Client-Auth-Id (See Note 1.)	✓	✓	✓	–	–
   [91]	Tunnel-Server-Auth-Id (See Note 1.)	✓	✓	✓	–	–
   [96]	Framed-Interface-Id (See Note 1.)	✓	✓	✓	–	–
   [97]	Framed-Ipv6-Prefix (See Note 5.)	✓	✓	✓	–	–
   [99]	Framed-IPv6-Route	✓	✓	✓	–	–
   [100]	Framed-IPv6-Pool	✓	✓	✓	–	–
   [123]	Delegated-Ipv6-Prefix	✓	✓	✓	–	–
   [188]	Ascend-Num-In-Multilink (See Note 3.)	✓	✓	✓	–	–

Supported Juniper Networks VSAs

Table 39 lists the Juniper Networks (Vendor ID 4874) VSAs supported for Acct-Start, Acct-Stop, Interim-Acct, Acct-On, and Acct-Off messages.

The following notes are referred to in Table 39:

1. The attribute is not included in Acct-Stop messages that are sent when a user session does not get established in one of the following situations.
   • The aaa accounting acct-stop on-access-deny command is enabled and the authentication server sends an Access-Reject (deny) message.
   • The aaa accounting acct-stop on-aaa-failure command is enabled and the authentication server issues an Access-Accept message (grant), but the AAA configuration denies access for the user. The aaa accounting acct-stop on-aaa-failure is enabled by default.
   • The aaa accounting acct-stop on-aaa-failure command is enabled and the user terminates before AAA receives the authentication response from the authentication server.
2. ERX routers send IPv6 accounting attributes in the Acct-Stop and Interim-Acct messages (stop, interim) when they are configured to return these attributes and when the subscriber is either an IPv6 subscriber or a combined IPv4/IPv6 subscriber in a dual stack. For an IPv4 subscriber, IPv6 accounting attributes are not included in the accounting messages even if the IPv6 accounting is enabled.

   In JUNOSe Release 10.1.x and lower-numbered releases, the combined accounting statistics were retrieved at the layer 2. Therefore, error or discarded packets in the layer 2 itself were excluded in these statistics. Because the layer 2 cannot detect the error or discarded packets in the layer 3, the combined statistics also include the error or discarded packets of the layer 3. In this release, with the support for RADIUS VSAs for IPv6 accounting, the IPv6 statistics are retrieved at the layer 3. To be consistent with the combined statistics, the error or discarded packets of the layer 3 are also included in these IPv6 statistics.

Table 39: AAA Accounting Message Juniper Network (Vendor ID 4874) VSAs Supported

Tunnel Accounting Messages

Table 40 lists RADIUS attributes supported by the following tunnel-related accounting messages:

• Acct-Tunnel-Start
• Acct-Tunnel-Stop
• Acct-Tunnel-Reject
• Acct-Tunnel-Link-Start
• Acct-Tunnel-Link-Stop
• Acct-Tunnel-Link-Reject

  Table 40: AAA Accounting Tunnel Message RADIUS Attributes Supported

  Attribute Number	Attribute Name	Acct-Tunnel- Start	Acct-Tunnel- Stop	Acct-Tunnel- Reject	Acct-Tunnel- Link-Start	Acct-Tunnel- Link-Stop	Acct-Tunnel- Link-Reject
  [1]	User-Name	–	–	–	✓	✓	–
  [4]	NAS-IP-Address	✓	✓	✓	✓	✓	✓
  [26-51]	Disconnect-Cause	–	–	–	–	✓	–
  [32]	NAS-Identifier	✓	✓	✓	✓	✓	✓
  [40]	Acct-Status-Type	✓	✓	✓	✓	✓	✓
  [41]	Acct-Delay-Time	✓	✓	✓	✓	✓	✓
  [44]	Acct-Session-Id	✓	✓	✓	✓	✓	✓
  [46]	Acct-Session-Time	–	✓	–	–	✓	–
  [49]	Acct-Terminate-Cause	–	✓	✓	–	✓	✓
  [55]	Event-Timestamp	✓	✓	✓	✓	✓	✓
  [64]	Tunnel-Type	✓	✓	✓	✓	✓	✓
  [65]	Tunnel-Medium-Type	✓	✓	✓	✓	✓	✓
  [66]	Tunnel-Client-Endpoint	✓	✓	✓	✓	✓	✓
  [67]	Tunnel-Server-Endpoint	✓	✓	✓	✓	✓	✓
  [68]	Acct-Tunnel- Connection	✓	✓	✓	✓	✓	✓
  [82]	Tunnel-Assignment-Id (LAC only)	✓	✓	✓	✓	✓	✓
  [83]	Tunnel-Preference (LAC only)	–	–	–	✓	✓	✓
  [86]	Acct-Tunnel-Packets- Lost	–	–	–	–	✓	✓
  [90]	Tunnel-Client-Auth-Id	✓	✓	✓	✓	✓	✓
  [91]	Tunnel-Server-Auth-Id	✓	✓	✓	✓	✓	✓

Copyright © 2009, Juniper Networks, Inc. All rights reserved. Trademark Notice.