RADIUS Accounting for Subscriber Access

Layer 3 Wholesale Scenarios

In a Layer 3 wholesale network environment, the wholesaler and retailer might use different RADIUS accounting servers, and both might want to receive accounting reports. In this situation, you can configure RADIUS accounting duplicate reporting, which sends reports to both the wholesaler and the retailer accounting servers. The target to which the duplicate accounting records are sent must be in the default:default logical system:routing instance combination (LS:RI) , also called the default VRF.

Table 2 shows where subscriber management sends the accounting reports when you enable duplicate reporting. Subscriber management sends duplicate reports based on the access profile in which you configure the duplication statement at the [edit access profile profile-name accounting] hierarchy level, where the subscriber resides, and how the subscriber is authenticated.

Other Scenarios

For scenarios that are not in a Layer 3 wholesale network environment, you might want to send duplicate accounting records to a different set of RADIUS servers that reside in either the same or a different routing context. Unlike the Layer 3 wholesale scenario, the target for the duplicate RADIUS accounting records does not have to be the default VRF. You can specify a single nondefault VRF—that is, other than the default:default LS:RI combination—as the target. Additionally, you can specify up to five access profiles in the target VRF that list the RADIUS accounting servers that receive the duplicate reports.

For example, you might have a lawful intercept scenario where the subscriber is authenticated in the default domain. An authorized law enforcement organization needs duplicate accounting records for the subscriber to be sent to a mediation device that resides in the organization’s networking domain, which lies in a nondefault VRF.

Subscriber management sends duplicate reports to the VRF that you specify with the vrf-name statement at the [edit access profile profile-name accounting duplication-vrf] hierarchy level. Include the access-profile-name statement at the same level to designate the access profiles that in turn specify the RADIUS servers that receive the duplicate reports.

Filters for Duplicate Accounting Reports

Subscriber management provides a duplication filter feature that enables you to specify which accounting servers receive the RADIUS accounting interim reports when RADIUS accounting duplicate reporting is active. You configure the filters in the AAA access profile, and the router then applies the filters to subscribers associated with that profile.

Subscriber management supports the following filtering for RADIUS accounting duplicate reporting:

• Duplicated accounting interim messages— The router filters duplicate accounting messages. The accounting messages are sent only to RADIUS accounting servers in the subscriber’s access profile.

• Original accounting interim messages—The router filters accounting messages destined for original RADIUS accounting servers, which are accounting servers in the subscriber’s access profile. The accounting messages are sent only to duplication accounting servers (servers in a duplication access profile other than the subscriber’s access profile).

• Excluded RADIUS attributes—The router filters the RADIUS attributes in the accounting messages based on the exclude statement configuration in the access profile under the duplication context. You can use the exclude filter alone, or with the duplicated or original accounting message filters.

Purpose

Display information about RADIUS accounting stop messages that are being withheld due to an inability to contact the RADIUS accounting server.

Action

When you want to know whether the number of pending accounting-stop messages is nearing the maximum, you can display a simple count of pending requests:

You can use other commands to display more information about the accounting messages. The next example displays information for all services in the accounting session for the user, vjshah29@example.com. Although this example shows only one user, this command actually displays the information for all subscribers for whom accounting is being backed up.

You can display summary information for all users with a particular access profile. In the following example, only a single user, vjshah29@example.com, has the specified access profile, ce-ppp-profile:

You can also display summary information for all subscribers that have accounting-stop messages pending, regardless of access profile. The next example displays information for two users. Because the subscriber larry@example.com is not shown in the previous example, he must have a different access profile than vjshah29@example.com, even though he has received the same services.

Sequence of Events During the Suspension, Baselining, and Resumption of Accounting

The following sequence of events occur when you suspend accounting, generate a baseline, and restart accounting processes:

1. Issue the request network-access aaa accounting suspend command to suspend accounting.

   1. A system logging message is generated to indicate that accounting has been suspended.

   2. All accounting, including accounting-backup-options, is suspended for all accounting servers in all routing contexts.

2. Issue the request network-access aaa accounting baseline command to generate a baseline.

   1. A system logging message is generated to indicate that baselining has started for accounting statistics.

   2. Time and volume statistics for each subscriber are set to the baseline value. The amount of time that is taken to complete the baseline process is indeterminate, depending on the number of statistical details.

   3. A system logging message is generated to indicate that baselining has completed.

3. Issue the request network-access aaa accounting resume command when baselining is complete to restart accounting processes.

   1. A system logging message is generated to indicate that accounting has resumed.

   2. All previously configured accounting options are reenabled.

The baseline operation attempts to baseline the time and volume counters for each subscriber. Subscriber counters are set to baseline values only if interim accounting is enabled for the subscriber by using the set update-interval minutes statement at the [edit access profile profile-name accounting] hierarchy level. If interim accounting is not enabled for a subscriber, the counters of that corresponding subscriber are not mapped to baseline values.

After the baseline request is executed, an unspecified period of time elapses to baseline all subscriber records. During this interval, statistics for one subscriber can accumulate when the statistical information of another subscriber is being baselined. Sometimes, after baselining starts, counters for some services might be inaccurate and inconsistent due to traffic delivered to a subscriber while the counters of that subscriber are baselined. When the baseline command has been executed, accounting cannot be resumed until the baseline is complete. If you issue the command while accounting is not suspended or while baselining is in progress, the command fails. The command reports an error if the Accounting License is not installed.

Guidelines for Accounting Suspension and Baselining of Statistics

Keep the following points in mind when you suspend accounting and specify a baseline for statistics:

• Accounting suspension in an environment where thresholds (or quotas) are applicable is not supported. This includes environments where Gx-Plus and Juniper Networks Session and Resource Control (SRC) thresholds or RADIUS session volume quotas are effective for any subscriber. The accounting suspend request fails if any subscriber has thresholds or quotas.

• Activation for threshold (or quota) services is not allowed while accounting is suspended.

• Accounting baselining is not supported when accounting is not suspended.

• You cannot specify more than one baseline request during an accounting suspension.

• Baselining for subscribers that are not configured with interim accounting is not supported.

• The time it takes for the baseline operation to complete is indeterminate. It depends on the amount and depth of statistics being collected and is proportional to the number of subscriber and service sessions that are active at the time the baseline is started. The command fails if you attempt to resume accounting while baselining is still in progress.

• You cannot use the commands to suspend, baseline, or resume accounting during a unified ISSU process. If you attempt to perform a unified ISSU while the baseline is in process, when the chassis daemon state changes to the DAEMON_ISSU_PREPARE state, the authentication and Packet Forwarding Engine processes suspend baselining on a session boundary and resume after the Routing Engine switchover to the release to which the device is upgraded.

• If a graceful Routing Engine switchover (GRES) occurs while accounting is suspended or baselining is in progress, the state of suspension or baselining is preserved after the restart of the router. In such a scenario, accounting is suspended after the reboot of the router and the subscribers for which counters are remaining to be baselined are baselined after the router is online.

Sample Scenarios of Subscriber Accounting Suspension and Baselining

Consider the following scenario:

1. Interim accounting is configured for subscriber X. It is not configured for subscribers Y and Z.

2. The last interim accounting request sent before accounting is suspended includes statistics for subscriber X; 50,000 octets of traffic have so far been sent for this subscriber. Although 20,000 octets have been sent for subscriber Y and 10,000 octets for subscriber Z, that information has not yet been reported because they do not have interim accounting configured.

3. Accounting is suspended.

4. Baselining begins. The current count for subscriber X is 50,000 octets; this becomes the baseline value for the subscriber. No baseline value is established for subscribers X and Y, because they do not have interim accounting configured.

5. While baselining is in progress, traffic continues to be sent for the three subscribers: 150,000 octets for subscriber X, 80,000 octets for subscriber Y, and 20,000 octets for subscriber Z.

6. Subscriber Z logs out. No Acct-Stop request is sent because accounting is suspended. Consequently, the final accounting statistics are lost for this subscriber.

7. Baselining completes.

8. Accounting resumes.

9. Subscriber X logs out. Although 200,000 total octets were sent for subscriber X, the Acct-Stop record reports only 150,000 octets: 200,000 total octets minus the 50,000 octet baseline.

10. Subscriber Y logs out. Because 100,000 total octets were sent for subscriber Y and there is no baseline value, the Acct-Stop record reports the total of 100,000 octets.

Table 7 summarizes this scenario.