Per-User QoS via AAA Policy Name

The Per-User QoS via AAA Policy Name feature provides the ability to download a policy name that describes quality of service (QoS) parameters for a user session from a RADIUS server and apply them for the particular session.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Prerequisites for Per-User QoS via AAA Policy Name

Before you configure the Per-User QoS via AAA Policy Name feature, you must locally define on your router the policy whose name is received from the RADIUS server.

Information About Per-User QoS via AAA Policy Name

Effective with Cisco IOS XE Release 2.1, separate Cisco vendor-specific attributes (VSAs) are added for the service map.

VSAs Added for Per-User QoS via AAA Policy Name

Two new VSAs have been added for the service map, and the VSAs will bypass the parser while applying the policy for a particular user or session. The new VSAs are as follows:

  • vendor-id=9 (Cisco) Vendor type 37 for upstream traffic to input policy name

  • vendor-id=9 (Cisco) Vendor type 38 for downstream traffic to output policy name

Cisco AV Pairs for Policy-Maps

In Cisco IOS XE Release 2.1, the following two Cisco AV pairs for policy maps are defined at the ATM VC level:

  • Cisco VSA attribute vc-qos-policy-in

  • Cisco VSA attribute vc-qos-policy-out

These VSA attributes are formatted as:

  • cisco-avpair = “atm:vc-qos-policy-in=<in policy name>”

  • cisco-avpair = “atm:vc-qos-policy-out=<out policy name>”

In addition, two Cisco Generic RADIUS VSAs replace two others that do not correctly follow the Cisco VSA naming guidelines.

The two replacement VSAs are:

  • cisco-avpair = “ip:sub-qos-policy-in=<in policy name>”

  • cisco-avpair = “ip:sub-qos-policy-out=<out policy name>”

These VSAs should be used in place of the following outdated, generic VSAs:

  • cisco-avpair = “ip:sub-policy-In=<in policy name>”

  • cisco-avpair = “ip:sub-policy-Out=<out policy name>”


Note

We recommend using the new VSAs. However, the replaced attributes are currently still supported.

How to Configure Per-User QoS via AAA Policy Name

To configure per-user QoS, use the authentication, authorization, and accounting (AAA) policy name that you have received from the RADIUS server. To configure QoS policy, refer to the How to Configure Per-User QoS via AAA Policy Name. http:/​/​www.cisco.com/​univercd/​cc/​td/​doc/​product/​software/​ios122/​122cgcr/​fdial_c/​fnsprt11/​dafprusr.htm

Monitoring and Maintaining Per-User QoS via AAA Policy Name

To monitor and maintain per-user QoS using the AAA policy name, use the following debug commands:

SUMMARY STEPS

    1.    enable

    2.    debug aaa authorization

    3.    debug aaa per-user


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 debug aaa authorization


    Example:
    Router# debug aaa authorization
     

    Displays information about AAA/TACACS+ authorization.

     
    Step 3 debug aaa per-user


    Example:
    Router# debug aaa per-user
     

    Displays information about per-user QoS parameters.

     

    Configuration Example for Per-User QoS via AAA Policy Name

    The following example shows per-user QoS being configured using the AAA policy name “policy_class_1_2”:

    !NAS configuration 
class-map match-all class1 
 match access-group 101 
class-map match-all class2 
 match qos-group 4 
 match access-group 101 
policy-map policy_class_1_2 
 class class1 
 bandwidth 3000 
 queue-limit 30 
 class class2 
 bandwidth 2000 
 class class-default 
 bandwidth 500 
!RADIUS Profile Configuration
peruser_qos_1    Password = "password1" 
 Service-Type = Framed, 
 Framed-Protocol = PPP, 
 Cisco:Cisco-avpair = "ip:sub-qos-policy-in=ssspolicy"
!ssspolicy in the above line is the name of the policy.
peruser_qos_2    Password = "password1" 
 Service-Type = Framed, 
 Framed-Protocol = PPP, 
 Cisco:Cisco-avpair = "ip:sub-qos-policy-out=ssspolicy”

    Additional References

    The following sections provide references related to the Per-User QoS via AAA Policy Name.

    Related Documents

    Related Topic

    Document Title

    AAA per-user and QoS configurations and information about the policy-map command

    • Configuring Per-User Configuration

    • Cisco IOS Security Command Reference

    Standards

    Standards

    Title

    No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.

    --

    MIBs

    MIBs

    MIBs Link

    No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

    To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL:

    http:/​/​www.cisco.com/​go/​mibs

    RFCs

    RFCs

    Title

    No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.

    --

    Technical Assistance

    Description

    Link

    The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

    To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

    Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

    http:/​/​www.cisco.com/​techsupport

    Feature Information for Per-User QoS via AAA Policy Name

    The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

    Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to . An account on Cisco.com is not required.
    Table 1 Feature Information for Per-User QoS via AAA Policy Name

    Feature Name

    Releases

    Feature Information

    Per-User QoS via AAA Policy Name

    Cisco IOS XE Release 2.1

    Cisco IOS XE Release 3.3S

    You can use the Per-User QoS via AAA Policy Name feature to download a policy name that describes QoS parameters for a user session from a RADIUS server and apply them for a particular session.

    In Cisco IOS XE Release 2.1, this feature was implemented on the Cisco ASR 1000 Series Aggregation Services Routers.

    Glossary

    RADIUS --Remote Authentication Dial-In User Service. RADIUS is a database for authenticating modem and ISDN connections and for tracking connection time.

    VSA --vendor-specific attribute. A VSA is an attribute that has been implemented by a particular vendor. It uses the attribute Vendor-Specific to encapsulate the resulting AV pair: essentially, Vendor-Specific = protocol:attribute = value.

    Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. © 2000-2009 Cisco Systems, Inc. All rights reserved.