Configuration Guide For AAA Billing in Cisco PDF

R EFERENCE G UIDES
Configuration Guide for AAA Billing

Features in Cisco Voice-Enabled Routers
and Access Servers
by: Ted Huff
Product Marketing Engineer
Service Provider Line of Business
Introduction
This configuration guide details the accounting features in the authentication, authorization, and accounting (AAA) framework of the Cisco
IOS® software to aid in the development of third-party billing systems specifically for voice-enabled access servers and routers. Although
AAA represents authentication, authorization, and accounting, this guide addresses only the accounting element of AAA and the RADIUS
A/V (attribute/value) pairs generated through its use. This IOS™ and RADIUS accounting feature is required in the voice over IP (VoIP)
gateways for producing accurate, timely billing and usage information.
AAA Enhancements
The standard Cisco RADIUS accounting functionality has been enhanced for voice applications to allow calls to create a call detail record
(CDR).
Note: For a complete description of the Cisco standard AAA features, refer to the CCO Web site located at URL:
http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113t/113t_3/aaalists.htm
Accounting for Voice

IOS accounting for voice uses standard RADIUS attributes where possible. Attributes that cannot be mapped to standard RADIUS are
“packed” into the Acct-Session-Id attribute field (attribute 44) as a “/” (forward slash) delimited ASCII string. Data items are collected for
each call leg that is created on the gateway. A call leg is the internal representation of a connection to the gateway.
Each connection that is made through the gateway consists of two call legs: an incoming (answer) and an outgoing (originate) call leg.
A connection utilizing an originating and a terminating gateway has four separate call legs (answer telephony, originate VoIP, answer VoIP,
and originate telephony). When utilizing start-stop accounting, there is a separate start record and stop record for each call leg. This implies
that a call generated between two voice-enabled routers will generate four discrete start records and four discrete stop records for each call
connected, all having the same connection ID (see Acct-Session-Id in Table 1).
AAA accounting in IOS for voice calls can be configured to record either start-stop or stop-only records. The start-stop option creates a
record for each call leg at the start of a call and at the end of the same call. The stop-only option just creates the records for all call legs at the
end of each call. If stop-only accounting is configured, then the number of records generated for one call would be four (a stop record for each
Cisco Confidential
Copyright © 1999 Cisco Systems, Inc. All Rights Reserved.
Page 1 of 35
of the four call legs). The various call leg start and stop records generated by the gateway(s) can be organized by their connection ID (a 128-bit
field in hexadecimal format; it is one of the fields in the overloaded Acct-Session-Id ), which is the same for all call legs of a connection. Using
the connection-ID value as the glue, a billing application can generate all the information needed for accurate and timely billing.
Note: In certain scenarios where the network access server (NAS) does not receive a response from the RADIUS server in a certain time
window, duplicate call detail records for various call legs may be created and delivered to the RADIUS server. This can happen when the NAS
does not get a timely response from the RADIUS server acknowledging receipt of the record. The only difference in these duplicate call detail
records is found in the A/V pair Acct-Delay-Time (value 41). When duplicate records are created, the Acct-Delay-Time value is incremented
in each subsequent record (the first value for Acct-Delay-Time is 0). All other fields in the duplicate call detail records (CDRs) remain the
same. It would be up to the particular billing application to deal with discarding these duplicate records. For the sake of completeness, this
guide has included a duplicate record in the CDR of the first call documented (see section “Analysis of Call Records—Call 1”). The duplicated
record is the stop record for call leg 2 found in the section “Start and Stop Records for Call Leg 2.” For the sake of brevity, this guide has
deleted other duplicate records (if generated) created by the calls detailed at the end of this guide.
Table 1 Standard Supported RADIUS Attributes (RFCs 2138 and 2139)
Description
Attribute Value RFCs 2139, 2139
NAS-IP-Address 4 IP address in four hex octets (ASCII string)
NAS-Port-Type 61 Four octets (used for MLPPP)
User-Name 1 ASCII string field up to 63 octets
Called-station-Id 30 One or more octets (DNIS phone number, ASCII string)
Calling-station-Id 31 One or more octets (ANI phone number, ASCII string)
Acct-Status-Type 40 Four octets (hex ASCII number)
Service-Type 6 Four octets (hex ASCII number)
Acct-Session-Id 44 “overloaded” for CDR - ASCII string up to 256 bytes
Acct-Input-Octets 42 Four octets stop records only (hex number)
Acct-Output-Octets 43 Four octets stop records only (hex number)
Acct-Input-Packets 47 Four octets stop records only (hex number)
Acct-Output- Packets 48 Four octets stop records only (hex number)
Acct-Session-Time 46 Four octets (hex number in seconds) stop records only
Acct-Delay-Time 41 Four octets (hex number)
RADIUS Accounting with Overloaded Acct-Session-Id

In order to take advantage of standard RADIUS implementations that do not support vendor-specific attributes (VSAs), a new method is
defined, which embeds the unsupported information elements in the RADIUS Acct-Session-Id (RADIUS value 44 per RFC 2139). The
Acct-Session-Id field has a maximum length of 256 characters. It is defined to contain ten slash-separated fields, one of which is the RADIUS
connection-id, which is a unique identifier that links accounting records associated with the same login session for a user. The internal
representation of connection-id field is 128 bits in hex format. This string can vary in appearance. In the examples cited in the CDR section
of this guide, the connection-id is of the form 3C5AEAB9 95C80008 0 587F34 (one 4-octet string, a space, one 4-octet string, a space, a zero,
a space, and one 3-octet string). The overloaded Acct-Session-Id also contains connect and disconnect times, remote IP address, and
disconnect cause.
In order to support these additional fields, the following string format for the Acct-Session-Id field is utilized:
Cisco Confidential
Page 2 of 35
<session id>/<call leg setup time>/<gateway id>/<connection id>/<call origin>/<call type>/
<connect time>/<disconnect time>/<disconnect cause>/<remote ip address>
Overloaded Acct-Session-Id Field Descriptions
Field Description
Session ID The standard (RFC 2139) RADIUS account-session-id
Call leg setup time The Q.931setup time for this connection in NTP format
Gateway ID The name of the underlying gateway

Name string is of form “gateway.domain_name”
Connection ID A unique global identifier used to correlate call legs that belong to the same end-to-end call. The field consists of four long words (128 bits). Each
long word is displayed in hexadecimal value and separated by a space character.
Call origin Indicates origin of the call relative to the gateway; possible values are “originate” and “answer”
Call type Indicates call leg type; possible values are “Telephony” and “VoIP.”
Connect time The Q.931 connect time for this call leg in NTP format (stop only)
Disconnect time The Q.931 disconnect time for this call leg in NTP format (stop only)
Disconnect cause Documented in Q.931 specification; can be in the range of 1–160 (stop only)
Remote IP address IP address of the remote gateway used in this connection (stop only)
Note: The last four attributes (connect and disconnect times, disconnect cause, and remote IP address) packed in the overloaded Acct-Session-Id listed above are available only in the
stop packets. In start packets and update packets, these fields are blank.
Note: Field element #10 (remote IP address) is valid only in Voice over IP calls. Calls made using Voice over Frame Relay or Voice over ATM will have a null field in element #10
Note: As of IOS ver 12.2 there is an 11th field present in the overloaded session-id. This field is the incoming-Connection-ID and is enabled to deal with subsequent calls that are
reoriginated at the source without having to requthenticate.
Network Time Protocol (NTP) Usage Guidelines

In order for the accounting records to include accurate connect and disconnect time records, Network Time Protocol (NTP) must be included
in the router configuration. For information on configuring NTP in Cisco routers, please consult:
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_serv/as5800/sc_3640/swconfig.htm#xtocid259615
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat5000/rel_2_2/c5kcg2_2/11netmg.htm#xtocid2695127
In this configuration guide, because the network was not communicating with an official NTP site, the routers used were configured for NTP
simply by making one of the routers NTP master with the command:
ntp master
and pointing the other router to the NTP master with the command:
ntp server 10.11.254.8 (ip address of the master)
Please consult the configs at the end of this guide.
NTP time formats are displayed as: %H:%M:%S.%k %Z %tw %tn %td %Y, where:
%H is hour (00 to 23)
%M is minutes (00 to 59)
%S is seconds (00 to 59)
%k is milliseconds (000 to 999)
%Z is timezone string
%tw is day of the week (Saturday ... Sunday)
%tn is month (January ... December)
%td is day of the month (01 to 31)
%Y is the year, including century (for example, 1998)
Cisco Confidential
Page 3 of 35
Syslog Accounting
The syslog accounting option exports the information elements associated with each call leg through a system log message that can be
captured by a syslog daemon that is present on the network. The syslog output consists of the following:
<server timestamp> <gateway id> <message number> : <message label> : <list of A/V pairs>
Field Description
Server timestamp The timestamp created by the server when it receives the message to log
Gateway ID The name of the gateway emitting the message
Message number The number assigned to the message by the gateway
Message label A string used to identify the message category
List of A/V pairs A string consisting of <attribute name> <attribute value> pairs separated by commas
Example
%VOIPAAA-5-VOIP_CALL_HISTORY:CallLegType 2,ConnectionId 300094C0 60E0F3A0 60C894C0 60C90000,
SetupTime 22:35:22.023UTC Tue Aug 11 1998, PeerAddress 999, PeerSubAddress , DisconnectCause
10 ,DisconnectText normal call clearing., ConnectTime 22:35:24.027 UTC Tue Aug 11 1998,
DisconnectTime 22:35:29.028 UTC Tue Aug 11 1998, CallOrigin 1, ChargedUnits 0, InfoType
2,TransmitPackets 0, TransmitBytes 0, ReceivePackets 0, ReceiveBytes 0
This guide is limited to a discussion of RADIUS accounting (gw-accounting h323) only.
Cisco IOS AAA Accounting Commands

The following new Cisco IOS commands are designed for configuring the service provider voice over IP accounting and billing functionality.
Note: For additional information about the standard AAA functionality, see:
Cisco IOS Release 11.3(T) Software Configuration New Features. (AAA is also referred to as Security Services)
http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed_cr/secur_c/scprt1/index.htm
aaa accounting connection h323 <stop-only | start-stop> radius

This configuration defines the accounting method list “h323” with RADIUS as a method and with either stop-only or start-stop accounting
options. The method list must be called “h323” and is activated for all voice interfaces. This command tells the system to create a method list
called h323, which has start-stop or stop-only radius as its method. The h323 method list is static and is applied by default to all voice
interfaces, provided the gw-accounting h323 command is also activated.
Command Mode
Global configuration (as a member of the AAA new-model group of commands)
Default
The [no] form of this command is the default.
gw-accounting <h323 | syslog>

This command enables gateway-specific accounting. It defines a method for doing the accounting and enables the gateway to do the
accounting. Two accounting methods are defined:
• h323 method uses RADIUS to output accounting CDRs.
• Syslog uses the system logging facility to output CDRs.
Both h323 and syslog can be enabled at the same time, causing CDRs to be generated in both methods.
Cisco Confidential
Page 4 of 35
Command Mode
Global configuration
Default
debug voip aaa

This command enables debugging messages for gateway AAA messages to be output to the system console.
Command Mode
global exec
Default
Other Useful Debug and Troubleshooting Commands

Debug radius
Debug aaa accounting
Debug voip aaa
Show accounting
Show call history voice
Show count
The Anatomy and Dissection of a Call Detail Record

In order to illustrate accounting features available in RADIUS and IOS software on Cisco gateways, CDR output was obtained from a
CiscoSecure access control server operating on a Sun Ultra workstation running Solaris V. 2.5.1. The following pages detail several different
calls. The network was built according to the diagram in Figure 1
Figure 1 Basic Network
Originating Side Terminating Side

PSTN
Call Leg1 Call Leg4

Answer Originate
Telephony Telephony
Analog Analog
9549203 9549717
Call Leg2 PRI
PRI Originate VoIP 5710914
5710913
IP
Cloud
V V
Call Leg3
Answer VoIP
RADIUS
Transactions
CiscoSecure for UNIX
v2.2 with RADIUS on
Sun Solaris 2.5.1 Workstation
Cisco Confidential
Page 5 of 35
RADIUS Accounting Records
For the different calls, utilizing the network illustrated in Figure 1, the following output was collected:
• Start and stop records for all call legs
• Debug radius output for originating and terminating gateways
• Router configuration for each gateway
• IOS and vcware versions for each gateway
Generating Call Detail Records in CiscoSecure

When aaa accounting start-stop RADIUS is turned on in a Cisco IOS router/access server, RADIUS records (A/V pairs) are sent from the
router(s) to the RADIUS server at the call inception and at the call teardown. Many different RADIUS servers can be employed. For this guide,
the CiscoSecure access control server (ACS) for UNIX was utilized.
CiscoSecure UNIX includes a command-line application for exporting the RADIUS database records into a flat file format. The utility
is called AcctExport; instruction for its use and a sample session follow.
For complete details on the operation of CiscoSecure for UNIX, please consult:
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/cs_unx/csu23ug/index.htm
AcctExport Syntax:
AcctExport filename [no_truncate] [clean] [no_active]
The filename is required and refers to the path name of the target file. When there is no option other than filename, AcctExport will export all
accounting records (except the start records for the active sessions) to the file, then remove the records from the accounting tables. CiscoSecure
is not required to be off line for this operation.
The no_truncate option directs the tool to behave in the same manner as the default option except that no records from the tables will be
removed.
If the clean option is specified, the tool exports all the accounting records present in the tables (regardless of active or nonactive sessions)
to the external file and deletes them from the tables. The tool also resets the sequence numbers used for accounting records by the CiscoSecure
DBServer. The sequence numbers are used to identify each session accounting record and user session. These numbers are in the range from
1 to 2,147,483,647. The current sequence numbers can be obtained from the cs_id table. When using this option, make sure either that
CiscoSecure is off line or that accounting is turned off.
If the no_active option is specified, only completed sessions, those with matching start and stop packets, are exported.
Example Session for Exporting RADIUS Records in CiscoSecure UNIX v 2.3
1. Create a file to which you will export RADIUS records.

redzinger# touch /export/home/cs_acct/radius_output121598
2. Change directories to: $BASEDIR/utils/bin.
redzinger# cd /export/home/CiscoSecure/utils/bin
3. Run the export utility with the following command:
redzinger# ./AcctExport /export/home/cs_acct/radius_output121598
Loading properties from /export/home/CiscoSecure/config/CSConfig.ini

Finished loading properties.
Data Source = SQLAnywhere
Driver Type = ODBC-SQLAnywhere URL = jdbc:odbc:SQLAnywhere;ENG=csecure;DBF=/export/home/
SQLAnywhere/csecure.db;Start="dbeng50 -ud*
Connected to jdbc:odbc:SQLAnywhere;ENG=csecure;DBF=/export/home/SQLAnywhere/
csecure.db;Start="dbeng50 -ud"
Cisco Confidential
Page 6 of 35
Driver JDBC-ODBC Bridge (Sybase SQL Anywhere)
Version 1.1001 (05.05.0003)
Exporting to /export/home/cs_acct/radius_output121598
Number of active sessions: 0
DELETE FROM cs_user_accounting WHERE (record_id <= ?)
SELECT blob_ordinal, blob_data FROM cs_accounting_log WHERE (log_id <= ?) ORDER BY log_id,
blob_ordinal
Exported 28 accounting records.
DELETE FROM cs_accounting_log WHERE (log_id <= ?)
Successfully done.
4. Read the file you have just created

redzinger# more /export/home/cs_acct/radius_output121598
10.11.254.8 - - 4089540523 start server=redzinger time=09:36:27

date=11/18/1998 task_id=33/16:02:26.
057 UTC Fri Oct 17 1997/ted53-2./B95A5B7A 3B68002A 0 4CC8A24/answer/Telephony///
Wed Nov 18 09:36:27 1998
Client-Id = 10.11.254.8
NAS-Port-Type = AsyncUser-Name = ""
Called-Station-Id = "5710913"
Calling-Station-Id = "4089540523"
Acct-Status-Type = Start
User-Service-Type = Login-User
Acct-Session-Id = "33/16:02:26.057 UTC Fri Oct 17 1997/ted53-2./B95A5B7A 3B68002A 0
4CC8A24/answer/Telephony///"Acct-Delay-Time = 0
< ---------------------------snip------------------------------ >
Cisco Confidential
Page 7 of 35
Call Leg Accounting Records for Four Different Calls
Description and Discussion

The following pages contain the call detail records for several different calls made from (408) 9549203 across an IP network to (408) 9549171
(the area code was not dialed, although it does show up in some of the records). The first number dialed was the number of the Primary Rate
Interface (PRI) trunk in the originating gateway, 5710913. Upon completion of integrated voice response (IVR), the destination number 9
9549171 was entered (the dial peer requires that a 9 be dialed first, so some of the called number records show 99549171). This number maps
to a dial peer in both gateways so as to call 9549171 from the terminating gateway. All numbers are in the 408 area code.
Difference Between start-stop and stop-only Records

Start records, which begin at the inception of a call, by definition cannot contain the time connection details required for billing by time. All
the required details are contained in the stop records. Why then bother with start records and start-stop accounting? As far as normally
connected, completed, and disconnected calls go, stop-only records would be sufficient. However, for vendors that require a more
deterministic and real-time method for identifying when the call started, start records are sometimes required. The start record, in conjunction
with update** records, allows a more accurate measurement technique in case packets get lost. For all the calls studied in the following pages,
start-stop accounting was employed.
** Update records are obtained from Cisco routers with the AAA command:
aaa accounting update
Call Record Details

RADIUS records are recorded in the RADIUS server in the order in which they are received. For clarity and ease of discussion, the records
obtained in the following pages have been rearranged and grouped in a logical sequence and interspersed with RADIUS debugs gathered from
the gateways. In a similar manner, a vendor’s billing application would gather, parse, and analyze the RADIUS records in order to create a
customer bill. The CDRs in the following pages were obtained through the use of CiscoSecure. The application AcctExport prints out the
database information in an application-specific format. The particular format of AcctExport duplicates many of the important fields in each
record. Other applications will delineate the fields according to their own requirements.
Analysis of Call Records
Call 1:
This call is a normally connected and normally terminated call. Calls are matched by their connection id, a 128-bit field in the overloaded
Acct-Session-Id. Call legs are matched by the task-id, which is the same for start and stop records of a single call leg.
Start and Stop Records for Call Leg 1 (answer telephony)

Call leg 1 is the Public Switched Telephone Network (PSTN) call from the user’s phone to the VoIP gateway. The accounting records coming
from the originating router (ted53-2) are for call legs 1 and 2.
Items of interest are bolded and include:
• Task id followed by connect setup time in NTP format (UTC is Greenwich Mean Time)
• Connection-Id (matches in all call legs of a single session)
• Called station ID (in start record, this is the originating gateway access number, call leg 1 only)
• Called station ID (in all other call leg records, this is the final destination number)
• Calling station ID (the phone from which the call was placed—same in all records)
• Connect time in NTP format
• Disconnect time in NTP format (stop record only)
• Account delay time (incremented in duplicate records)
• Disconnect cause (stop record only in overloaded Session ID)
Start Record Call Leg 1

10.11.254.8 - -4089549203 start server=redzinger
Cisco Confidential
Page 8 of 35
time=10:27:14 date=12/ 9/1998 task_id=7/18:27:03.073 UTC Wed Dec 9 1998/ted53-2./3C5AEAB9
95C80008 0 587F34/answer/Telephony///
Wed Dec 9 10:27:13 1998
Client-Id = 10.11.254.8
NAS-Port-Type = Async
User-Name = ""
Acct-Session-Id = "7/18:27:03.073 UTC Wed Dec 9 1998/ted53-2./
3C5AEAB9 95C80008 0 587F34/answer/Telephony////"
Acct-Delay-Time = 0
Radius Debug Output (start record call leg 1)

01:36:39: Attribute 4 6 0A0BFE08 10.11.254.8
01:36:39: Attribute 61 6 00000000
01:36:39: Attribute 1 2 1E093537
01:36:39: Attribute 30 9 35373130 5710 first 4 digits of called station ID
01:36:39: Attribute 31 12 34303839 4089 first 4 digits of calling station ID
01:36:39: Attribute 40 6 00000001 Indicates a start record
01:36:39: Attribute 6 6 00000001
01:36:39: Attribute 44 91 372F3138 7 task-id for call leg 1
01:36:39: Attribute 41 6 00000000 Account delay is 0
01:36:39: RADIUS: ustruct sharecount=1
Stop Record Call Leg 1

10.11.254.8 1001 -4089549203 stop server=redzinger
time=10:28:01 date=12/ 9/1998 task_id=7/18:27:03.073 UTC Wed Dec 9 1998/ted53-2./
3C5AEAB9 95C80008 0 587F34/answer/Telephony/18:27:03.075 UTC Wed Dec 9 1998/18:27:50.073 UTC
Wed Dec 9 1998/10 /
Wed Dec9 10:28:00 1998
Client-Id = 10.11.254.8
User-Name = "1001"
Acct-Status-Type = Stop
Acct-Session-Id = "7/18:27:03.073 UTC Wed Dec 9 1998/ted53-2./3C5AEAB9
95C80008 0 587F34/answer/Telephony/18:27:03.075 UTC Wed Dec 9
1998/18:27:50.073 UTC Wed Dec 9 1998/10 /"
Acct-Input-Octets = 20220
Acct-Output-Octets = 77804
Acct-Input-Packets = 1011
Acct-Output-Packets = 1306
Cisco Confidential
Page 9 of 35
Acct-Session-Time = 47
Acct-Delay-Time = 0
Radius Debug Output

01:37:26: Attribute 4 6 0A0BFE08 10.11.254.8
01:37:26: Attribute 61 6 00000000
01:37:26: Attribute 1 6 31303031
01:37:26: Attribute 30 10 39393534
01:37:26: Attribute 31 12 34303839
01:37:26: Attribute 40 6 00000002 stop packet
01:37:26: Attribute 6 6 00000001
01:37:26: Attribute 44 157 372F3138 7 matches task ID
01:37:26: Attribute 42 6 00004EFC input octets
01:37:26: Attribute 43 6 00012FEC output octets
01:37:26: Attribute 47 6 000003F3 input packets
01:37:26: Attribute 48 6 0000051A output packets
01:37:26: Attribute 46 6 0000002F Acct-Session-Time in hex = 47 seconds
01:37:26: Attribute 41 6 00000000
Start and Stop Records for Call Leg 2 (originate VoIP)

Call leg 2 is the IP call from the originating gateway to destination gateway.

10.11.254.8 1001 - 4089549203 start server=redzinger
95C80008 0 587F34/originate/VoIP////10.11.253.8
Wed Dec 9 10:27:39 1998
Client-Id = 10.11.254.8
User-Name = "1001"
3C5AEAB9 95C80008 0 587F34/originate/VoIP////10.11.253.8"
Acct-Delay-Time = 0

01:37:04: Attribute 4 6 0A0BFE08
01:37:04: Attribute 61 6 00000000
01:37:04: Attribute 1 6 31303031
01:37:04: Attribute 30 10 39393534
01:37:04: Attribute 31 12 34303839
01:37:04: Attribute 40 6 00000001
01:37:04: Attribute 6 6 00000001
01:37:04: Attribute 44 89 382F3138
01:37:04: Attribute 41 6 00000000

10.11.254.8 1001 - 4089549203 stop server=redzinger
Cisco Confidential
Page 10 of 35
95C80008 0 587F34/originate/VoIP/18:27:31.072 UTC Wed Dec 9 1998/18:27:50.070 UTC Wed Dec 9
1998/10 /10.11.253.8
Wed Dec 910:28:00 1998
Client-Id = 10.11.254.8
User-Name = "1001"
Acct-Session-Id = "8/18:27:28.092 UTC Wed Dec 91998/ted53-2./
3C5AEAB9 95C80008 0 587F34/originate/VoIP/18:27:31.072 UTC Wed Dec 9 1998/18:27:50.070 UTC Wed
Dec 9 1998/10 /10.11.253.8"
Acct-Session-Time= 19
Acct-Delay-Time = 0
Duplicate Stop Record Call Leg 2

95C80008 0 587F34/originate/VoIP/18:27:31.072 UTC Wed Dec 9 1998/18:27:50.070 UTC Wed Dec 9
1998/10 /10.11.253.8
Wed Dec 910:28:00 1998
Client-Id = 10.11.254.8
User-Name = "1001"
3C5AEAB9 95C80008 0 587F34/originate/VoIP/18:27:31.072 UTC Wed Dec 9 1998/18:27:50.070 UTC Wed
Dec 9 1998/10 /10.11.253.8"
Acct-Delay-Time = 1 acct-delay-time is incremented in duplicate records
Radius Debug Output (stop record call leg 2)

Cisco Confidential
Page 11 of 35
01:37:26: Attribute 61 6 00000000
01:37:26: Attribute 1 6 31303031
01:37:26: Attribute 30 10 39393534
01:37:26: Attribute 31 12 34303839
01:37:26: Attribute 40 6 00000002
01:37:26: Attribute 6 6 00000001
01:37:26: Attribute 44 155 382F3138
01:37:26: Attribute 42 6 0000490C
01:37:26: Attribute 43 6 00004EE8
01:37:26: Attribute 47 6 000003A7
01:37:26: Attribute 48 6 000003F2
01:37:26: Attribute 46 6 00000013
01:37:26: Attribute 41 6 00000000
The stop records for call leg 2 and 3 record the IP portion of the call. Call leg 2 is from the perspective of the originating gateway and call leg
3 is from the perspective of the terminating gateway. Both call leg accounting records are similar.
Start and Stop Records for Call Leg 3 (answer VoIP)

Call leg 3 is the VoIP call looking from the destination gateway to the originating gateway. The accounting records coming from the
terminating router (ted53-6) are for call legs 3 and 4.

member=voice10.11.253.8 - -4089549203 start server=redzinger
3C5AEAB9 95C80008 0 587F34/answer/VoIP////10.11.254.8
Wed Dec 9 10:27:38 1998
Client-Id = 10.11.253.8
User-Name = ""
3C5AEAB9 95C80008 0 587F34/answer/VoIP////10.11.254.8"
Acct-Delay-Time= 0

01:34:02: Attribute 4 6 0A0BFD08
01:34:02: Attribute 61 6 00000000
01:34:02: Attribute 1 2 1E0A3939
01:34:02: Attribute 30 10 39393534 9954
01:34:02: Attribute 31 12 34303839 4089
01:34:02: Attribute 40 6 00000001 start record
01:34:02: Attribute 6 6 00000001
01:34:02: Attribute 44 86 362F3138 task-id is 6
01:34:02: Attribute 41 6 00000000
Cisco Confidential
Page 12 of 35
10.11.253.8 - - 4089549203 stop server=redzinger
3C5AEAB9 95C80008 0 587F34/answer/VoIP/18:27:30.094 UTC Wed Dec 9 1998/18:27:49.093 UTC Wed Dec
9 1998/10 /10.11.254.8
Wed Dec 9 10:28:00 1998
Client-Id = 10.11.253.8
User-Name = ""
3C5AEAB9 95C80008 0 587F34/answer/VoIP/18:27:30.094 UTC Wed Dec 9 1998/18:27:49.093 UTC Wed Dec
9 1998/10 /10.11.254.8"
Acct-Delay-Time = 0
Radius Debug Output Stop Record Call Leg 3

01:34:23: Attribute 61 6 00000000
01:34:23: Attribute 1 2 1E0A3939
01:34:23: Attribute 30 10 39393534
01:34:23: Attribute 31 12 34303839
01:34:23: Attribute 40 6 00000002
01:34:23: Attribute 6 6 00000001
01:34:23: Attribute 44 160 362F3138 task-id 6 for call leg 3
01:34:23: Attribute 42 6 00004EE8
01:34:23: Attribute 43 6 0000490C
01:34:23: Attribute 47 6 000003F2
01:34:23: Attribute 48 6 000003A7
01:34:23: Attribute 46 6 00000013
01:34:23: Attribute 41 6 00000000
Cisco Confidential
Page 13 of 35
Start and Stop Records for Call Leg 4 (originate telephony)
Call leg 4 is the PSTN call from the terminating gateway to the destination phone.

10.11.253.8 - - 4089549203 start server=redzinger
3C5AEAB9 95C80008 0 587F34/originate/Telephony////
Wed Dec 9 10:27:38 1998
Client-Id = 10.11.253.8
NAS-Port-Type = AsyncUser-Name = ""
3C5AEAB9 95C80008 0 587F34/originate/Telephony////"
Acct-Delay-Time = 0

01:34:02: Attribute 61 6 00000000
01:34:02: Attribute 1 2 1E0A3939
01:34:02: Attribute 30 10 39393534
01:34:02: Attribute 31 12 34303839
01:34:02: Attribute 40 6 00000001
01:34:02: Attribute 6 6 00000001
01:34:02: Attribute 44 94 372F3138
01:34:02: Attribute 41 6 00000000

member=voice10.11.253.8 - -4089549203 stop server=redzinger
3C5AEAB9 95C80008 0 587F34/originate/Telephony/18:27:30.094 UTC Wed Dec 9 1998/18:27:49.095 UTC
Wed Dec 9 1998/10 /
Wed Dec9 10:28:00 1998
Client-Id = 10.11.253.8
User-Name = ""
3C5AEAB9 95C80008 0 587F34/originate/Telephony/18:27:30.094 UTC Wed Dec 9 1998/18:27:49.095 UTC
Wed Dec 9 1998/10 /"
Cisco Confidential
Page 14 of 35
Acct-Delay-Time = 0

01:34:23: Attribute 61 6 00000000
01:34:23: Attribute 1 2 1E0A3939
01:34:23: Attribute 30 10 39393534
01:34:23: Attribute 31 12 34303839
01:34:23: Attribute 40 6 00000002
01:34:23: Attribute 6 6 00000001
01:34:23: Attribute 44 160 372F3138
01:34:23: Attribute 42 6 0000490C
01:34:23: Attribute 43 6 00004EE8
01:34:23: Attribute 47 6 000003A7
01:34:23: Attribute 48 6 000003F2
01:34:23: Attribute 46 6 00000013
01:34:23: Attribute 41 6 00000000
Call 2: Far end busy

For a call in which the far end is busy, the records look similar to the normally completed call. In order to conserve space and because they
are uninteresting, the start records are not included. Observations on the various call legs are discussed at the end of the call leg being
examined. Some differences to look for in the stop records are:
• Disconnect cause
• Call duration

10.11.254.8 - 4089549203 stop server=redzinger
time=15:09:28 date=12/ 9/1998 task_id=4/22:12:38.060 UTC Thu Oct 16 1997/ted53-2./
F4184248 97130004 0 F91BE8/answer/Telephony/22:12:38.062 UTC Thu Oct 16 1997/22:13:15.088 UTC
Thu Oct 16 1997/10 /
Wed Dec9 15:09:28 1998
Client-Id = 10.11.254.8
User-Name = ""
Acct-Session-Id = "4/22:12:38.060 UTC Thu Oct 161997/ted53-2./
F4184248 97130004 0 F91BE8/answer/Telephony/22:12:38.062 UTC Thu Oct 16 1997/22:13:15.088 UTC
Thu Oct 16 1997/10 /"
Acct-Delay-Time = 0
Cisco Confidential
Page 15 of 35
Radius Debug Output Call Leg 1
04:32:42: Attribute 61 6 00000000
04:32:42: Attribute 1 2 1E093537
04:32:42: Attribute 30 9 35373130
04:32:42: Attribute 31 12 34303839
04:32:42: Attribute 40 6 00000002
04:32:42: Attribute 6 6 00000001
04:32:42: Attribute 44 160 342F3232
04:32:42: Attribute 42 6 0000026C
04:32:42: Attribute 43 6 0000E924
04:32:42: Attribute 47 6 0000001F
04:32:42: Attribute 48 6 00000190
04:32:42: Attribute 46 6 00000025
04:32:42: Attribute 41 6 00000000
For call leg 1, the disconnect cause is normal disconnect (10) and the Acct-Session-Time is 25h or 37 seconds. In other words, the phone call
to the gateway was successful and took 37 seconds. With service providers who offer a local number with which to place VoIP calls, this is
not the record to look at for billing purposes, even though the call was completed.
Stop Record for Call Leg 2 (originate VoIP)

Call leg 2 is the IP call from the originating gateway to the IP cloud.
member=voice10.11.254.8 1008 4089549203 stop server=redzinger

time=15:09:18 date=12/ 9/1998 task_id=5/22:13:05.001 UTC Thu Oct 16 1997/ted53-2./F4184248
97130004 0 F91BE8/originate/VoIP/0/22:13:05.086 UTC Thu Oct 16 1997/11 /10.11.253.8
Wed Dec 9 15:09:18 1998
Client-Id =10.11.254.8
User-Name = "1008"
Acct-Session-Id = "5/22:13:05.001 UTC Thu Oct 16 1997/ted53-2./F4184248 97130004 0
F91BE8/originate/VoIP/0/22:13:05.086 UTC
Thu Oct 16 1997/11 /10.11.253.8"
Acct-Delay-Time = 0
Cisco Confidential
Page 16 of 35
04:32:32: Attribute 61 6 00000000
04:32:32: Attribute 1 6 31303038
04:32:32: Attribute 30 10 39393534
04:32:32: Attribute 31 12 34303839
04:32:32: Attribute 40 6 00000002
04:32:32: Attribute 6 6 00000001
04:32:32: Attribute 44 127 352F3232
04:32:32: Attribute 42 6 00000244
04:32:32: Attribute 43 6 00000258
04:32:32: Attribute 47 6 0000001D
04:32:32: Attribute 48 6 0000001E
04:32:32: Attribute 46 6 00000001
04:32:32: Attribute 41 6 00000000

F4184248 97130004 0 F91BE8/answer/VoIP/0/22:13:05.076 UTC Thu
Oct 16 1997/11 /10.11.254.8
Wed Dec 9 15:09:18 1998
Client-Id = 10.11.253.8
User-Name = ""
Acct-Session-Id = "18/22:13:04.093 UTC Thu Oct 16 1997/ted53-6./F4184248 97130004
0F91BE8/answer/VoIP/0/22:13:05.076 UTC Thu
Oct 16 1997/11 /10.11.254.8"
Acct-Delay-Time = 0
Radius Debug Output Stop Record Call Leg 3

06:15:40: Attribute 61 6 00000000
06:15:40: Attribute 1 2 1E0A3939
06:15:40: Attribute 30 10 39393534
06:15:40: Attribute 31 12 34303839
06:15:40: Attribute 40 6 00000002
Cisco Confidential
Page 17 of 35
06:15:40: Attribute 6 6 00000001
06:15:40: Attribute 44 125 31382F32
06:15:40: Attribute 42 6 00000258
06:15:40: Attribute 43 6 00000244
06:15:40: Attribute 47 6 0000001E
06:15:40: Attribute 48 6 0000001D
06:15:40: Attribute 46 6 00000001
06:15:40: Attribute 41 6 00000000
06:15:40: RADIUS: ustruct sharecount=2
The stop records for call legs 2 and 3 together show the details of the VoIP portion of the call. This will typically (but not always) be the portion
of the call that billing apps examine. The Acct-session-time and Disconnect-Cause are the same for both records. Call leg 2 looks forward and
call leg 3 looks backward at the same portion of the call. The disconnect cause is user busy (11) and the session time is 1 second. Notice that
even though RADIUS attribute 46 (Acct-Session-Time) comes up as 1 second, in the overloaded Acct-Session-Id there is a 0 for the connect
time. The billing vendor would have to decide how to interpret this situation, but obviously customers don’t want to be charged for incomplete
calls.
Stop Record for Call Leg 4 (originate telephony)

Call leg 4 is the PSTN call from the terminating gateway to the destination phone.

F4184248 97130004 0 F91BE8/originate/Telephony/0/22:13:05.076 UTC Thu Oct 16 1997/11 /Wed Dec
9 15:09:18 1998
Client-Id= 10.11.253.8
User-Name = ""
Acct-Session-Id = "19/22:13:05.012 UTC Thu Oct 16 1997/ted53-6./F4184248 97130004 0
F91BE8/originate/Telephony/0/22:13:05.07
6 UTC Thu Oct 16 1997/11 "
Acct-Delay-Time = 0

06:15:40: Attribute 61 6 00000000
06:15:40: Attribute 1 2 1E0A3939
06:15:40: Attribute 30 10 39393534
06:15:40: Attribute 31 12 34303839
Cisco Confidential
Page 18 of 35
06:15:40: Attribute 40 6 00000002
06:15:40: Attribute 6 6 00000001
06:15:40: Attribute 44 133 31392F32
06:15:40: Attribute 42 6 00000244
06:15:40: Attribute 43 6 00000258
06:15:40: Attribute 47 6 0000001D
06:15:40: Attribute 48 6 0000001E
06:15:40: Attribute 46 6 00000001
06:15:40: Attribute 41 6 00000000
The stop record for call leg 4 is the same as that for call legs 2 and 3; in other words, a 1-second call duration, user busy (11) is the disconnect
cause, and connect time is 0 (not connected).
Call 3:
Call 3 is a call that is not answered. (phone rings for four rings)
Once again, because they add little of interest, start records are not included here. An unanswered call is interesting, mainly because the
disconnect cause code is 10 (normal disconnect) and Acct-Session-Time is nonzero. However, like the unanswered call, the connect time is
0, indicating a call that was neither answered nor connected. The stop records are presented with the router debugs. The reader can inspect
the call duration and disconnect types.

time=13:21:52 date=12/10/1998 task_id=10/12:21:05.071 Pacific Thu Dec 10 1998/ted53-2./
FDEB6C8D A98C000A 0 7970BC/answer/Telephony/12:21:05.074 Pacific Thu Dec 10 1998/12:21:56.003
Pacific Thu Dec 10 1998/10 /
Thu Dec 10 13:21:51 1998
Client-Id = 10.11.254.8
User-Name = ""
Acct-Session-Id = "10/12:21:05.071 Pacific Thu Dec 10 1998/ted53-2./FDEB6C8D A98C000A
0 7970BC/answer/Telephony/12:21:05.074
Pacific Thu Dec 10 1998/12:21:56.003 Pacific Thu Dec 10 1998/10 /"
Acct-Delay-Time = 0
Cisco Confidential
Page 19 of 35
RADIUS Debug Call Leg 1
02:13:29: Attribute 61 6 00000000
02:13:29: Attribute 1 2 1E093537
02:13:29: Attribute 30 9 35373130
02:13:29: Attribute 31 12 34303839
02:13:29: Attribute 40 6 00000002
02:13:29: Attribute 6 6 00000001
02:13:29: Attribute 44 174 31302F31
02:13:29: Attribute 42 6 00005668
02:13:29: Attribute 43 6 00011804
02:13:29: Attribute 47 6 00000452
02:13:29: Attribute 48 6 000003E8
02:13:29: Attribute 46 6 00000032
02:13:29: Attribute 41 6 00000000

FDEB6C8D A98C000A 0 7970BC/originate/VoIP/0/12:21:56.000 Pacific Thu Dec 10 1998/10 /
10.11.253.8
Thu Dec 10 13:21:51 1998
Client-Id = 10.11.254.8
User-Name = "1012"
Acct-Session-Id = "11/12:21:32.042 Pacific Thu Dec 101998/ted53-2./FDEB6C8D A98C000A 0
7970BC/originate/VoIP/0/12:21:56.000
Pacific Thu Dec 10 1998/10 /10.11.253.8"
Acct-Delay-Time = 0

02:13:29: Attribute 61 6 00000000
02:13:29: Attribute 1 6 31303132
02:13:29: Attribute 30 10 39393534
02:13:29: Attribute 31 12 34303839
02:13:29: Attribute 40 6 00000002
Cisco Confidential
Page 20 of 35
02:13:29: Attribute 6 6 00000001
02:13:29: Attribute 44 148 31312F31
02:13:29: Attribute 42 6 00003124
02:13:29: Attribute 43 6 00005654
02:13:29: Attribute 47 6 00000275
02:13:29: Attribute 48 6 00000451
02:13:29: Attribute 46 6 00000018
02:13:29: Attribute 41 6 00000000

member=voice10.11.253.8 - - 4089549203 stop server=redzinger
FDEB6C8D A98C000A 0 7970BC/answer/VoIP/0/12:21:55.086 Pacific Thu Dec 10 1998/10 /10.11.254.8
Thu Dec 10 13:21:51 1998Client-Id = 10.11.253.8
User-Name = ""
Acct-Session-Id = "8/12:21:32.028 Pacific Thu Dec 10 1998/ted53-6./FDEB6C8D A98C000A 0
7970BC/answer/VoIP/0/12:21:55.086 Pacific Thu Dec 10 1998/10 /10.11.254.8"
Acct-Delay-Time = 0

02:02:09: Attribute 61 6 00000000
02:02:09: Attribute 1 2 1E0A3939
02:02:09: Attribute 30 10 39393534
02:02:09: Attribute 31 12 34303839
02:02:09: Attribute 40 6 00000002
02:02:09: Attribute 6 6 00000001
02:02:09: Attribute 44 144 382F3132
02:02:09: Attribute 42 6 00005654
02:02:09: Attribute 43 6 00003124
02:02:09: Attribute 47 6 00000451
02:02:09: Attribute 48 6 00000275
02:02:09: Attribute 46 6 00000018
02:02:09: Attribute 41 6 00000000
Cisco Confidential
Page 21 of 35
FDEB6C8D A98C000A 0 7970BC/originate/Telephony/0/12:21:55.088 Pacific Thu Dec 10 1998/10 /Thu
Dec 10 13:21:51 1998
Client-Id = 10.11.253.8
User-Name = ""
Acct-Session-Id = "9/12:21:32.048 Pacific Thu Dec 10 1998/ted53-6./FDEB6C8D A98C000A 0
7970BC/originate/Telephony/0/12:21:55.088 Pacific Thu Dec 10 1998/10 /"
Acct-Delay-Time = 0

02:02:09: Attribute 61 6 00000000
02:02:09: Attribute 1 2 1E0A3939
02:02:09: Attribute 30 10 39393534
02:02:09: Attribute 31 12 34303839
02:02:09: Attribute 40 6 00000002
02:02:09: Attribute 6 6 00000001
02:02:09: Attribute 44 141 392F3132
02:02:09: Attribute 42 6 00003124
02:02:09: Attribute 43 6 00005654
02:02:09: Attribute 47 6 00000275
02:02:09: Attribute 48 6 00000451
02:02:09: Attribute 46 6 00000017
02:02:09: Attribute 41 6 00000000
This call has a normal disconnect (10) and a session time of 23 seconds, but it also has a 0 in the connection time field, indicating that the call
was set up and was torn down 23 seconds later. The 0 in the connect time field indicates that the call was never connected end to end.
Cisco Confidential
Page 22 of 35
Call 4
This call is an abnormally terminated call. The terminating gateway was turned off, simulating a power outage.

FDEB6C8D A98C0010 0 DA1614/answer/Telephony/14:06:39.052 Pacific Thu Dec 10 1998/14:07:50.001
Pacific Thu Dec 10 1998/10 /
Thu Dec 10 15:07:46 1998
Client-Id = 10.11.254.8
User-Name = "1009"
Acct-Session-Id = "15/14:06:39.050 Pacific Thu Dec 10 1998/ted53-2./FDEB6C8D A98C0010
0 DA1614/answer/Telephony/14:06:39.052
Pacific Thu Dec 10 1998/14:07:50.001 Pacific Thu Dec 10 1998/10 /"
Acct-Delay-Time = 0
RADIUS Debugs Call Leg 1

03:59:23: Attribute 61 6 00000000
03:59:23: Attribute 1 6 31303039
03:59:23: Attribute 30 10 39393534
03:59:23: Attribute 31 12 34303839
03:59:23: Attribute 40 6 00000002
03:59:23: Attribute 6 6 00000001
03:59:23: Attribute 44 174 31352F31
03:59:23: Attribute 42 6 00009C18
03:59:23: Attribute 43 6 00013DC0
03:59:23: Attribute 47 6 000007CE
03:59:23: Attribute 48 6 000005CB
03:59:23: Attribute 46 6 00000047
03:59:23: Attribute 41 6 00000000

member=voice10.11.254.8 1009 - 4089549203 stop server=redzinger
FDEB6C8D A98C0010 0 DA1614/originate/VoIP/14:07:12.019 Pacific Thu Dec 10 1998/14:07:49.098
Pacific Thu Dec 10 1998/10 /10.11.253.8
Thu Dec 10 15:07:46 1998
Client-Id = 10.11.254.8
Cisco Confidential
Page 23 of 35
User-Name = "1009"
Acct-Session-Id = "16/14:07:08.066 Pacific Thu Dec 10 1998/ted53-2./FDEB6C8D A98C0010
0 DA1614/originate/VoIP/14:07:12.019 Pacific Thu Dec 10 1998/14:07:49.098
Pacific Thu Dec 10 1998/10 /10.11.253.8"
Acct-Delay-Time = 0

03:59:22: Attribute 61 6 00000000
03:59:22: Attribute 1 6 31303039
03:59:22: Attribute 30 10 39393534
03:59:22: Attribute 31 12 34303839
03:59:22: Attribute 40 6 00000002
03:59:22: Attribute 6 6 00000001
03:59:22: Attribute 44 183 31362F31
03:59:22: Attribute 42 6 000056E0
03:59:22: Attribute 43 6 00009C04
03:59:22: Attribute 47 6 00000458
03:59:22: Attribute 48 6 000007CD
03:59:22: Attribute 46 6 00000029
03:59:22: Attribute 41 6 00000000

No stop record produced

03:36:56: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0, changed state to down
03:37:29: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0, changed state to up
[Connection to r4 closed by foreign host]

No stop record produced

None received
Cisco Confidential
Page 24 of 35
Router Configurations and Versions
Originating Cisco 5300

ted53-2#wr t
Building configuration...
Current configuration:
!
! No configuration change since last restart
!
version 11.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname ted53-2
!
aaa new-model
aaa authentication login default local radius
aaa authentication login no_rad local
aaa authentication login h323 radius
aaa authentication login lazy none
aaa authorization network h323 radius
aaa accounting update newinfo
aaa accounting network default start-stop radius
aaa accounting connection default start-stop radius
aaa accounting connection h323 start-stop radius
aaa accounting connection no_rad none
aaa accounting system default start-stop radius
enable secret 5 $1$Tx4Q$wpX9Kk2ncq/I5KmAF3qE71
!
username cisco password 0 cisco
username 1000 password 0 123
partition flash 2 8 8
!
ip subnet-zero
isdn switch-type primary-5ess
clock calendar-valid
!
!
controller T1 0
framing esf
clock source internal
linecode b8zs
pri-group timeslots 1-24
!
Cisco Confidential
Page 25 of 35
controller T1 1
framing esf
clock source line secondary
linecode b8zs
!
controller T1 2
framing esf
linecode b8zs
!
controller T1 3
framing esf
clock source line primary
linecode b8zs
!
gw-accounting h323
!
dial-peer voice 5000 pots
application clid_authen_collect
destination-pattern 5550000
port 3:D
!
dial-peer voice 1000 voip
session target ipv4:10.11.253.8
!
application clid_authen_collect
port 1:D
!
destination-pattern 9.T
!
destination-pattern 8.......
port 1:D
!
destination-pattern 6...
port 0:D
!
Cisco Confidential
Page 26 of 35
port 0:D
prefix 851
!
!
!
voice-port 0:D
!
voice-port 1:D
!
voice-port 2:D
!
voice-port 3:D
!
interface Ethernet0
ip address 10.11.254.8 255.255.255.0
!
interface Serial0:23
description This is a PRI dms100 trunk TAC 666
no ip address
no ip directed-broadcast
isdn switch-type primary-dms100
isdn tei-negotiation first-call
isdn incoming-voice modem
no cdp enable
!
description This is a Pac Bell PRI 5710913
no ip address
no cdp enable
!
no ip address
no cdp enable
!
Cisco Confidential
Page 27 of 35
no ip address
no cdp enable
!
interface FastEthernet0
no ip address
no ip route-cache
no ip mroute-cache
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.11.254.1
!
tftp-server flash c5300-is-mz_113-6_NA2.bin
snmp-server community public RO
snmp-server community private RW
snmp-server host 172.22.42.48 traps public
radius-server host 10.1.11.11 auth-port 1645 acct-port 1646
radius-server key testing123
!
line con 0
exec-timeout 0 0
password cisco
login authentication lazy
transport input none
line aux 0
line vty 0 4
exec-timeout 0 0
password cisco
accounting connection no_rad
login authentication no_rad
!
ntp master
end
ted53-2#sh ver
Cisco Internetwork Operating System Software
IOS (tm) 5300 Software (C5300-IS-M), Version 11.3(7)NA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)
TAC:Home:SW:IOS:Service Provider feature
Copyright (c) 1986-1998 by cisco Systems, Inc.
Compiled Fri 30-Oct-98 14:25 by ayeh
Image text-base: 0x600088E8, data-base: 0x607A0000
ROM: System Bootstrap, Version 11.2(9)XA, RELEASE SOFTWARE (fc2)
Cisco Confidential
Page 28 of 35
BOOTFLASH: 5300 Software (C5300-BOOT-M), Version 11.2(9)XA1, RELEASE SOFTWARE (fc1)
ted53-2 uptime is 4 hours, 5 minutes

System restarted by power-on at 17:40:33 UTC Thu Oct 16 1997
System image file is "flash:c5300-is-mz_113-7.new", booted via flash
cisco AS5300 (R4K) processor (revision A.22) with 65536K/16384K bytes of memory.
Processor board ID 07798733
R4700 processor, Implementation 33, Revision 1.0 (512KB Level 2 Cache)
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software copyright 1990 by Meridian Technology Corp).
Primary Rate ISDN software, Version 1.1.
Backplane revision 2
Manufacture Cookie Info:
EEPROM Type 0x0001, EEPROM Version 0x01, Board ID 0x30,
Board Hardware Version 1.0, Item Number 73-2414-3,
Board Revision A0, Serial Number 07798733,
PLD/ISP Version 255.255, Manufacture Date 25-Feb-1998.
1 Ethernet/IEEE 802.3 interface(s)
1 FastEthernet/IEEE 802.3 interface(s)
96 Serial network interface(s)
4 Channelized T1/PRI port(s)
24 Voice resource(s)
128K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash partition 1 (Read/Write)
8192K bytes of processor board System flash partition 2 (Read/Write)
4096K bytes of processor board Boot flash (Read/Write)
Configuration register is 0x2102
ted53-2#sh vfc 1 dir
Files in slot 1 VFC flash:
File Name Size (Bytes)
1 . vcw-vfc-mz.2.5.bin 330844
2 . btl-vfc-l.2.2.bin 4174
3 . cor-vfc-l.2.3(3).bin 60296
Cisco Confidential
Page 29 of 35
4 . jbc-vfc-l.2.2.bin 12286
5 . fax-vfc-l.2.3(3).bin 64314
6 . bas-vfc-l.2.3(3).bin 49634
7 . cdc-g711-l.2.3(3).bin 190
8 . cdc-g729-l.2.3(3).bin 28230
ted53-2#
Terminating Cisco 5300

ted53-6#wr t
Building configuration...
Current configuration:
!
! No configuration change since last restart
!
version 11.3
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname ted53-6
!
aaa new-model
aaa authentication login default local radius
aaa authentication login no_rad local
aaa authentication login h323 radius
aaa authentication login lazy none
aaa authorization network h323 radius
aaa accounting update newinfo
aaa accounting network default start-stop radius
aaa accounting connection default start-stop radius
aaa accounting connection h323 start-stop radius
aaa accounting connection no_rad none
aaa accounting system default start-stop radius
enable secret 5 $1$L2dD$rHRQQLF59SOiwKCEb8uOd/
!
username cisco password 0 cisco
ip subnet-zero
!
!
controller T1 0
framing esf
linecode b8zs
!
Cisco Confidential
Page 30 of 35
controller T1 1
framing esf
clock source line secondary
linecode b8zs
!
controller T1 2
framing esf
linecode b8zs
!
controller T1 3
framing esf
clock source line primary
linecode b8zs
!
gw-accounting h323
!
destination-pattern 9.T
port 1:D
!
port 3:D
prefix 5551000
!
destination-pattern 8.......
fax-rate 9600
!
destination-pattern 6...
port 0:D
!
!
!
voice-port 0:D
!
Cisco Confidential
Page 31 of 35
voice-port 1:D
!
voice-port 2:D
!
voice-port 3:D
!
interface Ethernet0
ip address 10.11.253.8 255.255.255.0
!
no ip address
isdn switch-type primary-dms100
isdn tei-negotiation first-call
no cdp enable
!
no ip address
no cdp enable
!
no ip address
no cdp enable
!
no ip address
no cdp enable
!
interface FastEthernet0
no ip address
shutdown
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.11.253.1
!
snmp-server community public RO
snmp-server community private RW
radius-server host 10.1.11.11 auth-port 1645 acct-port 1646
radius-server key testing123
!
Cisco Confidential
Page 32 of 35
line con 0
exec-timeout 0 0
line aux 0
line vty 0 4
exec-timeout 0 0
password cisco
accounting connection no_rad
!
ntp clock-period 17180081
ntp server 10.11.254.8
end
ted53-6#sh ver
Cisco Internetwork Operating System Software
IOS (tm) 5300 Software (C5300-IS-M), Version 11.3(7)NA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)
TAC:Home:SW:IOS:Service Provider feature
Copyright (c) 1986-1998 by cisco Systems, Inc.
Compiled Fri 30-Oct-98 14:25 by ayeh
Image text-base: 0x600088E8, data-base: 0x607A0000
ROM: System Bootstrap, Version 11.2(9)XA, RELEASE SOFTWARE (fc2)

BOOTFLASH: 5300 Software (C5300-BOOT-M), Version 11.2(9)XA1, RELEASE SOFTWARE (fc1)
ted53-6 uptime is 5 hours, 50 minutes

System restarted by reload at 15:57:25 UTC Thu Oct 16 1997
System image file is "flash:c5300-is-mz_113-6_7.new", booted via flash
cisco AS5300 (R4K) processor (revision A.32) with 32768K/16384K bytes of memory.
Processor board ID 10078660
R4700 processor, Implementation 33, Revision 1.0 (512KB Level 2 Cache)
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software copyright 1990 by Meridian Technology Corp).
Primary Rate ISDN software, Version 1.1.
Backplane revision 2
Manufacture Cookie Info:
EEPROM Type 0x0001, EEPROM Version 0x01, Board ID 0x30,
Board Hardware Version 1.64, Item Number 800-2544-2,
Board Revision B0, Serial Number 10078660,
PLD/ISP Version 0.0, Manufacture Date 30-Sep-1998.
1 Ethernet/IEEE 802.3 interface(s)
1 FastEthernet/IEEE 802.3 interface(s)
96 Serial network interface(s)
Cisco Confidential
Page 33 of 35
4 Channelized T1/PRI port(s)
24 Voice resource(s)
128K bytes of non-volatile configuration memory.
8192K bytes of processor board System flash (Read/Write)
4096K bytes of processor board Boot flash (Read/Write)
Configuration register is 0x2102
ted53-6# sh vfc 1 dir
Files in slot 1 VFC flash:
File Name Size (Bytes)
1 . vcw-vfc-mz.2.5.bin 330844
2 . btl-vfc-l.2.2.bin 4174
3 . cor-vfc-l.2.3(3).bin 60296
4 . jbc-vfc-l.2.2.bin 12286
5 . fax-vfc-l.2.3(3).bin 64314
6 . bas-vfc-l.2.3(3).bin 49634
7 . cdc-g711-l.2.3(3).bin 190
8 . cdc-g729-l.2.3(3).bin 28230
ted53-6#
Acknowledgements:
This document was written with the generous assistance of Azita Kia and the Cisco Product Documentation team.
Cisco Confidential
Page 34 of 35
Corporate Headquarters European Headquarters Americas Asia Headquarters
Cisco Systems, Inc. Cisco Systems Europe s.a.r.l. Headquarters Nihon Cisco Systems K.K.
170 West Tasman Drive Parc Evolic, Batiment L1/L2 Cisco Systems, Inc. Fuji Building, 9th Floor
San Jose, CA 95134-1706 16 Avenue du Quebec 170 West Tasman Drive 3-2-3 Marunouchi
USA Villebon, BP 706 San Jose, CA 95134-1706 Chiyoda-ku, Tokyo 100
http://www.cisco.com 91961 Courtaboeuf Cedex USA Japan
Tel: 408 526-4000 France http://www.cisco.com http://www.cisco.com
800 553-NETS (6387) http://www-europe.cisco.com Tel: 408 526-7660 Tel: 81 3 5219 6250
Fax: 408 526-4100 Tel: 33 1 69 18 61 00 Fax: 408 527-0883 Fax: 81 3 5219 6001
Fax: 33 1 69 28 83 26
Cisco Systems has more than 200 offices in the following countries. Addresses, phone numbers, and fax numbers are listed on the
C i s c o C o n n e c t i o n O n l i n e We b s i t e a t h t t p : / / w w w. c i s c o . c o m / o f fi c e s .
Argentina • Australia • Austria • Belgium • Brazil • Canada • Chile • China • Colombia • Costa Rica • Croatia • Czech Republic • Denmark • Dubai, UAE Finland • France
• Germany • Greece • Hong Kong • Hungary • India • Indonesia • Ireland • Israel • Italy • Japan • Korea • Luxembourg • Malaysia Mexico • The Netherlands • New
Zealand • Norway • Peru • Philippines • Poland • Portugal • Puerto Rico • Romania • Russia • Saudi Arabia • Singapore Slovakia • Slovenia • South Africa • Spain •
Sweden • Switzerland • Taiwan • Thailand • Turkey • Ukraine • United Kingdom • United States • Venezuela
Copyright © 1999 Cisco Systems, Inc. All rights reserved. Printed in USA. IOS is a trademark; and Cisco, Cisco IOS, Cisco Systems, and the Cisco Systems logo are registered trademarks of Cisco Systems, Inc. in the U.S. and
certain other countries. All other trademarks mentioned in this document are the property of their respective owners. (9811R) 1/99LW

Configuration Guide For AAA Billing in Cisco PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Configuration Guide For AAA Billing in Cisco PDF

Uploaded by

Copyright:

Available Formats

R EFERENCE G UIDES

Configuration Guide for AAA Billing

Accounting for Voice

Table 1 Standard Supported RADIUS Attributes (RFCs 2138 and 2139)

NAS-Port-Type 61 Four octets (used for MLPPP)

User-Name 1 ASCII string field up to 63 octets

Called-station-Id 30 One or more octets (DNIS phone number, ASCII string)

Calling-station-Id 31 One or more octets (ANI phone number, ASCII string)

Acct-Status-Type 40 Four octets (hex ASCII number)

Service-Type 6 Four octets (hex ASCII number)

Acct-Session-Id 44 “overloaded” for CDR - ASCII string up to 256 bytes

Acct-Input-Octets 42 Four octets stop records only (hex number)

Acct-Output-Octets 43 Four octets stop records only (hex number)

Acct-Input-Packets 47 Four octets stop records only (hex number)

Acct-Output- Packets 48 Four octets stop records only (hex number)

Acct-Session-Time 46 Four octets (hex number in seconds) stop records only

Acct-Delay-Time 41 Four octets (hex number)

RADIUS Accounting with Overloaded Acct-Session-Id

Overloaded Acct-Session-Id Field Descriptions

Gateway ID The name of the underlying gateway

Network Time Protocol (NTP) Usage Guidelines

Gateway ID The name of the gateway emitting the message

Message number The number assigned to the message by the gateway

Message label A string used to identify the message category

This guide is limited to a discussion of RADIUS accounting (gw-accounting h323) only.

Cisco IOS AAA Accounting Commands

aaa accounting connection h323 <stop-only | start-stop> radius

gw-accounting <h323 | syslog>

debug voip aaa

Other Useful Debug and Troubleshooting Commands

The Anatomy and Dissection of a Call Detail Record

Figure 1 Basic Network

Originating Side Terminating Side

Call Leg1 Call Leg4

Generating Call Detail Records in CiscoSecure

Example Session for Exporting RADIUS Records in CiscoSecure UNIX v 2.3

1. Create a file to which you will export RADIUS records.

Loading properties from /export/home/CiscoSecure/config/CSConfig.ini

DELETE FROM cs_user_accounting WHERE (record_id <= ?)

Exported 28 accounting records.

DELETE FROM cs_accounting_log WHERE (log_id <= ?)

4. Read the file you have just created

10.11.254.8 - - 4089540523 start server=redzinger time=09:36:27

Description and Discussion

Difference Between start-stop and stop-only Records

Call Record Details

Analysis of Call Records

Start and Stop Records for Call Leg 1 (answer telephony)

Start Record Call Leg 1

Radius Debug Output (start record call leg 1)

Stop Record Call Leg 1

Radius Debug Output

Start and Stop Records for Call Leg 2 (originate VoIP)

Start Record Call Leg 2

Radius Debug Output (start record call leg 2)

Stop Record Call Leg 2

Duplicate Stop Record Call Leg 2

Radius Debug Output (stop record call leg 2)

Start and Stop Records for Call Leg 3 (answer VoIP)

Start Record Call Leg 3

Radius Debug Output (start record call leg 3)

Radius Debug Output Stop Record Call Leg 3

Start Record Call Leg 4