Cisco Cisco Access Registrar 5.0 Guide D’Information
Q&A
© 2009 Cisco Systems, Inc. All rights reserved. This document is Cisco Public Information.
Page 3 of 11
Q.
What are the basic components in Cisco Access Registrar and how are they implemented?
A.
Cisco Access Registrar basically consists of UNIX daemons and a very fast internal database. The internal
database stores the AAA configuration and can also be used for storing user profiles.
Basically Cisco Access Registrar consists of three functional units:
●
Policy Engine: A robust and extensible method of imposing per packet policies
●
AAA server: A RADIUS server designed from the ground up for performance, scalability, and extensibility for
deployment in complex service provider environments
●
Session Manager: Keeps track of active user sessions and allows real-time query from external applications;
allocates resources such as IP address per user, per group session limiting, and other methods.
Q.
What standards are supported by Cisco Access Registrar?
A.
Cisco Access Registrar supports the following RFCs:
●
2865 RADIUS
●
2866 RADIUS Accounting
●
2867 RADIUS Accounting Modifications for Tunnel Protocol Support
●
2868 RADIUS Attributes for Tunnel Protocol Support
●
3576 Dynamic Authorization Extensions (updates RFC 2869, Packet of Disconnect [PoD] support only)
●
3579 RADIUS Support for Extensible Authentication Protocol (EAP) (updates RFC 2869)
●
2618 RADIUS Authentication Client MIB
●
2619 RADIUS Authentication Server MIB
●
2620 RADIUS Accounting Client MIB
●
2621 RADIUS Accounting Server MIB
●
4186 Extensible Authentication Protocol Method for Global System for Mobile Communications (GSM)
Subscriber Identity Modules (EAP-SIM)
Cisco Access Registrar supports the following drafts/documents:
●
Digest Authentication over RADIUS (draft-sterman-aaa-sip-00.txt)
●
EAP-SIM draft 11 (draft-haverinen-pppext-eap-sim-11.txt)
●
WiMAX support as per NWG version 1.3.1 of the stage III document (WiMAX Forum)
Q.
Can Cisco Access Registrar process RADIUS requests differently based on attributes in the request?
A.
Yes. Cisco Access Registrar can be configured to dynamically decide how to process requests based on any
attribute in the packet, including, but not limited to, username prefix or suffix, dialed number, or calling number.
An access request can be processed using information in an LDAP directory server or an Oracle or MySQL
database, forwarded to another RADIUS server, or handled through a combination of these methods. An
accounting request can be processed locally into a file, forwarded to another RADIUS/Diameter server, written
to a database, or processed using a combination of these methods.
Q.
Can Cisco Access Registrar be configured to modify attributes in a RADIUS packet?
A.
In addition to the authorization process, in which attributes stored in Cisco Access Registrar's internal database
or external database are returned in an access-accept packet, Cisco Access Registrar allows attributes in a
RADIUS/Diameter request, response, or proxy packet to be added, modified, or deleted.