Cisco Cisco ASR 5000 トラブルシューティングガイド
Contents
Introduction
Trap triggers
Consecutive failures in a aaamgr process approach
Keepalive approach
Troubleshooting commands/approaches
Radius configuration basics
show task resources facility aaamgr all
show radius counters { {all | server
show session subsystem facility {aaamgr | sessmgr} {all | instance
ping
traceroute
radius test instance x auth {radius group
radius test instance x accounting {radius group
show radius info [radius group
monitor subscriber
Packet Capture
Remediations
Final Example
Related Cisco Support Community Discussions
Introduction
This article discusses how to troubleshoot SNMP traps AAAAccSrvUnreachable and
AAAAuthSrvUnreachable, which are triggered due to reachability issues with a Remote
Authentication Dial-In User Service (RADIUS) server used to authenticate subscribers (or
operators logging into the node, but that is not what is being discussed here). There are two
approaches that can be used to determine when either of these traps will trigger. This article will
explain what conditions trigger these traps and what troubleshooting approaches and data
collection can be taken to determine root cause and solve them. It also discuss some potential
remediation steps that can be considered.
AAAAuthSrvUnreachable, which are triggered due to reachability issues with a Remote
Authentication Dial-In User Service (RADIUS) server used to authenticate subscribers (or
operators logging into the node, but that is not what is being discussed here). There are two
approaches that can be used to determine when either of these traps will trigger. This article will
explain what conditions trigger these traps and what troubleshooting approaches and data
collection can be taken to determine root cause and solve them. It also discuss some potential
remediation steps that can be considered.
Note that the RESULT of unreachability will be call failures or accounting failures, the same as if
radius responses are rejections instead of acceptances. While success/failure (authentication) rate
is measured independently of timeout/reachability (there are traps and alarms for this) and can
certainly be analyzed in its own right, the focus of this article will be on the reachability problem
and not the reject problem.
radius responses are rejections instead of acceptances. While success/failure (authentication) rate
is measured independently of timeout/reachability (there are traps and alarms for this) and can
certainly be analyzed in its own right, the focus of this article will be on the reachability problem
and not the reject problem.
Example output from the LAB and actual tickets is used throughout to help drive home the
discussions. What appears to be public IP addresses in this article are fake addresses.
discussions. What appears to be public IP addresses in this article are fake addresses.
Trap triggers
There are two different models/algorithms/approaches to choose from to determine the status of a
radius server and when to try a different server if failures are occurring:
radius server and when to try a different server if failures are occurring:
Consecutive failures in a aaamgr process approach