The traffic
accounting card mentioned in this chapter refers to LS81VSNP
LPU (line processing unit).
Some accounting servers, such as CAMS, can
perform accounting for successfully authenticated 802.1x users based on time or
traffic. Traffic accounting enables the switch where the users are
authenticated to account for the traffic generated when the users are online
and send traffic accounting results to the accounting server to charge the
online users.
l
Traffic group: a mechanism used to classify
destination networks by accounting attributes. The accounting attributes of a
traffic group include whether or not to charge and the charge rate.
l
Traffic group accounting address: a network IP
address configured for a traffic group. You can configure some network
addresses for a traffic group, and then traffic generated by accessing these
addresses will be accounted.
l
Traffic collection card: an interface card
configured to perform traffic collection. A traffic collection card sends all
the traffic passing through it to the traffic accounting card.
l
Traffic accounting card: the card which performs
traffic analysis, calculation and statistics.
l
Traffic collection: the process of sending the
traffic passing through the traffic collection card to the traffic accounting
card.
l
Traffic accounting: the process that the traffic
accounting card follows to analyze and calculate the traffic obtained from the
traffic collection card. Traffic accounting is performed based on the
users’ online IP addresses and the traffic groups to which the accessed
networks belong.
Figure 1-1
shows the implementation process of traffic accounting on the H3C S7500 series
switches.
Figure 1-1 Implementation process of traffic accounting
The following details the traffic
accounting procedure:
1)
After a user passes the 802.1x authentication,
the user goes online successfully.
2)
The authenticator device acquires the online IP
address of the user and starts to account for the traffic of the user.
3)
The user accesses networks and traffic is
generated.
4)
The traffic collection card sends the user's
online traffic to the traffic accounting card.
5)
The traffic accounting card performs traffic
statistics based on traffic group, and generates traffic accounting statistics,
which reflects the accumulated amount of the traffic generated since the user
gets online.
6)
The traffic accounting card periodically sends
update traffic accounting statistics to the accounting server.
7)
When the user goes offline, the authenticator
device sends the total traffic amount to the accounting server.
8)
The accounting process is over for this user.
l
A service card that can be used as the traffic
accounting card is plugged into the switch.
l
802.1x is enabled on the switch.
l
A CAMS server is properly configured.
This article
introduces the configuration of traffic accounting. The configuration of 802.1x
and CAMS server is not covered here.
The following table describes the
configuration tasks for traffic accounting.
Table 1-1 Configure the traffic accounting function
|
Operation
|
Command
|
Description
|
|
Enter system view
|
system-view
|
—
|
|
Configure the
traffic accounting slot
|
traffic-accounting
accounting-slot slot-num
|
Required
l
The traffic accounting slot you specified must
be the slot where the traffic accounting card resides.
l
You will enter the traffic accounting view
directly after the configuration succeeds.
l
By default, no traffic accounting slot is
specified.
|
|
Specify a
traffic collection card
|
Traffic-slot
slot-num
|
Required
|
|
Enable the
traffic accounting function
|
accounting
enable
|
Required
By default, this
function is disabled on the traffic accounting card.
|
Table 1-2 Configure traffic group
|
Configuration
|
Command
|
Description
|
|
Enter system
view
|
system-view
|
—
|
|
Configure a
traffic group
|
traffic-accounting
traffic-group group-name
|
Required
Enter
traffic group view automatically after successful configuration.
|
|
Configure a
network address for the traffic group
|
network ip-address {
mask | mask-len }
|
Required
Use this
command in traffic group view.
|
Table 1-3 Configure a traffic group for a domain
|
Configuration
|
Command
|
Description
|
|
Enter system view
|
system-view
|
—
|
|
Enter ISP
domain view
|
domain domain-name
|
—
|
|
Set the
accounting mode to traffic accounting
|
accounting-mode
traffic
|
Required
|
|
Configure
the domain to use a specified traffic group
|
traffic-group
group-name rate idnum
|
Required
|
l
The interface card that connects external
networks (Internet) should be configured as traffic collection cards.
l
Currently, only single rate is supported, and
multi-rate is not supported.
After the above configuration, you can
execute the display command in any view to display the operation status
of traffic accounting and verify your configuration.
Table 1-4 Display traffic accounting
|
Operation
|
Command
|
Description
|
|
Display
traffic group information
|
display
traffic-accounting traffic-group [ group-name ]
|
You
can execute the display command in any view.
|
|
Display
traffic accounting configuration
|
display
traffic-accounting accounting-slot [ slot-num ]
|
|
Display
traffic accounting statistics of one or all online users
|
display
traffic-accounting statistics [ ip-address ]
|
I. Network requirements
l
A user running 802.1x authentication client
accesses the Internet through a switch. The user can access external networks
after passing the authentication. The accounting mode is traffic accounting.
When the user accesses the networks 11.127.1.0/24 and 12.127.1.0/24, the
accounting server CAMS charges the user according to the user's online traffic.
When the user accesses other networks, however, the user is not charged.
II. Network diagram
Figure
1-2 Network diagram for traffic accounting
III. Configuration
procedure
# Configure a traffic accounting group
named somegroup.
<H3C> system-view
[H3C] traffic-accounting
traffic-group somegroup
# Configure the following two destination
network IP addresses for the traffic accounting group.
[H3C-traffic-group-somegroup] network
11.127.1.0 24
[H3C-traffic-group-somegroup] network
12.127.1.0 24
# Enter the user's domain view (suppose the
user belongs to domain aaa), set the accounting mode to traffic accounting and
configure the domain to use the traffic group.
[H3C] domain aaa
[H3C-isp-aaa] accounting-mode traffic
[H3C-isp-aaa] traffic-group somegroup
rate 1
# Configure the traffic accounting card,
specify the traffic collection card, and enable the traffic accounting
function.
[H3C] traffic-accounting accounting-slot
2
[H3C-accounting-slot-2] traffic-slot
3
[H3C-accounting-slot-2] accounting enable
