The ip auth-proxy auth-cache-time Command

Use the global configuration ip auth-proxy command with the auth-cache-time option to set the authentication proxy global idle timeout value. This cache idle timer monitors the length of time (in minutes) that an authentication cache entry, along with its associated dynamic user access control list entry, is managed after a period of inactivity. When that period of inactivity expires, the authentication entry and the associated dynamic access list entries are deleted.

If CBAC is also configured on the router, the auth-cache-time timeout value must be set higher than the idle timeout for any context-based access control protocols. If not, when the authentication proxy timer expires and removes the user profile and any associated dynamic user ACLs, idle connections could be monitored by CBAC. Deleting these ACL entries can cause the idle connections to hang.

The reverse isn’t a problem when the CBAC idle timeout value is shorter. CBAC always resets the idle connections whenever the CBAC idle timeout expires, which would then be before the authentication proxy removes the user profile. Use the no form of the command to restore the default. The syntax is

Rtr1(config)#ip auth-proxy auth-cache-time min
Rtr1(config)#no ip auth-proxy auth-cache-time

auth-cache-time min

Specifies the minutes of inactivity an authentication cache entry and the associated dynamic user ACL entry will exist before being deleted. Acceptable values: 1 to 2,147,483,647 minutes.

This command was introduced in IOS 12.0(5)T. The default value is 60 minutes.

The following example sets the authorization cache idle timeout to 20 minutes.

Rtr1(config)#ip auth-proxy auth-cache-time 20

The ip auth-proxy auth-cache-time Command

The ip auth-proxy auth-cache-time Command

admin