Intelligent Services Gateway Configuration Guide, Cisco IOS Release 15.2S
Configuring ISG Port-Bundle Host Key
Configuring ISG Port-Bundle Host Key
Last Updated: December 19, 2012
The Intelligent Services Gateway (ISG) provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. This module describes how to configure the ISG Port-Bundle Host Key feature, which maps TCP packets from subscribers to a local IP address for the ISG and a range of ports. This mapping allows an external portal to identify the ISG from which a session originated.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for the ISG Port-Bundle Host Key Feature
Restrictions for the ISG Port-Bundle Host Key Feature
Information About ISG Port-Bundle Host Key
Overview of ISG Port-Bundle Host Key
The ISG Port-Bundle Host Key feature serves as an in-band signaling mechanism for session identification at external portals. TCP packets from subscribers are mapped to a local IP address for the ISG and a range of ports. This mapping allows the portal to identify the ISG from which the session originated. The mapping also identifies sessions uniquely even when subscribers have overlapping IP addresses. The ISG Port-Bundle Host Key feature enables a single portal to be deployed for multiple virtual routing and forwarding (VRF) instances even when there are subscribers with overlapping IP addresses.
Port-Bundle Host Key Mechanism
With the ISG Port-Bundle Host Key feature, an ISG performs Port-Address Translation (PAT) and Network Address Translation (NAT) on TCP traffic between the subscriber and the portal. When a subscriber TCP connection is set up, the ISG creates a port mapping that changes the source IP address to a configured ISG IP address and changes the source TCP port to a port allocated by the ISG. The ISG assigns a bundle of ports to each subscriber because one subscriber can have several simultaneous TCP sessions when accessing a web page. The assigned port-bundle host key, or a combination of the port bundle and the ISG source IP address, uniquely identifies each subscriber. The host key is carried in RADIUS packets sent between the portal server and the ISG in the Subscriber IP vendor-specific attribute (VSA). The table below describes the Subscriber IP VSA. When the portal server sends a reply to the subscriber, the ISG uses translation tables to identify the destination IP address and destination TCP port.
For each TCP session between a subscriber and the portal, the ISG uses one port from the port bundle as the port map. Individual port mappings are flagged as eligible for reuse on the basis of inactivity timers, but are not explicitly removed once assigned. The number of port bundles is limited per ISG address, but there is no limit to the number of ISG IP addresses that can be configured for port bundle usage.
The port-bundle length is used to determine the number of ports in one bundle. By default, the port-bundle length is 4 bits. The maximum port-bundle length is 10 bits. See the table below for available port-bundle length values and the resulting port-per-bundle and bundle-per-group values. You may want to increase the port-bundle length when you see frequent error messages about running out of ports in a port bundle.
Benefits of ISG Port-Bundle Host Key
Support for Overlapped Subscriber IP Addresses Extended to Include External Portal Usage
The ISG Port-Bundle Host Key feature enables external portal access regardless of the subscriber IP address or VRF membership. Without the use of port-bundle host keys, all subscribers accessing a single external portal must have unique IP addresses. Furthermore, because port-bundle host keys isolate VRF-specific addresses from the domain in which the portal resides, routing considerations are simplified.
Portal Provisioning for Subscriber and ISG IP Addresses No Longer Required
Without the ISG Port-Bundle Host Key feature, a portal must be provisioned for subscriber and ISG IP addresses before the portal is able to send RADIUS packets to the ISG or HTTP packets to subscribers. The ISG Port-Bundle Host Key feature eliminates the need to provision a portal to allow one portal server to serve multiple ISGs and one ISG to be served by multiple portal servers.
How to Configure ISG Port-Bundle Host Key
Enabling the ISG Port-Bundle Host Key Feature in a Service Policy Map
Perform this task to enable the ISG Port-Bundle Host Key feature in a service policy map. The ISG Port-Bundle Host Key feature will be applied to any subscriber who uses this service policy map.
2. configure terminal
3. policy-map type service policy-name
4. ip portbundle
Enabling the ISG Port-Bundle Host Key Feature in a User Profile or Service Profile on the AAA Server
What to Do Next
If you enabled the ISG Port-Bundle Host Key feature in a service profile, you may want to configure a method of activating the service profile; for example, control policies can be used to activate services. For more information about methods of service activation, see the "Configuring ISG Subscriber Services" module.
Configuring Port-Bundle Host Key Parameters
Perform this task to configure ISG Port-Bundle Host Key parameters and specify the interface for which ISG will use translation tables to derive the IP address and port number for downstream traffic.
Verifying the ISG Port-Bundle Host Key Configuration
Configuration Examples for ISG Port-Bundle Host Key
ISG Port-Bundle Host Key Configuration Example
The following example shows how to configure the ISG Port-Bundle Host Key feature to apply to all sessions:
policy-map type service ISGPBHKService ip portbundle ! policy-map type control PBHKRule class type control always event session-start 1 service-policy type service ISGPBHKService ! service-policy type control PBHKRule interface ethernet0/0 ip address 10.1.1.1 255.255.255.0 ip portbundle outside ! ip portbundle match access-list 101 length 5 source loopback 0
Feature Information for ISG Port-Bundle Host Key
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2012 Cisco Systems, Inc. All rights reserved.