Your software release
may not support all the features documented in this module. For the latest
caveats and feature information, see
Bug Search Tool and the
release notes for your platform and software release. To find information about
the features documented in this module, and to see a list of the releases in
which each feature is supported, see the feature information table.
Use Cisco Feature
Navigator to find information about platform support and Cisco software image
support. To access Cisco Feature Navigator, go to
An account on Cisco.com is not required.
Restrictions for ISG RADIUS Proxy Support for Mobile Users—Hotspot Roaming and Accounting Start Filtering
Restrictions for RADIUS Proxy Support for Hotspot Roaming
A subscriber is connected to an access point (AP1) that is connected to an Access Zone Router (AZR) (AZR1). The subscriber moves to a different AZR and moves back to a different access point (AP2) within AZR1. When the subscriber tries to reauthenticate with the same IP address that it had for AP1, ISG cannot determine that it is a new session with AP2 and terminates the session when the roaming timer expires.
Restrictions for RADIUS Proxy Support for Accounting Start Filtering
Configuring RADIUS packet filtering in RADIUS proxy client configuration mode can cause negative impact on the number of RADIUS packets that ISG can process in a second and can bring down calls per second.
A maximum of four filters can be applied to a single configuration.
Information About ISG RADIUS Proxy Support for Mobile Users—Hotspot Roaming and Accounting Start Filtering
Hotspot Roaming Timer
When an Extensible Authentication Protocol (EAP)-authenticated subscriber moves from one hotspot to another (hotspot roaming), the subscriber authenticates against a new access point. ISG checks the following conditions to validate if the user has roamed from one hotspot to another:
The IP address of the access point has changed.
The user is authenticated.
If the reauthentication on hotspot roaming is successful, the ISG RADIUS proxy server saves the following data in the RADIUS proxy session context:
The time of reauthentication.
Authorization data that comes as part of the reauthentication.
If the reauthentication fails, ISG clears the session.
If reauthentication is successful, ISG receives an accounting-start request on the existing session from the new access point, with a different IP address. ISG creates a new RADIUS proxy session for the subscriber with a new IP address and provides seamless roaming by applying the services saved during reauthentication if the following conditions are satisfied:
The time difference between the arrival of the accounting start request and the reauthentication request is less than the configured IP timer. For more information on IP timers, see the “Configuring ISG RADIUS Proxy Global Parameters” and the “Configuring ISG RADIUS Proxy Client-Specific Parameters” sections in the “Configuring ISG as a RADIUS Prox”y chapter.
The subscriber is EAP-authenticated.
If the new session is created successfully, a roaming timer is started for the first session. Use the
timer roaming command in RADIUS proxy server configuration and RADIUS proxy client configuration modes to configure the roaming timer. Once the cleanup timer expires, ISG clears the first session, and the second session remains as the only session for the subscriber.
If the subscriber moves back to the first hotspot before the roaming timer expires on the first session and reauthentication is successful, the roaming timer is stopped for the first session. A new roaming timer is initiated for the second session. If the reauthentication fails, the first session is cleared.
If ISG receives an accounting-stop request for the first session from the AZR to which the session belongs, before the roaming timer expires, the timer is stopped and the first session is cleared. The accounting-stop request is forwarded to the RADIUS server. The response from the RADIUS server is forwarded to the AZR.
If the subscriber roams between multiple hotspots, ISG creates multiple parallel sessions. All these sessions are maintained on ISG until the roaming timer associated with them expires. Only the session that is authenticated last is not associated with a roaming timer.
RADIUS Packet Filter Creation
The RADIUS filter consists of a filter structure and a CLI through which subscribers can configure the filter on RADIUS packets. When a packet is received by ISG, ISG reads the attributes in the packet and matches them with the attributes defined in the filter. Depending on the match criteria that are specified in the filter, ISG takes the defined action on the RADIUS packet.
To create a RADIUS packet filter, follow three steps:
Create the RADIUS filter with match criteria.
Get the list of standard IETF attributes or vendor-specific attributes from the RADIUS packet that is received.
Accept, reject, or ignore the RADIUS packets by applying the filter criteria.
How to Configure ISG RADIUS Proxy Support for Mobile Users—Hotspot Roaming and Accounting Start Filtering
Configuring a Roaming Timer for the ISG RADIUS Proxy Session
4.aaa server radius proxy
5.timer roaming timer-value
Command or Action
Enters privileged EXEC mode.
Enter your password if prompted.
Device# configure terminal
Enters global configuration mode.
Device(config)# aaa new-model
Enables the authentication, authorization, and accounting (AAA) access control model.
aaa server radius proxy
Device(config)# aaa server radius proxy
Enters ISG RADIUS proxy server configuration mode.
Configuring RADIUS Proxy Support for Accounting Start Filtering
The Accounting Start Filtering feature allows the creation of RADIUS packet filtering to filter packets that reach ISG. Based on the defined filter criteria, ISG performs certain actions on the RADIUS packet.
The RADIUS packet filter is created on ISG by defining the filter name and the match criteria in the
radius filter command. The match criteria are applied to the attributes of the RADIUS packet. When you configure the
radius filtermatch-all command, the filter is applied to the RADIUS packet only if all the attributes configured in the command match the attributes in the RADIUS packet. When you configure the
radius filtermatch-any command, the filter is applied to the RADIUS packet if at least one attribute configured in the command matches the attributes in the RADIUS packet. The attributes to match are defined in RADIUS filter configuration mode.
In RADIUS filter configuration mode, you can specify a standard IETF RADIUS attribute or a vendor-specific RADIUS attribute. These attributes must match the attributes in the RADIUS packet so that the filter can be applied accordingly. The
match command checks if the attribute is present in the packet, and the
command checks if the attribute is not present in the packet.
Apply RADIUS filters to the RADIUS proxy server in order for the configuration to take effect. Apply RADIUS filters in RADIUS proxy server configuration mode and RADIUS proxy client configuration mode. If filters are applied in both modes, only the client mode configuration will take effect.
You can specify the type of RADIUS packets to which the filter should be applied using the
filter access and
filter accounting commands.
You can configure any one of the following three actions that the RADIUS proxy server should apply to the incoming RADIUS packets to complete the filtering process:
drop—Drops the RADIUS packet.
ignore—Forwards the packet to the RADIUS server, but does not apply any ISG-related features to the RADIUS packet.
ack—Returns the access-accept response for the access packet and the accounting response for the accounting packet.
Perform the following tasks to configure a RADIUS packet filter and apply the filter criteria to RADIUS proxy.
Applying RADIUS Filters to RADIUS Proxy Server or Client
filter command in RADIUS proxy server configuration mode or RADIUS proxy client configuration mode to apply a RADIUS filter. If the RADIUS filter is configured in both these modes, only the filter configured in the client mode will be applied.
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.
Feature Information for ISG RADIUS Proxy Support for Mobile Users: Hotspot Roaming and Accounting Start Filtering
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 Feature Information for ISG RADIUS Proxy Support for Mobile Users—Hotspot Roaming and Accounting Start Filtering
ISG RADIUS Proxy Support for Mobile Users—Hotspot Roaming and Accounting Start Filtering
Cisco IOS XE Release 3.5S
The ISG RADIUS Proxy Support for Mobile Users—Hotspot Roaming and Accounting Start Filtering feature allows you to configure hotspot roaming and RADIUS packet filtering for RADIUS proxy sessions.
The following commands were introduced or modified:
radius filter, and
timer (ISG RADIUS proxy).