Intelligent Services Gateway Configuration Guide, Cisco IOS Release 12.2SR
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Configuring ISG Policies for Regulating Network Access
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Contents
Configuring ISG Policies for Regulating Network AccessLast Updated: August 21, 2011
Intelligent Services Gateway (ISG) is a Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. ISG supports the use of policies for governing subscriber session bandwidth and network accessibility. This module provides information about the following methods of regulating session bandwidth and network access: Modular Quality of Service (QoS) command-line interface (CLI) policies, Dynamic Subscriber Bandwidth Selection (DBS), per-subscriber firewalls, and ISG policing.
Finding Feature InformationYour software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required. Restrictions for ISG Policies for Regulating Network AccessBeginning in Cisco IOS Release 12.2(33)SRC, the Cisco 7600 router supports this feature with the following limitation:
Information About ISG Policies for Regulating Network AccessMethods of Regulating Network AccessISG supports the following methods of regulating network access. Each of these methods can be applied to an ISG session and can be dynamically updated. Modular QoS CLI (MQC) PoliciesQoS policies configured using the MQC are supported for subscriber sessions only. MQC policies cannot be applied to ISG services. Dynamic Subscriber Bandwidth Selection (DBS)DBS enables you to control bandwidth at the ATM virtual circuit (VC) level. ATM QoS parameters from the subscriber domain are applied to the ATM permanent virtual circuit (PVC) on which a PPP over Ethernet (PPPoE) or PPP over ATM (PPPoA) session has been established.
Per-Subscriber FirewallsPer-subscriber firewalls are access control lists (ACLs) that are used to prevent subscribers, services, and pass-through traffic from accessing specific IP addresses and ports. Per-subscriber firewalls can be configured in user profiles and service profiles. ISG PolicingISG policing supports policing of upstream and downstream traffic. ISG policing differs from policing configured using the MQC in that ISG policing can be configured in service profiles to support policing of traffic flows. MQC policies cannot be configured in service profiles. ISG policing can also be configured in user profiles and service profiles to support session policing.
Overview of ISG PolicingTraffic policing allows you to control the maximum rate of traffic sent or received on an interface. Policing is often configured on interfaces at the edge of a network to limit traffic into or out of the network. Traffic that falls within the rate parameters is sent, whereas traffic that exceeds the parameters is dropped or sent with a different priority. ISG policing supports policing of upstream and downstream traffic and can be applied to a session or a flow. The following sections describe session-based policing and flow-based policing. Session-Based PolicingSession-based policing applies to the aggregate of subscriber traffic for a session. In the figure below, session policing would be applied to all traffic moving from the PPPoE client to ISG and from ISG to the PPPoE client. Session-based policing parameters can be configured on a AAA server in either a user profile or a service profile that does not specify a traffic class. It can also be configured on the router in a service policy map. Session-based policing parameters that are configured in a user profile take precedence over session-based policing parameters configured in a service profile or service policy map. Flow-Based PolicingFlow-based policing applies only to the destination-based traffic flows that are specified by a traffic class. In the figure below, flow-based policing would allow you to police the traffic between the PPPoE client and Internet 1 or Internet 2. Flow-based policing can be configured on a AAA server in a service profile that specifies a traffic class. It can also be configured on the router under a traffic class in a service policy map. Flow-based policing and session-based policing can coexist and operate simultaneously on subscriber traffic. Per-Subscriber FirewallsPer-subscriber firewalls are Cisco IOS ACLs that are used to prevent subscribers, services, and pass-through traffic from accessing specific IP addresses and ports. ACLs can be configured in user profiles or service profiles on a AAA server or in service policy maps on ISG. The ACLs can be numbered or named access lists that are configured on ISG, or the ACL statements can be included in the profile configuration. When an ACL is added to a service, all subscribers of that service are prevented from accessing the specified IP address, subnet mask, and port combinations through the service. When an ACL attribute is added to a user profile, it applies globally to all traffic for the subscriber. How to Configure ISG Policies for Regulating Network AccessConfiguring ISG Policing
Configuring Policing in a Service Policy Map on the Router
SUMMARY STEPS
DETAILED STEPS
Configuring Policing in a Service Profile or User Profile on the AAA ServerSUMMARY STEPS
DETAILED STEPS
Verifying ISG Policing
SUMMARY STEPS
DETAILED STEPS ExamplesThe following example shows output for the show subscriber session command when policing parameters have been configured in the service profile. The âConfig levelâ field indicates where the policing parameters are configured; in this case, in the service profile.
Router# show subscriber session detailed
Current Subscriber Information: Total sessions 2
Unique Session ID: 1
.....
Session inbound features:
Feature: Policing
Upstream Params:
Average rate = 24000, Normal burst = 4500, Excess burst = 9000
Config level = Service
Session outbound features:
Feature: Policing
Dnstream Params:
Average rate = 16000, Normal burst = 3000, Excess burst = 6000
Config level = Service
.....
The following example shows output for the show subscriber session command where upstream policing parameters are specified in a user profile and downstream policing parameters are specified in a service profile.
Router# show subscriber session all
Current Subscriber Information: Total sessions 2
Unique Session ID: 2
.....
Session inbound features:
Feature: Policing
Upstream Params:
Average rate = 24000, Normal burst = 4500, Excess burst = 9000
Config level = Per-user ===========> Upstream parameters are specified in
the user profile.
Session outbound features:
Feature: Policing
Dnstream Params:
Average rate = 16000, Normal burst = 3000, Excess burst = 6000
Config level = Service ============> No downstream parameters in the user
profile, hence the parameters in the service profile are applied.
.....
Configuring Per-Subscriber Firewalls
Configuring Per-Subscriber Firewalls in User Profiles or Service Profiles on a AAA ServerPerform this task to configure per-subscriber firewalls in user profiles or service profiles on a AAA server. This task assumes that you know how to configure access control lists. Only IP ACLs are supported. IPX and IPv6 ACLs are not supported. DETAILED STEPS Configuring Per-Subscriber Firewalls in a Service Policy Map
SUMMARY STEPS
DETAILED STEPS
Configuration Examples for ISG Policies for Regulating Network AccessISG Policing ExamplesFlow-Based Policing Configured in a Service Policy Map Using the CLIThe following example shows the configuration of ISG flow-based policing in a service policy map: class-map type traffic match-any C3 match access-group in 103 match access-group out 203 policy-map type service P3 class type traffic C3 police input 20000 30000 60000 police output 21000 31500 63000 Per-Subscriber Firewalls ExamplesThe following example shows per-subscriber firewalls configured in a user profile or service profile on the AAA server. In this case the ACLs 104 and 105 are configured on the router. âInâ and âoutâ represent the inbound and outbound directions of ACL application. Cisco-AVpair="ip:inacl=104", Cisco-AVpair="ip:outacl=105" The following example shows per-subscriber firewalls configured in a user profile or service profile on the AAA server. In this case the named ACLs are configured on the router. Cisco-AVpair="ip:inacl=named-inacl-123", Cisco-AVpair="ip:outacl=named-outacl-123" The following example of per-subscriber firewall configuration includes the individual ACL statements in the user profile or service profile configuration: Cisco-AVpair="ip:inacl#1=deny icmp host 10.0.25.25 host 10.0.3.3", Cisco-AVpair="ip:inacl#2=permit ip any any", Cisco-AVpair="ip:outacl#1=permit ip any any" Verifying ISG Per-Subscriber Firewalls
SUMMARY STEPS
DETAILED STEPS ExamplesThe following example is sample output for the show subscriber session detailed command. Information about per-subscriber firewalls appears in the âSession inbound featuresâ and âSession outbound featuresâ fields.
Router# show subscriber session detailed
Current Subscriber Information: Total sessions 1
--------------------------------------------------
Session inbound features:
Feature: Access lists
Active IP access list:
104
Session outbound features:
Feature: Access lists
Active IP access list:
subscriber_feature#102341017649
The show ip access-lists command can be used to display access list statements. The following example is sample output for the show ip access-lists command:
Router# show ip access-lists
Extended IP access list 104 (Compiled)
10 permit ip host 10.0.1.6 any (500 matches)
Extended IP access list subscriber_feature#102341017649 (per-user)
10 deny icmp host 10.0.25.25 host 10.0.3.3
20 permit ip any any
Additional ReferencesRelated Documents
Technical Assistance
Feature Information for ISG Policies for Regulating Network AccessThe following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||