Configuring ISG as a RADIUS Proxy

Public wireless LANs (PWLANs) and wireless mesh networks can contain hundreds of access points, each of which must send RADIUS authentication requests to a AAA server. The ISG RADIUS proxy functionality allows the access points to send authentication requests to ISG, rather than directly to the AAA server. ISG relays the requests to the AAA server. The AAA server sends a response to ISG, which then relays the response to the appropriate access point.

When serving as a RADIUS proxy, ISG can pull user-specific data from the RADIUS flows that occur during subscriber authentication and authorization, and transparently create a corresponding IP session upon successful authentication. This functionality provides an automatic login facility with respect to ISG for subscribers that are authenticated by devices that are closer to the network edge.

When configured as a RADIUS proxy, ISG proxies all RADIUS requests generated by a client device and all RADIUS responses generated by the corresponding AAA server, as described in RFC 2865, RFC 2866, and RFC 2869.

ISG RADIUS proxy functionality is independent of the type of client device and supports standard authentication (that is, a single Access-Request/Response exchange) using both Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP), Access-Challenge packets, and Extensible Authentication Protocol (EAP) mechanisms.

In cases where authentication and accounting requests originate from separate RADIUS client devices, ISG associates all requests with the appropriate session through the use of correlation rules. For example, in a centralized PWLAN deployment, authentication requests originate from the wireless LAN (WLAN) access point, and accounting requests are generated by the Access Zone Router (AZR). The association of the disparate RADIUS flows with the underlying session is performed automatically when the Calling-Station-ID (Attribute 31) is sufficient to make the association reliable.

Following a successful authentication, authorization data collected from the RADIUS response is applied to the corresponding ISG session.

Sessions that were created using ISG RADIUS proxy operation are generally terminated by receipt of an Accounting-Stop packet.

By default, ISG RADIUS proxy responds locally to accounting packets it receives. The accounting method-list command can be used to configure ISG to forward RADIUS proxy client accounting packets to a specified server. Forwarding of accounting packets can be configured globally for all RADIUS proxy clients or on a per-client basis.

If ISG is acting as a proxy for more than one client device, all of which reside on the same subnet, the clients may be configured using a subnet definition rather than a discrete IP address for each device. This configuration method results in the sharing of a single configuration by all the client devices.

ISG RADIUS proxy uses mobile wireless-specific processes to provide support for Gateway General Packet Radio Service (GPRS) Support Node (GGSN) environments. The following sections describe ISG RADIUS proxy attribute support and processing:

• Attribute Processing and RADIUS Request Correlation
  
• 3GPP Attribute Support
  

Use of ISG RADIUS proxy has the following benefits:

• Allows the complete set of ISG functionality to be applied to EAP subscriber sessions.
• Allows an ISG device to be introduced into a network with minimum disruption to the existing network access server (NAS) and AAA servers.
• Simplifies RADIUS server configuration because only the ISG, not every access point, must be configured as a client.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    interface type number

4.    ip subscriber {interface | l2-connected| routed}

5.    initiator radius-proxy

6.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface fastethernet 1/0/0	Specifies an interface for configuration and enters interface configuration mode.
Step 4	ip subscriber {interface | l2-connected| routed} Example: Router(config-if)# ip subscriber routed	Enables ISG IP subscriber support on an interface, specifies the access method that IP subscribers will use to connect to ISG on an interface and enters subscriber configuration mode.
Step 5	initiator radius-proxy Example: Router(config-subscriber)# initiator radius-proxy	Configures ISG to initiate IP sessions upon receipt of any RADIUS packet.
Step 6	end Example: Router(config-subscriber)# end	Exits the current configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa server radius proxy

5.    session-identifier {attribute number | vsa vendor id type number}

6.    calling-station-id format {mac-address | msisdn}

7.    accounting method-list {method-list-name| default}

8.    accounting port port-number

9.    authentication port port-number

10.    key [0 | 7] word

11.    timer {ip-address | request} seconds

12.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	aaa new-model Example: Router(config)# aaa new-model	Enables the AAA access control model.
Step 4	aaa server radius proxy Example: Router(config)# aaa server radius proxy	Enters ISG RADIUS proxy server configuration mode.
Step 5	session-identifier {attribute number | vsa vendor id type number} Example: Router(config-locsvr-proxy-radius)# session-identifier attribute 1 Example:	(Optional) Correlates the RADIUS server requests of a session and identifies the session in the RADIUS proxy module.
Step 6	calling-station-id format {mac-address | msisdn} Example: Router(config-locsvr-proxy-radius)# calling-station-id format msisdn	Specifies the calling-station-id format.
Step 7	accounting method-list {method-list-name| default} Example: Router(config-locsvr-proxy-radius)# accounting method-list fwdacct	Specifies the server to which accounting packets from RADIUS clients are forwarded. Note    By default, ISG RADIUS proxy handles accounting packets locally.
Step 8	accounting port port-number Example: Router(config-locsvr-proxy-radius)# accounting port 2222	Specifies the port on which the ISG listens for accounting packets from RADIUS clients. The default port is 1646.
Step 9	authentication port port-number Example: Router(config-locsvr-proxy-radius)# authentication port 1111	Specifies the port on which the ISG listens for authentication packets from RADIUS clients. The default port is 1645.
Step 10	key [0 | 7] word Example: Router(config-locsvr-proxy-radius)# key radpro	Configures the encryption key to be shared between ISG and RADIUS clients. 0 specifies that an unencrypted key will follow. 7 specifies a hidden key will follow.
Step 11	timer {ip-address | request} seconds Example: Router(config-locsvr-proxy-radius)# timer ip-address 5	Specifies the amount of time ISG waits for the specified event before terminating the session. ip-address --Specifies the amount of time ISG waits for an IP address to be assigned to the session. request --Specifies the amount of time ISG waits to receive an Access-Request from a client device.
Step 12	end Example: Router(config-locsvr-proxy-radius)# end	Exits the current configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa server radius proxy

5.    client {name | ip-address} [subnet-mask [vrf vrf-id]]

6.    session-identifier {attribute number | vsa vendor id type number}

7.    calling-station-id format {mac-address | msisdn}

8.    accounting method-list {method-list-name| default}

9.    accounting port port-number

10.    authentication port port-number

11.    key [0 | 7] word

12.    timer {ip-address | request} seconds

13.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	aaa new-model Example: Router(config)# aaa new-model	Enables the AAA access control model.
Step 4	aaa server radius proxy Example: Router(config)# aaa server radius proxy	Enters ISG RADIUS proxy server configuration mode.
Step 5	client {name | ip-address} [subnet-mask [vrf vrf-id]] Example: Router(config-locsvr-proxy-radius)# client 172.16.54.45 vrf myvrftable	Specifies a RADIUS proxy client for which client-specific parameters can be configured, and enters RADIUS client configuration mode.
Step 6	session-identifier {attribute number | vsa vendor id type number} Example: Router(config-locsvr-radius-client)# session-identifier vsa vendor 5335 type 123	(Optional) Correlates the RADIUS requests of a session and identifies the session in the RADIUS proxy module.
Step 7	calling-station-id format {mac-address | msisdn} Example: Router(config-locsvr-radius-client)# calling-station-id format msisdn	Specifies the calling-station-id format.
Step 8	accounting method-list {method-list-name| default} Example: Router(config-locsvr-radius-client)# accounting method-list fwdacct	Specifies the server to which accounting packets from RADIUS clients are forwarded.
Step 9	accounting port port-number Example: Router(config-locsvr-radius-client)# accounting port 2222	Specifies the port on which the ISG listens for accounting packets from RADIUS clients. The default port is 1646.
Step 10	authentication port port-number Example: Router(config-locsvr-radius-client)# authentication port 1111	Specifies the port on which the ISG listens for authentication packets from RADIUS clients. The default port is 1645.
Step 11	key [0 | 7] word Example: Router(config-locsvr-radius-client)# key radpro	Configures the encryption key to be shared between ISG and RADIUS clients. 0 specifies that an unencrypted key will follow. 7 specifies a hidden key will follow.
Step 12	timer {ip-address | request} seconds Example: Router(config-locsvr-radius-client)# timer ip-address 5	Specifies the amount of time ISG waits for the specified event before terminating the session. ip-address --Specifies the amount of time ISG waits for an IP address to be assigned to the session. request --Specifies the amount of time ISG waits to receive an Access-Request from a client device.
Step 13	end Example: Router(config-locsvr-radius-client)# end	Exits the current configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa authorization radius-proxy {default| list-name}method1 [method2 [method3...]]

5.    policy-map type control policy-map-name

6.    class type control {control-class-name | always} event session-start

7.    action-number proxy [aaa list {default | list-name}

8.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	aaa new-model Example: Router(config)# aaa new-model	Enables the AAA access control model.
Step 4	aaa authorization radius-proxy {default| list-name}method1 [method2 [method3...]] Example: Router(config)# aaa authorization radius-proxy RP group radius	Configures AAA authorization methods for ISG RADIUS proxy subscribers. A method may be either of the following: group group-name----Uses a subset of RADIUS servers for authorization as defined by the server group group-name command. group radius ----Uses the list of all RADIUS servers for authorization as defined by the aaa group server radius command.
Step 5	policy-map type control policy-map-name Example: Router(config)# policy-map type control proxyrule	Creates or modifies a control policy map, which defines an ISG control policy and enters control policy-map configuration mode.
Step 6	class type control {control-class-name | always} event session-start Example: Router(config-control-policymap)# class type control always event session-start	Specifies a control class for which actions may be configured and enters control policy-map class configuration mode.
Step 7	action-number proxy [aaa list {default | list-name} Example: Router(config-control-policymap-class-control)# 1 proxy aaa list RP	Sends RADIUS packets to the specified server. Use this command to configure ISG to forward RADIUS proxy packets to the server specified by the aaa authorization radius-proxy command in Step 4.
Step 8	end Example: Router(config-control-policymap-class-contro)# end	Exits the current configuration mode and returns to privileged EXEC mode.

SUMMARY STEPS

1.    show radius-proxy client ip-address [vrf vrf-id]

2.    show radius-proxy session {id id-number | ip ip-address}

3.    show subscriber session [identifier {authen-status {authenticated | unauthenticated} | authenticated-domain domain-name | authenticated-username username | dnis dnis | media type | nas-port identifier | protocol type | source-ip-address ip-address subnet-mask| timer timer-name| tunnel-name name | unauthenticated-domain domain-name | unauthenticated-username username} | uid session-identifier| username username] [detailed]

DETAILED STEPS

	Command or Action	Purpose
Step 1	show radius-proxy client ip-address [vrf vrf-id] Example: Router# show radius-proxy client 10.10.10.10	Displays RADIUS proxy configuration information and a summary of sessions for an ISG RADIUS proxy client.
Step 2	show radius-proxy session {id id-number | ip ip-address} Example: Router# show radius-proxy session ip 10.10.10.10	Displays information about an ISG RADIUS proxy session. Note    The ID can be found in the output of the show radius-proxy client command.
Step 3	show subscriber session [identifier {authen-status {authenticated | unauthenticated} | authenticated-domain domain-name | authenticated-username username | dnis dnis | media type | nas-port identifier | protocol type | source-ip-address ip-address subnet-mask| timer timer-name| tunnel-name name | unauthenticated-domain domain-name | unauthenticated-username username} | uid session-identifier| username username] [detailed] Example: Router# show subscriber session detailed	Displays information about subscriber sessions on an ISG device.

SUMMARY STEPS

1.    enable

2.    clear radius-proxy client ip-address

3.    clear radius-proxy session {id id-number | ip ip-address}

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	clear radius-proxy client ip-address Example: Router# clear radius-proxy client 10.10.10.10	Clears all ISG RADIUS proxy sessions that are associated with the specified client device.
Step 3	clear radius-proxy session {id id-number | ip ip-address} Example: Router# clear radius-proxy session ip 10.10.10.10	Clears a specific ISG RADIUS proxy session. Note    The ID can be found in the output of the show radius-proxy client command.