Configuring ISG Subscriber Services

An ISG service is a collection of policies that may be applied to a subscriber session. ISG services can be applied to any session, regardless of subscriber access media or protocol, and a single service may be applied to multiple sessions. An ISG service is not necessarily associated with a destination zone or a particular uplink interface.

Services can be defined in two ways: in a service policy map that is configured on the ISG device by using the CLI, and in a service profile that is configured on an external device, such as an authentication, authorization, and accounting (AAA) server. Although they are configured differently, service policy maps and service profiles serve the same purpose: they contain a collection of traffic policies and other functionality that can be applied to a subscriber session. Traffic policies determine which functionality will be applied to which session traffic. A service policy map or service profile may also contain a network-forwarding policy, a specific type of traffic policy that determines how session data packets will be forwarded to the network.

When a network-forwarding policy is included in a service profile or service policy map, the service is known as a primary service . Primary services are mutually exclusive and may not be simultaneously active. Upon activation of a new primary service, ISG will deactivate the existing primary service and any other services dependent on the existing primary service through association with a service group.

If a primary service is deactivated, sessions may be left without a network-forwarding policy, that is, with no means to route or forward packets. A policy may be applied to defend against this condition such that a specific service is activated upon deactivation of all others (or all other primary services). This backup service would return network-forwarding policy to the session and allow the subscriber to reach a web portal. However, it should be noted that an IP session will not be automatically terminated when all services are deactivated unless such a policy has been defined and applied.

ISG traffic classes allow for differentiated behavior for different traffic streams to and from a particular subscriber. For traffic to be classified into streams, you must specify an access control list (ACL) that classifies the traffic and specify the direction of the traffic to which the ACL applies (inbound or outbound). Optionally, the priority of the traffic class can also be specified.

Traffic that meets the specifications of a traffic class is said to match the traffic class. Once a match is made, features defined in the traffic policy are executed for that traffic class.

The priority of a traffic class determines which class is used first for a specified match if more than one traffic policy has been activated for a single session. In other words, if a packet matches more than one traffic class, it is classified to the class with the higher priority.

Packets that do not match any of the ACLs are considered to be part of the default traffic class and are processed as if a traffic policy was not applied to the session. A default class exists for every service, and the default action of the default class is to pass traffic. The default class can be configured to drop traffic. Default traffic is accounted for in the main session accounting.

A service can contain one traffic class and one default class.

Traffic classes are assigned unique identifiers that can be tracked with Cisco IOS show commands.

Traffic policies define the handling of data packets. A traffic policy contains a traffic class and one or more features. Whereas you can specify the event that will trigger an ISG control policy, the trigger for a traffic policy is implicit--the arrival of a data packet.

The features configured within a traffic policy apply only to the traffic defined by the traffic class. Multiple traffic policies with various features can be applied to a session.

An ISG feature is a functional component that performs a specific operation on a session’s data stream. A feature may or may not be associated with a traffic class. However, once associated with a traffic class, a feature can be applied only to the packets that match that traffic class. Otherwise, the feature is applied to all packets for that session.

The figure below shows how features apply to a subscriber session and to traffic flows within the session.

Figure 1. ISG Feature Application on a Session and Flows

Note

Two or more services that specify the same feature and apply to the entire session rather than to a specified traffic flow should not be activated for a session simultaneously. If two or more of these services are activated for a session, deactivation of one of the services will remove the feature from the session. If you need to offer to a subscriber multiple services that specify the same feature and apply to the session rather than a specific flow, configure the services so that they are mutually exclusive. That is, the subscriber should not be able to activate more than one such service at the same time. Similarly, control policies should not activate more than one such service at the same time.

A service group is a grouping of services that may be simultaneously active for a given session. Typically, a service group includes one primary service and one or more secondary services.

Secondary services in a service group are dependent on the primary service and should not be activated unless the primary service is already active. Once a primary service has been activated, any other services that reference the same group may also be activated. Services that belong to other groups, however, may be activated only if they are primary. If a primary service from another service group is activated, all services in the current service group will also be deactivated because they have a dependency on the previous primary service.

There are three methods by which services can be activated:

• Automatic service activation
• Control policy service activation
• Subscriber-initiated service activation

class-map type control match-all SERVICE1_CHECK
   match service-name SERVICE1
policy-map type control SERVICE1_CHECK event service-start
   1 service-policy type service name SERVICE1

Certain types of functionality that are configured in a service must be applied to the entire subscriber session rather than to a specific traffic flow. Services that are configured with this type of per-session functionality must not contain a traffic class. Perform this task to configure a service policy map without a traffic class on the ISG.

Note	Some of the commands that can be configured in a service policy map require other configuration in order to work properly. Details on how to configure specific ISG features and functionality are provided in other modules.

Note	A service that is configured with per-session functionality and a traffic policy will not work correctly.

1.    enable

2.    configure terminal

3.    policy-map type service policy-map-name

4.    authenticate aaa list name-of-list

5.    classname dhcp-pool-name

6.    ip portbundle

7.    ip unnumbered interface-type interface-number

8.    ip vrf forwarding name-of-vrf

9.    service deny

10.    service relay pppoe vpdn group VPDN-group-name

11.    service vpdn group VPDN-group-name

12.    sg-service-group service-group-name

13.    sg-service-type {primary | secondary}

An ISG traffic policy contains a traffic class and one or more ISG features. The traffic class defines the traffic to which the features will be applied. Perform the following tasks to configure an ISG service with a traffic policy on the router:

• Defining an ISG Traffic Class Map
  
• Configuring an ISG Service Policy Map with a Traffic Policy
  

1.    enable

2.    configure terminal

3.    policy-map type service policy-map-name

4.    class type traffic default {in-out | input | output}

5.    drop

There are three ways that ISG subscriber services can be activated: by specifying the service as an automatic activation service in a subscriber’s user profile, by configuring control policies to activate the service, and by a subscriber-initiated service logon. No special configuration is necessary to enable a subscriber to log on to a service.

To configure a service for automatic activation and to configure control policies to activate services, perform the following tasks:

• Configuring Automatic Service Activation in a User Profile
  
• Configuring ISG Control Policies to Activate Services
  

1.    enable

2.    show class-map type traffic

3.    show policy-map type service