Intelligent Services Gateway Configuration Guide, Cisco IOS Release 15.1S
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Enabling ISG to Interact with External Policy Servers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Contents
Enabling ISG to Interact with External Policy ServersLast Updated: May 27, 2011
Intelligent Services Gateway (ISG) is a Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. This document describes how to enable ISG to retrieve session policies or accept dynamic updates to session policies from external policy servers.
Finding Feature InformationYour software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required. Restrictions for ISG Interaction with External Policy ServersThe ISG and external policy servers should be available in the same virtual routing and forwarding (VRF) instance. Information About ISG Interaction with External Policy ServersInitial and Dynamic AuthorizationISG works with external devices, referred to as policy servers , that store per-subscriber and per-service information. ISG supports two models of interaction between ISG and external policy servers: initial authorization and dynamic authorization. In the initial authorization model, ISG must retrieve policies from the external policy server at specific points in a session. In this model, the external policy server is typically an authentication, authorization, and accounting (AAA) server that uses RADIUS. ISG is the RADIUS client. Instead of a AAA server, some systems use a RADIUS proxy component that converts to other database protocols such as Lightweight Directory Access Protocol (LDAP). The dynamic authorization model allows the external policy server to dynamically send policies to the ISG. These operations can be initiated in-band by subscribers (through service selection) or through the actions of an administrator, or applications can change policies on the basis of some algorithm (for example, change session quality of service (QoS) at a certain time of day). This model is facilitated by the Change of Authorization (CoA) RADIUS extension. CoA introduced peer-to-peer capability to RADIUS, enabling ISG and the external policy server each to act as a RADIUS client and server. Triple-Key Authentication for ISGTriple-key authentication is a method of authenticating users based on their username, password, and location after ISG redirects them to the Cisco Service Management Engine (SME) portal. The SME server provides the location based on the source IP address of the subscriber being authenticated. Before the Triple Key Authentication Support feature was introduced, users were authenticated on the basis of the username and password only (two-key authentication). The triple-key authentication feature also eases migration from Service Selection Gateway (SSG) to an ISG platform because SSG uses triple-key authentication. For SSG, the Cisco Subscriber Edge Services Manager (SESM) server populates RADIUS attribute 31 (calling-station ID) in the user-login request that it sends to SSG with a string containing the subscriberâs location. SSG then includes this value in the access-request message that it sends to the RADIUS server where the login is authenticated based on the username, password, and location string. With ISG triple-key authentication, the location string that SME sends to ISG in attribute 31 in the CoA account-logon request is repeated in the access-request packet that ISG sends to the RADIUS server to authenticate the subscriber. ISG sends the location string within a Cisco vendor-specific attribute (VSA) included in the access-request message to the RADIUS server. If the account-logon request from SME contains location information in both attribute 31 and the Cisco VSA, the value of the Cisco VSA location string takes precedence. The location information is received from SME as either attribute 31 or Cisco VSA 250. The location information is included in session authentication requests, session accounting requests from ISG, and prepaid authorization requests. The table below shows the Cisco vendor-specific non-AVPair attribute used for triple-key authentication. How to Enable ISG to Interact with External Policy Servers
Configuring ISG as a AAA ClientPerform this task to configure AAA method lists and enable ISG to retrieve policies from a AAA server. This task must be performed for both initial and dynamic authorization models. DETAILED STEPS
Configuring the ISG as a AAA ServerDynamic authorization allows a policy server to dynamically send policies to ISG. Perform this task to configure the ISG as a AAA server and enable dynamic authorization. DETAILED STEPS
Enabling the Location VSA for Triple-Key AuthenticationTo enable ISG to include the location VSA in authentication and accounting requests, perform the following steps. DETAILED STEPS Configuration Examples for ISG Interaction with External Policy ServersExample ISG Interaction with External Policy ServersThe following example configures ISG to interact with external policy servers: ! aaa group server radius CAR_SERVER server 10.100.2.36 auth-port 1812 acct-port 1813 ! aaa authentication login default none aaa authentication login IP_AUTHEN_LIST group CAR_SERVER aaa authentication ppp default group CAR_SERVER aaa authorization network default group CAR_SERVER aaa authorization subscriber-service default local group radius aaa accounting network default start-stop group CAR_SERVER ! aaa server radius dynamic-author client 10.76.86.90 key cisco client 172.19.192.25 vrf VRF1 key cisco client 172.19.192.25 vrf VRF2 key cisco client 172.19.192.25 key cisco message-authenticator ignore Example Triple-Key AuthenticationThe following example shows an authentication record with the session information including the location attribute. You can display this output by using the debug radius accounting command or the gw-accounting syslog command. *Feb 5 01:20:50.413: RADIUS/ENCODE: Best Local IP-Address 10.0.1.1 for Radius-Server 10.0.1.2 *Feb 5 01:20:50.425: RADIUS(0000000F): Send Access-Request to 10.0.1.2:1645 id 1645/5, len 107 *Feb 5 01:20:50.425: RADIUS: authenticator 4D 86 12 BC BD E9 B4 9B - CB FC B8 7E 4C 8F B6 CA *Feb 5 01:20:50.425: RADIUS: Vendor, Cisco [26] 19 *Feb 5 01:20:50.425: RADIUS: ssg-account-info [250] 13 "LWiFiHotSpot001" *Feb 5 01:20:50.425: RADIUS: Calling-Station-Id [31] 16 "AAAA.BBBB.CCCC" *Feb 5 01:20:50.425: RADIUS: User-Name [1] 7 "george" *Feb 5 01:20:50.425: RADIUS: User-Password [2] 18 * *Feb 5 01:20:50.425: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Feb 5 01:20:50.425: RADIUS: NAS-Port [5] 6 0 *Feb 5 01:20:50.425: RADIUS: NAS-Port-Id [87] 9 "0/0/0/0" *Feb 5 01:20:50.425: RADIUS: NAS-IP-Address [4] 6 10.0.1.1 *Feb 5 01:20:50.425: RADIUS(0000000F): Started 5 sec timeout *Feb 5 01:20:50.425: RADIUS: Received from id 1645/5 10.0.1.2:1645, Access-Accept, len 68 *Feb 5 01:20:50.425: RADIUS: authenticator 49 A1 2C 7F C5 E7 9D 1A - 97 B3 E3 72 F3 EA 56 56 *Feb 5 01:20:50.425: RADIUS: Vendor, Cisco [26] 17 *Feb 5 01:20:50.425: RADIUS: ssg-account-info [250] 11 "S10.0.0.2" *Feb 5 01:20:50.425: RADIUS: Vendor, Cisco [26] 31 *Feb 5 01:20:50.425: RADIUS: Cisco AVpair [1] 25 "accounting-list=default" *Feb 5 01:20:50.433: RADIUS(0000000F): Received from id 1645/5 *Feb 5 01:20:50.437: RADIUS/ENCODE(0000000F):Orig. component type = Iedge IP SIP *Feb 5 01:20:50.437: RADIUS(0000000F): Config NAS IP: 0.0.0.0 *Feb 5 01:20:50.437: RADIUS(0000000F): sending Additional ReferencesRelated DocumentsMIBsTechnical Assistance
Feature Information for ISG Interaction with External Policy ServersThe following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||