Configuring ISG Port-Bundle Host Key

The ISG Port-Bundle Host Key feature serves as an in-band signaling mechanism for session identification at external portals. TCP packets from subscribers are mapped to a local IP address for the ISG gateway and a range of ports. This mapping allows the portal to identify the ISG gateway from which the session originated. The mapping also identifies sessions uniquely even when subscribers have overlapping IP addresses. The ISG Port-Bundle Host Key feature enables a single portal to be deployed for multiple Virtual Routing and Forwardings (VRFs) even when there are subscribers with overlapping IP addresses.

With the ISG Port-Bundle Host Key feature, an ISG performs Port-Address Translation (PAT) and Network Address Translation (NAT) on the TCP traffic between the subscriber and the portal. When a subscriber TCP connection is set up, the ISG creates a port mapping that changes the source IP address to a configured ISG IP address and changes the source TCP port to a port allocated by the ISG. The ISG assigns a bundle of ports to each subscriber because one subscriber can have several simultaneous TCP sessions when accessing a web page. The assigned port-bundle host key, or combination of the port bundle and ISG source IP address, uniquely identifies each subscriber. The host key is carried in RADIUS packets sent between the portal server and the ISG in the Subscriber IP vendor-specific attribute (VSA). The table below describes the Subscriber IP VSA. When the portal server sends a reply to the subscriber, the ISG uses the translation tables to identify the destination IP address and destination TCP port.

For each TCP session between a subscriber and the portal, the ISG uses one port from the port bundle as the port map. Individual port mappings are flagged as eligible for reuse on the basis of inactivity timers, but are not explicitly removed once assigned. The number of port bundles is limited per ISG address, but there is no limit to the number of ISG IP addresses that can be configured for port bundle usage.

The port-bundle length is used to determine the number of ports in one bundle. By default, the port-bundle length is four bits. The maximum port-bundle length is ten bits. See the table below for available port-bundle length values and the resulting port-per-bundle and bundle-per-group values. You may want to increase the port-bundle length when you see frequent error messages about running out of ports in a port bundle.

Note

For each portal server, all connected ISGs must have the same port-bundle length, which must correspond to the configured value given in the portal server's BUNDLE_LENGTH argument. If you change the port-bundle length on an ISG, be sure to make the corresponding change in the configuration on the portal.

• Support for Overlapped Subscriber IP Addresses Extended to Include External Portal Usage
  
• Portal Provisioning for Subscriber and ISG IP Addresses No Longer Required
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    policy-map type service policy-name

4.    ip portbundle

5.    end

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	policy-map type service policy-name Example: Router(config)# policy-map type service service1	Creates or defines a service policy map, which is used to define an ISG service.
Step 4	ip portbundle Example: Router(config-service-policymap)# ip portbundle	Enables the ISG Port-Bundle Host Key feature for the service.
Step 5	end Example: Router(config-service-policymap)# end	(Optional) Returns to privileged EXEC mode.

• What to Do Next
  

SUMMARY STEPS

1.    Add the Port-Bundle Host Key attribute to the user or service profile.

DETAILED STEPS

	Command or Action	Purpose
Step 1	Add the Port-Bundle Host Key attribute to the user or service profile. Example: 26,9,1 = "ip:portbundle=enable"	Enables the ISG Port-Bundle Host Key feature in the user or service profile.

• What to Do Next
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    ip portbundle

4.    match access-list access-list-number

5.    length bits

6.    source interface-type interface-number

7.    exit

8.    interface type number

9.    ip portbundle outside

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip portbundle Example: Router(config)# ip portbundle	Enters IP portbundle configuration mode.
Step 4	match access-list access-list-number Example: Router(config-portbundle)# match access-list 101	Specifies packets for port mapping by specifying an access list to compare against the subscriber traffic.
Step 5	length bits Example: Router(config-portbundle)# length 5	Specifies the ISG port-bundle length, which determines the number of ports per bundle and bundles per group. The default number of bits is 4. See the section "Port-Bundle Length" for more information.
Step 6	source interface-type interface-number Example: Router(config-portbundle)# source loopback 0	Specifies the interface for which the main IP address will be mapped by ISG to the destination IP addresses in subscriber traffic. We recommend that you use a loopback interface as the source interface.
Step 7	exit Example: Router(config-portbundle)# exit	Returns to global configuration mode.
Step 8	interface type number Example: Router(config)# interface gigabitethernet 0/0/0	Specifies an interface for configuration. Enters interface configuration mode.
Step 9	ip portbundle outside Example: Router(config-if)# ip portbundle outside	Configures ISG to reverse translate the destination IP address and TCP port to the actual subscriber IP address and TCP port for traffic going from the portal to the subscriber for the interface being configured.

SUMMARY STEPS

1.    enable

2.    show ip portbundle status [free | inuse]

3.    show ip portbundle ip portbundle-ip-address bundle port-bundle-number

4.    show subscriber session [detailed] [identifier identifier | uid session-id| username name]

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	show ip portbundle status [free | inuse] Example: Router# show ip portbundle status free	Displays information about ISG port-bundle groups.
Step 3	show ip portbundle ip portbundle-ip-address bundle port-bundle-number Example: Router# show ip portbundle ip 10.10.10.10 bundle 65	Displays information about a specific ISG port bundle.
Step 4	show subscriber session [detailed] [identifier identifier | uid session-id| username name] Example: Router# show subscriber session detailed	Displays ISG subscriber session information.