Walk-By User Support for PWLANs in ISG

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.

A default session is a template session that is used as a reference by lite sessions created for walk-by subscribers on a given interface. When an edge device connects to an open service set ID (SSID) in a public wireless LAN (PWLAN) environment a lite session is created on the Intelligent Services Gateway (ISG). Each lite session applies the session start services defined in the default policy configured for the default session. Only one default session can be configured on each device interface. The default policy defines the default session start services and features to be used as a template for the lite session.

In most public wireless LAN (PWLAN) setups, a high percentage of Intelligent Services Gateway (ISG) sessions are unauthenticated sessions from wireless devices that do not use the PWLAN service. These sessions are called walk-by sessions or lite sessions, and users that use these sessions are called walk-by users. Walk-by sessions consume a significant amount of CPU, memory and other physical resources of the ISG router. This resource utilization may lead to an increase in the number of ISG devices that are required for a given PWLAN deployment.

A lite session inherits the session start services applied for the default session. Lite sessions are created on ISG to support walk-by users and optimize resource usage. Each lite session is associated with an individual timer that specifies the duration for which the session can utilize PWLAN services while remaining unauthenticated. If these lite sessions remain unauthenticated even after the timer expires, these sessions are deleted from ISG.

Lite sessions are also created when dedicated sessions fail authentication.

A dedicated or regular session is a full-fledged Intelligent Services Gateway (ISG) subscriber session. All subscriber sessions that are authenticated cause the creation of dedicated sessions on ISG. The policy manager of ISG decides whether to create a complete session context (a dedicated session) or a minimal session context (a lite session).

All ISG sessions that are not lite sessions are dedicated sessions. However, on authorization failure, a dedicated session is converted to a lite session. Sometimes, ISG can neither convert lite sessions to dedicated sessions nor create dedicated sessions immediately on the First Sign of Life (FSoL). In this case, an authentication, authorization, and accounting (AAA) interaction is required based on which ISG decides whether to create a lite session or a dedicated session. ISG first creates a dedicated session for the subscriber, and then based on the AAA interaction, the subscriber continues with the dedicated ISG session or is moved to a lite session.

SUMMARY STEPS

1.    enable

2.   configure terminal

3.    policy-map type service policy-map-name

4.    service local

5.    ip portbundle

6.    exit

7.    class-map type traffic match-any class-map-name

8.    match access-group {input | output} {access-list-number | name access-list-name}

9.    exit

10.    policy-map type service policy-map-name

11.    [priority] class type traffic {class-map-name | default {in-out | input | output}}

12.    redirect to group {server-group-name | ip server-ip-address [port port-number]} [duration seconds [frequency seconds]]

13.    exit

14.    exit

15.    policy-map type control policy-map-name

16.    class type control {control-class-name | always} [event session-start]

17.    action-number service-policy type service name policy-map-name

18.    action-number service-policy type service name policy-map-name

19.    action-number set-timer name-of-timer minutes

20.    exit

21.    exit

22.    interface type number

23.    service-policy type control {policy-map-name | default [def-policy-map-name]}

24.    service-policy type control {policy-map-name | default [def-policy-map-name]}

25.    end

26.    show running-config interface type number

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Device> enable	Enters privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Device# configure terminal	Enters global configuration mode.
Step 3	policy-map type service policy-map-name Example: Device(config)# policy-map type service PBHK	Configures a service policy map, and enters service policy-map configuration mode.
Step 4	service local Example: Device(config-service-policymap)# service local	Specifies the local termination service in the ISG service policy map.
Step 5	ip portbundle Example: Device(config-service-policymap)# ip portbundle	Enables the ISG Port-Bundle Host Key (PBHK) feature for the service.
Step 6	exit Example: Device(config-service-policymap)# exit	Returns to global configuration mode.
Step 7	class-map type traffic match-any class-map-name Example: Device(config)# class-map type traffic match-any ALLTRAFFIC	Creates or modifies a traffic class map, which is used for matching packets to a specified ISG traffic class, and enters traffic class-map configuration mode.
Step 8	match access-group {input | output} {access-list-number | name access-list-name} Example: Device(config-traffic-classmap)# match access-group input 100	Configures the match criteria for an ISG traffic class map on the basis of the specified access control list (ACL).
Step 9	exit Example: Device(config-traffic-classmap)# exit	Exits traffic class-map configuration mode.
Step 10	policy-map type service policy-map-name Example: Device(config)# policy-map type service L4R	Configures another service policy map, and enters service policy-map configuration mode.
Step 11	[priority] class type traffic {class-map-name | default {in-out | input | output}} Example: Device(config-service-policymap)# class type traffic ALLTRAFFIC	Associates a previously configured ISG traffic class map with a service policy map, and enters service policy-map traffic class configuration mode.
Step 12	redirect to group {server-group-name | ip server-ip-address [port port-number]} [duration seconds [frequency seconds]] Example: Device(config-service-policymap-class-traffic)# redirect to group PORTAL	Redirects ISG Layer 4 traffic to a specified server or server group.
Step 13	exit Example: Device(config-service-policymap-class-traffic)# exit	Returns to service policy-map configuration mode.
Step 14	exit Example: Device(config-service-policymap)# exit	Returns to global configuration mode.
Step 15	policy-map type control policy-map-name Example: Device(config)# policy-map type control DefRULE	Creates or modifies a default control policy map, which is used to define a control policy, and enters control policy-map configuration mode.
Step 16	class type control {control-class-name | always} [event session-start] Example: Device(config-control-policymap)# class type control always event session-start	Specifies a control class for which actions are configured and enters control policy-map class configuration mode.
Step 17	action-number service-policy type service name policy-map-name Example: Device(config-control-policymap-class-control)# 10 service-policy type service name PBHK	Activates the specified ISG service.
Step 18	action-number service-policy type service name policy-map-name Example: Device(config-control-policymap-class-control)# 20 service-policy type service name L4R	(Optional) Activates another specified ISG service.
Step 19	action-number set-timer name-of-timer minutes Example: Device(config-control-policymap-class-control)# 30 set-timer UNAUTH 1	Starts a named policy timer. Expiration of the timer initiates the timed-policy-expiry event.
Step 20	exit Example: Device(config-control-policymap-class-control)# exit	Returns to control policy-map configuration mode.
Step 21	exit Example: Device(config-control-policymap)# exit	Returns to global configuration mode.
Step 22	interface type number Example: Device(config)# interface GigabitEthernet 0/0/4	Specifies an interface and enters interface configuration mode.
Step 23	service-policy type control {policy-map-name | default [def-policy-map-name]} Example: Device(config-if)# service-policy type control default DefRULE	Applies a default control policy on the interface.
Step 24	service-policy type control {policy-map-name | default [def-policy-map-name]} Example: Device(config-if)# service-policy type control RegRULE	Applies a regular control policy on the interface.
Step 25	end Example: Device(config-if)# end	Returns to privileged EXEC mode.
Step 26	show running-config interface type number Example: Device# show running-config interface GigabitEthernet 0/0/4	(Optional) Displays the running configuration for a specific interface.