Table Of Contents

Enabling ISG to Interact with External Policy Servers

Contents

Prerequisites for ISG Interaction with External Policy Servers

Restrictions for ISG Interaction with External Policy Servers

Information About ISG Interaction with External Policy Servers

Initial and Dynamic Authorization

How to Enable ISG to Interact with External Policy Servers

Configuring the ISG as a AAA Client

Prerequisites

Configuring the ISG as a AAA Server

Configuration Examples for ISG Interaction with External Policy Servers

ISG Interaction with External Policy Servers: Example

Additional References

Related Documents

Technical Assistance

Feature Information for ISG Interaction with External Policy Servers

Enabling ISG to Interact with External Policy Servers

---

First Published: March 20, 2006

Last Updated: March 20, 2006

Intelligent Service Gateway (ISG) is a Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. This document describes how to enable ISG to retrieve session policies or accept dynamic updates to session policies from external policy servers.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all features. To find information about feature support and configuration and platform requirements, use the "Feature Information for ISG Interaction with External Policy Servers" section.

Contents

•Restrictions for ISG Interaction with External Policy Servers

•Information About ISG Interaction with External Policy Servers

•How to Enable ISG to Interact with External Policy Servers

•Configuration Examples for ISG Interaction with External Policy Servers

•Additional References

•Feature Information for ISG Interaction with External Policy Servers

Prerequisites for ISG Interaction with External Policy Servers

For information about release and platform support, see the "Feature Information for ISG Interaction with External Policy Servers" section.

Restrictions for ISG Interaction with External Policy Servers

The ISG and external policy servers should be in the same virtual routing and forwarding instance (VRF).

Information About ISG Interaction with External Policy Servers

•Initial and Dynamic Authorization

Initial and Dynamic Authorization

ISG works with external devices, referred to as policy servers, that store per-subscriber and per-service information. ISG supports two models of interaction between ISG and external policy servers: initial authorization and dynamic authorization.

In the initial authorization model, ISG must retrieve policies from the external policy server at specific points in a session. In this model, the external policy server is typically an authentication, authorization, and accounting (AAA) server that uses RADIUS. ISG is the RADIUS client. Instead of a AAA server, some systems use a RADIUS proxy component that converts to other database protocols such as Lightweight Directory Access Protocol (LDAP).

The dynamic authorization model allows the external policy server to dynamically send policies to the ISG. These operations can be initiated in-band by subscribers (through service selection) or through the actions of an administrator, or applications can change policies on the basis of some algorithm (for example, change session quality of service (QoS) at a certain time of day). This model is facilitated by the Change of Authorization (CoA) RADIUS extension. CoA introduced peer-to-peer capability to RADIUS, enabling ISG and the external policy server each to act as a RADIUS client and server.

How to Enable ISG to Interact with External Policy Servers

This section contains the following tasks:

•Configuring the ISG as a AAA Client

•Configuring the ISG as a AAA Server

Configuring the ISG as a AAA Client

Perform this task to configure AAA method lists and enable ISG to retrieve policies from a AAA server. This task must be performed for both initial and dynamic authorization models.

Prerequisites

The servers and server groups referenced by the AAA methods must be configured.

SUMMARY STEPS

1. enable

2. configure terminal

3. aaa authentication login {default | list-name} method1 [method2...]

4. aaa authentication ppp {default | list-name} method1 [method2...]

5. aaa authorization {network | exec | commands level | reverse-access | configuration} {default | list-name} [method1 [method2...]]

6. aaa authorization subscriber-service {default | list-name} method1 [method2...]

7. aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] group groupname

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	aaa authentication login {default | list-name} method1 [method2...] Example: Router(config)# aaa authentication login PPP1 group radius	Specifies one or more AAA authentication methods to be used at login.
Step 4	aaa authentication ppp {default | list-name} method1 [method2...] Example: Router(config)# aaa authentication ppp default group radius	Specifies one or more AAA authentication methods for use on serial interfaces that are running PPP.
Step 5	aaa authorization {network | exec | commands level | reverse-access | configuration} {default | list-name} [method1 [method2...]] Example: Router(config)# aaa authorization network NET1 radius	Specifies one or more AAA authorization methods to be used for restricting subscriber access to a network.
Step 6	aaa authorization subscriber-service {default | list-name} method1 [method2...] Example: Router(config)# aaa authorization subscriber-service default radius	Specifies one or more AAA authorization methods for ISG to use in providing a service.
Step 7	aaa accounting {auth-proxy | system | network | exec | connection | commands level} {default | list-name} [vrf vrf-name] {start-stop | stop-only | none} [broadcast] group groupname Example: Router(config)# aaa accounting network default start-stop group radius	Enables AAA accounting of requested services for billing or security purposes.

Configuring the ISG as a AAA Server

Dynamic authorization allows a policy server to dynamically send policies to ISG. Perform this task to configure the ISG as a AAA server and enable dynamic authorization.

SUMMARY STEPS

1. enable

2. configure terminal

3. aaa server radius dynamic-author

4. client {name | ip-address} [key [0 | 7] word] [vrf vrf-id]

5. port port-number

6. server-key [0 | 7] word

7. auth-type {all | any | session-key}

8. ignore {server-key | session-key}

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. •Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	aaa server radius dynamic-author Example: Router(config)# aaa server radius dynamic-author	Configures the ISG as a AAA server.
Step 4	client {name | ip-address} [key [0 | 7] word] [vrf vrf-id] Example: Router(config-locsvr-da-radius)#	Specifies a client with which ISG will be communicating.
Step 5	port port-number Example: Router(config-locsvr-da-radius)# port 1600	Specifies the RADIUS server port. •Default is 1700.
Step 6	server-key [0 | 7] word Example: Router(config-locsvr-da-radius)# server-key cisco	Specifies the encryption key shared with the RADIUS client.
Step 7	auth-type {all | any | session-key} Example: Router(config-locsvr-da-radius)# auth-type all	Specifies the attributes to be used for session authorization.
Step 8	ignore {server-key | session-key} Example: Router(config-locsvr-da-radius)# ignore session-key	Configures ISG to ignore the shared encryption key or attribute 151.

Configuration Examples for ISG Interaction with External Policy Servers

This section contains the following example:

•ISG Interaction with External Policy Servers: Example

ISG Interaction with External Policy Servers: Example

The following example configures ISG to interact with external policy servers:

!

aaa group server radius CAR_SERVER

 server 10.100.2.36 auth-port 1812 acct-port 1813

!

aaa authentication login default none

aaa authentication login IP_AUTHEN_LIST group CAR_SERVER

aaa authentication ppp default group CAR_SERVER

aaa authorization network default group CAR_SERVER 

aaa authorization subscriber-service default local group radius 

aaa accounting network default start-stop group CAR_SERVER

!

aaa server radius dynamic-author

 client 10.76.86.90 key cisco

 client 172.19.192.25 vrf VRF1 key cisco

 client 172.19.192.25 vrf VRF2 key cisco

 client 172.19.192.25 key cisco

 message-authenticator ignore

Additional References

The following sections provide references related to ISG interaction with external policy servers.

Related Documents

Related Topic	Document Title
ISG commands	Cisco IOS Intelligent Service Gateway Command Reference
AAA configuration tasks	Part 1, "Authentication, Authorization, and Accounting (AAA)," Cisco IOS Security Configuration Guide, Release 12.2
AAA commands	Part 1, "Authentication, Authorization, and Accounting (AAA)," Cisco IOS Security Command Reference, Release 12.2

Technical Assistance

Description	Link
Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.	http://www.cisco.com/public/support/tac/home.shtml

Feature Information for ISG Interaction with External Policy Servers

Table 12 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Release 12.2(28)SB or later appear in the table. If you are looking for information on a feature in this technology that is not documented here, see the "Intelligent Service Gateway Features Roadmap."

Not all commands may be available in your Cisco IOS software release. For details on when support for specific commands was introduced, see the command reference documents.

Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

---

Note Table 12 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

---

Table 12 Feature Information for ISG Interaction with External Policy Servers

Feature Name	Releases	Feature Configuration Information
ISG:Policy Control:Policy Server:CoA	12.2(28)SB	This feature provides ISG support for the RADIUS Change of Authorization (CoA) extension, which facilitates dynamic authorization. The following sections provide information about this feature: •Initial and Dynamic Authorization •How to Enable ISG to Interact with External Policy Servers

Copyright © 2006 Cisco Systems, Inc. All rights reserved.