Cisco IOS Software Releases 12.0 Special and Early Deployments

User Profiles
Service Profiles
Service Group Profiles
Pseudo-Service Profiles
NRP-SSG Vendor-Specific Attributes
Cisco-AVpair Attribute
Account-Info Attributes
Service-Info Attributes
Control-Info Attributes
Sample User and Service Profiles
RADIUS Accounting Records

Verifying Security
Configuring a Default Network
Verifying the Default Network
Configuring Interfaces
Verifying Interfaces
Configuring Services
Verifying Services
Configuring Local Service Profiles
Verifying Local Service Profiles
Configuring Transparent Passthrough
Verifying Transparent Passthrough
Configuring Redundancy
Verifying Redundancy
Configuring Fastswitching
Verifying Fastswitching
Configuring Multicast
Verifying Multicast
Verifying NRP-SSG Configuration
Monitoring and Maintaining the NRP-SSG
Configuration Examples
Security
Default Network
Interfaces
Services
Service Search Order
Next-Hop Table
Max Services
Local Service Profile
Transparent Passthrough Filter
Redundancy
Fastswitching
Multicast
Command Reference
attr
clear ssg connection
clear ssg host
clear ssg next-hop
clear ssg pass-through-filter
clear ssg service
local-profile
show ssg binding
show ssg connection
show ssg direction
show ssg host
show ssg next-hop
show ssg pass-through-filter
show ssg service
ssg bind direction
ssg bind service
ssg default-network
ssg fastswitch
ssg maxservice
ssg multicast
ssg next-hop
ssg pass-through
ssg radius-helper
ssg service-password
ssg service-search-order
Debug Commands
debug ssg ctrl-errors
debug ssg ctrl-events
debug ssg ctrl-packets
debug ssg data
debug ssg data-nat
debug ssg errors
debug ssg events
Glossary

Node Route Processor—Service Selection Gateway

---

This feature module describes the Node Route Processor-Service Selection Gateway (NRP-SSG) feature. It includes information on the benefits of the new feature, supported platforms, related documents, and so forth.

This document includes the following sections:

Feature Overview

---

The NRP-SSG is a feature of Cisco IOS Release 12.0(3)DC. It is a switching solution for service providers who offer intranet, extranet, and Internet connections to subscribers using high-speed data circuit equipment (DCE) such as Asymmetric Digital Subscriber Line (ADSL) to allow simultaneous access to network services. The NRP-SSG with Web Selection works in conjunction with the Cisco Service Selection Dashboard (SSD). The Cisco SSD is a customizable web-based application that allows users to select from multiple passthrough and proxy services through a standard web browser.

Figure 1 shows a diagram of a typical network topology including the NRP-SSG. This is an end-to-end, service-oriented DSL deployment consisting of Digital Subscriber Line Access Multiplexers (DSLAMs), ADSL modems, and other internetworking components and servers. The NRP-SSG resides in the Cisco 6400 universal access concentrator, which acts as a central control point for Layer 2 and Layer 3 services. This can include services available through Asynchronous Transfer Mode (ATM) virtual circuits (VCs), virtual private dial-up networks (VPDNs), or normal routing methods.

Figure 1   NRP-SSG Connection Between ADSL Equipment and Network Services

The NRP-SSG communicates with the authentication, authorization, and accounting (AAA) management network where Remote Access Dial-In User Service (RADIUS), Dynamic Host Configuration Protocol (DHCP), and Simple Network Management Protocol (SNMP) servers reside and with the Internet service provider (ISP) network, which may connect to the Internet, corporate networks, and value-added services.

A licensed version of the NRP-SSG works with the Cisco SSD to present to subscribers a menu of network services that can be selected from a single graphical user interface (GUI). This improves flexibility and convenience for subscribers, and enables service providers to bill subscribers based on connect time and services used, rather than charging a flat rate.

The user opens an HTML browser and accesses the URL of the Cisco SSD, a web server application. The Cisco SSD forwards user login information to the NRP-SSG, which forwards the information to the AAA server.

Based on the contents of the Access-Accept response, the Cisco SSD presents a dashboard menu of services that the user is authorized to use, and the user selects one or more of the services. The NRP-SSG then creates an appropriate connection for the user and starts RADIUS accounting for the connection.

Note that when a non-Point-to-Point Protocol (non-PPP) user, such as in a bridged networking environment, disconnects from a service without logging off, the connection remains open and the user will be able to reaccess the service without going through the logon procedure. This is because no direct connection (PPP) exists between the subscribers and the NRP-SSG. To prevent non-PPP users from being logged on to services indefinitely, be sure to configure the Session-Timeout and/or Idle-Timeout RADIUS attributes.

Note that the Cisco SSD functionality discussed throughout this document is available only with the NRP-SSG with Web Selection product.

Benefits

Web-Based Dashboard

The NRP-SSG with Web Selection works in conjunction with the Cisco SSD. The Cisco SSD is a specialized web server that allows users to log on to and disconnect from multiple passthrough and proxy services through a standard web browser.

After the user opens a web browser, the NRP-SSG allows access to a single IP address or subnet, referred to as the "default network." This is typically the IP address of the Cisco SSD. The Cisco SSD prompts the user for a username and password. After the user is authenticated, the Cisco SSD presents a list of available services.

RADIUS Authentication and Accounting

The NRP-SSG is designed to work with RADIUS-based AAA servers that accept vendor-specific attributes (VSAs).

Multiple Traffic-Type Support

The NRP-SSG supports the following types of services:

The NRP-SSG can forward traffic through any interface via normal routing or a next hop table. Because Network Address Translation (NAT) is not performed for this type of traffic, overhead is reduced. Passthrough service is ideal for standard Internet access.

When a subscriber requests access to a proxy service, the NRP-SSG will proxy the Access-Request to the remote AAA server. Upon receiving an Access-Accept from the remote RADIUS server, the NRP-SSG responds to the subscriber with the Access-Accept. To the remote AAA server, the NRP-SSG appears as a client.

During remote authentication, if the RADIUS server assigns an IP address to the subscriber, the NRP-SSG performs NAT between the assigned IP address and the subscriber's real IP address. If the remote RADIUS server does not assign an IP address, NAT is not performed.

When a user selects a proxy service, there is another username and password prompt. After authentication, the service is accessible until the user logs out from the service, logs out from the Cisco SSD, or is timed out.

When enabled, transparent passthrough allows unauthenticated subscriber traffic to be routed through the NRP-SSG in either direction. Filters can be specified to control transparent passthrough traffic. Some of the applications for this feature include:

The NRP-SSG supports multicast traffic, which includes normal multicast packets and Internet Group Management Protocol (IGMP) packets.

In order for the NRP-SSG to forward multicast packets to the IOS routing engine, it must be configured as follows:

If multicast is not enabled, multicast packets received on the interface will be dropped.

PTA can only be used by PPP-type users. AAA is performed exactly as in the proxy service type. A subscriber logs on to a service using a PPP dialer application with a username of the form user@service. The NRP-SSG recognizes the @service as a service profile and loads the service profile from the local configuration or a AAA server. The NRP-SSG forwards the AAA request to the remote RADIUS server as specified by the service profile's RADIUS-Server Attribute. An address is assigned to the subscriber through RADIUS Attribute 8 or Cisco-AVpair "ip:addr-pool." NAT is not performed, and all user traffic is aggregated to the remote network. With PTA, users can only access one service. Users will not have access to the default network or the Cisco SSD.

While PTA terminates the PPP session into a single routing domain, PTA-MD terminates the PPP sessions into multiple IP routing domains, thus supporting a wholesale VPN model where each domain is isolated from the other by an ATM core and has the capability to support overlapping IP addresses.

Packet Filtering

The NRP-SSG uses IOS access control lists (ACLs) to prevent users, services, and passthrough traffic from accessing specific IP addresses and ports.

When an ACL attribute is added to a service profile, all users of that service are prevented from accessing the specified IP address, subnet mask, and port combinations through the service.

When an ACL attribute is added to a user profile, it will apply globally to all of the user's traffic.

Upstream and downstream attributes, including inacl and outacl attributes, can be added to a special pseudo-service profile that can be downloaded to the NRP-SSG from a RADIUS server. Additionally, locally configured ACLs can be used. After the ACLs have been defined, they are applied to all traffic passed by the transparent passthrough feature.

Service Access Order

When users are accessing multiple services, the NRP-SSG must determine the services for which the packets are destined. To do this, the NRP-SSG uses an algorithm to create a service access order list. This list is stored in the user's host object and contains services that are currently open and the order in which they are searched.

The algorithm that creates this list orders the open services based on the size of the network. Network size is determined by the subnet mask of the Service Route RADIUS attribute. A subnet that contains more hosts implies a larger network. In the case of networks that are the same size, the services will be listed in the order in which they were last accessed.

When creating service profiles, be sure to define as small a network as possible. If there is overlapping address space, packets might be forwarded to the wrong service.

Next Hop Gateway

The next hop gateway attribute is used to specify the next hop key for a service. Each NRP-SSG uses its own next hop gateway table that associates this key with an actual IP address.

Note that this attribute overrides the IP routing table for packets destined to a service.

DNS Redirection

When the NRP-SSG receives a DNS request, it performs domain name matching using the Domain Name attribute from the service profiles of the currently logged in services.

If a match is found, the request is redirected to the DNS server for the matched service.

If a match is not found and the user is logged on to a service that has Internet connectivity, the request is redirected to the first service in the user's service access order list that has Internet connectivity. Internet connectivity is defined as a service containing a Service Route attribute of 0.0.0.0/0.

If a match is not found and the user is not logged on to a service that has Internet connectivity, the request is forwarded using the normal routing methods specified in the client's Transmission Control Protocol/Internet Protocol (TCP/IP) stack.

Fault Tolerance for DNS

The NRP-SSG can be configured to work with a single DNS server, or two servers in a fault-tolerant configuration. Based on an internal algorithm, DNS requests will be switched to the secondary server if the primary server begins to perform poorly or fails.

Session-Timeout and Idle-Timeout RADIUS Attributes

In a dial-up networking or bridged (non-PPP) network environment, a user might disconnect from the NAS and release the IP address without logging out from the NRP-SSG. If this happens, the NRP-SSG will continue to allow traffic to pass from that IP address and this might be a problem if the IP address is obtained by another user.

The NRP-SSG provides two mechanisms to prevent this problem:

The Session-Timeout and Idle-Timeout attributes can be used in either a user or service profile. In a user profile, the attribute applies to the user's session. In a service profile, the attribute individually applies to each service connection.

Concurrent or Sequential Service Access Mode

NRP-SSG services can be configured for concurrent or sequential access. Concurrent access allows users to log on to this service while simultaneously connected to other services. Sequential access requires that the user log out of all other services before accessing a service configured for sequential access.

Concurrent access is recommended for most services. Sequential access is ideal for services for which security is important, such as corporate intranet access, or for which there is a possibility of overlapping address space.

Extended High System Availability

The NRP-SSG supports extended high system availability (EHSA) redundancy. You can configure this chassis redundancy at the slot level of the Cisco 6400 for adjacent slot or subslot pairs. For example, if you have NRP-SSGs installed in slots 1 and 2, you can set a preferred device between the two. To ensure that configuration is consistent between redundant NRP-SSGs, you can configure automatic synchronization between the two. You can also manually force the primary and secondary devices in a redundant pair to switch roles. See the Cisco 6400 UAC Software Configuration Guide for more information on EHSA redundancy.

Related Features and Technologies

The NRP-SSG works in conjunction with the Cisco SSD. The Cisco SSD is a specialized web server, populated by the service provider, that lists all of the potential networks (or services) a particular customer can access. Customers select and deselect services from a menu through an HTML browser.

Related Documents

For related information on this feature, refer to the following documents:

Supported Platforms

---

This feature is supported on these platforms:

New Supported Standards, MIBs, and RFCs

---

MIBs

None

RFCs

None

Standards

None

Prerequisites

---

Cisco Service Selection Dashboard

If you want to perform Layer 3 service selection, you must install and configure the Cisco Service Selection Dashboard as described in the Cisco Service Selection Dashboard User Guide.

Configuration Tasks

---

Perform the following tasks to configure the NRP-SSG.

The following tasks are optional:

Configuring RADIUS Profiles

You must set up user and service RADIUS profiles on the AAA server as described in this section. Service profiles can also be defined locally using the local-profile command.You can optionally set up pseudo-service profiles also as described in this section.

This section describes RADIUS attributes that can be used to define specific AAA elements in NRP-SSG user profiles, service profiles, and specialized pseudo-service profiles.

For detailed information on the syntax of these attributes, see "NRP-SSG Vendor-Specific Attributes".

User Profiles

RADIUS user profiles contain a password, a list of subscribed services and/or groups, and access control lists.

Cisco AVPair Attributes

This section specifies Cisco AVPair attributes that appear within user profiles.

Table 1   Cisco AVPair Attributes

User Profile Attributes

This section specifies standard and vendor-specific RADIUS attributes that can be used in NRP-SSG user profiles.

Table 2   User Profile Attributes

Service Profiles

Service profiles include the password, service type (outbound), type of service (passthrough or proxy), the service access mode (sequential or concurrent), the DNS server IP address, networks that exist in the service domain, access control lists, and other optional attributes.

Cisco AVPair Attributes

This section specifies Cisco AVPair attributes that appear within service profiles.

Table 3   Cisco AVPair Attributes

Standard Service Profile Attributes

This section specifies standard RADIUS attributes that can be used in NRP-SSG service profiles.

Table 4   Standard Service Profile Attributes

NRP-SSG Specific Service Profile Attributes

This section specifies VSAs that appear within service profiles.

Table 5   NRP-SSG Service Profile Attributes

Service Group Profiles

Service group profiles contain a list of services and/or service groups and can be used to create directory structures for locating and logging on to services. When a user is subscribed to a service group, the user automatically is subscribed to all services and groups within that service group. A service group profile includes the password and the service type (outbound) as check attributes and a list of services and/or a list of service groups as reply attributes.

This section specifies vendor-specific attributes that can be used in NRP-SSG service group profiles.

Table 6   Service Group Profile Attributes

Pseudo-Service Profiles

This section describes pseudo-service profiles. Pseudo-service profiles are used to define variable length tables or lists of information in the form of services. There are currently two types of pseudo-service profiles: Transparent Passthrough Filter and Next Hop Gateway. The following sections describe both types.

Transparent Passthrough Filter Pseudo-Service Profile

Transparent passthrough is designed to allow unauthenticated traffic (users or network devices that have not logged in to the NRP-SSG through the Cisco SSD) to be routed through normal IOS processing.

Table 7   Transparent Passthrough Filter Pseudo-Service Profile Attributes

The Transparent Passthrough Filter pseudo-service profile allows or denies access to IP addresses and ports accessed through the transparent passthrough feature.

To define what traffic can pass through, the NRP-SSG downloads the Transparent Passthrough Filter pseudo-service profile. This profile contains a list of access control list (ACL) attributes. Each item contains an IP address or range of IP addresses, a list of port numbers, and specifies whether traffic is allowed or denied.

To create a filter for transparent passthrough, create a profile that contains ACL attributes that define what can and cannot be accessed.

You can also create ACLs locally. For more information, see the ssg pass-through command in the Command Reference section.

Next Hop Gateway Pseudo-Service Profile

Because multiple NRP-SSGs might access services from different networks, each service profile specifies a next hop key, which is any string identifier, rather than an actual IP address. For each NRP-SSG to determine the IP address of the next hop, each NRP-SSG downloads its own next hop gateway table that associates keys with IP addresses.

Table 8   Next Hop Gateway Pseudo-Service Profile Attributes

To create a next hop gateway table, create a profile and give it any name. Use the Next Hop Gateway Entry attribute to associate service keys with their IP addresses. When you have finished, repeat this for each NRP-SSG if the next hop IP addresses are different. For an example next hop gateway pseudo-service profile, see "Sample Pseudo-Service Profiles".

For more information, see the ssg next-hop command in the Command Reference section.

NRP-SSG Vendor-Specific Attributes

The NRP-SSG uses vendor-specific RADIUS attributes. If using the NRP-SSG with Cisco User Control Point (UCP) software, specify settings that allow processing of the NRP-SSG attributes while configuring the CiscoSecure Access Control Server (ACS) component. If using another AAA server, you must customize that server's RADIUS dictionary to incorporate the NRP-SSG vendor-specific attributes.

Table 9 lists vendor-specific attributes used by the NRP-SSG. By sending an Access-Request packet with the vendor-specific attributes shown in the table, the Cisco Service Selection Dashboard (SSD) can send requests to the NRP-SSG to log on and log off an account and disconnect and connect services. The vendor ID for all of the Cisco-specific attributes is 9.

Table 9   Vendor-Specific RADIUS Attributes for the NRP-SSG

The following sections describe the format of each subattribute.

Cisco-AVpair Attribute

The Cisco-AVpair attributes are used in user and service profiles. The Cisco-AVpair attributes are used to configure ACLs.

Upstream Access Control List

This attribute specifies either an IOS standard access control list or an extended access control list to be applied to upstream traffic coming from the user.

Cisco-AVpair = "ip:inacl[#number]={standard-access-control-list | extended-access-control-list}"

Syntax Description

number	Access list identifier.
standard-access-control-list	Standard access control list.
extended-access-control-list	Extended access control list.

Example

Downstream Access Control List

This attribute specifies either an IOS standard access control list or an extended access control list to be applied to downstream traffic going to the user.

Cisco-AVpair = "ip:outacl[#number]={standard-access-control-list | extended-access-control-list}"

Syntax Description

number	Access list identifier.
standard-access-control-list	Standard access control list.
extended-access-control-list	Extended access control list.

Example

Account-Info Attributes

The Account-Info attributes are used in user profiles and service group profiles.

User profiles define the password and services and/or groups to which the user is subscribed.

Service group profiles contain a list of services and/or service groups and can be used to create sophisticated directory structures for locating and logging on to services. When a user is subscribed to a service group, the user is automatically subscribed to all services and groups within that service group. A service group profile includes the name of the service group, the password, the service type (outbound), a list of services and/or a list of other service groups.

Example (RADIUS Freeware Format)

Example (CiscoSecure ACS for UNIX and UCP Format)

Service Name

In user profiles, this attribute subscribes the user to the specified service. In service group profiles, this attribute lists services that belong to the service group.

Account-Info = "Nname"

Syntax Description

name	Name of the service profile.

Example

Service Group

In user profiles, this attribute subscribes a user to a service group. In service group profiles, this attribute lists the service groups that belong to this service group.

Account-Info = "Gname"

Syntax Description

name	Name of the group profile.

Example

Auto Service

This attribute subscribes the user to a service and automatically logs the user on to the service when the user accesses the Cisco SSD. Each user profile can have more than one auto service attribute.

Account-Info = "Aservicename [;username;password]"

Syntax Description

servicename	Name of the service.
username	Username used to access the service. Required for proxy services.
password	Password used to access the service. Required for proxy services.

Example

Group Description

This attribute provides a description of the service group to the Cisco SSD. If this attribute is omitted, the service group profile name is used.

Account-Info = "Idescription"

Syntax Description

description

Description of the service group.

Example

Service-Info Attributes

The Service-Info attributes are used to define a service. The following attributes define the parameters for a service.

Service Description

This attribute describes the service. This attribute is optional.

Service-Info = "Idescription"

Syntax Description

description

Description of the service.

Example

Type of Service

This attribute indicates whether the service is proxy or passthrough. This attribute is optional.

Service-Info = "Ttype"

Syntax Description

type	P—Passthrough. Indicates the user's packets are forwarded through the NRP-SSG. This is the default.
	X—Proxy. Indicates the NRP-SSG performs proxy service.

Example

Service Mode

This attribute defines whether the user is able to log on to this service while simultaneously connected to other services (concurrent) or whether the user cannot access any other services while using this service (sequential). The default is concurrent. This attribute is optional.

Service-Info = "Mmode"

Syntax Description

mode	S—Sequential mode. C—Concurrent mode. This is the default.

Example

DNS Server Address

This attribute specifies the primary and secondary DNS servers for this service. If two servers are specified, the NRP-SSG can send DNS requests to the primary DNS server until performance is diminished or it fails (failover). This attribute is optional.

Service-Info = "Dip_address_1[;ip_address_2]"

Syntax Description

ip_address_1	IP address of the primary DNS server.
ip_address_2	(Optional) IP address of the secondary DNS server used for fault tolerance.

Example

Service Route

This attribute specifies networks available to the user for this service. This attribute is required.

Service-Info = "Rip_address;mask"

Syntax Description

ip_address	IP address.
mask	Subnet mask.

---

Note      An Internet service is typically specified as "R0.0.0.0;0.0.0.0" in the service profile.

---

Service-Info = "R192.168.1.128;255.255.255.192"

---

Note      There can be multiple instances of this attribute within a single service profile.

---

Example

Service Next Hop Gateway

This attribute specifies the next hop key for this service. Each NRP-SSG uses its own next hop gateway table that associates this key with an actual IP address. For information on creating a next hop gateway table, see "Next Hop Gateway Table Entry". This attribute is optional.

Service-Info = "Gkey"

Syntax Description

key	Name of the next hop.

Example

Domain Name

This attribute specifies domain names that get DNS resolution from the DNS server(s) specified in DNS server address. This attribute is optional.

Service-Info = "Oname1[;name2]...[;nameX]"

Syntax Description

name1	Domain name that gets DNS resolution from this server.
name2...X	(Optional) Additional domain name(s) that gets DNS resolution from this server.

Service-Info = "Ocisco.com;cisco-sales.com"

---

Note      There can be multiple instances of this attribute within a single service profile.

---

Example

Service Name

This attribute defines the name of the service.

Service-Info = "Nname"

Syntax Description

name	Name of the service profile or service that belongs to a service group.

Example

Control-Info Attributes

The Control-Info attributes are used to define lists or tables of information.

Next Hop Gateway Table Entry

Because multiple NRP-SSGs might access services from different networks, each service profile specifies a next hop key rather than an actual IP address. For each NRP-SSG to determine the IP address of the next hop, each NRP-SSG downloads its own next hop gateway table that associates keys with IP addresses. For information on defining next hop keys, see "Service Next Hop Gateway".

Control-Info = "Gkey;ip_address"

Syntax Description

key	Service name or key specified in the Service Next Hop Gateway service profile.
ip_address	IP address of the next hop for this service.

Control-Info = "GNHT_for_SSG_1;192.168.1.128"

Control-Info = "O2;153"

---

Note      This attribute is only used for accounting purposes and does not appear in profiles.

---

Control-Info = "I3;151"

---

Note      This attribute is only used for accounting purposes and does not appear in profiles.

---

bert Password = "ernie"

Session-Timeout = 21600,

Account-Info = "GServiceGroup1",

Account-Info = "Nservice1.com",

Account-Info = "Ngamers.net"

user = bert {

radius = SSG {

check_items = {

2 = "ernie"

}

reply_attributes = {

27 = 21600

9,250 = "GServiceGroup1"

9,250 = "Nservice1.com"

9,250 = "Ngamers.net"

}

}

}

ServiceGroup1 Password = "cisco", Service-Type = outbound,

Account-Info = "Nservice1.com",

Account-Info = "Ngamers.net",

Account-Info = "GServiceGroup3",

Account-Info = "GServiceGroup4",

Account-Info = "IStandard User Services"

user = ServiceGroup1 {

radius = SSG {

check_items = {

2 = "cisco"

6 = 5

}

reply_attributes = {

9,250 = "Nservice1.com"

9,250 = "Ngamers.net"

9,250 = "GServiceGroup3"

9,250 = "GServiceGroup4"

9,250 = "IStandard User Services"

}

}

}

service1.com    Password = "cisco", Service-Type = outbound,

Idle-Timeout = 1800,

Service-Info = "R192.168.1.128;255.255.255.192",

Service-Info = "R192.168.2.0;255.255.255.192",

Service-Info = "R192.168.3.0;255.255.255.0",

Service-Info = "Gservice1",

Service-Info = "D192.168.2.81",

Service-Info = "MC",

Service-Info = "TP",

Service-Info = "ICompany Intranet Access",

Service-Info = "Oservice1.com"

user = service1.com {

radius = SSG {

check_items = {

2 = "cisco"

6 = 5

}

reply_attributes = {

28 = 1800

9,251 = "R192.168.1.128;255.255.255.192"

9,251 = "R192.168.2.0;255.255.255.192"

9,251 = "R192.168.3.0;255.255.255.0"

9,251 = "Gservice1"

9,251 = "D192.168.2.81"

9,251 = "MC"

9,251 = "TP"

9,251 = "ICompany Intranet Access"

9,251 = "Oservice1.com"

}

}

}

ssg-filter Password = "cisco", Service-Type = outbound,

Cisco-AVpair="ip:inacl#3=deny tcp 192.168.1.0 0.0.0.255 any eq 21",

Cisco-AVpair="ip:inacl#7=permit ip any any"

user = ssg-filter {

radius = SSG {

check_items = {

2 = "cisco"

6 = 5

reply_attributes = {

9,1 = "ip:inacl#3=deny tcp 192.168.1.0 0.0.0.255 any eq 21",

9,1 = "ip:inacl#7=permit ip any any"

}

}

}

nht1           Password = "cisco", Service-Type = outbound,

Account-Info = "Gservice3;192.168.103.3",

Account-Info = "Gservice2;192.168.103.2",

Account-Info = "Gservice1;192.168.103.1",

Account-Info = "GLabservices;192.168.4.2",

Account-Info = "GWorldwide_Gaming;192.168.4.2"

user = nht1{

radius= SSG {

check_items= {

2=cisco

6=5

}

reply_attributes= {

9,253="Gservice3;192.168.103.3"

9,253="Gservice2;192.168.103.2"

9,253="Gservice1;192.168.103.1"

9,253="GLabservices;192.168.4.2"

9,253="GWorldwide_Gaming;192.168.4.2"

}

}

Acct-Status-Type = Start

NAS-IP-Address = ip_address

User-Name = "username"

Acct-Session-Id = "session_id"

Framed-IP-Address = user_ip

Proxy-State = "n"

ip_address	IP address of the NRP-SSG.
username	Name used to log on to the service provider network.
session_id	Session number.
user_ip	IP address of the user's system.
n	Accounting record queuing information (has no effect on account billing).

Account Logoff

When a user logs off, the NRP-SSG sends a RADIUS accounting-request on behalf of the user to the accounting server. The attributes associated with this record are:

Connection Start

When a user accesses a service, the NRP-SSG sends a RADIUS accounting-request to the accounting server. The attributes associated with this record are:

Connection Stop

When a user terminates a service, the NRP-SSG sends a RADIUS accounting-request to the accounting server. The attributes associated with this record are:

Configuring Security

Command	Purpose
Router(config)# aaa new-model	Enables AAA.
Router(config)# aaa authentication ppp default radius	Specifies RADIUS as the default authentication method for users that log in to serial interfaces using PPP.
Router(config)# aaa authorization network default radius	Specifies that RADIUS is the default authorization used for all network-related requests.
Router(config)# radius-server host {hostname | ip-address} [auth-port UDP-port-number] [acct-port UDP-port-number]	Specifies the RADIUS server host.
Router(config)# radius-server key AAAPassword	Sets the RADIUS shared secret between the NRP-SSG and the local AAA server.
Router(config)# radius-server vsa send	(Optional) Send vendor-specific attributes with authentication and accounting requests to the AAA server.
Router(config)# ssg radius-helper key DashboardPassword	Sets the RADIUS shared secret between the NRP-SSG and the Cisco SSD.
Router(config)# ssg radius-helper	Specifies the UDP default port numbers for a RADIUS authentication server (1645) and accounting server (1646).
Router(config)# ssg service-password ServicePassword	Sets the password used to authenticate the NRP-SSG with the local AAA server service profiles. This value must match the value configured for the AAA server service profiles.

Command	Purpose
Router(config)# ssg default-network ip-address mask	Sets the IP address or subnet that users will be able to access without authentication. Typically, this is the address where the Cisco SSD resides. A mask provided with the IP address specifies the range of IP addresses that users will be able to access without authentication.

Verifying the Default Network

Use the show running-config command to verify that the default network has been configured correctly.

Configuring Interfaces

If you are going to use PPP to connect subscribers to the NRP-SSG, you do not have to configure any downlink interfaces. If you are using non-PPP connections, such as bridging or LAN, you must configure at least one downlink interface.

Configure all interfaces that will be connected to services as uplink interfaces.

Verifying Interfaces

Use the show ssg direction command to verify that interfaces have been configured correctly.

Configuring Services

Every service must be bound to an uplink interface.

Verifying Services

Use the show ssg service command to verify that services have been bound to interfaces correctly. Use the show running-config command to verify that the service search order and maximum services have been configured correctly. Use the show ssg next-hop command to verify all mappings between services and IP addresses.

Configuring Local Service Profiles

This task is required if you want to use Layer 2 service selection; otherwise, it is optional. You can configure local service profiles in addition to the service profiles on the remote RADIUS server.

Verifying Local Service Profiles

Use the show running-config command to verify that local service profiles have been configured correctly.

Configuring Transparent Passthrough

This task is optional, and only supported in Cisco IOS Releases 12.0(3)DC and 12.0(5)DC. Enable or disable transparent passthrough by using the appropriate command:

Verifying Transparent Passthrough

Use the show running-config command to verify that transparent passthrough has been enabled. Use the show ssg pass-through-filter command to verify that the filter for transparent passthrough has been configured correctly.

Configuring Redundancy

This task is optional. Perform the following tasks on the NSP:

This task is optional. Perform the following tasks on the NRP:

Verifying Redundancy

Use the show redundancy command to verify that redundancy has been configured correctly.

Configuring Fastswitching

This task is optional. Fastswitching is enabled by default.

Verifying Fastswitching

Use the show running-config command to verify that fastswitching has been enabled. Because fastswitching is enabled by default, it will not be displayed in the running configuration. If fastswitching has been disabled, the following line will appear in the output of the show running-config command:

Configuring Multicast

This task is optional. Multicast is disabled by default.

Verifying Multicast

Use the show running-config command to verify that multicast has been enabled. If multicast is disabled, which is the default, it will not be displayed in the running configuration. If multicast is enabled, the following line will appear in the output of the show running-config command:

Verifying NRP-SSG Configuration

You can perform the following verification tasks after completing all configuration tasks described above.

To verify that the NRP-SSG, Cisco SSD, and RADIUS server have been configured to work together correctly:

To verify that transparent passthrough has been configured correctly:

To verify that redundancy has been configured correctly:

Monitoring and Maintaining the NRP-SSG

---

Configuration Examples

---

The configuration examples in this section support the network topology shown in Figure 2.

Figure 2   Example NRP-SSG Network Topology

Security

Default Network

Interfaces

Services

The following is an example service profile as it would appear on the RADIUS server. It is formatted for CiscoSecure ACS for UNIX and UCP.

Service Search Order

Next-Hop Table

The following is an example next-hop table as it would appear on the RADIUS server. It is formatted for CiscoSecure ACS for UNIX and UCP.

Max Services

Local Service Profile

Transparent Passthrough Filter

The following is an example transparent passthrough filter as it would appear on the RADIUS server. It is formatted for CiscoSecure ACS for UNIX and UCP.

Redundancy

Fastswitching

There will be nothing in the running configuration for fastswitching when it is enabled.

Multicast

Command Reference

---

This section documents new commands associated with the NRP-SSG. All other commands used with this feature are documented in the Cisco IOS Release 12.0 command reference publications.

attr

To configure an attribute in a local RADIUS service profile, use the attr profile configuration command. Use the no form of this command to delete an attribute from a service profile.

attr radius-attribute-id [vendor-id] [cisco-vsa-type] attribute-value
no attr radius-attribute-id [vendor-id] [cisco-vsa-type] attribute-value

Syntax Description

radius-attribute-id	RADIUS attribute ID to be configured.
vendor-id	(Optional) Vendor ID. Required if the RADIUS attribute ID is 26, indicating a vendor-specific attribute. Cisco's vendor ID is 9.
cisco-vsa-type	(Optional) Cisco vendor-specific attribute (VSA) type. Required if the vendor ID is 9, indicating a Cisco VSA.
attribute-value	Attribute value.

routerA# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

routerA(config)# local-profile cisco.com

routerA(config-prof)# attr 26 9 1 "ip:inacl#101=deny tcp 192.168.1.0 0.0.0.255 any eq 21"

routerA# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

routerA(config)# local-profile cisco.com

routerA(config-prof)# no attr 27 600

RouterA# clear ssg connection 192.168.1.1 Perftest

RouterA# clear ssg host 192.168.1.1

RouterA# clear ssg next-hop

RouterA# clear ssg pass-through-filter

RouterA# clear ssg service Perftest

routerA# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

routerA(config)# local-profile cisco.com

routerA(config-prof)#

RouterA# show ssg binding

WhipitNet -> 192.168.1.1 (NHT)

Service1.com -> 192.168.1.2 (NHT)

Service2.com -> 192.168.1.3 (NHT)

Service3.com -> 192.168.1.4 (NHT)

GoodNet -> 192.168.2.1

Perftest -> 192.168.1.6

RouterA# show ssg connection 192.168.1.1 Perftest

------------------------ ConnectionObject Content -----------------------

User Name:

User Password:

Owner Host: 192.168.1.1

Associated Service: Perftest

Connection State: 0

Connection Started since:

*11:08:15.000 PST Mon Jan 25 1999

Connection Traffic Statistics:

Input Bytes = 0 (HI = 0), Input packets = 0

Output Bytes = 0 (HI = 0), Output packets = 0

RouterA# show ssg direction

ATM0/0/0.10: Uplink

BVI1: Downlink

FastEthernet0/0/0: Uplink

RouterA# show ssg host

1:172.16.4.3

2:172.16.4.21

3:172.16.61.1

### Active HostObject Count:3

RouterA# show ssg host | begin 172.16.6

3:172.16.61.1

### Active HostObject Count:3

---

Note      A vertical bar (|) must precede the output modifier (begin, exclude or include).

---

RouterA# show ssg host username

1: 172.16.2.11 (active) Host name: user1

### Total HostObject Count(including inactive hosts): 1

RouterA# show ssg host 172.16.6.112

------------------------ HostObject Content -----------------------

Activated:TRUE

IDB:1625316924

User Name:user1

Host IP:172.16.6.112

Msg IP:0.0.0.0 (0)

Host DNS IP:0.0.0.0

Maximum Session Timeout:0 seconds

Host Idle Timeout:0 seconds

Class Attr:NONE

User logged on since:*06:34:42.000 pst Mon May 3 1999

User last activity at:*06:34:47.000 pst Mon May 3 1999

Default Service:NONE

DNS Default Service:NONE

Active Services:isp-2; isp-name.com; isp-1;

AutoService:isp-1; isp-2;

Subscribed Services:isp-2; isp-3; isp-1; isp-4; isp-5;

RouterA# show ssg next-hop

Next hop table loaded from profile prof-nhg:

WhipitNet -> 192.168.1.6

Service1.com -> 192.168.1.3

Service2.com -> 192.168.1.2

Service3.com -> 192.168.1.1

GoodNet -> 192.168.1.2

Perftest -> 192.168.1.5

End of next hop table.

RouterA# show ssg pass-through-filter

Service name: filter01

Password: cisco

Direction: Uplink

Extended IP access list (SSG ACL)

permit tcp 172.16.6.0 0.0.0.255 any eq telnet

permit tcp 172.16.6.0 0.0.0.255 192.168.250.0 0.0.0.255 eq ftp

RouterA# show ssg service isp-name.com

------------------------ ServiceInfo Content -----------------------

Name:isp-name.com

Type:PASS-THROUGH

Mode:CONCURRENT

Service Session Timeout:0 seconds

Service Idle Timeout:0 seconds

Class Attr:NONE

Authentication Type:CHAP

Max Connections Allowed:10

Reference Count:1

DNS Server(s):Primary:192.168.250.11

Included Network Segments:

192.168.250.0/255.255.255.0

Excluded Network Segments:

Domain List:isp-name.com;

Active Connections:

1 :Virtual=172.16.6.112, Subscriber=172.16.6.112

------------------------ End of ServiceInfo Content ----------------

routerA# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

routerA(config)# ssg bind direction downlink ATM 0/0/0.10

routerA# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

routerA(config)# ssg bind service MyService ATM 0/0/0.10

routerA# configure terminal

Enter configuration commands, one per line. End with CNTL/Z.