Public wireless LANs (PWLANs) and wireless mesh networks can contain hundreds of access points, each of which must send RADIUS authentication requests to an authentication, addressing and authorization (AAA) server. The Intelligent Services Gateway (ISG) RADIUS proxy functionality allows the access points to send authentication requests to ISG, rather than directly to the AAA server. ISG relays the requests to the AAA server. The AAA server sends a response to ISG, which then relays the response to the appropriate access point.

When serving as a RADIUS proxy, ISG can pull user-specific data from the RADIUS flows that occur during subscriber authentication and authorization, and transparently create a corresponding IP session upon successful authentication. This functionality provides an automatic login facility with respect to ISG for subscribers that are authenticated by devices that are closer to the network edge.

When configured as a RADIUS proxy, ISG proxies all RADIUS requests generated by a client device and all RADIUS responses generated by the corresponding AAA server, as described in RFC 2865, RFC 2866, and RFC 2869.

ISG RADIUS proxy functionality is independent of the type of client device and supports standard authentication (that is, a single Access-Request/Response exchange) using both Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP), Access-Challenge packets, and Extensible Authentication Protocol (EAP) mechanisms.

In cases where authentication and accounting requests originate from separate RADIUS client devices, ISG associates all requests with the appropriate session through the use of correlation rules. For example, in a centralized PWLAN deployment, authentication requests originate from the wireless LAN (WLAN) access point, and accounting requests are generated by the Access Zone Router (AZR). The association of the disparate RADIUS flows with the underlying session is performed automatically when the Calling-Station-ID (Attribute 31) is sufficient to make the association reliable.

Following a successful authentication, authorization data collected from the RADIUS response is applied to the corresponding ISG session.

Sessions that were created using ISG RADIUS proxy operation are generally terminated by receipt of an Accounting-Stop packet.

To configure RADIUS proxy billing, you can use the timer reconnect command and show radius-proxy session command in the appropriate configuration modes.

To enable session reconnection for ISG RADIUS proxy servers and clients, use pwlan-session reconnect command in the appropriate configuration mode.

By default, ISG RADIUS proxy responds locally to accounting packets it receives. The accounting method-list command can be used to configure ISG to forward RADIUS proxy client accounting packets to a specified server. Forwarding of accounting packets can be configured globally for all RADIUS proxy clients or on a per-client basis.

If Intelligent Services Gateway (ISG) is acting as a proxy for more than one client device, all of which reside on the same subnet, the clients may be configured using a subnet definition rather than a discrete IP address for each device. This configuration method results in the sharing of a single configuration by all the client devices.

ISG RADIUS proxy uses mobile wireless-specific processes to provide support for Gateway General Packet Radio Service (GPRS) Support Node (GGSN) environments.

• Attribute Processing and RADIUS Request Correlation
• 3GPP Attribute Support

Use of Intelligent Services Gateway (ISG) RADIUS proxy has the following benefits:

• Allows the complete set of ISG functionality to be applied to extensible authentication protocol (EAP) subscriber sessions.
• Allows an ISG device to be introduced into a network with minimum disruption to the existing network access server (NAS) and authentication, authorization and accounting (AAA) servers.
• Simplifies RADIUS server configuration because only the ISG, not every access point, must be configured as a client.

1.    enable

2.    configure terminal

3.    interface type number

4.    ip subscriber {interface | l2-connected| routed}

5.    initiator radius-proxy

6.    end

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa server radius proxy

5.    session-identifier {attribute number | vsa vendor id type number}

6.    calling-station-id format {mac-address | msisdn}

7.    accounting method-list {method-list-name| default}

8.    accounting port port-number

9.    authentication port port-number

10.    key [0 | 7] word

11.    timer {ip-address |reconnect |request} seconds

12.    end

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa server radius proxy

5.    client {name | ip-address} [subnet-mask [vrf vrf-id]]

6.   pwlan-session reconnect

7.    session-identifier {attribute number | vsa vendor id type number}

8.    calling-station-id format {mac-address | msisdn}

9.    accounting method-list {method-list-name | default}

10.    accounting port port-number

11.    authentication port port-number

12.    key [0 | 7] word

13.    timer {ip-address | reconnect | request} seconds

14.    end

1.    enable

2.    configure terminal

3.    aaa new-model

4.    aaa authorization radius-proxy {default| list-name}method1 [method2 [method3...]]

5.    policy-map type control policy-map-name

6.    class type control {control-class-name | always} event session-start

7.    action-number proxy [aaa list {default | list-name}

8.    end

1.    show radius-proxy client ip-address [vrf vrf-id]

2.    show radius-proxy session {id id-number | ip ip-address}

3.    show subscriber session [identifier {authen-status {authenticated | unauthenticated} | authenticated-domain domain-name | authenticated-username username | dnis dnis | media type | nas-port identifier | protocol type | source-ip-address ip-address subnet-mask| timer timer-name| tunnel-name name | unauthenticated-domain domain-name | unauthenticated-username username} | uid session-identifier| username username] [detailed]

1.    enable

2.    clear radius-proxy client ip-address

3.    clear radius-proxy session {id id-number | ip ip-address}