The ISG Port-Bundle Host Key feature serves as an in-band signaling mechanism for session identification at external portals. TCP packets from subscribers are mapped to a local IP address for the ISG gateway and a range of ports. This mapping allows the portal to identify the ISG gateway from which the session originated. The mapping also identifies sessions uniquely even when subscribers have overlapping IP addresses. The ISG Port-Bundle Host Key feature enables a single portal to be deployed for multiple Virtual Routing and Forwardings (VRFs) even when there are subscribers with overlapping IP addresses.

With the ISG Port-Bundle Host Key feature, an ISG performs Port-Address Translation (PAT) and Network Address Translation (NAT) on the TCP traffic between the subscriber and the portal. When a subscriber TCP connection is set up, the ISG creates a port mapping that changes the source IP address to a configured ISG IP address and changes the source TCP port to a port allocated by the ISG. The ISG assigns a bundle of ports to each subscriber because one subscriber can have several simultaneous TCP sessions when accessing a web page. The assigned port-bundle host key, or combination of the port bundle and ISG source IP address, uniquely identifies each subscriber. The host key is carried in RADIUS packets sent between the portal server and the ISG in the Subscriber IP vendor-specific attribute (VSA). The table below describes the Subscriber IP VSA. When the portal server sends a reply to the subscriber, the ISG uses the translation tables to identify the destination IP address and destination TCP port.

For each TCP session between a subscriber and the portal, the ISG uses one port from the port bundle as the port map. Individual port mappings are flagged as eligible for reuse on the basis of inactivity timers, but are not explicitly removed once assigned. The number of port bundles is limited per ISG address, but there is no limit to the number of ISG IP addresses that can be configured for port bundle usage.

The port-bundle length is used to determine the number of ports in one bundle. By default, the port-bundle length is four bits. The maximum port-bundle length is ten bits. See the table below for available port-bundle length values and the resulting port-per-bundle and bundle-per-group values. You may want to increase the port-bundle length when you see frequent error messages about running out of ports in a port bundle.

Note

For each portal server, all connected ISGs must have the same port-bundle length, which must correspond to the configured value given in the portal server’s BUNDLE_LENGTH argument. If you change the port-bundle length on an ISG, be sure to make the corresponding change in the configuration on the portal.

• Support for Overlapped Subscriber IP Addresses Extended to Include External Portal Usage
  
• Portal Provisioning for Subscriber and ISG IP Addresses No Longer Required
  

Perform this task to enable the ISG Port-Bundle Host Key feature in a service policy map. The ISG Port-Bundle Host Key feature will be applied to any subscriber who uses this service policy map.

Note	We recommend that you use a dedicated service policy for the feature. Do not share a policy with other ISG features.

1.    enable

2.    configure terminal

3.    policy-map type service policy-name

4.    ip portbundle

5.    end

• What to Do Next
  

1.    Add the Port-Bundle Host Key attribute to the user or service profile.

• What to Do Next
  

1.    enable

2.    configure terminal

3.    ip portbundle

4.    match access-list access-list-number

5.    length bits

6.    source interface-type interface-number

7.    exit

8.    interface type number

9.    ip portbundle outside

1.    enable

2.    show ip portbundle status [free | inuse]

3.    show ip portbundle ip portbundle-ip-address bundle port-bundle-number

4.    show subscriber session [detailed] [identifier identifier | uid session-id| username name]