Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

In a typical WiFi hotspot deployment, all subscriber traffic goes through Cisco ISG (Intelligent Service Gateway) after successful authentication. For unauthenticated traffic, L4R feature offers a logic to redirect traffic based on a pre-defined access-list (ACL). This L4R feature acts as a way to redirect some traffic to a web portal or opengarden environment using a translation logic. In order to implement a similar redirection logic after successful authentication without the need for translating the traffic, the flow based redirect has been implemented in ISG to allow traffic to be redirected/rerouted. A typical use case is Adult Content Filtering (ACF) where web traffic needs to be redirected to a Web Filtering Appliance.

The following figure shows a typical scenario where ACF is applied on Wi-Fi hotspots.

Mobile IP sessions are provisioned with a traffic class service in the Cisco Intelligent Wireless Access Gateway (iWAG) for routing web traffic to a next hop device, depending on the local policies or the policies that are downloaded from the Cisco IOS authentication, authorization, and accounting (AAA) network security services.

The traffic class service can be configured for routing traffic to the next hop along with the other supported features such as policing and Dynamic Rate Limit (DRL) accounting. You can configure multiple TC services with different next hop addresses with the Flow-Based Redirect feature. However, only 16 traffic class services can be applied to a session.

Network Address Translation (NAT) with Selective IP Traffic Offload (SIPTO) is required only for IPv4 and Dual Stack IPv4 traffic sessions. NAT is enabled at the outgoing interface level so NAT does not need to be IPoE session aware when used with Flow Based Redirect for Selective IP Traffic Offload.

Note

In existing deployment, a NAT or Carrier Grade Network Address Translation (CGN) device may exist upstream of the Intelligent Wireless Access Gateway (iWAG) device. In such a scenario, it is possible to keep the architecture in place without enabling NAT on the Cisco ASR 1000 Series Aggregation Services Router acting as iWAG, if and only if, there is a simple way for the return traffic to go from the NAT or CGN device back to the iWAG. This needs to be verified prior to deployment to guarantee return paths.

The following figure shows a typical deployment scenario where internet traffic is offloaded from the access network, and is routed directly through the nearest IP gateway.

You can provision or activate a traffic class service with the Flow-Based Redirect feature by adding the following vendor-specific attribute (VSA) in the user profile of the RADIUS server:

vsa cisco 250 ACF_SERVICE

You can activate a traffic class service with the Flow-Based Redirect feature for an established session through the RADIUS Change of Authorization (CoA) feature, using the following VSAs:

vsa cisco 250 S<sessionID>
vsa cisco generic 1 string "subscriber:command=activate-service"
vsa cisco generic 1 string "subscriber:service-name=ACF_SERVICE”

You can deactivate a traffic class service with the Flow-Based Redirect feature for an established session through the RADIUS CoA feature, using the following VSAs:

vsa cisco 250 S<sessionID>
vsa cisco generic 1 string "subscriber:command=deactivate-service"
vsa cisco generic 1 string "subscriber:service-name=ACF_SERVICE”

1.    enable


2.    configure terminal


3.    ip access-list extended traffic class


4.    permit tcp source_IP destination_IP eq port


5.    class-map type traffic match-any traffic class map


6.    match access-group input name traffic class


7.    policy-map type service policy-map name


8.    class type traffic traffic class map


9.    reroute to next-hop ip IP address


10.    policy-map type control policy-map name


11.    class type control always event account-logon


12.    20 service-policy type service name service-policy name


13.    class type control always event service-stop


14.    1 service-policy type service unapply identifier service-name


15.    class type control always event service-start


16.    10 service-policy type service identifier service-name


17.    class type control always event account-logoff


18.    10 service disconnect delay 5

Router> enable

Router# configure terminal

Router (config)# ip access-list extended WEB_ACL_IN

Router (config-ext-nacl)# permit tcp any any eq www

Router (config)# class-map type traffic match-any ACF_ACL

Router (config-traffic-classmap)# match access-group input name WEB_ACL_IN

Router (config)# policy-map type service ACF_SERVICE

Router (config-service-policymap)# class type traffic ACF_ACL

Router (config-service-policymap-class-traffic)# reroute to next-hop ip 44.0.0.22

Router (config)# policy-map type control INTERNET_SERVICE_RULE

Router (config-control-policymap)# class type control always event account-logon

Router (config-control-policymap-class-control)# 20 service-policy type service name ACF_SERVICE

Router (config-control-policymap)# class type control always event service-stop

Router (config-control-policymap-class-control)# 1 service-policy type service unapply identifier service-name

Router (config-control-policymap)# class type control always event service-start

Router (config-control-policymap-class-control)# 10 service-policy type service identifier service-name

Router (config-control-policymap)# class type control always event account-logoff

Router (config-control-policymap-class-control)# 10 service disconnect delay 5

You can preserve the addresses in the global address pool by allowing a device to use one global address for many local addresses. This type of NAT configuration is called overloading.

When an Interface IP is overloaded for the translations and a single IP address is used for all the expected translations, a maximum of 60,000 translations can be achieved with this configuration depending on the traffic ports and the port parity involved. You can use the NAT Pool Overload configuration to achieve maximum translations.

There is a concept of port parity (even/odd) in NAT and NAT64. If a source port is in the port range of 0 to 1023, it is translated between ports 512 to 1023. If a source port range is more than 1023, it takes ports from 1024 onwards.

The NAT Interface Overloading with VRF scenario assumes that the service provider is only interested in performing application-specific NAT, for example, the service provider perform NAT only on the DNS requests from clients and the rest of the traffic will proceed as it is. Therefore, we can use Interface Overloading instead of a pool. With this, we can have a maximum of 60000 translations per interface, which is deemed good for the application-specific NAT. Also, the IP sessions and NAT are in a VRF (named PROVIDER_WIFI_01, in the example below).