Table Of Contents
Redirecting ISA Subscriber Traffic
Prerequisites for Redirecting ISA Subscriber Traffic
Restrictions for Redirecting ISA Subscriber Traffic
Information About Redirecting ISA Subscriber Traffic
Overview of ISA Layer 4 Redirect
How to Configure ISA Layer 4 Redirect
Defining a Redirect Server Group
Configuring Layer 4 Redirection on an Interface
Configuring Layer 4 Redirection in a Service Policy Map
Configuring Layer 4 Redirection in a Service Profile or User Profile on the AAA Server
Verifying ISA Traffic Redirection
Configuration Examples for ISA Layer 4 Redirect
Redirecting Unauthenticated Subscriber Traffic: Example
Redirecting Unauthorized Subscriber Traffic: Example
Periodic Redirection: Examples
Redirecting DNS Traffic: Example
Feature Information for Redirecting ISA Subscriber Traffic
Redirecting ISA Subscriber Traffic
The Intelligent Service Architecture (ISA) is a core set of Cisco IOS components that provide a structured framework in which edge access devices can deliver flexible and scalable services to subscribers. A Cisco device that is running a Cisco IOS image with ISA is called an Intelligent Service Gateway (ISG). This module describes how to configure ISA to redirect subscriber traffic by using the ISA Layer 4 Redirect feature. The ISA Layer 4 Redirect feature enables service providers to better control the user experience by allowing subscriber TCP or User Datagram Protocol (UDP) packets to be redirected to specified servers for appropriate handling. ISA Layer 4 redirection can be used to facilitate subscriber authentication, initial and periodic advertising captivation, redirection of application traffic, and DNS redirection.
Module History
This module was first published on April 28, 2005, and last updated on April 28, 2005.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all features. To find information about feature support and configuration, use the "Feature Information for Redirecting ISA Subscriber Traffic" section.
Contents
•Prerequisites for Redirecting ISA Subscriber Traffic
•Restrictions for Redirecting ISA Subscriber Traffic
•Information About Redirecting ISA Subscriber Traffic
•How to Configure ISA Layer 4 Redirect
•Configuration Examples for ISA Layer 4 Redirect
•Feature Information for Redirecting ISA Subscriber Traffic
Prerequisites for Redirecting ISA Subscriber Traffic
The tasks in this document assume you know how to configure access control lists.
Restrictions for Redirecting ISA Subscriber Traffic
The ISA Layer 4 Redirect feature applies only to TCP or UDP traffic.
Information About Redirecting ISA Subscriber Traffic
Before you configure Layer 4 Redirect, you should understand the following concepts:
•Overview of ISA Layer 4 Redirect
•Layer 4 Redirect Applications
Overview of ISA Layer 4 Redirect
The ISA Layer 4 Redirect feature redirects specified packets to servers that handle the packets in a specified manner. For example, packets sent upstream by unauthorized users can be forwarded to a server that redirects the users to a logon page. Similarly, if users try to access a service to which they have not logged on, the packets can be redirected to a server that provides a service logon screen.
The Layer 4 Redirect feature supports three types of redirection, which can be applied to subscriber sessions or to flows:
•Permanent redirection—Specified traffic is redirected to the specified server all the time.
•Initial redirection—Specified traffic is redirected for a specific duration of the time only, starting from when the feature is applied.
•Periodic redirection—Specified traffic is periodically redirected. The traffic is redirected for a specified duration of time. The redirection is then suspended for another specified duration. This cycle is repeated.
The Layer 4 Redirect feature uses access lists to define which traffic will be redirected. Multiple access lists can be used to redirect packets to different server groups. Only the first packet of a TCP session must match the access list; subsequent packets for the session will be sent to the same server.
A redirect server can be any server that is programmed to respond to the redirected packets. If ISA is used with a web portal, unauthenticated subscribers can be sent automatically to a logon page when they start a browser session. Web portal applications can also redirect to service logon pages, advertising pages, and message pages.
Redirected packets are sent to an individual redirect server or redirect server group that consists of one or more servers. The ISG selects one server from the group in a rotating fashion to receive the redirected packets.
When traffic is redirected, ISG modifies the destination IP address and TCP port of upstream packets to reflect the destination server. For downstream packets, ISG returns the source IP address and port to the original packet's destination.
Layer 4 Redirect Applications
The Layer 4 Redirect feature supports the following applications:
•TCP redirection for unauthenticated users and unauthorized services
HTTP traffic from subscribers can be redirected to a web dashboard where the subscribers can log on so that authentication and authorization can be performed.
•Initial and periodic redirection for advertising captivation
Subscriber traffic can be redirected to a sponsor's web page for a brief period of time at the start of the session or periodically throughout the session.
•Redirection of application traffic
Application traffic from a subscriber can be redirected so as to provide value-added services. For example, a subscriber's SMTP traffic can be redirected to a local mail server that can function as a forwarding agent for the mail.
•Domain Name System (DNS) redirection
DNS queries may be redirected to a local DNS server. In some deployments, such as public wireless LAN (PWLAN) hotspots, subscribers may have a static DNS server addresses, which may not be reachable at certain locations. Redirecting DNS queries to a local DNS server allows applications to work properly without requiring reconfiguration.
How to Configure ISA Layer 4 Redirect
There are three ways to apply Layer 4 redirection to sessions. One way is to configure redirection directly on the subscriber interface. A second way is to configure a service profile or service policy map with the Layer 4 redirect attribute in it, and apply that service to the session. A third way is to configure the Layer 4 redirect attribute in the user profile.
The following tasks describe how to configure Layer 4 redirection. The first task is optional. One or more of the next three tasks is required. The last task is optional.
For examples of Layer 4 redirection configuration for specific applications (such as unauthenticated user redirect), see the "Configuration Examples for ISA Layer 4 Redirect" section.
•Defining a Redirect Server Group
•Configuring Layer 4 Redirection on an Interface
•Configuring Layer 4 Redirection in a Service Policy Map
•Configuring Layer 4 Redirection in a Service Profile or User Profile on the AAA Server
•Verifying ISA Traffic Redirection
Defining a Redirect Server Group
Perform this task to define a group of one or more servers to which traffic will be redirected. Traffic will be forwarded to servers in a rotating fashion.
SUMMARY STEPS
1. enable
2. configure terminal
3. redirect server-group group-name
4. server ip ip-address port port-number
DETAILED STEPS
Configuring Layer 4 Redirection on an Interface
Perform this task to redirect all matching Layer 4 subscriber traffic that arrives on an interface.
Prerequisites
An IP access list must be configured if you choose to use an access list to identify traffic for redirection.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip subscriber
5. identifier interface
6. exit
7. redirect [list access-list-number] to {group server-group-name | ip ip-address [port port-number]} [duration seconds] [frequency seconds]
DETAILED STEPS
Configuring Layer 4 Redirection in a Service Policy Map
Perform this task to configure ISA layer 4 redirection in a service policy map.
Prerequisites
The ISA Layer 4 Redirect feature is configured under a traffic class within a service policy map. This task assumes that you have defined the traffic class map. See the module "Configuring ISA Subscriber Services" for more information.
SUMMARY STEPS
1. enable
2. configure terminal
3. policy-map service policy-map-name
4. class type traffic class-name
5. redirect [list access-list-number] to {group server-group-name | ip ip-address [port port-number]} [duration seconds] [frequency seconds]
DETAILED STEPS
What to Do Next
You may want to configure a method of activating the service policy map; for example, control policies can be used to activate services. For more information about methods of service activation, see the module "Configuring ISA Subscriber Services."
Configuring Layer 4 Redirection in a Service Profile or User Profile on the AAA Server
The Layer 4 Redirect feature can be configured as a Cisco vendor-specific attribute (VSA) in a user or service profile on an authentication, authorization, and accounting (AAA) server. This attribute can appear more than once in a profile to define different types of redirections for a session and can be used in both user and service profiles simultaneously.
SUMMARY STEPS
1. Add the Layer 4 Redirect VSA to the user profile or service profile on the AAA server.
DETAILED STEPS
What to Do Next
If you configure ISA Layer 4 redirection in a service profile, you may want to configure a method of activating the service profile; for example, control policies can be used to activate services. For more information about methods of service activation, see the module "Configuring ISA Subscriber Services."
Verifying ISA Traffic Redirection
Perform this task to verify the configuration and operation of ISA Layer 4 traffic redirection.
SUMMARY STEPS
1. enable
2. show redirect translations [ip ip-address]
3. show redirect group [group-name]
4. show subscriber session [detailed] [identifier identifier | uid session-id | username name]
DETAILED STEPS
Examples
The following example shows sample output for the show redirect translations command:
Router# show redirect translations ip 53.0.0.2Destination IP/port Server IP/port Prot In Flags Out Flags Timestamp152.0.0.2 23 9.2.36.253 23 TCP none none May 08 2003 12:37:10The following example show sample output for the show subscriber session command. This output shows that Layer 4 redirect is being applied from the service profile.
Router# show subscriber session uid 135Subscriber session handle: 7C000114, state: connected, service: Local TermUnique Session ID: 135Identifier: blind-rdtSIP subscriber access type(s): IP-InterfaceRoot SIP Handle: CF000020, PID: 73Current SIP options: Req Fwding/Req FwdedSession Up-time: 40 minutes, 30 seconds, Last Changed: 40 minutes, 30 secondsAAA unique ID: 135Switch handle: F000086Interface: ATM2/0.53Policy information:Authentication status: unauthenConfig downloaded for session policy:From Access-Type: IP-Interface, Client: SM, Event: Service Selection Request, ServiceProfile name: blind-rdt, 2 referencesusername "blind-rdt"l4redirect "redirect list 100 to group sesm-grp"Rules, actions and conditions executed:subscriber rule-map blind-rdtcondition always event session-startaction 1 service-policy type service "blind-rdt"Session inbound features:Feature: Layer 4 RedirectRule Cfg Definition#1 SVC Redirect list 100 to group sesm-grp !! applied redirectConfiguration sources associated with this session:Service: blind-rdt, Active Time = 40 minutes, 32 secondsInterface: ATM2/0.53, Active Time = 40 minutes, 32 secondsThe following is sample output for the show subscriber session command for a session in which the Layer 4 redirection is applied on the interface:
Router# show subscriber session uid 133Subscriber session handle: D7000110, state: connected, service: Local TermUnique Session ID: 133Identifier:SIP subscriber access type(s): IP-InterfaceRoot SIP Handle: 1E, PID: 73Current SIP options: Req Fwding/Req FwdedSession Up-time: 42 minutes, 54 seconds, Last Changed: 42 minutes, 54 secondsAAA unique ID: 133Switch handle: 17000084Interface: FastEthernet0/0.505Policy information:Authentication status: unauthenSession inbound features:Feature: Layer 4 RedirectRule Cfg Definition#1 INT Redirect list 100 to group sesm-grpConfiguration sources associated with this session:Interface: FastEthernet0/0.505, Active Time = 42 minutes, 54 secondsConfiguration Examples for ISA Layer 4 Redirect
This section contains the following examples:
•Redirecting Unauthenticated Subscriber Traffic: Example
•Redirecting Unauthorized Subscriber Traffic: Example
•Periodic Redirection: Examples
•Redirecting DNS Traffic: Example
Redirecting Unauthenticated Subscriber Traffic: Example
The following example shows the configuration of redirection for unauthenticated users. In this case, Layer 4 traffic from unauthenticated subscribers is redirected to the web portal.
service-policy type control all-rdt!class-map type traffic match-any CLASS-ALL!policy-map type service blind-rdtclass type traffic CLASS-ALLredirect to group PORTAL!policy-map type control all-rdtclass type control always event session-start1 service-policy type service blind-rdtclass type control always event account-logon1 authenticate2 service-policy type service unapply blind-rdt!redirect server-group PORTALserver ip 9.2.36.253 port 80Redirecting Unauthorized Subscriber Traffic: Example
The following example shows the configuration of redirection for unauthorized subscribers. If the subscriber is not logged onto service "svc2", traffic matching the service "SVC" is redirected to the server group "PORTAL". Once the subscriber logs in to the service, the traffic is no longer redirected. When the subscriber logs out of the service, redirection is applied again.
service-policy type control THE_RULE!class-map type traffic match-any CLASS-ALL!class-map type traffic match-any CLASS-100_110match access-group input 100match access-group output 110!policy-map type service blind-rdtclass type traffic CLASS-ALLredirect to group PORTAL!policy-map type service svc-rdtclass type traffic CLASS-ALLredirect list 100 to group PORTAL!policy-map type service svcclass type traffic CLASS-100_110class type traffic default in-outdrop!policy-map type control THE_RULEclass type control alwyas event account-logon1 authenticate2 service-policy type service svc-rdtclass type control cond-svc-logon event service-start1 service-policy type service unapply svc-rdt2 service-policy type service identifier service-nameclass type control cond-svc-logon event service-stop1 service-policy type service unapply svc2 service-policy type service svc-rdt!class-map type control match-all cond-svc-logonmatch identifier service-name svc!redirect server-group PORTALserver ip 9.2.36.253 port 80Initial Redirection: Example
The following example shows ISA configured to redirect user traffic that comes over interface FastEthernet0/0.505 to a server group called "ADVT" for the intial 60 seconds of the session. After the initial 60 seconds, ISA will stop redirecting the traffic for the rest of the lifetime of the session.
interface FastEthernet0/0.505encapsulation dot1Q 505ip address 10.0.0.1 255.255.255.0ip subscriberidentifier interfaceredirect to group ADVT duration 60no cdp enableThe following example shows ISA configured to redirect the Layer 4 traffic of all subscribers to a server group called "ADVT" for the intial 60 seconds of the session. After the initial 60 seconds, ISA will stop redirecting the traffic for the rest of the lifetime of the session.
service-policy type control initial-rdtpolicy-map type control intial-rdtclass type control always event session-start1 service-policy type service initial-rdt-profile!policy-map type service initial-rdt-profileclass type traffic CLASS-ALLredirect to group ADVT duration 60Periodic Redirection: Examples
The following example shows how to redirect subscriber traffic coming over FastEthernet interface 0/0.505 for a period of 60 seconds every 3600 seconds.
interface FastEthernet0/0.505encapsulation dot1Q 505ip address 50.0.0.1 255.255.255.0subscriber sessionredirect to group ADVT duration 60 frequency 3600no cdp enable!
The following example shows how to redirect all subscriber traffic for a period of 60 seconds every 3600 seconds.
service-policy control periodic-rdt session-start!policy-map control periodic-rdtclass type control always event session-start1 service-policy service periodic-rdt-profile!policy-map service periodic-rdt-profileredirect to group ADVT duration 60 frequency 3600Redirecting DNS Traffic: Example
The following example shows how to redirect all subscriber DNS packets to the server group "DNS-server".
service-policy type control DNS-rdtpolicy-map type control DNS-rdtclass type control event session-start1 service-policy type service DNS-rdt-profile!policy-map type service DNS-rdt-profileclass type traffic CLASS-ALLredirect list 120 to group DNS-server!access-list 100 permit udp any any eq domainAdditional References
The following sections provide references related to the ISA Layer 4 Redirect feature.
Related Documents
Related Topic Document TitleISA commands
Cisco IOS Intelligent Service Architecture Configuration Guide
Technical Assistance
Feature Information for Redirecting ISA Subscriber Traffic
Table 16 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Releases 12.2(27)SBA or later appear in the table.
Not all commands may be available in your Cisco IOS software release. For details on when support for specific commands was introduced, see the command reference documents.
If you are looking for information on a feature in this technology that is not documented here, see the "Intelligent Service Architecture Features Roadmap."
Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Table 16 Feature Information for Redirecting ISA Subscriber Traffic
Feature Name Software Releases Feature Configuration InformationISA: Flow Control: Flow Redirect
12.2(27)SBA
The ISA Layer 4 Redirect feature enables service providers to better control the user experience by allowing subscriber TCP or UDP packets to be redirected to specified servers for appropriate handling. ISA Layer 4 redirection can be applied to individual subscriber sessions or flows.
The following sections provide information about this feature:
•Information About Redirecting ISA Subscriber Traffic
Copyright © 2005 Cisco Systems, Inc. All rights reserved.
This module first published April 28, 2005. Last updated April 28, 2005.