Cisco ISG Design and Deployment Guide: ATM to ISG LNS Aggregation

Table Of Contents

Cisco ISG Design and Deployment Guide:
ATM to ISG LNS Aggregation

Designing ATM to ISG LNS Aggregation

Network Topology

Network Elements

CPE

DSLAM

LAC

LNS

PE

AAA Server for ISP-1

AAA Server for ISP-2

SESM

Billing Server

Network Design Options

Aggregation Technology

Routing Technology

QoS Strategy

Protocol Flow

Multiservice Service Bundle

Layer 3 VPN Access

Bandwidth on Demand

Prepaid Services

Deploying ATM to ISG LNS Aggregation

Deployment Model

Network Topology

Call Flows

Device Characteristics Table

Configuring the Network

Prerequisites

Baseline Configuration

Service Bundle Configurations

Verifying ATM to ISG LNS Aggregation

Basic Verification

Verification of Default BOD256K Service

show Command Output for BOD1MTIME Service

show Command Output for History of Service Changes

Clearing Statistics

Complete Running Configurations

CPE

LAC

ISG LNS

PE at ISP-2

AAA Server for ISP-1

AAA Server for ISP-2

Cisco ISG Design and Deployment Guide:
ATM to ISG LNS Aggregation

---

Version History

Version Number	Date	Notes
1	April 29, 2005	This document was created.

The Intelligent Service Architecture (ISA) is a Cisco IOS feature set that enables the provisioning and maintaining of broadband networks that have multiple types of edge devices, many subscribers, and many services. ISA combines real-time session and flow control with programmable, dynamic policy control to deliver flexible and highly scalable subscriber session management capabilities.

A Cisco device that is running a Cisco IOS image with ISA is called a Cisco Intelligent Service Gateway (ISG). A Cisco ISG is used to control subscriber access at the edge of an IP network. An ISG is deployed at network access control points, and subscribers access services through ISG. The role of ISA is to execute policies that identify and authenticate subscribers and provide access to the services that the subscriber is entitled to access.

This document describes how to leverage the capabilities of a Cisco ISG to simply network design and deployment. The network described in this document uses the Cisco 7206 and 7301 as ISGs, ATM as the aggregation technology, and L2TP tunnels to securely deliver traffic across the Internet. It enables ISPs to offer customers both basic Layer 3 VPN access and the advanced services known as Bandwidth on Demand and Prepaid Services.

This document contains the following sections:

•Designing ATM to ISG LNS Aggregation

•Deploying ATM to ISG LNS Aggregation

•Verifying ATM to ISG LNS Aggregation

•Complete Running Configurations

Designing ATM to ISG LNS Aggregation

The network described in this document uses the Cisco 7206 and 7301 as ISGs, ATM as the aggregation technology, and L2TP tunnels to securely deliver traffic across the Internet. The network involves two ISPs:

•ISP-1 offers wholesale service to other ISPs.

•ISP-2 contracts with ISP-1 to receive wholesale service, which it then offers to retail customers.

The motivation for deploying this network is an ISP's desire to broaden the flexibility of its digital subscriber line (DSL) deployments beyond traditional, static DSL service. Basic Layer 3 VPN access is established first. The following advanced ISA services are then deployed:

•Bandwidth on Demand—Enables subscribers to temporarily increase their upstream and downstream bandwidths. This increased bandwidth can be charged to the subscriber's account on either a duration or a volume basis.

•Prepaid Services—Enables subscribers to purchase short-term DSL access, using either time or volume limits.

The following sections describe the design of the network:

•Network Topology

•Network Elements

•Network Design Options

•Multiservice Service Bundle

Network Topology

Figure 1 shows a high-level network topology.

Figure 1 High-Level Topology

Network Elements

The following elements play key roles in the network:

•CPE

•DSLAM

•LAC

•LNS

•PE

•AAA Server for ISP-1

•AAA Server for ISP-2

•SESM

CPE

The customer premises equipment (CPE) router is a small router (such as the Cisco 800 series) that is used to initiate PPP over Ethernet (PPPoE) connections from the customer PC to the L2TP Access Concentrator (LAC).

DSLAM

The Digital Subscriber Line Access Multiplexer (DSLAM) aggregates multiple incoming DSL connections into a single ATM line. It is maintained by ISP-1 at a point-of-presence (POP) separate from the ISP's central network.

---

Note The configuration of the DSLAM will not be discussed in this document.

---

LAC

The L2TP Access Concentrator (LAC) is maintained by ISP-1 as part of its central network. It receives incoming sessions from the DSLAM and forwards them to the appropriate retail ISP (ISP-2 in this case) by establishing an L2TP tunnel with the ISG LNS. The LAC contacts ISP-1's AAA server to determine the forwarding information based on the domain name in the subscriber's username.

LNS

The ISG L2TP Network Server (LNS) terminates the L2TP tunnel from the LAC and the PPPoE session from the subscriber. It is maintained by ISP-2 on its central network. The ISG LNS authenticates the subscriber by contacting the AAA server for ISP-2 and assigns the subscriber a VPN routing/forwarding instance (VRF). The ISG LNS also communicates with the AAA server when the subscriber requests additional services.

PE

The provider edge (PE) router is responsible for maintaining VRF information. It is the final endpoint on the ISP's network that terminates the subscriber session. The ISP uses VRF to segment customers easily without having to specify different subnets for different classes of customers.

AAA Server for ISP-1

The AAA server for ISP-1 (known as AAA-1) maintains forwarding information for the retail ISPs. When queried by the LAC, it sends forwarding information based on the subscriber's domain name or username.

AAA Server for ISP-2

The AAA server for ISP-2 (known as AAA-2) maintains subscriber authentication information as well as information on the services available to subscribers. When the ISG LNS receives a subscriber's username and password, it forwards them to AAA-2 for authentication. When a subscriber activates a service, the ISG LNS contacts AAA-2. AAA-2 then replies with information about the service to the ISG LNS.

SESM

The Cisco Subscriber Edge Services Manager (SESM) provides service selection and connection management in broadband and mobile wireless networks. The Cisco SESM provides a web portal by which users access services. ISPs can customize the web portal to their needs.

---

Note Configuring the Cisco SESM is beyond the scope of this document. A detailed Installation and Configuration Guide for the Cisco SESM is at the following URL: http://www.cisco.com/univercd/solution/sesm/sesm_320/index.htm

---

Billing Server

The billing server maintains subscriber account information, including the amount of credit remaining for prepaid services. When subscribers initiate services, the ISG LNS contacts the billing server to determine if the subscriber has credit available.

Network Design Options

The following sections describe the various options that the ISP must consider in deploying the network:

•Aggregation Technology

•Routing Technology

•QoS Strategy

Aggregation Technology

ISA currently supports ATM for use as the aggregation technology.

Routing Technology

In all cases the DSLAM delivers traffic to the first ISG using an ATM permanent virtual circuit (PVC). When designing the network, you have three basic choices for how to deliver traffic from the ISG at the wholesale ISP to the retail ISP:

•IP routed—Traffic is IP-routed from the ISG to the retail ISP.

•PPP terminated—The DSLAM delivers traffic to the ISG using PPPoE. The ISG terminates the PPPoE and then IP routes traffic to the retail ISP.

•L2TP tunneled—The DSLAM delivers traffic to the ISG using PPPoE. The ISG then establishes an L2TP tunnel with an LNS at the retail ISP. The LNS terminates the PPPoE, and IP is used to route the traffic in the retail ISP's network. Using an L2TP tunnel offers the advantage that it can support both ATM and Gigabit Ethernet as the aggregation technology.

The network deployed in this document uses the L2TP tunneled method.

QoS Strategy

Figure 2 shows all of the interfaces in the network where quality of service (QoS) could potentially be configured, where "Up" refers to the upstream interface between the two devices, and "Dw" refers to the downstream interface. The interfaces in bold are where QoS is configured for this deployment.

Figure 2 QoS Interfaces

Table 1 describes the QoS strategy that is deployed on each of the interfaces shown in Figure 2.

Table 1 QoS Strategy

Interface	Device	Traffic Origin	Traffic Destination	QoS Strategy
2Up	LAC	CPE	LAC	Virtual circuit (VC) shaping parameters are defined by a domain profile on AAA-1 using the Dynamic Bandwidth Selection (DBS) feature.
2Dw	LAC	LAC	CPE	VC shaping parameters are defined by a domain profile on AAA-1 using the DBS feature.
3Up	LAC	LAC	ISG LNS	All traffic is reclassified as best effort (DiffServ Code Point (DSCP) is set to 0).
4Up	ISG LNS	LAC	ISG LNS	Multiple Bandwidth on Demand services are defined on AAA-2 using the QU attribute.
4Dw	ISG LNS	ISG LNS	LAC	Multiple Bandwidth on Demand services are defined on AAA-2 using the QD attribute.
5Up	ISG LNS	ISG LNS	PE	Upstream traffic is marked as the default service, MPLS EXP 0 by the service policy governing the outbound Gigabit Ethernet interface.

Protocol Flow

PPP is tunneled from the LAC to the ISG LNS. At the ISG LNS, the PPP session is terminated, and the encapsulated IP session is routed on through the ISP's network. The identity of the customer is uniquely maintained only by the PPP session. Figure 3 shows how the PPP session is routed across the network.

Figure 3 Network Protocol Flow

Figure 4 shows all of the protocols that are active at each device in the network.

Figure 4 Network Protocol Stacks

Multiservice Service Bundle

Because of the large number of features available for ISA services, the design and deployment guides group the features into service bundles. For this deployment, the Multiservice service bundle will be deployed. It consists of the features described in the following section:

•Layer 3 VPN Access

•Bandwidth on Demand

•Prepaid Services

Layer 3 VPN Access

All ISPs that deploy ISA services begin with Layer 3 VPN access. In this network, this consists of basic DSL connectivity. Subscribers establish Layer 2 access connections over a Layer 3 VPN technology—in this case, an Multiprotocol Label Switching (MPLS) VPN. Subscriber bandwidth for basic Layer 3 VPN access is capped at 128 kbps upstream and 256 kbps downstream.

Bandwidth on Demand

The Bandwidth on Demand feature enables subscribers to temporarily increase their upstream and downstream bandwidths for either a set duration of time or volume of bandwidth. Subscribers first establish basic connectivity with a default cap on bandwidth and then access a website (maintained by the Cisco SESM) where they trigger a request for the Bandwidth on Demand. The ISP authorizes the subscriber for the service and bills the subscriber's account. The service remains active until either the subscriber deactivates the service or the subscriber terminates the session.

Prepaid Services

The Prepaid Services feature provides the same service to the subscriber as the Bandwidth on Demand feature. Subscribers access a website (maintained by the Cisco SESM) to increase their bandwidth. The difference between the two features is in how they are billed. The Bandwidth on Demand feature is charged against the subscriber account, which the subscriber pays later, after service is rendered. For Prepaid Services, subscribers pay into their accounts before the service is initiated. When a subscriber activates the service, the billing server charges the subscriber's account either for the time the service is active or for the bandwidth the subscriber uses. The service remains active until either the subscriber's account is depleted or the subscriber deactivates the service or terminates the session.

Deploying ATM to ISG LNS Aggregation

The following sections describe how to deploy the ATM to ISG LNS aggregation network:

•Deployment Model

•Configuring the Network

•Verifying ATM to ISG LNS Aggregation

Deployment Model

The following sections describe the deployment model on which the network is based:

•Network Topology

•Call Flows

•Device Characteristics Table

In this deployment, the subscriber's PC connects to CPE, which initiates a PPPoE session to the LAC (maintained by ISP-1) across either an ATM or a DSL network. The LAC then establishes an L2TP tunnel with the ISG LNS (maintained by ISP-2), and forwards the PPPoE session to the LNS. The LNS assigns the subscriber a VRF and assigns the subscriber the default service, which is a capped bandwidth of 256 kbps. The following advanced ISA services are then available to the subscriber:

•BOD1MVOLUME—1 Mbps downstream, 256 kbps upstream

•BOD1MTIME—1 Mbps downstream, 256 kbps upstream

•BOD2MVOLUME—2 Mpbs downstream, 512 kbps upstream

•BOD2MTIME—2 Mbps downstream, 512 kbps upstream

For time-based service, subscribers are billed according to the length of time that the service is active. For volume-based service, subscribers are billed accordign to the amount of bandwidth they use.

---

Note In this deployment, subscribers will not be able to switch from a time-based prepaid service to a volume-based prepaid service or vice versa. In this deployment, subscribers have access to both time-based and volume-based services. This is done to describe the full range of ISA services available. Typically, ISPs will only deploy either time-based or volume-based services for subscribers, but not both simultaneously.

---

Network Topology

Figure 5 shows the network topology of this deployment.

Figure 5 Network Topology

Call Flows

The following call flows describe the operation of the network:

•Basic Layer 3 VPN Access Call Flow

•Prepaid Service Call Flow

Basic Layer 3 VPN Access Call Flow

Figure 6 shows the call flow process of establishing basic Layer 3 VPN access. Every subscriber session begins with this process before initiating advanced ISA services.

Figure 6 Layer 3 VPN Access Call Flow

The following describes the sequence of events in Figure 6:

1. The subscriber initiates a PPPoE connection from the PC to the LAC by way of the CPE.

2. The PC and the LAC establish a PPP connection.

3. The LAC contacts the AAA-1 server to retrieve domain authentication information for L2TP.

4. The LAC establishes an L2TP tunnel with the ISG LNS. This step is necessary only if an L2TP tunnel does not already exist.

5. The LAC forwards the subscriber PPP session and associated information to the ISG LNS.

6. The ISG LNS contacts the AAA-2 server to authenticate the subscriber. Once the subscriber is authenticated, the ISG LNS clones a virtual-access interface from the virtual template.

7. The ISG LNS sends a CHAP response to the subscriber. The IP Control Protocol (IPCP) negotiation is performed, and the route to the ISG LNS is installed. The PPP session now runs between the subscriber and the ISG LNS, while the ISG forwards the PPP traffic over the L2TP tunnel.

8. The ISG LNS sends an accounting start message to the AAA-2 server.

9. The subscriber and the ISG LNS use IPCP to negotiate the link details, including the IP address. IPCP is responsible for configuring, enabling, and disabling the IP protocol modules on both ends of the PPP link. IPCP uses the same packet exchange mechanism as the Link Control Protocol (LCP). IPCP packets may not be exchanged until PPP has reached the Network-Layer Protocol phase.

Prepaid Service Call Flow

Figure 7 shows the call flow process that occurs when a subscriber initiates prepaid services.

Figure 7 Prepaid Services Call Flow

The following describes the sequence of events shown in Figure 7:

1. The subscriber selects the BOD1MTIME service on the Cisco SESM web interface.

2. The Cisco SESM sends an Access-Request message to the ISG LNS for the subscriber's information.

3. The ISG LNS replies to the Cisco SESM with an Access-Accept message containing the subscriber's information.

4. The Cisco SESM sends an Access-Request message to the ISG LNS requesting information on the BOD1MTIME service.

5. The ISG LNS sends an Access-Request message to the AAA-2 server requesting information on the BOD1MTIME service.

6. The AAA-2 server replies to the ISG LNS with an Access-Accept message containing the traffic class, the BOD1MTIME profile, and the prepaid configuration.

7. The ISG LNS sends an Access-Accept message to the AAA-2 server containing the details of the BOD1MTIME service.

8. The ISG LNS sends an Access-Request message to the billing server, notifying it that the subscriber has initiated the BOD1MTIME service.

9. The billing server replies with an Access-Accept message that authorizes the subscriber for a set quota of time.

10. The ISG LNS sends an accounting request to the billing server with the subscriber's username and an event time stamp.

11. When the subscriber quota is depleted, the ISG LNS sends a reauthorization request to renew the quota.

12. The billing server reauthorizes the subscriber and sends a renewed quota to the ISG LNS.

Steps 8 through 12 are repeated until either the subscriber terminates the BOD1MTIME service or the subscriber runs out of quota on the billing server.

Device Characteristics Table

Table 2 describes details of the devices in the network.

Table 2 Device Characteristics

Device	Platform	Software	Interfaces
CPE	Cisco 837	12.3(2)XC2	1 Ethernet 4 FastEthernet 1 ATM/DSL
LAC	Cisco 7206 or Cisco 7301	12.2(27)SBA	2 FastEthernet 3 Gigabit Ethernet 2 ATM
ISG LNS	Cisco 7206 or Cisco 7301	12.2(27)SBA	2 FastEthernet 3 Gigabit Ethernet
PE	Cisco 6509	12.2(18)SXD1	1 FastEthernet 5 Gigabit Ethernet
AAA for ISP1	UNIX server	CAR	—
AAA for ISP2	UNIX Server	CAR	—

Configuring the Network

The configuration of this deployment is divided into the following sections:

•Prerequisites

•Baseline Configuration

•Service Bundle Configurations

Prerequisites

Before the ISA configuration begins, the following baseline network operations must be configured:

•Basic IP connectivity must be established across the entire network

•L2TP must be configured between the ISG LAC and LNS

•Subscribers must be able to establish a PPPoE connection over the L2TP tunnel to the LNS.

Network administrators should be familiar with the following topics:

•CAR configuration procedure: http://www.cisco.com/univercd/cc/td/doc/product/rtrmgmt/cnsar/3_5/install/config.htm

•CNR configuration procedure: http://www.cisco.com/en/US/products/sw/netmgtsw/ps1982/products_user_guide_book09186a008022745c.html

•Basic broadband (PPP and L2TP) configuration:

–http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca72a.html

–http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_configuration_guide_chapter09186a00800ca724.html

–http://www.cisco.com/en/US/partner/tech/tk801/tk703/technologies_configuration_example09186a0080093c2a.shtml

Baseline Configuration

The following devices are configured to enable baseline network operation. The baseline configuration establishes basic connectivity across the network and enables the subscriber to establish basic Layer 3 VPN access.

•CPE

•LAC

•ISG LNS

•PE

•AAA Server for ISP-1

•AAA Server for ISP-2

CPE

The following baseline configuration tasks are performed on the CPE:

•Configuring the Ethernet Interface and DHCP

•Configuring the Outbound Interface

•Configuring the Dialer Interface and NAT

Configuring the Ethernet Interface and DHCP

Interface Ethernet 0 is configured to connect to the subscriber PC, and DHCP is enabled for incoming sessions.

interface Ethernet0

 ip address 10.10.10.1 255.255.255.0

 ip nat inside

 load-interval 30

 no cdp enable

 hold-queue 100 out

!

ip dhcp excluded-address 10.10.10.1

!

! DHCP configuration for interface Ethernet 0 subscribers

ip dhcp pool CLIENT 

   import all

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.1 

   lease 0 2

Configuring the Outbound Interface

ATM interface 0.6 is configured as a PVC. This is the outbound interface from the CPE to the DSLAM.

interface ATM0.6 point-to-point

! This is the PVC which is going to the ATM DSLAM

  pvc 6/46 

  encapsulation aal5snap

! This associates the PVC with dialer 1

  pppoe-client dial-pool-number 1

Configuring the Dialer Interface and NAT

Dialer interface 1 is configured to receive incoming connections from the subscriber. CHAP is used for the CPE's username and password, and NAT is enabled for outbound traffic.

interface Dialer1

 ip address negotiated

 ip nat outside 

! using PPP

 encapsulation ppp 

 ip route-cache flow

 dialer pool 1

 no cdp enable

!The username and password are set for CHAP

 ppp chap hostname cpe6_1@isp.com

 ppp chap password 7 060A0E23

!

! Enables subscribers on the inside of E0 to access outside using NAT

ip nat inside source list 1 interface Dialer1 overload 

!

ip classless

! set the default gateway out the dialer 1 interface

ip route 0.0.0.0 0.0.0.0 Dialer1 

!

! allow E0 subscribers to be NAT translated

access-list 1 permit 10.10.10.0 0.0.0.255 

! refers to ACL 1

dialer-list 1 protocol ip permit 

no cdp run

LAC

The following baseline configuration tasks are performed on the LAC:

•Configuring AAA and the Connection to the RADIUS Server

•Configuring the Connection to the ISG LNS and PPPoE

Configuring AAA and the Connection to the RADIUS Server

A basic AAA configuration is entered, and the connection to the RADIUS server is configured, including vendor specific attribute (VSA) accounting and authentication.

aaa new-model 

!

aaa authentication login default none

! setup RADIUS server for authentication

aaa authentication ppp default group radius local 

aaa authorization network default group radius local 

aaa accounting network default start-stop group radius

!

!

aaa session-id common

!

interface Loopback0

 ip address 10.200.1.49 255.255.255.255

!

! Use Loopback 0 to communicate with radius server

ip radius source-interface Loopback0 

!

!

radius-server host 10.100.1.35 auth-port 1812 acct-port 1813 key Cisco 

radius-server vsa send accounting

radius-server vsa send authentication

Configuring the Connection to the ISG LNS and PPPoE

The connection to the ISG LNS is configured. The LAC uses VPDN to initiate L2TP tunnels to the ISG LNS, which are used to carry the subscriber PPPoE sessions. An ISA control policy map is used to instruct L2TP to authenticate on the basis domain name, and a BBA group is used to configure PPPoE.

no ip dhcp use vrf connected

!

subscriber policy recording rules limit 64

subscriber access pppoe pre-authorize nas-port-id default

subscriber authorization enable

! Enables VPDN globally, which is used for PPPoE.

vpdn enable 

vpdn ip udp ignore checksum

vpdn search-order domain 

!

no mpls traffic-eng auto-bw timers frequency 0

call rsvp-sync

!

!

!

! This control policy map instructs L2TP to authenticate based on domain name.

policy-map type control RULE_L2TP_LM_ATM5

 class type control always event session-start

  1 collect identifier unauthenticated-domain

  2 authorize identifier unauthenticated-domain

!

!

! The BBA group method is used to configure PPPoE (alternatively, the vpdn-group

! method could be used).

bba-group pppoe BBA_LM_ATM5

 virtual-template 5

 sessions auto cleanup

!

! This virtual circuit (VC) class is applied to the ATM PVC.

vc-class atm VC_LM_ATM5

! Associates the VC class with the above bba-group.

  protocol pppoe group BBA_LM_ATM5 

! Enables dynamic bandwidth selection.

  dbs enable maximum 

  encapsulation aal5snap

! Applies the L2TP rule above to the VC class.

  service-policy type control RULE_L2TP_LM_ATM5

!

! Interface Gigabit Ethernet 0/3 points to the LNS.

interface GigabitEthernet0/3

 ip address 180.49.1.49 255.255.255.0

! The port bundle host key (PBHK) feature is enabled on the interface.

 ip portbundle outside

 ip flow ingress

 load-interval 30

 duplex full

 speed 1000

 media-type gbic

 negotiation auto

!

!

interface ATM2/0.101 point-to-point

 ip flow ingress

 no atm enable-ilmi-trap

 pvc 106/46 

! The VC class is associated with the PVC.

  class-vc VC_LM_ATM5

! This can be changed to restrict PPPoE sessions on the PVC.

  pppoe max-sessions 1 

!

!

! The PPP CHAP configuration is entered on the virtual template.

interface Virtual-Template5

 no ip address

 no peer default ip address

 no keepalive

 ppp authentication chap

 ppp timeout aaa

ISG LNS

The following baseline configuration tasks are performed on the ISG LNS:

•Configuring AAA and the Connection to the RADIUS Server

•Configuring PPPoE and the Connection to the LAC

•Configuring Inbound and Outbound Access Lists

Configuring AAA and the Connection to the RADIUS Server

In this AAA configuration, connections to the AAA server, the Cisco SESM, and two billing servers are configured. VSA accounting and authentication are enabled, and the loopback interface 0 is used for AAA communications.

aaa new-model

!

! Configures the AAA server group for the CAR AAA server.

aaa group server radius CAR_SERVER

 server 10.100.2.36 auth-port 1812 acct-port 1813

!

! Configures the AAA server group for the RSIM_SERVER billing server.

aaa group server radius RSIM_SERVER

 server 10.100.6.88 auth-port 1645 acct-port 1646

!

! Configures the AAA server group for the MIND_SERVER billing server.

aaa group server radius MIND_SERVER

 server 10.100.11.86 auth-port 1645 acct-port 1646

! Configures AAA for the CAR AAA server.

aaa authentication login default none

aaa authentication login IP_AUTHEN_LIST group CAR_SERVER

aaa authentication ppp default group CAR_SERVER

! The following commands configure authentication, authorization, and accounting for the

! CAR AAA server and the two billing servers.

aaa authentication ppp PREPAID_MIND group MIND_SERVER

aaa authentication ppp PREPAID_AUTHEN_LIST group RSIM_SERVER 

aaa authorization network default group CAR_SERVER 

aaa authorization network PREPAID_MIND group MIND_SERVER 

aaa authorization network PREPAID_AUTHOR_LIST group RSIM_SERVER 

aaa authorization subscriber-service default local group radius 

aaa accounting network default start-stop group CAR_SERVER

aaa accounting network PREPAID_MIND start-stop group MIND_SERVER

aaa accounting network PREPAID_ACCNT_LIST start-stop group RSIM_SERVER

! Configures the connection to the Cisco SESM

aaa server radius sesm

 client 10.100.4.38

 key cisco

 port 1812

 message-authenticator ignore

!

! Loopback 0 is used for communicating with AAA, the billing servers, and SESM.

interface Loopback0

 ip address 10.200.1.55 255.255.255.255

 ip router isis Remote_ISP

! Instructs the router to use loopback 0 to communicate with the AAA RADIUS servers.

ip radius source-interface Loopback0

!

! These RADIUS attributes are required for prepaid services.

radius-server attribute 44 include-in-access-req

radius-server attribute 8 include-in-access-req

radius-server attribute 55 include-in-acct-req

radius-server attribute 55 access-request include

radius-server attribute 25 access-request include

! The CAR AAA server.

radius-server host 10.100.2.36 auth-port 1812 acct-port 1813 key Cisco

! The RSIM_SERVER billing server.

radius-server host 10.100.6.88 auth-port 1645 acct-port 1646 key Cisco

! The MIND_SERVER billing server.

radius-server host 10.100.11.86 auth-port 1645 acct-port 1646 key Cisco

radius-server retransmit 5

radius-server key cisco

radius-server vsa send accounting

radius-server vsa send authentication

Configuring PPPoE and the Connection to the LAC

VPDN is configured to receive L2TP tunnels from the LAC over which the PPPoE sessions are sent. A DHCP pool and MPLS virtual routing forwarding (VRF) tables are created for incoming subscribers.

no ip dhcp use vrf connected

!

! Globally enables MPLS VRFs for incoming subscribers.

ip vrf VPN11006 

 rd 200:6

 route-target export 200:6

 route-target import 200:6

!

!

ip cef

!

vpdn enable

vpdn ip udp ignore checksum

!

! VPDN group 1 terminates PPPoE clients that come in from the LAC over L2TP tunnels.

vpdn-group 1

 accept-dialin

  protocol l2tp

  virtual-template 5

 terminate-from hostname sp_lac

 local name sp_lns

 l2tp tunnel password 0 lab

!

!

interface Loopback1

 ip vrf forwarding VPN11006

 ip address 100.6.6.6 255.255.255.255

!

! Gigabit Ethernet interface 0/3 points to the ISG LNS.

interface GigabitEthernet0/3

 ip address 22.22.1.55 255.255.255.0

! The PBHK feature is enabled on this interface.

 ip portbundle outside

 ip flow ingress

 ip router isis Remote_ISP

 load-interval 30

 duplex full

 speed 1000

 media-type gbic

 negotiation auto

 mpls mtu 1522

 mpls label protocol ldp

 mpls ip

 no keepalive

!

! PPPoE subscribers terminated from L2TP tunnels use this virtual template.

interface Virtual-Template5

 no ip address

 load-interval 30

 no peer default ip address

 no keepalive

 ppp mtu adaptive

 ppp authentication chap

! Applies this policy map to PPPoE subscribers.

 service-policy type control RULE_PPP_ATM5

!         

! The DHCP pool that is assigned to subscribers.

ip local pool cpe6_pool-53 200.53.6.2 200.53.6.254

!

Configuring Baseline ISA Subscriber Services

Basic ISA subscriber services are configured, including Layer 4 redirect to the Cisco SESM and the PBHK feature. When the port bundle host key (PBHK) feature is enabled, TCP packets from subscribers are mapped to a local IP address for the ISA gateway and a range of ports. This mapping allows the portal to identify the ISA gateway from which the session originated. Also, the default service, BOD256K_CLASS is configured, which limits subscribers bandwidth to 256 kbps.

! Configures the connection to the Cisco SESM for Layer 4 Redirect functionality.

redirect server-group SESM-Server 

 server ip 10.100.4.38 port 8080

!

!

! Creates the class map BOD256K_CLASS, which is the default service applied to all

! subscribers.

class-map type control match-any BOD256K_CLASS

 match service-name BOD256K 

!

 class type control BOD256K_CLASS event service-start

  1 service-policy type service identifier service-name

!

! Applies PBHK to all subscribers so they can access the Cisco SESM.

 class type control always event session-start

  1 service local

  2 service-policy type service name PBHK_SERVICE

!

! If both the quota from the billing server and idle time equal zero, the connection is

! dropped.

 class type control always event quota-depleted 

  1 set-param drop-traffic FALSE

!

! If the quota from the billing server equals zero, but the idle time is greater than

! zero, Layer 4 redirect is activated.

 class type control always event credit-exhausted

  1 service-policy type service name L4REDIRECT_SERVICE

!

! Enables port bundle host key (PBHK) access to the Cisco SESM.

ip portbundle

 match access-list 110

! The Loopback 0 interface is used to communicate with the Cisco SESM.

 source Loopback0

Configuring Inbound and Outbound Access Lists

Basic access lists are configured to govern subscribers' Internet access, and an access list is created for the PBHK feature.

! This access list is referenced in the AAA subscriber profile. It governs incoming

! Internet traffic.

ip access-list extended Internet-in-acl 

 deny   ip any 223.0.0.0 0.255.255.255

 deny   ip any 20.0.0.0 0.255.255.255

 deny   ip any 40.0.0.0 0.255.255.255

 deny   ip any 21.0.0.0 0.255.255.255

 deny   ip any 22.0.0.0 0.255.255.255

 deny   ip any 41.0.0.0 0.255.255.255

 deny   ip any 80.0.0.0 0.255.255.255

 deny   ip any 81.0.0.0 0.255.255.255

 deny   ip any 82.0.0.0 0.255.255.255

 deny   ip any 10.200.0.0 0.0.255.255

 permit ip any any

! This access list is called out in the AAA subscriber profile. It governs outgoing

! Internet traffic. 

ip access-list extended Internet-out-acl

 deny   ip 223.0.0.0 0.255.255.255 any

 deny   ip 10.200.0.0 0.0.255.255 any

 deny   ip 20.0.0.0 0.255.255.255 any

 deny   ip 40.0.0.0 0.255.255.255 any

 deny   ip 21.0.0.0 0.255.255.255 any

 deny   ip 22.0.0.0 0.255.255.255 any

 deny   ip 41.0.0.0 0.255.255.255 any

 deny   ip 80.0.0.0 0.255.255.255 any

 deny   ip 81.0.0.0 0.255.255.255 any

 deny   ip 82.0.0.0 0.255.255.255 any

 permit ip any any

!

access-list 101 permit ip any any

! This access list is used in the ip portbundle configuration above.

access-list 110 permit ip any any

access-list 111 deny   tcp any host 10.100.4.38 eq www

access-list 111 deny   tcp any host 10.100.4.38 eq 8080

access-list 111 permit tcp any any eq www

PE

The PE is configured to assign subscribers to a VRF and to allow subscribers to access the Cisco SESM.

! The VRF that subscribers are assigned to.

ip vrf VPN11006

 rd 200:6

 route-target export 200:6

 route-target import 200:6

!

!

router bgp 200

 no synchronization

 bgp router-id 10.200.1.43

 bgp log-neighbor-changes

 network 10.100.2.0 mask 255.255.255.0

 network 10.200.1.43 mask 255.255.255.255

 network 24.7.1.0 mask 255.255.255.0

 network 83.83.1.0 mask 255.255.255.0

 network 84.1.1.0 mask 255.255.255.0

 network 84.2.1.0 mask 255.255.255.0

 network 84.3.1.0 mask 255.255.255.0

 network 84.4.1.0 mask 255.255.255.0

 neighbor 10.200.1.47 remote-as 200

 neighbor 10.200.1.47 ebgp-multihop 10

 neighbor 10.200.1.47 update-source Loopback0

 no auto-summary

!

! Enables BGP VPNv4 neighbors

 address-family vpnv4

 neighbor 10.200.1.47 activate

 neighbor 10.200.1.47 send-community extended

 exit-address-family

!        

!

! Allows VRF routes into the BGP routing table.

 address-family ipv4 vrf VPN11006

 redistribute connected

 redistribute static

 no auto-summary

 no synchronization

 exit-address-family

!

!

! Creates an IP route for subscribers in VRF VPN11006 to access the Cisco SESM.

ip route vrf VPN11006 10.100.4.38 255.255.255.255 Vlan6 10.100.4.38

AAA Server for ISP-1

The following baseline configuration tasks are performed on the AAA server for ISP-1:

•Configuring the Connection to the LAC

•Configuring L2TP Forwarding from the LAC to the ISG LNS

Configuring the Connection to the LAC

This profile allows the LAC router access to the AAA CAR server. The IP address 10.200.1.49 is the address of the loopback interface on the LAC.

--> cd ie2-c7206-ge

[ //localhost/Radius/Clients/ie2-C7206-GE ]

    Name = ie2-C7206-GE

    Description = 

    IPAddress = 10.200.1.49

    SharedSecret = cisco

    Type = NAS

    Vendor = 

    IncomingScript~ = 

    OutgoingScript~ = 

    EnablePOD = FALSE

Configuring L2TP Forwarding from the LAC to the ISG LNS

This profile and the corresponding attributes instruct the LAC to establish an L2TP tunnel to the ISG LNS, based on the "@isp.com" portion of the username. The IP address 10.200.1.55 is the address of the loopback interface on the ISG LNS.

--> cd isp.com

[ //localhost/Radius/UserLists/SESMServices/isp.com ]

    Name = isp.com

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVpair = vpdn:tunnel-id=sp_lac

    Cisco-AVpair = vpdn:l2tp-tunnel-password=lab

    Cisco-AVpair = vpdn:tunnel-type=l2tp

    Cisco-AVpair = vpdn:ip-addresses=10.200.1.55

    Cisco-AVpair = atm:peak-cell-rate=3000

    Cisco-AVpair = atm:sustainable-cell-rate=3000

    idle-timeout = 86400

AAA Server for ISP-2

The following baseline configuration tasks are performed on the AAA server for ISP-2:

•Configuring the Connection to the ISG LNS

•Configuring the Connection to the Cisco SESM

•Configuring Layer 4 Redirect

•Configuring PBHK

•Configuring the Subscriber's Default PPP Profile

Configuring the Connection to the ISG LNS

This profile allows the ISG LNS to have access to the AAA CAR server.

--> cd ie2-c7206-lns

[ //localhost/Radius/Clients/ie2-C7206-LNS ]

    Name = ie2-C7206-LNS

    Description = 

    IPAddress = 10.200.1.55

    SharedSecret = cisco

    Type = NAS

    Vendor = 

    IncomingScript~ = 

    OutgoingScript~ = 

    EnablePOD = FALSE

Configuring the Connection to the Cisco SESM

This profile connects the AAA CAR server to the Cisco SESM.

--> cd ie2-sesm-1b

[ //localhost/Radius/Clients/ie2-SESM-1b ]

    Name = ie2-SESM-1b

    Description = 

    IPAddress = 10.100.4.38

    SharedSecret = cisco

    Type = NAS

    Vendor = 

    IncomingScript~ = 

    OutgoingScript~ = 

    EnablePOD = FALSE

Configuring the Baseline ISA Subscriber Services

This profile and the following attributes specify the ISA subscriber services that are allowed.

--> cd cpe6_1@isp.com

[ //localhost/Radius/UserLists/SESMSubscribers/cpe6_1@isp.com ]

! Specifies the username that the CPE uses.

    Name = cpe6_1@isp.com 

    Description = 

! This password must match the one configured on the CPE.

    Password = <encrypted> 

    Enabled = TRUE

    Group~ = 

! Specifies the name of the PPP profile.

    BaseProfile~ = Default-PPP-Users

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

! Assigns subscribers to vrf VPN11006.

    Cisco-AVpair = "lcp:interface-config=ip vrf forwarding VPN11006" 

    Cisco-AVpair = "lcp:interface-config=ip unnumbered loopback 1" 

! Assigns an address to this DHCP pool on the LNS.

    Cisco-AVpair = ip:addr-pool=cpe6_pool-53 

! The "A" in front of BOD256K designates autologin, which means that the default service

! is BOD256k.

    Cisco-SSG-Account-Info = ABOD256K 

    Cisco-SSG-Account-Info = NBOD256K 

! Specifies the other services that the subscriber is allowed to access.

    Cisco-SSG-Account-Info = NBOD1MTIME 

    Cisco-SSG-Account-Info = NBOD2MTIME

    Cisco-SSG-Account-Info = NBOD1MVOLUME

    Cisco-SSG-Account-Info = NBOD2MVOLUME

! Specifies the total session timeout value (optional).

    Session-Timeout = 86400 

This profile and the following attributes configure the default service, BOD256K.

--> cd bod256k

[ //localhost/Radius/UserLists/SESMServices/BOD256K ]

! This service is not a prepaid service because there is no "prepaid-config" line.

    Name = BOD256K 

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-SSG-Service-Info = IBOD256K 

    Cisco-SSG-Service-Info = QU;128000;8000;8000;D;256000;16000;16000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

Configuring Layer 4 Redirect

This attribute enables the Layer 4 Redirect feature.

[ Attributes ]

! Instructs Layer 4 redirect to send traffic to ACL 111 on the ISG LNS.

    Cisco-AVPair = "ip:l4redirect=redirect list 111 to group SESM-Server duration 30 
frequency 180"

Configuring PBHK

This profile and the following attribute enable the PBHK feature on the AAA server, which enables access to the SESM by way of the PBHK feature.

--> cd pbhk_service

[ //localhost/Radius/UserLists/SESMServices/PBHK_SERVICE ]

    Name = PBHK_SERVICE

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = ip:portbundle=enable

Configuring the Subscriber's Default PPP Profile

This profile and the following attributes configure the PPP profile that is used in the subscriber's base profile.

--> cd default-ppP-users/ 

[ //localhost/Radius/Profiles/default-PPP-users ]

    Name = default-PPP-users

    Description = 

    Attributes/

--> ls attributes/

[ Attributes ]

    Ascend-Idle-Limit = 1800

    Framed-MTU = 1500

    Framed-Protocol = PPP

    Framed-Routing = None

! Configures the length of the idle timeout on PPP sessions, after which the session is

! dropped.

    Idle-timeout = 180 

    Service-Type = Framed

Service Bundle Configurations

The following devices are configured to enable the advanced ISA subscriber services:

•ISG LNS

•AAA Server for ISP-2

ISG LNS

The following configuration tasks are performed on the ISG LNS to enable the advanced ISA subscriber services:

•Configuring the Global Prepaid Services Configuration

•Reconfiguring the BOD256K Service

•Configuring the BOD1MTIME Service

•Configuring the BOD2MTIME Service

•Configuring the BOD1MVOLUME Service

•Configuring the BOD2MVOLUME Service

Configuring the Global Prepaid Services Configuration

The global attributes of the prepaid services are configured for each of the two billing servers.

! This is the global configuration for the PREPAID_RSIM prepaid billing server.

subscriber feature prepaid PREPAID_RSIM 

   threshold time 10 seconds

   threshold volume 1000 bytes

   interim-interval 3 minutes

! References the authorization list in the above AAA configuration.

   method-list author PREPAID_AUTHOR_LIST 

! References the accounting list in the above AAA configuration.

   method-list accounting PREPAID_ACCNT_LIST 

! This is the prepaid password that is configured on the billing servers.

   password prepaidcisco

! This is the global configuration for the PREPAID_MIND prepaid billing server.

subscriber feature prepaid PREPAID_MIND 

   threshold time 10 seconds

   threshold volume 1000 bytes

   interim-interval 3 minutes

   method-list author PREPAID_MIND

   method-list accounting PREPAID_MIND

   password prepaidcisco

!

subscriber policy recording rules limit 64

Reconfiguring the BOD256K Service

The control class for the BOD256K service is reconfigured, so that when it is initiated, the other services are unapplied.

 class type control BOD256K_CLASS event service-start

  1 service-policy type service unapply name BOD1MVOLUME

  2 service-policy type service unapply name BOD2MVOLUME

  3 service-policy type service unapply name BOD1MTIME

  4 service-policy type service unapply name BOD2MTIME

  5 service-policy type service identifier service-name

Configuring the BOD1MTIME Service

To configure the additional services, each service is first defined by creating a control class map. Then instructions on how to start and stop the service are configured as class controls.

! This control class map defines the BOD1MTIME_CLASS service.

class-map type control match-any BOD1MTIME_CLASS

 match service-name BOD1MTIME 

!

! When subscribers start the service, the other services are unapplied.

 class type control BOD1MTIME_CLASS event service-start

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BOD2MTIME

  3 service-policy type service identifier service-name

!

! When subscribers stop the service, it is unapplied, and the default BOD256K service is

! reapplied.

 class type control BOD1MTIME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

Configuring the BOD2MTIME Service

The same method is used to configure the BOD2MTIME service.

class-map type control match-any BOD2MTIME_CLASS

 match service-name BOD2MTIME 

!

 class type control BOD2MTIME_CLASS event service-start

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BOD1MTIME

  3 service-policy type service identifier service-name

!

 class type control BOD2MTIME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

Configuring the BOD1MVOLUME Service

The same method is used to configure the BOD1MVOLUME service.

class-map type control match-any BOD1MVOLUME_CLASS

 match service-name BOD1MVOLUME 

class type control BOD1MVOLUME_CLASS event service-start

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BOD2MVOLUME

  3 service-policy type service identifier service-name

!

 class type control BOD1MVOLUME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

Configuring the BOD2MVOLUME Service

The same method is used to configure the BOD2MVOLUME service.

class-map type control match-any BOD2MVOLUME_CLASS

 match service-name BOD2MVOLUME 

!

 class type control BOD2MVOLUME_CLASS event service-start

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BOD1MVOLUME

  3 service-policy type service identifier service-name

!

 class type control BOD2MVOLUME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

AAA Server for ISP-2

The following configuration tasks are performed on the AAA server for ISP-2 to enable the advanced ISA subscriber services:

•Configuring the BOD1MTIME Service

•Configuring the BOD2MTIME Services

•Configuring the BOD1MVOLUME Service

•Configuring the BOD2MVOLUME Service

•Configuring Layer 4 Redirect for when Quotas Run Out

Configuring the BOD1MTIME Service

The following profile and attributes configure the BOD1MTIME service.

--> cd bod1mtime

[ //localhost/Radius/UserLists/SESMServices/BOD1MTIME ]

    Name = BOD1MTIME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

! Identifies the service as a prepaid service and references the PREPAID_RSIM global

! configuration on the ISG LNS.

    Cisco-AVPair = prepaid-config=PREPAID_RSIM

! The name of the service on the SESM is BOD1MTIME. The "I" instructs RADIUS that this

! attribute is specifying a service named "BOD1MTIME."

    Cisco-SSG-Service-Info = IBOD1MTIME

! Configures QoS policing, where Q indicates that QoS is applied, U is the upstream rates,

! and D is the downstream rates. Three rates are configured for both upstream and

! downstream rates: the committed rate, the normal burst rate, and the excess burst rate

! respectively.

    Cisco-SSG-Service-Info = QU;256000;16000;16000;D;1000000;64000;64000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

Configuring the BOD2MTIME Services

The following profile and attributes configure the BOD2MTIME service.

--> cd bod2mtime

[ //localhost/Radius/UserLists/SESMServices/BOD2MTIME ]

    Name = BOD2MTIME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-AVPair = prepaid-config=PREPAID_RSIM

    Cisco-SSG-Service-Info = IBOD2MTIME

    Cisco-SSG-Service-Info = QU;512000;32000;32000;D;2000000;128000;128000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

Configuring the BOD1MVOLUME Service

The following profile and attributes configure the BOD1MVOLUME service.

--> cd bod1mvolUME/

[ //localhost/Radius/UserLists/SESMServices/BOD1MVOLUME ]

    Name = BOD1MVOLUME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-AVPair = prepaid-config=PREPAID_RSIM

    Cisco-SSG-Service-Info = IBOD1MVOLUME

    Cisco-SSG-Service-Info = QU;256000;16000;16000;D;1000000;64000;64000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

Configuring the BOD2MVOLUME Service

The following profile and attributes configure the BOD2MVOLUME service.

--> cd bod2mvolUME/

[ //localhost/Radius/UserLists/SESMServices/BOD2MVOLUME ]

    Name = BOD2MVOLUME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-AVPair = prepaid-config=PREPAID_RSIM

    Cisco-SSG-Service-Info = IBOD2MVOLUME

    Cisco-SSG-Service-Info = QU;512000;32000;32000;D;2000000;128000;128000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

Configuring Layer 4 Redirect for when Quotas Run Out

The following profile enables Layer 4 Redirect when the subscriber's quota or funds from the billing server run out.

--> cd l4redirECT_SERVICE/

[ //localhost/Radius/UserLists/SESMServices/L4REDIRECT_SERVICE ]

    Name = L4REDIRECT_SERVICE

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

Verifying ATM to ISG LNS Aggregation

The following sections provide sample show command output:

•Basic Verification

•Verification of Default BOD256K Service

•show Command Output for BOD1MTIME Service

•show Command Output for History of Service Changes

•Clearing Statistics

Basic Verification

The show subscriber session command shows basic information for all active subscribers. In the following output, there is one active subscriber session.

ie2-C7206-LNS# show subscriber session

Current Subscriber Information: Total sessions 1

Uniq ID Interface  State         Service      Identifier           Up-time

! This is the VID for the subscriber

520     Vi3        authen        Local Term   cpe6_1@isp.com       00:12:03

! This is the VID for the subscriber's traffic class

521     Traffic-Cl unauthen      Ltm Internal                      00:12:03

The show ip route vrf VPN11006 command shows routing table information for the VRF. In the following output, there is one active subscriber session.

ie2-C7206-LNS# show ip route vrf VPN11006

Routing Table: VPN11006

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     84.0.0.0/24 is subnetted, 1 subnets

B       84.1.206.0 [200/0] via 10.200.1.43, 4d19h

     100.0.0.0/32 is subnetted, 1 subnets

C       100.6.6.6 is directly connected, Loopback1

     200.53.6.0/32 is subnetted, 1 subnets

! This shows that the subscriber is connected and part of vrf VPN11006

C       200.53.6.2 is directly connected, Virtual-Access3

     200.6.6.0/32 is subnetted, 1 subnets

B       200.6.6.6 [200/0] via 10.200.1.56, 4d19h

     10.0.0.0/32 is subnetted, 1 subnets

B       10.100.4.38 [200/0] via 10.200.1.43, 4d19h

ie2-C7206-LNS#

Verification of Default BOD256K Service

The show subscriber session uid 520 command shows detailed information for the subscriber with UID 520. The following output is for a subscriber with the default BOD256K service.

ie2-C7206-LNS# show subscriber session uid 520

Unique Session ID: 520

Identifier: cpe6_1@isp.com

SIP subscriber access type(s): VPDN/PPP

Current SIP options: Req Fwding/Req Fwded

Session Up-time: 00:12:10, Last Changed: 00:12:10

AAA unique ID: 472

Interface: Virtual-Access3

Policy information:

  Context 212C1F2C: Handle 41000819

  Authentication status: authen

  User profile, excluding services:

    service-type         2 [Framed]

    Framed-Protocol      1 [PPP]

    routing              False

    Framed-MTU           1500 (0x5DC)

    timeout              86400 (0x15180)

    idletime             180 (0xB4)

! The "A" stands for auto-login, which indicates that BOD256K is the default service.

    ssg-account-info     "ABOD256K"

! The "N" indicates that the subscriber is allowed access to these services based on the

! user's AAA profile.

    ssg-account-info     "NBOD256K"

    ssg-account-info     "NBOD1MTIME"

    ssg-account-info     "NBOD2MTIME"

    ssg-account-info     "NBOD1MVOLUME"

    ssg-account-info     "NBOD2MVOLUME"

    idletime             1800 (0x708)

    interface-config     "ip"

    interface-config     "ip"

    addr-pool            "cpe6_pool-53"

! Indicates the current active services.

  Active services associated with session:

    name "BOD256K"

! PBHK was applied when the session was started, as configured in the policy-map.

    name "PBHK_SERVICE", applied outwith active session 

! Because BOD256K is not a prepaid service, prepaid is not active.

  Prepaid context: not present 

  Rules, actions and conditions executed:

    subscriber rule-map RULE_PPP_ATM5

      condition always event session-start

        1 service-policy type service service PBHK_SERVICE

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MTIME_CLASS event service-start

        subscriber condition-map match-any BOD1MTIME_CLASS

          match identifier service-name BOD1MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD2MTIME_CLASS event service-start

        subscriber condition-map match-any BOD2MTIME_CLASS

          match identifier service-name BOD2MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        subscriber condition-map match-any BOD256K_CLASS

          match identifier service-name BOD256K [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MVOLUME_CLASS event service-start

        subscriber condition-map match-any BOD1MVOLUME_CLASS

          match identifier service-name BOD1MVOLUME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD2MVOLUME_CLASS event service-start

        subscriber condition-map match-any BOD2MVOLUME_CLASS

          match identifier service-name BOD2MVOLUME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MTIME_CLASS event service-start

        subscriber condition-map match-any BOD1MTIME_CLASS

          match identifier service-name BOD1MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD2MTIME_CLASS event service-start

        subscriber condition-map match-any BOD2MTIME_CLASS

          match identifier service-name BOD2MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        subscriber condition-map match-any BOD256K_CLASS

! Services that are active are identified as "TRUE."

          match identifier service-name BOD256K [TRUE] 

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        1 service-policy service unapply service BOD1MTIME

        2 service-policy service unapply service BOD2MTIME

        3 service-policy service unapply service BOD1MVOLUME

        4 service-policy service unapply service BOD2MVOLUME

        5 service-policy service identifier service-name

Session inbound features:

Traffic classes:

  Traffic class session ID: 521

! Identifies the ACL that restricts inbound traffic. The ACL is configured on the ISG LNS,

! and it is applied to the subscriber based on the subscriber profile on the AAA server.

   ACL Name: Internet-in-acl, Packets = 4, Bytes = 368 

 Default traffic is dropped

 Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

 Feature: Portbundle Hostkey 

! Identifies the PBHK IP address and the bundle number. This information can be used to

! troubleshoot PBHK with the show ip portbundle command.

 Portbundle IP = 10.200.1.55     Bundle Number = 761 

Session outbound features:

 Feature: PPP Idle Timeout

  Timeout value is 1800

! The current elapsed idle time.

  Idle time is 00:12:11

Traffic classes:

  Traffic class session ID: 521

   ACL Name: Internet-out-acl, Packets = 0, Bytes = 0

 Default traffic is dropped

 Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

Non-datapath features:

 Feature: Interface-Config

 Feature: Session Timeout

  Timeout value is 86400 seconds

  Time remaining is 23:47:48

 Feature: IP Config

  Address Pool: cpe6_pool-53

  Unnumbered Intf: [None]

Configuration sources associated with this session:

Service: BOD256K, Active Time = 00:12:11

Service: PBHK_SERVICE, Active Time = 00:12:11

Interface: Virtual-Template5, Active Time = 00:12:11

The show subscriber session uid 521 command shows detailed information for the subscriber with UID 521. The following output is for a subscriber with the default BOD256K service.

ie2-C7206-LNS# show subscriber session uid 521

Unique Session ID: 521

Identifier: 

SIP subscriber access type(s): Traffic-Class

Current SIP options: None

Session Up-time: 00:12:14, Last Changed: 00:12:14

AAA unique ID: 0

Policy information:

  Context 212C1B18: Handle 5A00081C

  Authentication status: unauthen

  Prepaid context: not present

Session inbound features:

Feature: Policing

! Identifies the upstream policing rates for the BOD256K service. These rates are defined

! on the AAA server in the BOD256K service profile.

 Upstream Params: 

Average rate = 128000, Normal burst = 8000, Excess burst = 8000

Config level = Service

Session outbound features:

Feature: Policing

! Identifies the downstream policing rates for the BOD256K service. These rates are

! defined on the AAA server in the BOD256K service profile.

 Dnstream Params: 

Average rate = 256000, Normal burst = 16000, Excess burst = 16000

Config level = Service

Configuration sources associated with this session:

Service: BOD256K, Active Time = 00:12:14

ie2-C7206-LNS#

show Command Output for BOD1MTIME Service

The following output is for subscribers who have activated the BOD1MTIME service.

ie2-C7206-LNS# show subscriber session

Current Subscriber Information: Total sessions 1

Uniq ID Interface  State         Service      Identifier           Up-time

520     Vi3        authen        Local Term   cpe6_1@isp.com       00:14:17

522     Traffic-Cl unauthen      Ltm Internal cpe6_1@isp.com       00:00:11

ie2-C7206-LNS# show subscriber session uid 520

Unique Session ID: 520

Identifier: cpe6_1@isp.com

SIP subscriber access type(s): VPDN/PPP

Current SIP options: Req Fwding/Req Fwded

Session Up-time: 00:14:29, Last Changed: 00:00:23

AAA unique ID: 472

Interface: Virtual-Access3

Policy information:

  Context 212C1F2C: Handle 41000819

  Authentication status: authen

  User profile, excluding services:

    service-type         2 [Framed]

    Framed-Protocol      1 [PPP]

    routing              False

    Framed-MTU           1500 (0x5DC)

    timeout              86400 (0x15180)

    idletime             180 (0xB4)

    ssg-account-info     "ABOD256K"

    ssg-account-info     "NBOD256K"

    ssg-account-info     "NBOD1MTIME"

    ssg-account-info     "NBOD2MTIME"

    ssg-account-info     "NBOD1MVOLUME"

    ssg-account-info     "NBOD2MVOLUME"

    idletime             1800 (0x708)

    interface-config     "ip"

    interface-config     "ip"

    addr-pool            "cpe6_pool-53"

  Active services associated with session:

! Indicates that the BOD1MTIME service is active.

    name "BOD1MTIME"

    name "PBHK_SERVICE", applied outwith active session

  Prepaid context: not present

  Rules, actions and conditions executed:

    subscriber rule-map RULE_PPP_ATM5

      condition always event session-start

        1 service-policy service service PBHK_SERVICE

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MTIME_CLASS event service-start

        subscriber condition-map match-any BOD1MTIME_CLASS

          match identifier service-name BOD1MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD2MTIME_CLASS event service-start

        subscriber condition-map match-any BOD2MTIME_CLASS

          match identifier service-name BOD2MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        subscriber condition-map match-any BOD256K_CLASS

          match identifier service-name BOD256K [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MVOLUME_CLASS event service-start

        subscriber condition-map match-any BOD1MVOLUME_CLASS

          match identifier service-name BOD1MVOLUME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD2MVOLUME_CLASS event service-start

        subscriber condition-map match-any BOD2MVOLUME_CLASS

          match identifier service-name BOD2MVOLUME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MTIME_CLASS event service-start

        subscriber condition-map match-any BOD1MTIME_CLASS

          match identifier service-name BOD1MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD2MTIME_CLASS event service-start

        subscriber condition-map match-any BOD2MTIME_CLASS

          match identifier service-name BOD2MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        subscriber condition-map match-any BOD256K_CLASS

          match identifier service-name BOD256K [TRUE] 

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        1 service-policy service unapply service BOD1MTIME

        2 service-policy service unapply service BOD2MTIME

        3 service-policy service unapply service BOD1MVOLUME

        4 service-policy service unapply service BOD2MVOLUME

        5 service-policy service identifier service-name

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MTIME_CLASS event service-start

        subscriber condition-map match-any BOD1MTIME_CLASS

          match identifier service-name BOD1MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD2MTIME_CLASS event service-start

        subscriber condition-map match-any BOD2MTIME_CLASS

          match identifier service-name BOD2MTIME [FALSE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        subscriber condition-map match-any BOD256K_CLASS

          match identifier service-name BOD256K [TRUE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD256K_CLASS event service-start

        1 service-policy service unapply service BOD1MTIME

        2 service-policy service unapply service BOD2MTIME

        3 service-policy service unapply service BOD1MVOLUME

        4 service-policy service unapply service BOD2MVOLUME

        5 service-policy service identifier service-name

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MTIME_CLASS event service-start

        subscriber condition-map match-any BOD1MTIME_CLASS

! Indicates that the BOD1MTIME service is active.

          match identifier service-name BOD1MTIME [TRUE]

    subscriber rule-map RULE_PPP_ATM5

      condition BOD1MTIME_CLASS event service-start

        1 service-policy service unapply service BOD256K

        2 service-policy service unapply service BoD2MTIME

        3 service-policy service unapply service BOD1MVOLUME

        4 service-policy service unapply service BOD2MVOLUME

        5 service-policy service identifier service-name

Session inbound features:

Traffic classes:

  Traffic class session ID: 522

   ACL Name: Internet-in-acl, Packets = 17, Bytes = 1157

 Default traffic is dropped

 Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

 Feature: Portbundle Hostkey

 Portbundle IP = 10.200.1.55     Bundle Number = 761

Session outbound features:

 Feature: PPP Idle Timeout

  Timeout value is 1800

  Idle time is 00:00:24

Traffic classes:

  Traffic class session ID: 522

   ACL Name: Internet-out-acl, Packets = 26, Bytes = 28894

 Default traffic is dropped

 Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0

Non-datapath features:

 Feature: Interface-Config

 Feature: Session Timeout

  Timeout value is 86400 seconds

  Time remaining is 23:45:28

 Feature: IP Config

  Address Pool: cpe6_pool-53

  Unnumbered Intf: [None]

Configuration sources associated with this session:

Service: BOD1MTIME, Active Time = 00:00:25

Service: PBHK_SERVICE, Active Time = 00:14:31

Interface: Virtual-Template5, Active Time = 00:14:31

ie2-C7206-LNS# show subscriber session uid 522

Unique Session ID: 522

Identifier: cpe6_1@isp.com

SIP subscriber access type(s): Traffic-Class

Current SIP options: None

Session Up-time: 00:00:27, Last Changed: 00:00:21

AAA unique ID: 0

Policy information:

  Context 212C1C74: Handle 40000821

  Authentication status: unauthen

! Indicates that prepaid is now active to PREPAID_RSIM.

  Prepaid context: PREPAID_RSIM

    threshold time 10 seconds

    threshold volume 1000 bytes

    method-list author PREPAID_AUTHOR_LIST

    method-list accounting PREPAID_ACCNT_LIST

    password prepaidcisco

    Interim 3

    State PREPAID_FEATURE_RUNNING

    Flow idle ? NO

    Acct start sent ? YES

Session inbound features:

Feature: Policing

 Upstream Params: 

! Identifies the upstream policing rates for the BOD1MTIME service. 

Average rate = 256000, Normal burst = 16000, Excess burst = 16000

Config level = Service

 Feature: Prepaid Volume Monitor

   Threshold:4294967295 - Quota:4294967295 

   Usage(since last update):0 - Total:0

   Current states: Start 

Session outbound features:

Feature: Policing

 Dnstream Params: 

! Identifies the downstream policing rates for the BOD1MTIME service. 

Average rate = 1000000, Normal burst = 64000, Excess burst = 64000 

Config level = Service

 Feature: Prepaid Volume Monitor 

   Threshold:4294967295 - Quota:4294967295 

   Usage(since last update):0 - Total:0

   Current states: Start 

Non-datapath features:

! Shows the time statistics for the prepaid services.

 Feature: Time Monitor 

   Threshold: 90 (seconds) - Quota: 100 (seconds)

   Session time: 21 (seconds)

Configuration sources associated with this session:

Service: BOD1MTIME, Active Time = 00:00:27

ie2-C7206-LNS#

show Command Output for History of Service Changes

The show subscriber policy conditions command shows the history of subscriber service changes.

ie2-C7206-LNS# show subscriber policy conditions 

Class-map                     Action                          Exec Hit Miss Comp

---------                     ------                          ---- --- ---- ----

match-any BOD2MVOLUME_CLASS   match identifier service-name B  256   7  249    7

match-any BOD1MVOLUME_CLASS   match identifier service-name B  257   9  248    9

match-any BOD2MTIME_CLASS     match identifier service-name B  534   4  530    4

match-any BOD256K_CLASS       match identifier service-name B  505 259  246  259

match-any BOD1MTIME_CLASS     match identifier service-name B  548  37  511   37

Key:

  "Exec" - The number of times this line was executed

  "Hit"  - The number of times this line evaluated to TRUE

  "Miss" - The number of times this line evaluated to FALSE

  "Comp" - The number of times this line completed the execution of its

           condition without a need to continue on to the end

ie2-C7206-LNS# show subscriber policy profile 

Current policy profile DB contents are:

  Profile name: PBHK_SERVICE, 4 references 

    portbundle           "enable"

  Profile name: apply-config-only, 3 references 

    service-type         2 [Framed]

    Framed-Protocol      1 [PPP]

    routing              False

    Framed-MTU           1500 (0x5DC)

    timeout              86400 (0x15180)

    idletime             180 (0xB4)

    ssg-account-info     "ABOD256K"

    ssg-account-info     "NBOD256K"

    ssg-account-info     "NBOD1MTIME"

    ssg-account-info     "NBOD2MTIME"

    ssg-account-info     "NBOD1MVOLUME"

    ssg-account-info     "NBOD2MVOLUME"

    idletime             1800 (0x708)

    interface-config     "ip"

    interface-config     "ip"

    addr-pool            "cpe6_pool-53"

  Profile name: BOD256K, 4 references 

    traffic-class        "in access-group name  Internet-in-acl"

    traffic-class        "in default drop"

    traffic-class        "out access-group name Internet-out-acl"

    traffic-class        "out default drop"

    ssg-service-info     "IBOD256K"

    ssg-service-info     "QU;128000;8000;8000;D;256000;16000;16000"

    ssg-service-info     "R42.1.1.0;255.255.255.0"

    policy-handle        1509951516 (0x5A00081C)

  Profile name: BOD1MTIME, 5 references 

    traffic-class        "in access-group name  Internet-in-acl"

    traffic-class        "in default drop"

    traffic-class        "out access-group name Internet-out-acl"

    traffic-class        "out default drop"

    ssg-service-info     "IBOD1MTIME"

    ssg-service-info     "QU;256000;16000;16000;D;1000000;64000;64000"

    ssg-service-info     "R42.1.1.0;255.255.255.0"

    policy-handle        1073743905 (0x40000821)

  Profile name: BOD1MTIME, 3 references 

    traffic-class        "in access-group name  Internet-in-acl"

    traffic-class        "in default drop"

    traffic-class        "out access-group name Internet-out-acl"

    traffic-class        "out default drop"

    ssg-service-info     "IBOD1MTIME"

    ssg-service-info     "QU;256000;16000;16000;D;1000000;64000;64000"

    ssg-service-info     "R42.1.1.0;255.255.255.0"

    policy-handle        889194527 (0x3500081F)

----------------------------------------------------------

 Entries in Profile dB subscribers for exact match

----------------------------------------------------------

No entries found in Profile dB

ie2-C7206-LNS# show subscriber policy rules

Rule          Class-map                     Action                          Exec

----          ---------                     ------                          ----

internal-rule always event account-logon    1 authenticate aaa list default    0

RULE_PPP_ATM5 BOD1MTIME_CLASS event service 1 service-policy service unapply  21

RULE_PPP_ATM5 BOD1MTIME_CLASS event service 2 service-policy service unapply  21

RULE_PPP_ATM5 BOD1MTIME_CLASS event service 3 service-policy service unapply  21

RULE_PPP_ATM5 BOD1MTIME_CLASS event service 4 service-policy service unapply  21

RULE_PPP_ATM5 BOD1MTIME_CLASS event service 5 service-policy service identif  21

RULE_PPP_ATM5 BOD2MTIME_CLASS event service 1 service-policy service unapply   3

RULE_PPP_ATM5 BOD2MTIME_CLASS event service 2 service-policy service unapply   3

RULE_PPP_ATM5 BOD2MTIME_CLASS event service 3 service-policy service unapply   3

RULE_PPP_ATM5 BOD2MTIME_CLASS event service 4 service-policy service unapply   3

RULE_PPP_ATM5 BOD2MTIME_CLASS event service 5 service-policy service identif   3

RULE_PPP_ATM5 BOD256K_CLASS event service-s 1 service-policy service unapply 259

RULE_PPP_ATM5 BOD256K_CLASS event service-s 2 service-policy service unapply 259

RULE_PPP_ATM5 BOD256K_CLASS event service-s 3 service-policy service unapply 259

RULE_PPP_ATM5 BOD256K_CLASS event service-s 4 service-policy service unapply 259

RULE_PPP_ATM5 BOD256K_CLASS event service-s 5 service-policy service identif 259

RULE_PPP_ATM5 BOD1MVOLUME_CLASS event servi 1 service-policy service unapply   5

RULE_PPP_ATM5 BOD1MVOLUME_CLASS event servi 2 service-policy service unapply   5

RULE_PPP_ATM5 BOD1MVOLUME_CLASS event servi 3 service-policy service unapply   5

RULE_PPP_ATM5 BOD1MVOLUME_CLASS event servi 4 service-policy service unapply   5

RULE_PPP_ATM5 BOD1MVOLUME_CLASS event servi 5 service-policy service identif   5

RULE_PPP_ATM5 BOD2MVOLUME_CLASS event servi 1 service-policy service unapply   4

RULE_PPP_ATM5 BOD2MVOLUME_CLASS event servi 2 service-policy service unapply   4

RULE_PPP_ATM5 BOD2MVOLUME_CLASS event servi 3 service-policy service unapply   4

RULE_PPP_ATM5 BOD2MVOLUME_CLASS event servi 4 service-policy service unapply   4

RULE_PPP_ATM5 BOD2MVOLUME_CLASS event servi 5 service-policy service identif   4

RULE_PPP_ATM5 BOD2MTIME_CLASS event service 1 service-policy service unapply   1

RULE_PPP_ATM5 BOD2MTIME_CLASS event service 2 service-policy service service   1

RULE_PPP_ATM5 BOD1MTIME_CLASS event service 1 service-policy service unapply  16

RULE_PPP_ATM5 BOD1MTIME_CLASS event service 2 service-policy service service  16

RULE_PPP_ATM5 BOD2MVOLUME_CLASS event servi 1 service-policy service unapply   3

RULE_PPP_ATM5 BOD2MVOLUME_CLASS event servi 2 service-policy service service   3

RULE_PPP_ATM5 BOD1MVOLUME_CLASS event servi 1 service-policy service unapply   4

RULE_PPP_ATM5 BOD1MVOLUME_CLASS event servi 2 service-policy service service   4

RULE_PPP_ATM5 always event session-start    1 service-policy service service 233

RULE_PPP_ATM5 always event quota-depleted   1 set-param drop-traffic FALSE     0

RULE_PPP_ATM5 always event credit-exhausted 1 service-policy service service   0

RULE_PPP_ATM5 always event internal-event-c 1 service-policy service unapply   0

Key:

  "Exec" - The number of times this rule action line was executed

ie2-C7206-LNS#

Clearing Statistics

The clear subscriber policy conditions command can be used to clear the statistics of subscriber policy changes.

ie2-C7206-LNS# clear subscriber policy conditions

ie2-C7206-LNS#

ie2-C7206-LNS# show subscriber policy conditions

Class-map                     Action                          Exec Hit Miss Comp

---------                     ------                          ---- --- ---- ----

match-any BOD2MVOLUME_CLASS   match identifier service-name B    0   0    0    0

match-any BOD1MVOLUME_CLASS   match identifier service-name B    0   0    0    0

match-any BOD2MTIME_CLASS     match identifier service-name B    0   0    0    0

match-any BOD256K_CLASS       match identifier service-name B    0   0    0    0

match-any BOD1MTIME_CLASS     match identifier service-name B    0   0    0    0

Key:

  "Exec" - The number of times this line was executed

  "Hit"  - The number of times this line evaluated to TRUE

  "Miss" - The number of times this line evaluated to FALSE

  "Comp" - The number of times this line completed the execution of its

           condition without a need to continue on to the end

ie2-C7206-LNS#

Complete Running Configurations

The following sections contain complete running configurations for the devices in the network:

•CPE

•LAC

•ISG LNS

•PE at ISP-2

•AAA Server for ISP-1

•AAA Server for ISP-2

---

Note Lines preceded by an exclamation marks (!) are comments about the configuration.

---

CPE

version 12.3

no service pad

service timestamps debug uptime

service timestamps log uptime

service password-encryption

!

hostname ie2-C837-CPE6

!

enable password 7 13091610

!

no aaa new-model

ip subnet-zero

ip dhcp excluded-address 10.10.10.1

!

! DHCP config for interface E0 subscribers

ip dhcp pool CLIENT 

   import all

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.1 

   lease 0 2

!

!         

ip cef

ip audit notify log

ip audit po max-events 100

!

!

no ftp-server write-enable

!

!

! 

!

!

!

!

interface Ethernet0

 ip address 10.10.10.1 255.255.255.0

 ip nat inside

 load-interval 30

 no cdp enable

 hold-queue 100 out

!

interface ATM0

 bandwidth 864

 no ip address

 ip route-cache flow

 load-interval 30

 no atm ilmi-keepalive

 dsl operating-mode auto

!

interface ATM0.6 point-to-point

! This is the PVC which is going to the ATM DSLAM

 pvc 6/46   

  encapsulation aal5snap

! Refers to dialer 1

  pppoe-client dial-pool-number 1 

 !

!

interface FastEthernet1

 no ip address

 duplex auto

 speed auto

!

interface FastEthernet2

 no ip address

 duplex auto

 speed auto

!         

interface FastEthernet3

 no ip address

 duplex auto

 speed auto

!

interface FastEthernet4

 no ip address

 duplex auto

 speed auto

!

interface Dialer1

 ip address negotiated

! NAT outside interface

 ip nat outside 

! using ppp 

 encapsulation ppp 

 ip route-cache flow

 dialer pool 1

 dialer-group 1

 no cdp enable

! here we set the username via CHAP

 ppp chap hostname cpe6_1@isp.com 

! set the password for CHAP

 ppp chap password 7 060A0E23 

!

! This allows the subscribers on the inside E0 interface access to the outside via NAT

ip nat inside source list 1 interface Dialer1 overload 

!

ip classless

! set the default gateway out the dialer 1 interface

ip route 0.0.0.0 0.0.0.0 Dialer1 

ip http server

no ip http secure-server

!

! allow E0 subscribers to be NAT translated

access-list 1 permit 10.10.10.0 0.0.0.255 

! refers to ACL 1

dialer-list 1 protocol ip permit 

no cdp run

!

line con 0

 exec-timeout 120 0

 no modem enable

 stopbits 1

line aux 0

line vty 0 4

 access-class 23 in

 exec-timeout 120 0

 password 7 11051807

 no login

 length 0

!         

scheduler max-task-time 5000

!

end

LAC

version 12.2

no service pad

service timestamps debug datetime msec localtime

service timestamps log datetime msec

no service password-encryption

!

hostname ie2-C7206-ATM2

!

boot-start-marker

boot system disk2:c7200-js-mz.122-27.1.11.SIE7

boot-end-marker

!

no logging console

enable password lab

!

! enable AAA globally

aaa new-model 

!

!

aaa authentication login default none

! setup RADIUS server for authentication

aaa authentication ppp default group radius local 

aaa authorization network default group radius local 

aaa accounting network default start-stop group radius

!

!

aaa session-id common

clock timezone Pacific -8

ip subnet-zero

!

!

ip ftp username root

ip ftp password lab

no ip dhcp use vrf connected

!         

!

ip cef

!

!

subscriber policy recording rules limit 64

subscriber access pppoe pre-authorize nas-port-id default

subscriber authorization enable

! enable VPDN globally used for PPPoE

vpdn enable 

vpdn ip udp ignore checksum

vpdn search-order domain 

!

no mpls traffic-eng auto-bw timers frequency 0

call rsvp-sync

!

!

!

!

!

username all

!

!

! rule to look at L2TP @domain

policy-map control RULE_L2TP_LM_ATM5 

 class control always event session-start

  1 collect identifier unauthenticated-domain

  2 authorize identifier unauthenticated-domain

!

!

!

! bba PPPoE group (another method is vpdn-group)

bba-group pppoe BBA_LM_ATM5 

 virtual-template 5

 sessions auto cleanup

!

!

! This is applied to ATM pvc

vc-class atm VC_LM_ATM5 

! refers to bba-group above

  protocol pppoe group BBA_LM_ATM5 

! allow dynamic bandwidth selection

  dbs enable maximum 

  encapsulation aal5snap

! apply L2TP rule

  service-policy control RULE_L2TP_LM_ATM5 

!

interface Loopback0

 ip address 10.200.1.49 255.255.255.255

!

interface GigabitEthernet0/1

 ip address 223.255.12.49 255.255.255.0

 duplex auto

 speed auto

 media-type rj45

 no negotiation auto

!

interface GigabitEthernet0/2

 ip address 160.49.1.49 255.255.255.0

 load-interval 30

 duplex full

 speed 1000

 media-type gbic

 negotiation auto

!

interface GigabitEthernet0/3

 ip address 180.49.1.49 255.255.255.0

 ip portbundle outside

 ip flow ingress

 load-interval 30

 duplex full

 speed 1000

 media-type gbic

 negotiation auto

!

interface ATM1/0

 no ip address

 no ip redirects

 no ip unreachables

 no ip proxy-arp

 ip flow ingress

 load-interval 30

 no atm auto-configuration

 no atm ilmi-keepalive

 no atm address-registration

!

interface ATM2/0

 no ip address

 no ip redirects

 no ip unreachables

 no ip proxy-arp

 ip flow ingress

 load-interval 30

 no atm auto-configuration

 no atm ilmi-keepalive

 no atm address-registration

 no atm ilmi-enable

 no atm enable-ilmi-trap

 bundle-enable

 ntp disable

!

!

interface ATM2/0.101 point-to-point

 ip flow ingress

 no atm enable-ilmi-trap

 pvc 106/46 

! VC class

  class-vc VC_LM_ATM5 

! this can be changed to restrict PPPoE sessions on the PVC

  pppoe max-sessions 1 

!

!

interface ATM2/0.108 point-to-point

 ip flow ingress

 no atm enable-ilmi-trap

 pvc 108/48 

  class-vc VC_LM_ATM5

  pppoe max-sessions 1

!

!

interface FastEthernet4/0

 no ip address

 shutdown

 duplex auto

 speed auto

!

interface FastEthernet4/1

 no ip address

 shutdown

 duplex auto

 speed auto

!

! PPP CHAP configs here

interface Virtual-Template5 

 no ip address

 no peer default ip address

 no keepalive

 ppp authentication chap

 ppp timeout aaa

!

router ospf 10

 log-adjacency-changes

 network 10.200.1.49 0.0.0.0 area 200

 network 160.49.1.0 0.0.0.255 area 200

 network 180.49.1.0 0.0.0.255 area 200

 network 201.53.6.1 0.0.0.0 area 200

!

router bgp 100

 no synchronization

 bgp router-id 10.200.1.49

 bgp log-neighbor-changes

 redistribute connected

 neighbor 10.200.1.41 remote-as 100

 neighbor 10.200.1.41 update-source Loopback0

 no auto-summary

!

ip classless

!

no ip http server

!

!

! Use Loopback 0 to communicate with radius server

ip radius source-interface Loopback0 

!

!

! use this as radius server and specified ports and passwords

radius-server host 10.100.1.35 auth-port 1812 acct-port 1813 key Cisco 

! set up accounting VSA (vendor specific attributes)

radius-server vsa send accounting 

! set up authentication VSA

radius-server vsa send authentication 

!

control-plane

!

!

dial-peer cor custom

!

!         

!

!

gatekeeper

 shutdown

!

!

line con 0

 exec-timeout 0 0

 stopbits 1

line aux 0

 stopbits 1

line vty 0 4

 exec-timeout 3600 0

!

ntp clock-period 17179700

ntp server 10.200.1.41 prefer

!

end

ISG LNS

version 12.2

no service pad

service timestamps debug datetime msec localtime

service timestamps log datetime msec

no service password-encryption

!

hostname ie2-C7206-LNS

!

boot-start-marker

boot system disk2:c7200-js-mz.122-27.1.11.SIE7

boot-end-marker

!

logging buffered 2000000 debugging

no logging console

enable password lab

!

! enable AAA globally

aaa new-model 

!

!

! set up AAA server group for CAR

aaa group server radius CAR_SERVER 

 server 10.100.2.36 auth-port 1812 acct-port 1813

!

! set up AAA server for billing server 1

aaa group server radius RSIM_SERVER 

 server 10.100.6.88 auth-port 1645 acct-port 1646

!

! set up AAA server group for billing server 2

aaa group server radius MIND_SERVER 

 server 10.100.11.86 auth-port 1645 acct-port 1646

! the following sets up the server groups for the 3 phases of AAA

aaa authentication login default none

aaa authentication login IP_AUTHEN_LIST group CAR_SERVER

aaa authentication ppp default group CAR_SERVER

aaa authentication ppp PREPAID_MIND group MIND_SERVER

aaa authentication ppp PREPAID_AUTHEN_LIST group RSIM_SERVER 

aaa authorization network default group CAR_SERVER 

aaa authorization network PREPAID_MIND group MIND_SERVER 

aaa authorization network PREPAID_AUTHOR_LIST group RSIM_SERVER 

aaa authorization subscriber-service default local group radius 

aaa accounting network default start-stop group CAR_SERVER

aaa accounting network PREPAID_MIND start-stop group MIND_SERVER

aaa accounting network PREPAID_ACCNT_LIST start-stop group RSIM_SERVER

! SESM access port, password

aaa server radius sesm 

! IP address of SESM

 client 10.100.4.38 

 key cisco

 port 1812

 message-authenticator ignore

!

!

aaa session-id common

clock timezone Pacific -8

ip subnet-zero

!

!

ip ftp username root

ip ftp password lab

no ip dhcp use vrf connected

!

!

! Set up MPLS VRF for subscribers globally on router

ip vrf VPN11006 

 rd 200:6

 route-target export 200:6

 route-target import 200:6

!

!

ip cef

!

! This is the prepaid server global config PREPAID_RSIM will be referred to on AAA server

! for each service profile

subscriber feature prepaid PREPAID_RSIM 

   threshold time 10 seconds

   threshold volume 1000 bytes

   interim-interval 3 minutes

! This refers to authorization list in AAA configuration above

   method-list author PREPAID_AUTHOR_LIST 

! accounting method list

   method-list accounting PREPAID_ACCNT_LIST 

! prepaid password on billing server

   password prepaidcisco 

! This is a 2nd billing server prepaid global setup

subscriber feature prepaid PREPAID_MIND 

   threshold time 10 seconds

   threshold volume 1000 bytes

   interim-interval 3 minutes

   method-list author PREPAID_MIND

   method-list accounting PREPAID_MIND

   password prepaidcisco

!

subscriber policy recording rules limit 64

! enable VPDN for PPPoE/L2TP

vpdn enable 

vpdn ip udp ignore checksum

!

! terminate PPPoE client here via L2TP tunnel

vpdn-group 1 

 accept-dialin

  protocol l2tp

  virtual-template 5

 terminate-from hostname sp_lac

 local name sp_lns

 l2tp tunnel password 0 lab

!

!

! L4 Redirect server configuration

redirect server-group SESM-Server 

 server ip 10.100.4.38 port 8080

!

clns routing

no mpls traffic-eng auto-bw timers frequency 0

mpls label protocol ldp

call rsvp-sync

!

!

class-map type control match-any BOD1MTIME_CLASS<-- following is the class-map 
configuration for the services available which is applied in the policy map below

 match service-name BOD1MTIME 

!

class-map type control match-any BOD256K_CLASS

 match service-name BOD256K 

!         

class-map type control match-any BOD2MTIME_CLASS

 match service-name BOD2MTIME 

!

class-map type control match-any BOD1MVOLUME_CLASS

 match service-name BOD1MVOLUME 

!

class-map type control match-any BOD2MVOLUME_CLASS

 match service-name BOD2MVOLUME 

!

!

! Rule which is applied to virtual-template

policy-map type control RULE_PPP_ATM5

 class type control BOD1MTIME_CLASS event service-start

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BoD2MTIME

  3 service-policy type service identifier service-name

!

 class type control BOD2MTIME_CLASS event service-start

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BOD1MTIME

  3 service-policy type service identifier service-name

!

 class type control BOD256K_CLASS event service-start

  1 service-policy type service unapply name BOD1MTIME

  2 service-policy type service unapply name BOD2MTIME

  3 service-policy type service unapply name BOD1MVOLUME

  4 service-policy type service unapply name BOD2MVOLUME

  5 service-policy type service identifier service-name

!

! If a subscriber selects this service class we follow the steps below

 class type control BOD1MVOLUME_CLASS event service-start 

! unapply these services first before we apply the selected BOD1MVOLUME service

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BOD2MVOLUME

  3 service-policy type service identifier service-name

!

 class type control BOD2MVOLUME_CLASS event service-start

  1 service-policy type service unapply name BOD256K

  2 service-policy type service unapply name BOD1MVOLUME

  3 service-policy type service identifier service-name

!

! if the subscriber stops this service then we unapply it and then apply the default

! BOD256K service

 class type control BOD2MTIME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

!

 class type control BOD1MTIME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

!        

 class type control BOD2MVOLUME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

!

 class type control BOD1MVOLUME_CLASS event service-stop

  1 service-policy type service unapply identifier service-name

  2 service-policy type service name BOD256K

!

 class type control always event session-start

! always apply PBHK so subscriber can access SESM

  1 service-policy type service name PBHK_SERVICE

!

 class type control always event quota-depleted

! If quota from billing server and idle time equal zero then drop traffic

  1 set-param drop-traffic FALSE

!

! If quota from billing server equal zero, but idle time is greater than zero L4 redirect

 class type control always event credit-exhausted

  1 service-policy type service name L4REDIRECT_SERVICE

!

!

!

!

! address we communicate with AAA, billing servers, SESM

interface Loopback0 

 ip address 10.200.1.55 255.255.255.255

 ip router isis Remote_ISP

!

interface Loopback1

 ip vrf forwarding VPN11006

 ip address 100.6.6.6 255.255.255.255

!

interface GigabitEthernet0/1

 ip address 223.255.12.55 255.255.255.0

 duplex auto

 speed auto

 media-type rj45

 no negotiation auto

!

interface GigabitEthernet0/2

 ip address 21.21.1.55 255.255.255.0

 ip portbundle outside

 ip flow ingress

 ip router isis Remote_ISP

 load-interval 30

 duplex auto

 speed auto

 media-type gbic

 negotiation auto

 mpls mtu 1522

 mpls label protocol ldp

 mpls ip

!

interface GigabitEthernet0/3

 ip address 22.22.1.55 255.255.255.0

 ip portbundle outside

 ip flow ingress

 ip router isis Remote_ISP

 load-interval 30

 duplex full

 speed 1000

 media-type gbic

 negotiation auto

 mpls mtu 1522

 mpls label protocol ldp

 mpls ip

 no keepalive

!

interface FastEthernet1/0

 ip address 199.1.1.1 255.255.255.0

 load-interval 30

 shutdown

 duplex full

 speed 100

!

interface FastEthernet1/1

 no ip address

 shutdown

 duplex auto

 speed auto

!

! PPPoE subscribers terminate from L2TP here

interface Virtual-Template5 

 no ip address

 load-interval 30

 no peer default ip address

 no keepalive

 ppp mtu adaptive

 ppp authentication chap

! apply this rule to subscribers

 service-policy control RULE_PPP_ATM5 

!         

router isis Remote_ISP

 net 02.000c.cffe.c81b.00

 redistribute connected

!

router bgp 200

 no synchronization

 bgp router-id 10.200.1.55

 bgp log-neighbor-changes

 network 10.100.4.0 mask 255.255.255.0

 network 10.200.1.47 mask 255.255.255.255

 network 10.200.1.55 mask 255.255.255.255

 network 10.200.1.62 mask 255.255.255.255

 network 21.21.1.55 mask 255.255.255.0

 network 22.22.1.55 mask 255.255.255.0

 network 23.0.0.0

 network 24.0.0.0 mask 255.255.0.0

 network 24.5.0.0 mask 255.255.0.0

 neighbor 10.200.1.41 remote-as 100

 neighbor 10.200.1.41 ebgp-multihop 2

 neighbor 10.200.1.41 update-source Loopback0

 neighbor 10.200.1.47 remote-as 200

 neighbor 10.200.1.47 update-source Loopback0

 neighbor 10.200.1.47 next-hop-self

 no auto-summary

!

 address-family vpnv4

 neighbor 10.200.1.47 activate

 neighbor 10.200.1.47 send-community extended

 exit-address-family

!

address-family ipv4 vrf VPN11006

 redistribute connected

 no auto-summary

 no synchronization

 exit-address-family

!

! DHCP pool assigned to subscribers

ip local pool cpe6_pool-53 200.53.6.2 200.53.6.254 

!

! for PBHK SESM access

ip portbundle 

 match access-list 110

! communicate with SESM via router Loopback 0

 source Loopback0 

!

ip classless

ip route 10.200.1.41 255.255.255.255 21.21.1.41

!

no ip http server

!

!

!

! This ACL is called out in the AAA subscriber profile and allows or denies access to

! destinations for subscribers based on this ACL

ip access-list extended Internet-in-acl 

 deny   ip any 223.0.0.0 0.255.255.255

 deny   ip any 20.0.0.0 0.255.255.255

 deny   ip any 40.0.0.0 0.255.255.255

 deny   ip any 21.0.0.0 0.255.255.255

 deny   ip any 22.0.0.0 0.255.255.255

 deny   ip any 41.0.0.0 0.255.255.255

 deny   ip any 80.0.0.0 0.255.255.255

 deny   ip any 81.0.0.0 0.255.255.255

 deny   ip any 82.0.0.0 0.255.255.255

 deny   ip any 10.200.0.0 0.0.255.255

 permit ip any any

! This ACL is called out in the AAA subscriber profile and allows or denies access to

! destinations for subscribers based on this ACL

ip access-list extended Internet-out-acl 

 deny   ip 223.0.0.0 0.255.255.255 any

 deny   ip 10.200.0.0 0.0.255.255 any

 deny   ip 20.0.0.0 0.255.255.255 any

 deny   ip 40.0.0.0 0.255.255.255 any

 deny   ip 21.0.0.0 0.255.255.255 any

 deny   ip 22.0.0.0 0.255.255.255 any

 deny   ip 41.0.0.0 0.255.255.255 any

 deny   ip 80.0.0.0 0.255.255.255 any

 deny   ip 81.0.0.0 0.255.255.255 any

 deny   ip 82.0.0.0 0.255.255.255 any

 permit ip any any

! sets up router to communicate AAA RADIUS via loopback 0 address as source

ip radius source-interface Loopback0 

access-list 101 permit ip any any

! deny SESM

access-list 110 permit ip any host 10.100.4.38 

! called out in "ip portbundle" config above

access-list 110 permit ip any any 

access-list 111 deny   tcp any host 10.100.4.38 eq www

access-list 111 deny   tcp any host 10.100.4.38 eq 8080

access-list 111 permit tcp any any eq www

!

!

radius-server attribute 44 include-in-access-req

radius-server attribute 8 include-in-access-req

radius-server attribute 55 include-in-acct-req

radius-server attribute 55 access-request include

radius-server attribute 25 access-request include

! AAA/CAR server

radius-server host 10.100.2.36 auth-port 1812 acct-port 1813 key Cisco 

! billing server 1

radius-server host 10.100.6.88 auth-port 1645 acct-port 1646 key Cisco 

! billing server 2

radius-server host 10.100.11.86 auth-port 1645 acct-port 1646 key Cisco 

radius-server retransmit 5

radius-server key cisco

radius-server vsa send accounting

radius-server vsa send authentication

!

control-plane

!

!

dial-peer cor custom

!

!

!

!

gatekeeper

 shutdown

!

!

line con 0

 exec-timeout 0 0

 stopbits 1

line aux 0

 stopbits 1

line vty 0 4

 exec-timeout 0 0

!

ntp clock-period 17180035

ntp server 10.200.1.41 prefer

!

end

PE at ISP-2

version 12.2

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

service counters max age 10

!

hostname ie2-C6509-PE2

!

boot system disk0:s72033-pk9sv-mz.122-18.SXD1.bin

logging snmp-authfail

no logging console

enable password lab

!

no aaa new-model

clock timezone PST -8

vtp mode transparent

ip subnet-zero

!

!

ip ftp username root

ip ftp password lab

no ip domain-lookup

!

!

ip vrf VPN11006 

 rd 200:6

 route-target export 200:6

 route-target import 200:6

!

!

mls ip multicast flow-stat-timer 9

no mls flow ip

no mls flow ipv6

mls cef error action freeze

!

!

! 

!         

spanning-tree mode pvst

no spanning-tree optimize bpdu transmission

diagnostic cns publish cisco.cns.device.diag_results

diagnostic cns subscribe cisco.cns.device.diag_commands

!

redundancy

 mode sso

 main-cpu

  auto-sync running-config

  auto-sync standard

!

controller T1 7/1/0

 framing esf

 linecode b8zs

!

controller T1 7/1/1

 framing esf

 linecode b8zs

!

controller T1 7/1/2

 framing esf

 linecode b8zs

!

controller T1 7/1/3

 framing esf

 linecode b8zs

!         

vlan internal allocation policy ascending

vlan access-log ratelimit 2000

!

vlan 6,10 

!

!

interface Loopback0

 ip address 10.200.1.43 255.255.255.255

 ip router isis Area10

!

interface FastEthernet1/1

 description FE link to C7206-PE-FE1/0

 no ip address

 switchport

!

interface FastEthernet1/2

 description FE-LINK to ie2-SNMP-1A

 ip address 10.100.2.43 255.255.255.0

 ip router isis Area10

!

interface FastEthernet1/3

 description FE LINK to ie2-SESM-1B 

 no ip address

 switchport

 switchport access vlan 6

!

interface FastEthernet1/4

 description link to SESM1b on non-vrf for Mind

 ip address 10.100.5.1 255.255.255.0

 ip router isis Area10

!

interface FastEthernet1/5

 no ip address

 switchport

 switchport access vlan 10

!

interface FastEthernet1/6

 no ip address

!

interface FastEthernet1/7

 ip address 10.100.6.43 255.255.255.0

!

interface FastEthernet1/47

 no ip address

 speed 100

 duplex full

!

interface FastEthernet1/48

 ip address 223.255.12.43 255.255.255.0

 ip router isis Area10

 speed 100

 duplex full

!

interface GigabitEthernet2/1

 no ip address

 shutdown

!

interface GigabitEthernet2/2

 no ip address

 shutdown

!

interface GE-WAN2/1

 no ip address

 shutdown

 negotiation auto

 mls qos trust dscp

!

interface GE-WAN2/2

 no ip address

 shutdown

 negotiation auto

 mls qos trust dscp

!

interface GE-WAN2/3

 no ip address

 shutdown

 negotiation auto

 mls qos trust dscp

!

interface GE-WAN2/4

 no ip address

 shutdown

 negotiation auto

 mls qos trust dscp

!

interface GigabitEthernet3/1

 no ip address

 shutdown

!

interface GigabitEthernet3/2

 no ip address

 shutdown

!

interface GigabitEthernet3/3

 no ip address

 shutdown

!

interface GigabitEthernet3/4

 no ip address

 shutdown

!

interface POS3/1

 no ip address

 shutdown

 mls qos trust dscp

!

interface POS3/2

 no ip address

 shutdown

 mls qos trust dscp

!

interface GigabitEthernet4/1

 ip address 83.83.1.43 255.255.255.0

 ip router isis Area10

 load-interval 30

 mpls label protocol ldp

 tag-switching ip

!

interface GigabitEthernet4/2

 no ip address

 shutdown

!

interface GigabitEthernet4/3

 no ip address

 shutdown

!

interface GigabitEthernet4/4

 no ip address

 shutdown

!

interface GigabitEthernet4/5

 no ip address

!

interface GigabitEthernet4/6

 no ip address

 load-interval 30

!

interface GigabitEthernet4/6.206

 encapsulation dot1Q 206

 ip vrf forwarding VPN11006

 ip address 84.1.206.43 255.255.255.0

!         

!

interface GigabitEthernet4/7

 no ip address

 shutdown

!

interface GigabitEthernet4/8

 no ip address

 shutdown

!

interface GigabitEthernet5/1

 no ip address

 shutdown

!

interface GigabitEthernet5/2

 no ip address

 shutdown 

!

interface Hssi7/0/0

 no ip address

 shutdown

!

interface Hssi7/0/1

 no ip address

 shutdown

!

interface Serial8/0/0

 no ip address

 shutdown

 no fair-queue

!

interface Serial8/0/1

 no ip address

 shutdown

 no fair-queue

!

interface Serial8/0/2

 no ip address

 shutdown

 no fair-queue

!

interface Serial8/0/3

 no ip address

 shutdown 

 no fair-queue

!

interface Serial8/1/0

 no ip address

 shutdown

 dsu bandwidth 44210

 framing c-bit

 cablelength 10

!

interface Serial8/1/1

 no ip address

 shutdown

 dsu bandwidth 44210

 framing c-bit

 cablelength 10

!

interface Vlan1

 no ip address

 shutdown

!

interface Vlan6

 ip address 10.100.4.43 255.255.255.0

 ip router isis Area10

!

interface Vlan10

 ip address 10.100.10.1 255.255.255.0

 ip router isis Area10

!

router isis Area10

 net 10.000e.d6aa.5000.00

 redistribute connected

!

router bgp 200

 no synchronization

 bgp router-id 10.200.1.43

 bgp log-neighbor-changes

 network 10.100.2.0 mask 255.255.255.0

 network 10.200.1.43 mask 255.255.255.255

 network 24.7.1.0 mask 255.255.255.0

 network 83.83.1.0 mask 255.255.255.0

 network 84.1.1.0 mask 255.255.255.0

 network 84.2.1.0 mask 255.255.255.0

 network 84.3.1.0 mask 255.255.255.0

 network 84.4.1.0 mask 255.255.255.0

 neighbor 10.200.1.47 remote-as 200

 neighbor 10.200.1.47 ebgp-multihop 10

 neighbor 10.200.1.47 update-source Loopback0

 no auto-summary

!

 address-family vpnv4 

 neighbor 10.200.1.47 activate

 neighbor 10.200.1.47 send-community extended

 exit-address-family

!        

!

 address-family ipv4 vrf VPN11006 

 redistribute connected

 redistribute static

 no auto-summary

 no synchronization

 exit-address-family

!

!

ip classless

ip route vrf VPN11006 10.100.4.38 255.255.255.255 Vlan6 10.100.4.38 

ip http server

!

!

!

!

!

!

control-plane

!

!

!

line con 0

 exec-timeout 0 0

line vty 0 4

 exec-timeout 0 0

 no login

!         

end

AAA Server for ISP-1

This profile allows the LAC access to AAA-1. 10.200.1.49 is the loopback address on the LAC.

--> cd ie2-c7206-ge

[ //localhost/Radius/Clients/ie2-C7206-GE ]

    Name = ie2-C7206-GE

    Description = 

    IPAddress = 10.200.1.49

    SharedSecret = cisco

    Type = NAS

    Vendor = 

    IncomingScript~ = 

    OutgoingScript~ = 

    EnablePOD = FALSE

-->

This profile allows the @isp.com portion of the username to bring up the L2TP tunnel to ISP-2. 10.200.1.55 is the loopback address of the ISG LNS.

--> cd isp.com

[ //localhost/Radius/UserLists/SESMServices/isp.com ]

    Name = isp.com

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVpair = vpdn:tunnel-id=sp_lac

    Cisco-AVpair = vpdn:l2tp-tunnel-password=lab

    Cisco-AVpair = vpdn:tunnel-type=l2tp

    Cisco-AVpair = vpdn:ip-addresses=10.200.1.55

    Cisco-AVpair = atm:peak-cell-rate=3000

    Cisco-AVpair = atm:sustainable-cell-rate=3000

    idle-timeout = 86400

AAA Server for ISP-2

This profile allows the ISG LNS to access to AAA-2.

--> cd ie2-c7206-lns

[ //localhost/Radius/Clients/ie2-C7206-LNS ]

    Name = ie2-C7206-LNS

    Description = 

    IPAddress = 10.200.1.55

    SharedSecret = cisco

    Type = NAS

    Vendor = 

    IncomingScript~ = 

    OutgoingScript~ = 

    EnablePOD = FALSE

-->

--> cd ie2-sesm-1b

[ //localhost/Radius/Clients/ie2-SESM-1b ]

    Name = ie2-SESM-1b

    Description = 

    IPAddress = 10.100.4.38

    SharedSecret = cisco

    Type = NAS

    Vendor = 

    IncomingScript~ = 

    OutgoingScript~ = 

    EnablePOD = FALSE

-->

This is the subscriber profile, which specifies the services that are allowed.

--> cd cpe6_1@isp.com

[ //localhost/Radius/UserLists/SESMSubscribers/cpe6_1@isp.com ]

    Name = cpe6_1@isp.com 

    Description = 

    Password = <encrypted> 

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = Default-PPP-Users 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVpair = "lcp:interface-config=ip vrf forwarding VPN11006" 

    Cisco-AVpair = "lcp:interface-config=ip unnumbered loopback 1" 

    Cisco-AVpair = ip:addr-pool=cpe6_pool-53 

    Cisco-SSG-Account-Info = ABOD256K 

    Cisco-SSG-Account-Info = NBOD256K 

    Cisco-SSG-Account-Info = NBOD1MTIME 

    Cisco-SSG-Account-Info = NBOD2MTIME

    Cisco-SSG-Account-Info = NBOD1MVOLUME

    Cisco-SSG-Account-Info = NBOD2MVOLUME

    Session-Timeout = 86400 

-->

These profiles define the prepaid services.

--> cd bod256k

[ //localhost/Radius/UserLists/SESMServices/BOD256K ]

    Name = BOD256K 

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-SSG-Service-Info = IBOD256K 

    Cisco-SSG-Service-Info = QU;128000;8000;8000;D;256000;16000;16000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

-->

--> cd bod1mtime

[ //localhost/Radius/UserLists/SESMServices/BOD1MTIME ]

    Name = BOD1MTIME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-AVPair = prepaid-config=PREPAID_RSIM 

    Cisco-SSG-Service-Info = IBOD1MTIME 

    Cisco-SSG-Service-Info = QU;256000;16000;16000;D;1000000;64000;64000 

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

-->

--> cd bod2mtime

[ //localhost/Radius/UserLists/SESMServices/BOD2MTIME ]

    Name = BOD2MTIME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-AVPair = prepaid-config=PREPAID_RSIM

    Cisco-SSG-Service-Info = IBOD2MTIME

    Cisco-SSG-Service-Info = QU;512000;32000;32000;D;2000000;128000;128000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

-->

--> cd bod1mvolUME/

[ //localhost/Radius/UserLists/SESMServices/BOD1MVOLUME ]

    Name = BOD1MVOLUME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-AVPair = prepaid-config=PREPAID_RSIM

    Cisco-SSG-Service-Info = IBOD1MVOLUME

    Cisco-SSG-Service-Info = QU;256000;16000;16000;D;1000000;64000;64000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

-->

--> cd bod2mvolUME/

[ //localhost/Radius/UserLists/SESMServices/BOD2MVOLUME ]

    Name = BOD2MVOLUME

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:traffic-class=in access-group name  Internet-in-acl"

    Cisco-AVPair = "ip:traffic-class=in default drop"

    Cisco-AVPair = "ip:traffic-class=out access-group name Internet-out-acl"

    Cisco-AVPair = "ip:traffic-class=out default drop"

    Cisco-AVPair = prepaid-config=PREPAID_RSIM

    Cisco-SSG-Service-Info = IBOD2MVOLUME

    Cisco-SSG-Service-Info = QU;512000;32000;32000;D;2000000;128000;128000

    Cisco-SSG-Service-Info = R42.1.1.0;255.255.255.0

-->

These are the other profiles that are required for the services to function properly.

--> cd l4redirECT_SERVICE/ 

[ //localhost/Radius/UserLists/SESMServices/L4REDIRECT_SERVICE ]

    Name = L4REDIRECT_SERVICE

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = "ip:l4redirect=redirect list 111 to group SESM-Server duration 30 
frequency 180"  

-->

--> cd pbhk_service 

[ //localhost/Radius/UserLists/SESMServices/PBHK_SERVICE ]

    Name = PBHK_SERVICE

    Description = 

    Password = <encrypted>

    Enabled = TRUE

    Group~ = 

    BaseProfile~ = 

    AuthenticationScript~ = 

    AuthorizationScript~ = 

    UserDefined1 = 

    AllowNullPassword = FALSE

    Attributes/

    CheckItems/

--> ls attributes/

[ Attributes ]

    Cisco-AVPair = ip:portbundle=enable

-->

--> cd default-ppP-users/  

[ //localhost/Radius/Profiles/default-PPP-users ]  

    Name = default-PPP-users

    Description = 

    Attributes/

--> ls attributes/

[ Attributes ]

    Ascend-Idle-Limit = 1800

    Framed-MTU = 1500

    Framed-Protocol = PPP

    Framed-Routing = None

    Idle-timeout = 180 

    Service-Type = Framed

Copyright © 2005 Cisco Systems, Inc. All rights reserved.