Configures the APN's authentication parameters.
Product
GGSN
P-GW
PDG/TTG
SAEGW
Privilege
Security Administrator, Administrator
Mode
Exec > Global Configuration > Context Configuration > APN
Configuration
configure > context
context_name
> apn
apn_name
Entering the above command sequence results in the following prompt:
[context_name]host_name(config-apn)#
Syntax
authentication [ [ msid-auth | imsi-auth [ password-use-pco | username-strip-apn | prefer-chap-pco ] | msisdn-auth [ password-use-pco | username-strip-apn | username-append-apn | prefer-chap-pco ] | eap initial-access-request [ authenticate-authorize | authenticate-only ] | [ allow-noauth [ pco-usernmae { chap | pap } ] ] [ chap preference [ convert-to-mschap ] ] [ mschap preference ] [ pap preference ] ]
default authentication
default
Sets the default authentication type for this APN. By default
allow-noauth is the type for authentication
for an APN.
msid-auth
Obsolete. Use
imsi-auth .
imsi-auth
Default: Disabled.
Configures the APN to attempt to authenticate the subscriber based on
their International Mobile Subscriber Identification (IMSI) number.
msisdn-auth
Default: Disabled.
Configures the APN to attempt to authenticate the subscriber based on
their Mobile Station International Integrated Services Digital Network (MSISDN)
number as described in the
Usage section of this command.
username-strip-apn
Default: Disabled.
This keyword if enabled, either with
msisdn-auth or
imsi-auth strips the APN name from the user
name
msisdn @apn or
imsi @apn received
from AAA and makes the user name as
msisdn or
imsi respectively.
username-append-apn
Default: Disabled.
This keyword if enabled, works only with pap and chap options. If
username-append-apn option enabled in authentication CLI, then apn name will be
appended to the pco received username and same username will be used across all
interfaces.
password-use-pco
Default: Disabled.
This keyword, if enabled, uses the password received through Protocol
Configuration Options (PCO) from AAA for authentication.
prefer-chap-pco
Default: Disabled.
If this keyword along with msisdn-auth/imsi-auth is enabled, GGSN
performs Challenge Handshake Authentication Protocol (CHAP) authentication, if
CHAP parameters are received in Protocol Configuration Options (PCO). However,
chap username would be constructed as
msisdn @apn /
imsi @apn and chap
challenge, chap response parameters should be used as it is from CHAP
parameters received in the PCO IE. If CHAP parameters are not received in the
PCO IE of the CPC Request, GGSN does normal Password Authentication Protocol
(PAP) authentication with PAP username as
msisdn @apn /
imsi @apn (ignoring
any PAP username if received).
eap initial-access-request
Default: Enabled
Configures the type of initial access request to be used in Diameter
EAP (Extensible Authentication Protocol) request. This feature is applicable to
only Diameter-based AAA interface and not applicable to RADIUS or any other
type of AAA interface.
authenticate-authorize
Default: Enabled
Configures the "authenticate and authorize" type of initial access
request to be used in a Diameter EAP request.
authenticate-only
Default: Disabled
Configures the "authenticate only" type of initial access request to
be used in a Diameter EAP request.
allow-noauth
Default: Enabled
Configures the APN to not perform authentication for PDP contexts as
described in the
Usage section.
pco-username
Default: Disabled
This option is used in conjunction with allow-noauth. It allows
session to get established when PCO contains both pap and chap in
authentication disabled case.
chap
preference
Default: Disabled
Configures the APN to attempt to use CHAP to authenticate the
subscriber as described in the
Usage section of this command.
A
preference must be specified in conjunction
with this option. Priorities specify which authentication protocol should be
attempted first, second, third and so on. It must be an integer from 1 through
1000. The lower the integer, the higher the preference.
convert-to-mschap
Default: Disabled
If enabled, the CHAP parameters received with the length of 49 bytes,
the AAAmgr converts it to MSCHAP.
mschap
preference
Default: Disabled
Configures the APN to attempt to use the Microsoft Challenge Handshake
Authentication Protocol (MSCHAP) to authenticate the subscriber as described in
the
Usage section of this command.
A
preference can be specified in conjunction
with this option. Priorities specify which authentication protocol should be
attempted first, second, third and so on. It must be an integer from 1 through
1000. The lower the integer, the higher the preference.
pap
preference
Default: Disabled
Configures the APN to attempt to use PAP to authenticate the
subscriber as described in the
Usage section of this command.
A
preference must be specified in conjunction
with this option. Priorities specify which authentication protocol should be
attempted first, second, third and so on. It must be an integer from 1 through
1000. The lower the integer, the higher the preference.
Usage Guidelines
Use this command to specify how the APN profile should handle PDP
context authentication and what protocols to use (if any). The ability to
configure this option is provided to accommodate the fact that not every MS
will implement the same authentication protocols.
The authentication process varies depending on whether the PDP context
is of type IP or PPP. Table given in this section describes these differences.
For IP PDP contexts, the authentication protocol and values will be
passed from the SGSN as Protocol Configuration Options (PCOs) within the create
PDP context PDU to the GGSN. The GGSN requires that the authentication protocol
is specified by this command (with no regard to priority) and will use this
information to authenticate the subscriber.
Table 1. Authentication Process Variances Between PDP Context Type
Authentication Mechanism
|
IP PDP Context Behavior
|
PPP PDP Context Behavior
|
allow-noauth
|
Allows the session even if the PCOs do not match any of the
configured algorithms.
If the there was no match and the
aaa constructed-nai authentication
parameter is enabled in the authentication context, the system attempts to
determine a subscriber profile (via PAP with no password) using the
subscriber's MSISDN as the username.
|
Allows the session with no authentication algorithm selected.
If the
aaa constructed-nai authentication
parameter is enabled in the authentication context, the system attempts to
determine a subscriber profile (via PAP with no password) using the
subscriber's MSISDN as the username.
|
chap
|
If also specified in the PCOs, this protocol will be used to
authenticate the subscriber.
|
Attempts this protocol according to its configured priority.
If accepted by the remote end of the PPP connection, this
protocol will be used to provide authentication.
|
mschap
|
If also specified in the PCOs, this protocol will be used to
authenticate the subscriber.
|
Attempts this protocol according to its configured priority.
If accepted by the remote end of the PPP connection, this
protocol will be used to provide authentication.
|
pap
|
If also specified in the PCOs, this protocol will be used to
authenticate the subscriber.
If this protocol is used is specified and the
allow-noauth parameter is disabled,
the system will attempt to use the APN's default username/password specified by
the
outbound command for authentication via PAP.
|
Attempts this protocol according to its configured priority.
If accepted by the remote end of the PPP connection, this
protocol will be used to provide authentication.
|
msid-auth
|
Obsolete. Use
imsi-auth .
|
Obsolete. Use
imsi-auth .
|
imsi-auth
|
Values in the PCOs are ignored.
The subscriber's IMSI is used as the username for PAP
authentication. No password is used.
|
The subscriber's IMSI is used as the username for PAP
authentication. No password is used.
|
msisdn-auth
|
Values in the PCOs are ignored.
The subscriber's MSISDN is used as the username for PAP
authentication. No password is used.
|
Option not available.
|
Example
The following command would configure the system to attempt subscriber
authentication first using MSCHAP, then CHAP, and finally PAP. Since the
allow-noauth command was also issued, if all
attempts to authenticate the subscriber using these protocols fail, then the
subscriber would be still be allowed access.
authentication mschap 1 chap 2 pap 3 allow-noauth
To enable
imsi-auth or
msisdn-auth , the following command instances
must be issued:
authentication imsi-auth
authentication msisdn-auth