Intelligent Services Gateway (ISG) is a
Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. This module describes how to configure ISG and Cisco Service Control Engine (SCE) to function as a single policy enforcement point for subscriber sessions.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for Configuring ISG Integration with SCE
An ISG platform, which can be any of the following (beginning in Cisco IOS Release 12.2(33)SRC):
Cisco 7200 router
Cisco 7301 router
Cisco 7600 router
An SCE platform
Two connections between the ISG device and the SCE:
A control path, through which the ISG device and SCE can exchange policy information
A data path that carries the subscriber traffic
A policy server configured to communicate with the ISG platform. The ISG-SCE integration removes any need for a communication layer between the policy server and the SCE.
Software Requirements
Configure control and access policies, accounting, session maintenance, and network access regulation for ISG. For details on these configurations, see the
Cisco IOSIntelligent Services Gateway Configuration Guide.
Cisco Software Release 3.1.0 or later on the SCE
Configure SCE appropriately. For instructions on configuring SCE, see the
Cisco Service Control Engine (SCE) Software Configuration Guide, Release 3.1.
Restrictions for Configuring ISG Integration with SCE
The following restrictions apply to the integration of the ISG and an SCE:
When an SCE policy is deactivated, the policy is removed from the session on the SCE, and the session policy reverts to the default SCE policy.
Only one SCE policy at a time may be applied to a session. Applying additional policies will override the policy previously applied on the SCE.
This feature requires a control bus communication protocol, which runs over RADIUS and RADIUS extensions (as specified in RFC 3576), operating in two modes; PUSH and PULL.
In PULL mode the ISG device waits for a query from the SCE.
In PUSH mode the download of an external feature is initiated by the ISG device as soon as an external service is activated on the subscriber session.
To work with the SCE for subscriber management, the control bus protocol must do the following:
Support pushing a session and make relevant changes to a session to the SCE.
Allow a session, its relevant identity, and the SCE policy profile to be pulled from the ISG device by using an identity-based query.
Support accounting events, including the following:
Correlating SCE accounting data to the appropriate ISG session.
Parsing the SCE accounting data to perform protocol translation.
The per-user IP subnet assigned to Point-to-Point Protocol (PPP) users during login is not communicated to SCE. A per-user static route is downloaded to PPP users through the framed-route RADIUS attribute during login. ISG does not send the per-user subnet address for a PPP session to SCE in the CoA provision session (ProvSess) attribute.
Information About Configuring ISG Integration with SCE
The ISG Integration with SCE feature integrates ISG and SCE at the policy plane level so that for purposes of subscriber provisioning, ISG and SCE function as a single logical entity. The ISG device and SCE communicate to manage subscriber sessions jointly, minimizing the requirements for coordination with additional external components. ISG handles subscriber management at Layer 4 and below. SCE is primarily focused at Layer 4 and above. When ISG and SCE are configured to work together, they provide tools for these functions:
Subscriber mapping--Subscriber awareness is distributed between ISG and the SCE. The shared subscriber session is referenced by both devices using a unique session identifier allocated by the ISG. Identity keys such as IP Address, IP Subnet, network access server (NAS) identifier, and NAS port are also associated to the session. SCE policies that should be enabled on the session are identified by their policy names.
Subscriber policy updates--Change subscriber policies in real time.
ISG and SCE Roles in Subscriber Management
The table below shows the specific roles of ISG and SCE in subscriber management.
Table 1 ISG and SCE Roles in Subscriber Management
Redirection and application-based policy management
Service security
Behavioral classification
URL caching and filtering
Value-added services
Parental controls
Usage and content billing (prepaid and postpaid)
1 Prepaid billing is not supported when a Cisco 7600 router is configured as the ISG device.
ISG pushes policies (or external services) to the SCE for a given subscriber session, in the form of RADIUS change of authorization (CoA) messages. External service activation can be triggered by the policy manager component inside the ISG or by an external authentication, authorization, and accounting (AAA) server. The SCE sees the ISG as the policy manager. ISG serves as a proxy for service activation requests from the external AAA server to the SCE. The SCE sends accounting records to the ISG. The ISG, if configured to do so, serves as a proxy that sends the accounting records to an external AAA server. SCE can also query the ISG about session information for unprovisioned sessions. ISG informs SCE when a session terminates by means of a RADIUS Packet of Disconnect (PoD).
Communication between the SCE and the ISG device is managed by an external policy delegation (EPD) handler module in Cisco IOS software. The EPD implements the control bus on the ISG and handles all messaging between the ISG device and SCE. This task is necessary to establish the parameters for the communication between the ISG device and the SCE, including the following:
Port to which CoA messages are sent from the ISG device and SCE
Port on which ISG should receive access, accounting, and connection management requests from SCE
Shared secret between the ISG device and SCE
To configure communication between SCE and the ISG device, enter the following commands on the ISG device.
Router(config-locsvr-radius)# client 10.10.10.1 key cisco port 1431
Configures client-specific details.
The IP address identifies the destination for CoA messages. If no port is configured, the default port (3799) is used. ISG sends CoA messages to the SCE to provision, update, or deactivate a session and activate or deactivate policies.
A shared secret configured for a specific client overrides the key configured using the
keyshared-secretcommand.
Step 5
authenticationportport-number
Example:
Router(config-locsvr-radius)# authentication port 1433
Specifies the port on which the EPD handler listens for session and identity query requests from SCE.
If no port is specified, the default port (1645) is used.
Step 6
accountingportport-number
Example:
Router(config-locsvr-radius)# accounting port 1435
Specifies the port on which the EPD handler listens for accounting and peering requests and maintenance packets from SCE.
If no port is specified, the default port (1646) is used.
Step 7
keyshared-secret
Example:
Router(config-locsvr-radius)# key xxxxxxxxxx
Configures the secret shared between the EPD handler and SCE.
This key is used if no per-client shared secret is configured.
Step 8
exit
Example:
Router(config-locsvr-rasius)# exit
Exits RADIUS server configuration mode.
Configuring SCE Connection Parameter on ISG
To configure the server connection management on either a per-server or a global basis, perform the steps in this section.
Downloads a service name from the SCE to the ISG device.
Configuring Services
To configure services, perform the steps in this section. You can configure this feature either on the ISG device, using the Cisco IOS command line interface (CLI) commands, or on the AAA server.
This section contains sample output of the showsubscriberpolicypeercommand.
show subscriber policy peer all
The following example shows sample output of the command when the all keyword is used.
Router# show subscriber policy peer all
Peer IP: 10.0.0.10
Conn ID: 11
Mode : PULL
State : ACTIVE
Version: 1.0
Conn up time: 00:00:14
Conf keepalive: 0
Negotiated keepalive: 1000
Time since last keepalive: 00:00:14
Remove owner on pull: TRUE
show subscriber policy peer all detail
The following example shows sample output for the showsubscriberpolicypeercommand when the detail keyword is added.
Router# show subscriber policy peer all detail
Peer IP: 10.0.0.10
Conn ID: 11
Mode : PULL
State : ACTIVE
Version: 1.0
Conn up time: 00:04:00
Conf keepalive: 0
Negotiated keepalive: 1000
Time since last keepalive: 00:04:00
Remove owner on pull: TRUE
Associated session details:
12.134.4.5session_guid_str
12.34.4.5session_guid_str
Configuration Examples for ISG Integration with SCE
The following example shows how to configure two SCEs, each with the same authentication and accounting ports. ISG handles CoA messages on port 1700 for one SCE and on default port 3799 for the other SCE. Peering is maintained for each SCE with the ISG via different keepalive intervals.
When a user session starts, POLICY-LOCAL is applied. If the userâs profile at the AAA server has auto-logon, the session will begin using the SCE-SERVICE-LOCAL service. This service has the SCE service-monitor facility enabled. If the user profile does not specify auto-logon to the SCE-SERVICE-LOCAL service, SCE will use its default values for the policy-name argument and the service-monitorcommand, which are configured at the SCE.
aaa accounting network service_acct start-stop group radius
aaa accounting network session_acct start-stop group radius
aaa server radius policy-device
authentication port 1343
accounting port 1345
message-authenticator ignore
client 10.10.10.1 port 1341 key cisco
class-map type traffic match-any bar
match access-group input 102
access-list 102 permit ip any any
policy-map type service sce_service
class type traffic bar
accounting aaa list service_acct
sg-service-type external-policy
policy-name gold
service-monitor enable
policy-map type control sce_policy
class type control always event session-start
1 service-policy type service sce_service
class type control always event acct-notification
1 proxy aaa list session_acct
SCE Control Bus Configuration Examples
SCE Control Bus Setup Configured in PUSH Mode
The following example shows how to configure the SCE control bus in PUSH mode:
scmp
scmp name ISG radius 10.10.10.2 secret cisco auth 1433 acct 1435
scmp subscriber send-session-start
interface LineCard 0
subscriber anonymous-group name all IP-range
192.168.12.0:0xffffff00 scmp name ISG
SCE Control Bus Setup Configured in PULL Mode
The following example shows how to configure the SCE control bus in PULL mode:
scmp
scmp name ISG radius 10.10.10.2 secret cisco auth 1433 acct 1435
interface LineCard 0
subscriber anaonymous-group name all IP-range
192.168.12.0:0xffffff00 scmp name ISG
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.
To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.
Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.
Feature Information for Configuring ISG Integration with SCE
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 2 Feature Information for ISG Integration with SCE
Feature Name
Releases
Feature Information
ISG: Policy Control: ISG-SCE Control Bus
12.2(33)SRC 12.2(33)SB 15.0(1)S
ISG accounting provides the means to bill for account or service usage. ISG accounting uses the RADIUS protocol to facilitate interaction between ISG and an external RADIUS-based AAA or mediation server.
In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router.
Note
The traffic class feature cannot be configured on the Cisco 7600 router.
In Cisco IOS Release 12.2(33)SB, support was added for the Cisco 10000 router.
The following commands were introduced or modified:
aaaserverradiuspolicy-device,
classtypecontrol,
clearsubscriberpolicypeer,
clearsubscriberpolicypeersession,policy-name,
policypeer,
proxy(ISGRADIUSproxy),
service-monitor,
sg-service-typeexternalpolicy,
showsubscriberpolicypeer.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
1 Prepaid billing is not supported when a Cisco 7600 router is configured as the ISG device.