In traditional internet deployment architectures, the service provider provide WiFi access to subscribers based on web-based authentication. These deployment architecture might use access points (AP) which are incapable of RADIUS-based authentication triggers. These access points are only capable of relaying DHCP messages between the subscriber's user equipment (UE) and the DHCP server, to obtain the IP address for the UE, after which the AP forwards data packets between the UE and the default gateway.

With this feature, the SaMOG Gateway can initiate session creation when a DHCP message is received from the AP over the EoGRE tunnel. This feature integrates SaMOG as a gateway in deployment architectures where the AP/WLC cannot initiate RADIUS (Access-Request) messages.

The DHCP trigger-based session creation feature does not require a separate license. However, a Local Breakout - Enhanced license is required to configure a local P-GW.

Contact your Cisco account representative for detailed information on specific licensing requirements.

The SaMOG Gateway receives the location information in the AP-MAC or AP-MAC:SSID format in either the Circuit-ID (1) or Remote-ID (2) sub-option in the DHCP Relay Agent Information Option (option 82). Currently, the maximum supported length for DHCP option 82 is 64 bytes, and the maximum SSID value supported is 32 bytes. Formats other than AP-MAC or AP-MAC:SSID is considered as an opaque value. The SaMOG Gateway validates the Circuit-ID or Remote-ID sub-options based on the CLI configured under the TWAN Profile Configuration mode. For more configuration information, refer Configuring DHCP Trigger-based Session Creation.

When the sub-option contains the location information in AP-MAC:SSID format, the SaMOG Gateway uses the SSID for policy selection, and selects the AAA server based on the policy.

During subscriber authentication with the AAA server, the SaMOG Gateway includes the processed Circut-ID or Remote-ID values (AP-MAC, AP-MAC:SSID, or opaque value) in Called-station-ID attribute in the Access-Request message towards the AAA server. While responding to the DHCP Discover/Request messages containing the DHCP Relay Agent Information Option (option 82), the SaMOG Gateway copies the DHCP option 82 value as it is in the DHCP-Offer/Ack messages.

Currently, the SaMOG Gateway supports AP-MAC and AP-MAC/SSID options in the following formats:

AP-MAC (separated by hyphen (-), colon (:), or period (.):

• XX-XX-XX-XX-XX-XX

• XX:XX:XX:XX:XX:XX

• XXXX.XXXX.XXXX

Other AP-MAC formats are not parsed.

AP-MAC and SSID (separated by colon (:) or semi-colon (;)):

• XX-XX-XX-XX-XX-XX:SSID

• XX-XX-XX-XX-XX-XX;SSID

• XX:XX:XX:XX:XX:XX:SSID

• XX:XX:XX:XX:XX:XX;SSID

• XXXX.XXXX.XXXX:SSID

• XXXX.XXXX.XXXX;SSID

This feature complies with the following standards:

• RFC 2131 (Handling of DHCP messages)

• RFC 3046 (DHCP Relay Agent Information Option)

The interface between the AP/WLC and the SaMOG Gateway is currently not standardized, and does not require any compliance.

Use the following configuration to enable DHCP trigger-based session creation:

configure 
    twan-profile twan_profile_name 
        access-type eogre 
        session-trigger { dhcp location { circuit-id | remote-id } | radius } 
        end 

Notes:

• Use the session-trigger command under the TWAN Profile Configuration Mode to enable DHCP trigger-based session creation.

• Use the sub-option circuit-id or remote-id for the SaMOG Gateway to choose the UE location from the DHCP-Relay-Agent-Info option (DHCP option 82).

• Use the default session-trigger command to reset the configuration to its default value.

• If previously configured, use the no session-trigger dhcp location command to remove the configuration.

• Default: RADIUS-based session creation

• If the TWAN profile is configured with a DHCP session trigger, the access type must be EoGRE.

• At least one TWAN profile should have the DHCP session trigger enabled. If multiple TWAN profile configurations have DHCP session trigger enabled, the SaMOG Gateway will use the first configured TWAN profile with DHCP session trigger.

Use the following configuration to enable the SaMOG Gateway to send the mapped RADIUS attributes to the AAA server.

For Default AAA Server Group:

configure 
    context context_name 
        radius attribute authentication nas-identifier 
        radius attribute authentication nas-port-id 
        end 

For Specific AAA Server Group:

configure 
    context context_name 
        aaa group group_name 
            radius attribute authentication nas-identifier 
            radius attribute authentication nas-port-id 
            end 

Notes:

• If previously configured, use the no radius attribute authentication nas-identifier command and no radius attribute authentication nas-port-id commands to remove the configuration.

• By default, nas-identifier is enabled and nas-port-id is disabled.

• If these commands are configured under the Global Context Configuration Mode, the configuration will be applicable to the default AAA server group.

• If these commands are configured under the respective AAA server group, the configuration will be applicable to that AAA server group only.

• For expected functionality, both nas-identifier and nas-port-id keywords must be enabled.

• When radius attribute authentication nas-identifier is configured, also configuring radius attribute nas-identifier under the Global Context Configuration or AAA Server Group Configuration Mode will overwrite the VLAN ID received from the UE.

Use the show subscribers samog-only command to verify if a subscriber session is triggered on receiving DHCP messages.

show subscribers samog-only full

Session Trigger Type: DHCP 

Use the shown twan-profile command to verify if DHCP trigger-based session creation is enabled for the TWAN profile.

show twan-profile name twan_profile_name

Session Trigger Type: DHCP 

The following bulks statistics included in the SaMOG schema support this feature: