The SaMOG Gateway supports the Web Authorization feature that enables SaMOG to register the subscriber's non-SIM UEs by authenticating the subscriber through a web portal (using username and password). On successful authentication, the AAA server stores the subscriber profile (APN, IMSI, QoS) from the HLR/HSS for the subscriber's device, and SaMOG establishes the network connection for the UE.

The Web Authorization feature has two phases:

• Pre-Authentication Phase – SaMOG allocates the IP address for the UE locally, and redirects the UE traffic to a web portal for subscriber authentication.

• Post-Authentication/Transparent Auto Logon (TAL) phase – P-GW allocates the IP address to the UE.

During transition between the two phases, the subscriber session disconnects. The Web Authorization feature can also be configured where the transition between the pre-authentication and post-authentication phases are achieved without session disconnection (optimized Web Authorization feature).

Refer the Web Authorization and Optimized Web Authorization sections in the SaMOG Administration Guide for more information on these features.

The Web Authorization Session Logout feature provides additional functionality to the Web Authorization feature. In release 21.1 and earlier, when the subscriber logs out of the portal or exhausts the quota, SaMOG clears the subscriber session on receiving a trigger from the P-GW or PCRF.

In Release 21.2 and later, SaMOG does not clear the subscriber session when the subscriber logs out of the portal or exhausts the quota. The subscriber session is instead moved from the post-authentication phase to the pre-authentication phase, and retained until the subscriber logs back in, or the timeout period (configurable) expires. This functionality enables operators to provide session stickiness for subscribers by retaining the subscriber’s Wi-Fi network connection.

The Web Authorization Session Logout feature requires the following licenses:

• SaMOG General license

• SaMOG Web Authorization feature license (to configure web authorization)

• SaMOG Local Breakout feature license (to configure a local P-GW)

Contact your Cisco account representative for detailed information on specific licensing requirements.

When the subscriber logs out from the web portal or exhausts the quota, the AAA Server initiates a subscription change request to SaMOG. The AAA Server does not include the APN subscription, vIMSI, or NAI information for the session (portal redirection rulebase, ACL name, IP pool name and Gi context names are optionally shared). On receiving the subscription change request without the user identity information, SaMOG verifies if the subscriber session is in post-authentication phase. SaMOG then switches the session back to the pre-authentication phase by initiating an address transfer from the local P-GW (through the VPN manager) to SaMOG, and installing the redirection rules and ACLs. CDRs used during the post-authentication phase are released when the session moves to the pre-authentication phase. New CDRs are used if the session moves back to the post-authentication phase.

The subscriber session will be retained in the pre-authentication phase until the subscriber re-authenticates through the web portal, or the session in the pre-authentication phase timeout period expires. The timeout period can be configured using the disconnect preauth-wait-time command under the MRME Configuration Mode.

Architectural Limitations

• This feature is currently not support on GTPv1 and PMIPv6 towards P-GW.

• Only AAA Diameter-based authentication is supported. AAA Radius-based authentication is currently not supported.

• Inter-chassis session recovery (ICSR) is currently not supported with this feature.

Use the following configuration to configure the timeout for the subscriber’s session after the session moves from the post-authentication phase to the pre-authentication phase:

config 
    context context_name 
        mrme-service service_name 
            disconnect preauth-wait-time minutes 
            end 

Notes:

• Use the default disconnect preauth-wait-time command to restore the configuration to its default value.

• Default: 5 minutes

• minutes must be an integer from 1 through 60.