Intelligent Services Gateway (ISG) is a
Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. ISG control policies are a means of defining the actions the system will take in response to specified conditions and events. A wide variety of system actions, conditions, and events can be combined using a consistent policy language, providing a flexible and precise way of configuring ISG. This module provides information about how to configure ISG control policies.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for ISG Control Policies
Authentication, authorization, and accounting (AAA) method lists must be configured prior to defining authentication and authorization actions.
Restrictions for ISG Control Policies
Control policies are activated for specific contexts, not directly on sessions. Control policies apply to all sessions hosted on the context.
Only one control policy map may be applied to a given context.
Control policies can be defined only through the routerâs command-line interface (CLI).
Not all actions may be associated with all events.
A new control class may not be inserted between existing control classes once a control policy map has been defined.
Control policies define the actions that the system will take in response to specified events and conditions. For example, a control policy can be configured to authenticate specific subscribers and then provide them with access to specific services.
A control policy is made of one or more control policy rules. A control policy rule is an association of a control class and one or more actions. The control class defines the conditions that must be met before the actions will be executed.
Three steps are involved in defining a control policy:
Create one or more control class maps.
A control class map specifies the conditions that must be met for a policy to be activated, and, optionally, the event that causes the class to be evaluated. A control class map may contain multiple conditions, each of which will evaluate to either true or false. Match directives can be used to specify whether all, any, or none of the individual conditions must evaluate true in order for the class to evaluate true.
Create a control policy map.
A control policy map contains one or more control policy rules. A control policy rule associates a control class map with one or more actions. Actions are numbered and executed sequentially.
Apply the control policy map.
A control policy map is activated by applying it to a context. A control policy map can be applied to one or more of the following types of contexts. In the following list, the context types are listed in order of precedence. For example, a control policy map that is applied to a PVC takes precedence over a control policy map that is applied to an interface.
Permanent virtual circuit (PVC)
Virtual circuit (VC) class
Virtual template
Subinterface
Interface
Global
In general, control policy maps that are applied to more specific contexts take precedence over policy maps applied to more general contexts.
Note
Traffic policies are another type of policy used by ISG. Traffic policies define the handling of data packets and are configured in service policy maps or service profiles. For more information about traffic policies, see the "Configuring ISG Subscriber Services" module.
Authentication failure for a subscriber may happen for an access-reject (which means a RADIUS server responded with a Reject) or due to an access request timeout (RADIUS server is unreachable).
Using ISG control policies, and actions configured for the 'radius-timeout' and 'access-reject' events, the system can distinguish between the different reasons for an authentication failure. Different events are thrown by the system (for example, a received authentication reject or an unavailable RADIUS server event). This allows the control policy to specify different actions for each type of authentication failure. For example, if the RADIUS server is down or unreachable, temporary access can be given to subscribers.
This feature is available only for IP-based sessions for subscriber authentication. This feature does not support the Point-to-Point Protocol over Ethernet (PPPoE) sessions.
Uses of Control Policies
Use control policies to configure an ISG to perform specific actions in response to specific events and conditions. For example, control policies could be used for the following purposes:
To activate a default service when a subscriber session is first detected
To sequence the gathering of subscriber identity, where a control protocol exists on the access side
To determine how the system responds to an idle timeout or to a subscriber who has run out of credit
To enable transparent automatic login, which enables authorization on the basis of an IP address or MAC address
To configure the maximum amount of time a session can remain unauthenticated
To send periodic session state information to other devices
A control class map contains conditions that must be met for a control policy to be executed. A control class map can contain one or more conditions. Perform this task to configure a control class map.
Router(config)# class-map type control match-all class1
Creates or modifies a control class map, which defines the conditions under which the actions of a control policy map will be executed, and enters control class map mode.
Router(config-control-classmap)# match authenticated-username regexp "admin@.*com"
(Optional) Creates a condition that evaluates true if a subscriberâs authenticated username matches the specified username.
Step 12
matchdnis {dnis | regexpregular-expression}
Example:
Router(config-control-classmap)# match dnis reg-exp 5551212
(Optional) Creates a condition that evaluates true if a subscriberâs Dialed Number Identification Service number (DNIS number, also referred to as called-partynumber) matches the specified DNIS number.
(Optional) Creates a condition that evaluates true if a subscriberâs access media type matches the specified media type.
Step 14
matchmlp-negotiated {no | yes}
Example:
Router(config-control-classmap)# match mlp-negotiated yes
(Optional) Creates a condition that evaluates true or false depending on whether the subscriberâs session was established using multilink PPP negotiation.
If the yes keyword is used, the condition evaluates true if the subscriberâs session was established using multilink PPP negotiation.
Router(config-control-classmap)# match tunnel-name regexp L.*
(Optional) Creates a condition that evaluates true if a subscriberâs virtual private dialup network (VPDN) tunnel name matches the specified tunnel name.
Router(config-control-classmap)# match unauthenticated-username regexp examplename1
(Optional) Creates a condition that evaluates true if a subscriberâs unauthenticated username matches the specified username.
Step 24
matchvrf {vrf-name | regexpregular-expression}
Example:
Router(config-control-classmap)# match vrf regexp examplename2
(Optional) Creates a condition that evaluates true if a subscriberâs VPN routing and forwarding (VRF) matches the specified VRF.
Configuring a Control Policy Map
A control policy map contains one or more control policy rules that associate a control class with one or more actions. Perform this task to configure a control policy map.
Note
The actions that can be configured in a policy rule depend on the type of event that is specified by the classtypecontrol command. For example, if the account-logoff event is specified, the only action that can be configured in that policy rule is service. The procedure in this section shows all actions that can be configured in a policy map.
Applying a Control Policy Map Globally on the Router
Perform this task to apply a control policy globally.
SUMMARY STEPS
1.enable
2.configureterminal
3.service-policytypecontrolpolicy-map-name
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password if prompted.
Step 2
configureterminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
service-policytypecontrolpolicy-map-name
Example:
Router(config)# service-policy type control policy1
Applies a control policy.
Applying an ISG Control Policy Map to an Interface or Subinterface
Perform this task to apply an ISG control policy to an interface or subinterface.
SUMMARY STEPS
1.enable
2.configureterminal
3.interfacetypenumber[.subinterface-number]
4.service-policytypecontrolpolicy-map-name
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password if prompted.
Step 2
configureterminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
interfacetypenumber[.subinterface-number]
Example:
Router(config)# interface gigabitethernet 0/1.1
Specifies an interface and enters interface configuration mode.
Step 4
service-policytypecontrolpolicy-map-name
Example:
Router(config-if)# service-policy type control policy1
Applies a control policy.
Applying an ISG Control Policy Map to a Virtual Template
Perform this task to apply an ISG control policy map to a virtual template.
SUMMARY STEPS
1.enable
2.configureterminal
3.interfacevirtual-templatenumber
4.service-policytypecontrolpolicy-map-name
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password if prompted.
Step 2
configureterminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
interfacevirtual-templatenumber
Example:
Router(config)# interface virtual-template0
Creates a virtual template interface and enters interface configuration mode.
Step 4
service-policytypecontrolpolicy-map-name
Example:
Router(config-if)# service-policy type control policy1
Applies a control policy.
Applying an ISG Control Policy Map to an ATM VC Class
A VC class is a set of preconfigured VC parameters that are configured and applied to a particular VC or ATM interface. Perform this task to apply an ISG control policy map to an ATM VC class.
SUMMARY STEPS
1.enable
2.configureterminal
3.vc-classatmvc-class-name
4.service-policytypecontrolpolicy-map-name
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password if prompted.
Step 2
configureterminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
vc-classatmvc-class-name
Example:
Router(config)# vc-class atm class1
Creates an ATM VC class and enters ATM VC class configuration mode.
A VC class can be applied to an ATM interface, subinterface, or VC.
Step 4
service-policytypecontrolpolicy-map-name
Example:
Router(config-vc-class)# service-policy type control policy1
Applies a control policy.
Applying a Control Policy Map to an ATM PVC
Perform this task to apply an ISG control policy to an ATM PVC.
Control Policy for Layer 2 Access and Service Provisioning Example
The following example shows how to configure a control policy that produces the following results:
VPDN forwarding is applied to anyone dialing in from âexample1.comâ.
Access to locally terminated Layer 3 network resources is provided to anyone dialing in from âexample2.comâ.
Anyone else is barred.
! Configure the control class maps.
class-map type control match-all MY-FORWARDED-USERS
match unauthenticated-domain "example1.com"
!
class-map type control match-all MY-LOCAL-USERS
match unauthenticated-domain "example2.com"
!
! Configure the control policy map.
policy-map type control MY-POLICY
class type control MY-FORWARDED-USERS event session-start
1 service-policy type service identifier nas-port
2 service local
!
class type control MY-LOCAL-USERS event session-start
1 service local
!
class type control always event session-start
2 service disconnect
!
! Apply the control policy to dialer interface 1.
interface Dialer1
service-policy type control MY-POLICY
Control Policy for Restricting Access on the Basis of Interface and Access Media Example
This example shows how to configure a control policy to allow access only to users who enter the router from a particular interface and access type. In this case, only PPPoE users will be allowed; everyone else is barred.
The first condition class map âMATCHING-USERSâ evaluates true only if all of the lines within it also evaluate true; however, within âMATCHING-USERSâ is a nested class map (second condition), âNOT-ATMâ. This nested class map represents a subcondition that must also evaluate to true. Note that the class map âNOT-ATMâ specifies âmatch-noneâ. This means that âNOT-ATMâ evaluates to true only if every condition line within it evaluates to false.
The third condition specifies matching on the NAS port associated with this subscriber. Specifically, only subscribers that arrive on a Gigabit Ethernet interface and on slot 3 will evaluate to true.
! Configure the control class maps.
class-map type control match-all MATCHING-USERS
class type control NOT-ATM
match media ether
match nas-port type ether slot 3
!
class-map type control match-none NOT-ATM
match media atm
!
If the conditions in the class map âMATCHING-USERSâ evaluate to true, the first action to be executed is to authenticate the user. If authentication is successful, the service named âservice1â will be downloaded and applied. Finally, a Layer 3 service is provided.
If âMATCHING-USERSâ is not evaluated as true, the âalwaysâ class will apply, which results in barring anyone who does not match âMATCHING-USERSâ.
! Configure the control policy map.
policy-map type control my-pppoe-rule
class type control MATCHING-USERS event session-start
1 authenticate aaa list XYZ
2 service-policy type service service1
3 service local
!
class type control always
1 service disconnect
!
! Apply the control policy to an interface.
interface gigabitethernet3/0/0
service-policy type control my-pppoe-rule
Finally, the policy is associated with an interface.
Default Method Lists
If you specify the default method list for any of the control policy actions, the default list will not display in the output from the showrunning-config command. For example, if you configure the following command:
Router(config-control-policymap-class-control)# 1 authenticate aaa list default
The following will display in the output from the showrunning-config command:
1 authenticate
Control Policy for ISG Prepaid Billing Support Example
The following example shows a control policy configured to redirect subscriber packets to the server group âredirect-sgâ when the credit-exhausted event occurs:
service-policy type control RULEA
!
policy-map type control RULEA
class type control always event credit-exhausted
1 service-policy type service redirectprofile
!
policy-map type service redirectprofile
class type traffic CLASS-ALL
redirect to group redirect-sg
policy-map type service mp3
class type traffic CLASS-ACL-101
authentication method-list cp-mlist
accounting method-list cp-mlist
prepaid conf-prepaid
subscriber feature prepaid conf-prepaid
threshold time 20
threshold volume 0
method-list accounting ap-mlist
method-list authorization default
password cisco
Control Policies for Automatic Subscriber Login Example
In the following example, if the client is from the a subnet, automatic subscriber login is applied and an authorization request is sent to the list TALLIST with the subscriberâs source IP address as the username. If the authorization request is successful, any automatic activation services specified in the returned user profile are activated for the session and the execution of rules within the control policy stops. If the authorization is not successful, the rule execution proceeds, and the subscriber is redirected to the policy server to log in. If the subscriber does not log in within five minutes, the session is disconnected.
interface GigabitEthernet0/0/0
service-policy type control RULEA
aaa authentication login TALLIST group radius
aaa authentication login LOCAL local
access-list 100 permit ip any any
class-map type traffic match-any all-traffic
match access-group input 100
match access-group output 100
policy-map type service redirectprofile
class type traffic all-traffic
redirect to ip 10.0.0.148 port 8080
class-map type control match-all CONDA
match source-ip-address 209.165.201.1 255.255.255.0
!
class-map type control match-all CONDF
match timer TIMERB
match authen-status unauthenticated
policy-map type control RULEA
class type control CONDA event session-start
1 authorize aaa list TAL_LIST password cisco identifier source-ip-address
2 apply aaa list LOCAL service redirectprofile
3 set-timer TIMERB 5 minutes
class type control CONDF event timed-policy-expiry
No new or modified RFCs are supported, and support for existing RFCs has not been modified.
--
Technical Assistance
Description
Link
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.
To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.
Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1 Feature Information for ISG Control Policies
Feature Name
Releases
Feature Configuration Information
ISG: Policy Control: Policy: Domain Based (Autodomain, Proxy)
12.2(28)SB 12.2(33)SRC 15.0(1)S
ISG control policies manage the primary services and rules used to enforce particular contracts. These policies include programmable interfaces to dynamic triggers and conditional logic to be applied to flows within a session, or other characteristics of a session, upon meeting the policy criteria. Policies can be configured to interpret the domain as a request to activate the service associated with that domain name, allowing users to automatically receive services in accordance with the domain to which they are attempting to connect.
In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router.
ISG: Policy Control: Policy: Triggers
12.2(28)SB 12.2(33)SRC 15.0(1)S
ISG control policies can be configured with time-based, volume-based, and duration-based policy triggers. Time-based triggers use an internal clock, allowing policies to be applied at specific times. Volume-based triggers are based on packet count; when the packet count reaches a specified value, the specified policy is applied. Duration-based triggers are based on an internal timer. Upon expiration of the timer, the specified policy is applied.
In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router.
ISG: Policy Control: Multidimensional Identity per Session
12.2(28)SB 12.2(33)SRC 15.0(1)S
ISG control policies provide a flexible way to collect pieces of subscriber identity information during session establishment. Control policies also allow session policy to be applied iteratively as more elements of identity information become available to the system.
In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router.
ISG: Policy Control: Cisco Policy Language
12.2(28)SB 12.2(33)SRC
ISG control policies are a structured replacement for feature-specific configuration commands and allow configurable functionality to be expressed in terms of an event, a condition, and an action. Control policies provide an intuitive and extensible framework, with a consistent set of CLI commands, for specifying system behavior.
In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router.
ISG: Policy Control: Differentiated Initial Policy Control
12.2(33)SRE 12.2(33)XNE
This features provides the ability to distinguish RADIUS authentication rejects from RADIUS server unavailability. It allows minimal or temporary network access to the subscribers when the RADIUS servers are down or cannot be accessed because of network issues or when an authentication reject is received for a subscriber.
In Cisco IOS Release 12.2(33)XNE, support was added for the Cisco 10000 Series Routers.
The following command was introduced or modified:
classtypecontrol
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.