Intelligent Services Gateway (ISG) is a
Cisco IOS software feature set that provides a structured framework in which edge devices can deliver flexible and scalable services to subscribers. The ISG RADIUS proxy feature enables ISG to serve as a proxy between a client device that uses RADIUS authentication and an authentication, authorization, and accounting (AAA) server. When configured as a RADIUS proxy, ISG is able to âsniffâ (look at) the RADIUS packet flows and, on successful authentication, it can transparently create a corresponding ISG session. This document describes how to configure ISG as a RADIUS proxy.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Prerequisites for ISG RADIUS Proxy
The Cisco IOS image must support AAA and ISG.
Restrictions for ISG RADIUS Proxy
Wireless Internet service provider roaming (WISPr) attributes are not supported.
Public wireless LANs (PWLANs) and wireless mesh networks can contain hundreds of access points, each of which must send RADIUS authentication requests to a AAA server. The ISG RADIUS proxy functionality allows the access points to send authentication requests to ISG, rather than directly to the AAA server. ISG relays the requests to the AAA server. The AAA server sends a response to ISG, which then relays the response to the appropriate access point.
When serving as a RADIUS proxy, ISG can pull user-specific data from the RADIUS flows that occur during subscriber authentication and authorization, and transparently create a corresponding IP session upon successful authentication. This functionality provides an automatic login facility with respect to ISG for subscribers that are authenticated by devices that are closer to the network edge.
When configured as a RADIUS proxy, ISG proxies all RADIUS requests generated by a client device and all RADIUS responses generated by the corresponding AAA server, as described in RFC 2865, RFC 2866, and RFC 2869.
ISG RADIUS proxy functionality is independent of the type of client device and supports standard authentication (that is, a single Access-Request/Response exchange) using both Password Authentication Protocol (PAP) and Challenge Handshake Authentication Protocol (CHAP), Access-Challenge packets, and Extensible Authentication Protocol (EAP) mechanisms.
In cases where authentication and accounting requests originate from separate RADIUS client devices, ISG associates all requests with the appropriate session through the use of correlation rules. For example, in a centralized PWLAN deployment, authentication requests originate from the wireless LAN (WLAN) access point, and accounting requests are generated by the Access Zone Router (AZR). The association of the disparate RADIUS flows with the underlying session is performed automatically when the Calling-Station-ID (Attribute 31) is sufficient to make the association reliable.
Following a successful authentication, authorization data collected from the RADIUS response is applied to the corresponding ISG session.
Sessions that were created using ISG RADIUS proxy operation are generally terminated by receipt of an Accounting-Stop packet.
ISG RADIUS Proxy Handling of Accounting Packets
By default, ISG RADIUS proxy responds locally to accounting packets it receives. The accountingmethod-list command can be used to configure ISG to forward RADIUS proxy client accounting packets to a specified server. Forwarding of accounting packets can be configured globally for all RADIUS proxy clients or on a per-client basis.
RADIUS Client Subnet Definition
If ISG is acting as a proxy for more than one client device, all of which reside on the same subnet, the clients may be configured using a subnet definition rather than a discrete IP address for each device. This configuration method results in the sharing of a single configuration by all the client devices.
ISG RADIUS Proxy Support for Mobile Wireless Environments
ISG RADIUS proxy uses mobile wireless-specific processes to provide support for Gateway General Packet Radio Service (GPRS) Support Node (GGSN) environments. The following sections describe ISG RADIUS proxy attribute support and processing:
Attribute Processing and RADIUS Request Correlation
When authentication and accounting requests originate from separate RADIUS client devices, ISG uses correlation rules to associate all the requests with the appropriate session. The association of the disparate RADIUS flows with the underlying session is performed automatically when the Calling-Station-ID (Attribute 31) is sufficient to make the association reliable.
In mobile wireless environments attribute processing and the correlation of RADIUS requests with a session are implemented differently than in a PWLAN environment. For example, in a PWLAN environment the Attribute 31 is a MAC address, and in a GGSN environment Attribute 31 is a Mobile Station Integrated Services Digital Network (MSISDN), which is a plain number or alphanumeric string. In addition, in a GGSN environment the correlation of RADIUS requests can be performed using attributes other than Attribute 31.
ISG RADIUS proxy supports mobile wireless environments by allowing you to specify whether the RADIUS-proxy client uses a MAC or MSISDN format for Attribute 31. The format is specified using thecalling-station-idformat command. In addition, you can use the session-identifier command to configure ISG RADIUS proxy to use other attributes (apart from Attribute 31) to perform RADIUS request correlation.
3GPP Attribute Support
In GGSN environments ISG RADIUS proxy must understand and parse the Third Generation Partnership Project (3GPP) attributes described in the table below. These attributes form part of the accounting requests.
Table 1 3GPP Attributes Supported by ISG RADIUS Proxy
Attribute
Description
Vendor ID/type
3GPP-IMSI
The International Mobile Subscriber Identity (IMSI) for the user.
10415/1
3GPP-Charging-Id
The charging ID for this Packet Data Protocol (PDP) context (this together with the GGSN address constitutes a unique identifier for PDP context).
10415/2
3GPP-SGSN-Address
The Serving GPRS Support Node (SGSN) address that is used by the GPRS Tunneling Protocol (GTP) control plane for handling of control messages. It may be used to identify the Public Line Mobile Network (PLMN) to which the user is attached.
10415/6
Benefits of ISG RADIUS Proxy
Use of ISG RADIUS proxy has the following benefits:
Allows the complete set of ISG functionality to be applied to EAP subscriber sessions.
Allows an ISG device to be introduced into a network with minimum disruption to the existing network access server (NAS) and AAA servers.
Simplifies RADIUS server configuration because only the ISG, not every access point, must be configured as a client.
Perform this task to configure ISG to initiate an IP session upon receipt of a RADIUS proxy message from a RADIUS client.
SUMMARY STEPS
1.enable
2.configureterminal
3.interfacetypenumber
4.ipsubscriber {interface | l2-connected| routed}
5.initiatorradius-proxy
6.end
DETAILED STEPS
Command or Action
Purpose
Step 1
enable
Example:
Router> enable
Enables privileged EXEC mode.
Enter your password if prompted.
Step 2
configureterminal
Example:
Router# configure terminal
Enters global configuration mode.
Step 3
interfacetypenumber
Example:
Router(config)# interface fastethernet 1/0/0
Specifies an interface for configuration and enters interface configuration mode.
Step 4
ipsubscriber {interface | l2-connected| routed}
Example:
Router(config-if)# ip subscriber routed
Enables ISG IP subscriber support on an interface, specifies the access method that IP subscribers will use to connect to ISG on an interface and enters subscriber configuration mode.
Step 5
initiatorradius-proxy
Example:
Router(config-subscriber)# initiator radius-proxy
Configures ISG to initiate IP sessions upon receipt of any RADIUS packet.
Step 6
end
Example:
Router(config-subscriber)# end
Exits the current configuration mode and returns to privileged EXEC mode.
Configuring ISG RADIUS Proxy Global Parameters
Perform this task to configure ISG RADIUS proxy parameters that are applied by default to all RADIUS proxy clients. Client-specific parameters can also be configured and take precedence over this global configuration. To specify a client-specific configuration, see the "Configuring ISG RADIUS Proxy Client-Specific Parameters" section.
Perform this task to configure client-specific parameters for the ISG RADIUS proxy. This configuration applies to the specified client or subnet only. The client-specific configuration takes precedence over the global ISG RADIUS proxy configuration.
The following example configures ISG to serve as a RADIUS proxy and to send RADIUS packets to the method list called RP. FastEthernet interface 0/0 is configured to initiate IP sessions upon receipt of RADIUS packets.
!
aaa new-model
!
aaa group server radius EAP
server 10.2.36.253 auth-port 1812 acct-port 1813
!
aaa authorization radius-proxy RP group EAP
aaa accounting network FWDACCT start-stop group EAP
aaa accounting network FLOWACCT start-stop group EAP
!
aaa server radius proxy
session-identifier attribute 1
calling-station-id format msisdn
authentication port 1111
accounting port 2222
key radpro
message-authenticator ignore
! The method list "FWDACCT" was configured by the aaa accounting network FWDACCT
! start-stop group EAP command above.
accounting method-list FWDACCT
client 10.45.45.2
timer request 5
!
client 10.45.45.3
key aashica#@!$%&/
timer ip-address 120
!
!
! This control policy references the method list called "RP" that was configured using the aaa authorization radius-proxy command above.
policy-map type control PROXYRULE
class type control always event session-start
1 proxy aaa list RP
!
!
!
bba-group pppoe global
!
!
interface FastEthernet 2/1/0
ip address 10.45.45.1 255.255.255.0
ip subscriber routed
initiator radius-proxy
no ip route-cache cef
no ip route-cache
no cdp enable
!
! The control policy "PROXYRULE" is applied to the interface.
service-policy type control PROXYRULE
!
!
radius-server host 10.2.36.253 auth-port 1812 acct-port 1813 key cisco
radius-server host 10.76.86.83 auth-port 1665 acct-port 1666 key rad123
radius-server vsa send accounting
radius-server vsa send authentication
aaa new-model
!
!
aaa group server radius EAP
server 10.2.36.253 auth-port 1812 acct-port 1813
!
ISG RADIUS Proxy and Layer 4 Redirect Example
The following example shows an ISG policy configured for both ISG RADIUS proxy and Layer 4 redirection:
aaa authorization network default local
!
redirect server-group REDIRECT
server ip 10.255.255.28 port 23
!
class-map type traffic match-any traffic1
match access-group input 101
!
policy-map type service service1
class type traffic traffic1
redirect list 101 to group REDIRECT
!
policy-map type control PROXYRULE
class type control always event session-start
1 proxy aaa list RP
2 service-policy type service name service1
!
access-list 101 permit tcp host 10.45.45.2 any
The following example shows corresponding sample output from the showsubscribersession command:
Router# show subscriber session username 12345675@cisco
Unique Session ID: 66
Identifier: aash
SIP subscriber access type(s): IP
Current SIP options: Req Fwding/Req Fwded
Session Up-time: 00:00:40, Last Changed: 00:00:00
Policy information:
Authentication status: authen
Active services associated with session:
name "service1", applied before account logon
Rules, actions and conditions executed:
subscriber rule-map PROXYRULE
condition always event session-start
1 proxy aaa list RP
2 service-policy type service name service1
Session inbound features:
Feature: Layer 4 Redirect ------>>> L4 redirect is applied to the session at session start
Rule table is empty
Traffic classes:
Traffic class session ID: 67
ACL Name: 101, Packets = 0, Bytes = 0
Unmatched Packets (dropped) = 0, Re-classified packets (redirected) = 0
Configuration sources associated with this session:
Service: service1, Active Time = 00:00:40
Interface: FastEthernet0/1, Active Time = 00:00:40
To locate and download MIBs for selected platforms, Cisco IOS XE software releases, and feature sets, use Cisco MIB Locator found at the following URL:
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.
To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.
Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to
www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 2 Feature Information for ISG RADIUS Proxy
Feature Name
Releases
Feature Information
ISG:AAA Wireless Enhancements
12.2(33)SRE
This feature enhances ISG RADIUS proxy to provide additional support for mobile wireless environments. It includes changes to RADIUS attribute 31 processing.
The following commands were introduced by this feature:
session-identifier,
calling-station-idformat.
This feature enhances ISG RADIUS proxy to provide additional support for WiMax broadband environments.
In Cisco IOS Release 12.2(33)XNE, support was added for the Cisco 10000 series routers.
ISG:Policy Control: RADIUS Proxy Enhancements for ISG
12.2(31)SB2 12.2(33)SRC 12.2(33)SRE
This feature enables ISG to serve as a proxy between a client device that uses RADIUS authentication and an AAA server. This functionality enables ISG to be deployed in PWLAN and wireless mesh networks where authentication requests for mobile subscribers must be sent to specific RADIUS servers.
The following commands were introduced or modified by this feature:
aaaauthorizationradius-proxy,
aaaserverradiusproxy,
accountingmethod-list,
accountingport,
authenticationport,
clearradius-proxyclient,
clearradius-proxysession,
client (ISG RADIUS proxy),
debugradius-proxy,
initiatorradius-proxy,
key (ISG RADIUS proxy),
message-authenticatorignore,
proxy (ISG RADIUS proxy),
showradius-proxyclient,
showradius-proxysession,
timer (ISG RADIUS proxy).
In Cisco IOS Release 12.2(33)SRC, support was added for the Cisco 7600 router.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.