Cisco Systems OL-16647-01 Adding a Service Policy Rule for Management Traffic

22-10

Cisco ASDM User Guide

OL-16647-01

Chapter 22 Configuring Service Policy Rules

Adding a Service Policy Rule for Management Traffic

Step 9 Click Finish.

Adding a Service Policy Rule for Management Traffic

You can create a service policy for traffic directed to the security appliance for management purposes.

This type of security policy can perform RADIUS accounting inspection and connection limits. This

section includes the following topics:

• RADIUS Accounting Inspection Overview, page 22-10

• Configuring a Service Policy Rule for Management Traffic, page 22-10

One of the well known problems is the over-billing attack in GPRS networks. The over-billing attack can

cause consumers anger and frustration by being billed for services that they have not used. In this case,

a malicious attacker sets up a connection to a server and obtains an IP address from the SGSN. When

the attacker ends the call, the malicious server will still send packets to it, which gets dropped by the

GGSN, but the connection from the server remains active. The IP address assigned to the malicious

attacker gets released and reassigned to a legitimate user who will then get billed for services that the

attacker will use.

RADIUS accounting inspection prevents this type of attack using by ensuring the traffic seen by the

GGSN is legitimate. With the RADIUS accounting feature properly configured, the security appliance

tears down a connection based on matching the Framed IP attribute in the Radius Accounting Request

Start message with the Radius Accounting Request Stop message. When the Stop message is seen with

the matching IP address in the Framed IP attribute, the security appliance looks for all connections with

the source matching the IP address.

You have the option to configure a secret pre-shared key with the RADIUS server so the security

appliance can validate the message. If the shared secret is not configured, the security appliance does

not need to validate the source of the message and will only check that the source IP address is one of

the configured addresses allowed to send the RADIUS messages.

To add a service policy rule for management traffic, perform the following steps:

Step 1 From the Configuration > Firewall > Service Policy Rules pane, click the down arrow next to Add.

Step 2 Choose Add Management Service Policy Rule.

The Add Management Service Policy Rule Wizard - Service Policy dialog box appears.

Step 3 In the Create a Service Policy and Apply To area, click one of the following options:

• Interface. This option applies the service policy to a single interface. Interface service policies take

precedence over the global service policy for a given feature. For example, if you have a global

policy with RADIUS accounting inspection, and an interface policy with connection limits, then