Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-4387-02 manual Example A-1 Cisco 10000 Router SSG Configuration

Models: OL-4387-02

1 110

Download 110 pages 54.42 Kb

Page 88

Appendix A SSG Configuration Example

Appendix A SSG Configuration Example

Example A-1 Cisco 10000 Router SSG Configuration

!

version 12.2 no service pad

service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone no service password-encryption

!

hostname c10k-ssg

!

boot system disk0:c10k2-p11-mz.bilgepump logging buffered 4096 debugging

no logging rate-limit no logging console enable password mrrbu

!

username cisco password 0 cisco clock timezone PST -8

clock summer-time PST recurring facility-alarm intake-temperature major 49 no facility-alarm intake-temperature minor facility-alarm core-temperature major 53 facility-alarm core-temperature minor 45

!

!

card 1/0 1gigethernet-1 card 8/0 4oc3atm-1

aaanew-model

!

!

aaa group server radius SSG-RADIUS

server 192.168.2.62 auth-port 1812 acct-port 1813

!

aaa group server radius SSG-RADIUS-RISM

server-private 192.168.2.62 auth-port 1812 acct-port 1813 key cisco

!

aaa authentication banner CCC !!! Cisco C10K PRE2 SSG !!!

aaa authentication fail-message CC !!! Unauthorized Access Is Not Permitted !!!

aaa authentication password-prompt Password: aaa authentication username-prompt Username:

aaa authentication login default local group SSG-RADIUS aaa authentication login console local

aaa authentication ppp default group SSG-RADIUS aaa authorization exec vty none

aaa authorization network default group SSG-RADIUS

aaa accounting network default start-stop group SSG-RADIUS aaa nas port extended

aaa session-id common ip subnet-zero

ip host-routing

ip ftp username cisco ip ftp password cisco no ip domain lookup

ip domain name cisco.com ip host rism 192.168.2.62 ip host sesm 192.168.2.50

ip name-server 172.16.168.183 ip name-server 172.31.226.120

!

mpls ldp log-neighbor-changes

!

!

ssg enable

Cisco 10000 Series Router Service Selection Gateway Configuration Guide

	A-2	OL-4387-02

Image 88

Cisco Systems OL-4387-02 manual Example A-1 Cisco 10000 Router SSG Configuration, Appendix A SSG Configuration Example

Contents

January Corporate HeadquartersCisco Systems, Inc 170 West Tasman Drive San Jose, CA 800 553-NETS Fax 408Copyright 2004, Cisco Systems, Inc All rights reserved Service Selection Gateway Overview Default NetworkC O N T E N T S AudienceConfiguration Example for SSG AutoDomain Configuration Example for SSG PrepaidConfiguration Examples for Account Login and Logout Configuration of SSG AutologoffConfiguration Example for SSG Open Garden Configuration of Mutually Exclusive Service SelectionService Profiles Service-Defined CookieConfiguration of VPI/VCI Static Binding to a Service Profile Interface ConfigurationConfiguring Port-Based Redirection for Unauthenticated Users Limiting Redirection for Unauthenticated UsersSSG Unconfig Per-Service StatisticsRestrictions for SSG Unconfig Service TranslationContents viiiOL-4387-02 About This Guide AudienceDocument Organization ChapterDocument Conventions ChapterTitle DescriptionCisco 10000 Series Router Feature Map Cisco 10000 Series Router Software Configuration GuidesRelated Documentation Obtaining DocumentationDocumentation Feedback Obtaining Technical AssistanceDocumentation CD-ROM Ordering DocumentationCisco TAC Website Opening a TAC CaseTAC Case Priority Definitions http//tools.cisco.com/RPF/register/register.doObtaining Additional Publications and Information Service Selection Gateway Service Selection Gateway OverviewC H A P T E R Figure 1-1 SSG Topology Example Default Network Access ProtocolsPackets from a User and Destined for the Default Network Packets from the Default Network and Destined for an SSG UserSupported SSG Features SSG Logon and Logoff, page Authentication and Accounting, pageService Selection Methods, page Service Connection, page Service Profiles and Cached Service Profiles, pageAny interface requiring tunneling for example, L2TP or GRE tunneling SSG Prerequisites SSG Architecture ModelInternet GamingIn Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices such as a desktop computer over DSL. The Cisco 10000 series router the SSG node forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network Chapter 1 Service Selection Gateway Overview SSG Architecture Model OL-4387-02Limitations and Restrictions Scalability and PerformanceC H A P T E R Best-Access to network B at rate Good-Access to network B at rate SSG Prepaid Idle Timeout, page SSG Session and Idle Timeout, page SSG Logon and LogoffSingle Host Logon Prerequisites for Single Host LogonConfiguration of SSG Autologoff SSG AutologoffRestrictions for SSG Autologoff ARP pingSSG Prepaid Idle Timeout Configuration Example for SSG AutologoffService Authorization Service ReauthorizationRestrictions for SSG Prepaid Idle Timeout Prerequisites for SSG Prepaid Idle TimeoutConfiguration of SSG Prepaid Idle Timeout Configuration Example for SSG Prepaid Idle TimeoutSSG Session and Idle Timeout Authentication and Accounting Configuration Examples for SSG Full Username RADIUS AttributeSSG Full Username RADIUS Attribute Restrictions for SSG Full Username RADIUS AttributeAccount Login and Logout Configuration Examples for Account Login and LogoutAccount Login and Logout, page Service Connection and Termination, pageService Connection and Termination Configuration Examples for Service Connection and TerminationService-Type-Indicates the type of service Service Selection Methods Web Service Selection, pagePPP Terminated Aggregation PTA-MultidomainWeb Service Selection Restrictions for PTA-MDSESM and SSG Performance Chapter 5 Service Selection Methods Web Service Selection OL-4387-02Service Connection Mutually Exclusive Service Selection, pageSSG AutoDomain SSG AutoDomain, page SSG Prepaid, page SSG Open Garden, pageConfiguration Example for SSG AutoDomain Configuration of SSG AutoDomainRestrictions for SSG AutoDomain Example 6-2 AutoDomain Exclude Profile SSG VSA Format Example 6-1 SSG AutoDomainExample 6-3 AutoDomain Exclude File Format SSG Prepaid Configuration of SSG PrepaidRestrictions for SSG Prepaid Configuration Example for SSG Prepaid SSG Open GardenConfiguration of SSG Open Garden Configuration Example for SSG Open GardenSSG Open Garden, Release 12.24B feature module SSG Port-Bundle Host KeyRestrictions for SSG Port-Bundle Host Key Mutually Exclusive Service Selection Configuration of SSG Port-Bundle Host KeySSG Port-Bundle Host Key, Release 12.24B feature module Exclude NetworksConfiguration Example for Mutually Exclusive Service Selection Configuration of Mutually Exclusive Service SelectionExample 6-5 Configuring a Mutually Exclusive Service Selection Group Chapter 6 Service Connection Mutually Exclusive Service Selection 6-10OL-4387-02 Service Profiles Downstream Access Control ListService Profiles, page Cached Service Profiles, page Service Profiles and Cached Service ProfilesUpstream Access Control List Service Authentication TypeDomain Name Full UsernameService-Defined Cookie Service DescriptionService Mode Service Next-Hop GatewayType of Service Cached Service ProfilesService Profile Example Configuration of Cached Service Profiles Cached Service Profiles Chapter 7 Service Profiles and Cached Service ProfilesOL-4387-02 SSG Hierarchical Policing SSG Hierarchical Policing OverviewSSG Hierarchical Policing Token Bucket Scheme C H A P T E RSSG Hierarchical Policing Configuration Restrictions for SSG Hierarchical PolicingConfiguration Examples for SSG Hierarchical Policing Configuration Examples for SSG Hierarchical PolicingRouterconfig# local-profile cisco.com Routerconfig-prof# attribute 26 9 1 “QU1600030004000D2400040008000”Chapter 8 SSG Hierarchical Policing Configuration Examples for SSG Hierarchical PolicingOL-4387-02 Interface Configuration Transparent PassthroughTransparent Passthrough, page C H A P T E RAccess Side Interfaces Configuration of Transparent Passthrough Multicast Protocols on SSG InterfacesNetwork Side Interfaces Restrictions of Transparent PassthroughConfiguration of Multicast Protocols on SSG Interfaces Redirection for Unauthenticated Users Redirection for Unauthenticated Users, pageRedirection for Unauthorized Services, page Initial Captivation, page SSG TCP Redirect10-2 Redirection for Unauthorized Servicesgroup-name Initial Captivation 10-3Configuration of SSG TCP Redirect Restrictions for SSG TCP RedirectPrerequisites for SSG TCP Redirect 10-4Configuration Considerations for SSG TCP Redirect Configuring Port-Based Redirection for Unauthenticated UsersLimiting Redirection for Unauthenticated Users Configuration Considerations for SSG TCP Redirect, pageConfiguring SSG TCP Redirect CommandPurpose 10-6Configuration Examples for SSG TCP Redirect Configuration Example for Server GroupsConfiguration Example for Network Lists Configuration Example for Server Groups, pageConfiguration Example for Port Lists 10-8Example 10-5 Defining Port Lists Chapter 10 SSG TCP RedirectMiscellaneous SSG Features VPI/VCI Static Binding to a Service ProfileRestrictions for VPI/VCI Static Binding to a Service Profile Configuration of VPI/VCI Static Binding to a Service ProfileAAA Server Group Support for Proxy Services Configuration of RADIUS Virtual Circuit LoggingRestrictions for AAA Server Group Support for Proxy Services RADIUS Virtual Circuit LoggingConfiguration of AAA Server Group Support for Proxy Services Configuration Example for AAA Server Group Support for Proxy ServicesDownstream Access Control List-outacl, page Upstream Access Control List-inacl, pageDownstream Access Control List-outacl Upstream Access Control List-inaclRestrictions for Packet Filtering 11-4SSG Unconfig Configuration of Packet FilteringConfiguration Example for Packet Filtering Restrictions for SSG UnconfigPrerequisites for SSG Unconfig Configuration of SSG UnconfigConfiguration Examples for SSG Unconfig 11-6SSG Enhancements for Overlapping Services Service TranslationService Translation, page Expansion of Service IDs, page 11-711-8 Set1 0.0.0.0/0.0.0.0 Set2 10.58.253.0/255.255.255.0 Set3Prerequisites for Service Translation Restrictions for Service Translation11-9 Configuration of Service Translation Configuration Example for Service TranslationEnables service translation and indicates to the router to use the Service DefinitionsExpansion of Service IDs Restrictions for Expansion of Service IDsConfiguration Example for Expansion of Service IDs 11-11Network Sets 11-12Monitoring and Maintaining SSG 12-1Command C H A P T E RTroubleshooting RADIUS Per-Service StatisticsRestrictions for Per-Service Statistics Removes the specified serviceMonitoring the Parallel Express Forwarding Engine Reference Guide12-3 Command12-4 Chapter 12 Monitoring and Maintaining SSGMonitoring the Parallel Express Forwarding Engine OL-4387-02SSG Configuration Example A P P E N D I X AExample A-1 Cisco 10000 Router SSG Configuration Appendix A SSG Configuration ExampleAppendix A SSG Configuration Example OL-4387-02Appendix A SSG Configuration Example OL-4387-02Appendix A SSG Configuration Example OL-4387-02Appendix A SSG Configuration Example exec-timeout 0 0 password labntp clock-period 17181406 ntp update-calendar OL-4387-02SSG Feature SSG Implementation NotesA P P E N D I X B Implementation NotesSSG Feature Implementation NotesSSG Feature Also see the “Restrictions for SSG TCP Redirect” section on pageImplementation Notes Appendix B SSG Implementation Notes OL-4387-02Digital Subscriber Line G L O S S A R YGL-1 GL-2 GL-3 GL-4 GL-5 GL-6 xDSLGlossary OL-4387-02See CEF I N D EIN-1 IN-2 idle timeoutIdle Timeout Attribute 28 3-4 inacl attributeSee PPP See PXFIN-3 See RBE IN-4AutoDomain Exclude Networks 6-8IN-5 See VPI IN-6VC G-5 VCI G-5 vendor-specific attributes definition G-5 virtual channel identifier See VCI virtual circuit See VCIN-7 VPI G-5 VPI/VCI implementation notes B-3 service profiles subscriberweb service selection 5-2 web sites accessing through Open Garden 6-5 VRF G-5 VSA definition G-5Index IN-8OL-4387-02