Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-4387-02 manual Appendix A SSG Configuration Example

Models: OL-4387-02

1 110

Download 110 pages 54.42 Kb

Page 91

Appendix A SSG Configuration Example

interface ATM8/0/1 no ip address shutdown

no atm ilmi-keepalive

!

interface ATM8/0/2 no ip address shutdown

no atm ilmi-keepalive

!

interface ATM8/0/3 no ip address shutdown

no atm ilmi-keepalive

!

interface Virtual-Template1 ip unnumbered Loopback1

peer default ip address pool SSG-POOL

pppauthentication pap chap ppp ipcp address accept

!

ip local pool SSG-POOL 10.60.1.1 10.60.1.100 ip classless

ip route 0.0.0.0 0.0.0.0 192.168.2.1

ip route 10.80.1.1 255.255.0.0 11.1.1.51 no ip http server

!

!

ip radius source-interface FastEthernet0/0/0

!

logging trap debugging logging facility local6 logging 192.168.2.50

access-list 101 permit ip 10.0.0.0 0.255.255.255 172.25.0.0 0.0.255.255 access-list 102 permit ip host 192.168.2.50 any

access-list 102 permit ip any host 192.168.2.50 access-list 103 permit ip host 10.60.1.2 any access-list 104 permit tcp any any

access-list 105 permit ip 10.60.1.0 0.0.0.255 any arp 10.27.1.3 3434.3434.3434 ARPA

snmp-server community public RW

snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart snmp-server enable traps tty

snmp-server enable traps alarms

!

radius-server host 192.168.2.62 auth-port 1812 acct-port 1813 key cisco radius-server retransmit 5

radius-server timeout 15 radius-server attribute nas-port format d radius-server key cisco

radius-server authorization permit missing Service-Type radius-server vsa send accounting

radius-server vsa send authentication alias exec cpu show proc cpu history

alias exec dcopy copy running-config disk0:ssg-c10k.txt

alias exec zcopy copy running-config tftp://192.168.2.50/rohit/ssg-c10k.txt

!

line con 0 exec-timeout 0 0

	line aux 0
	line vty 0 4
	exec-timeout 0		0
	password cisco
	line vty 5	99
			Cisco 10000 Series Router Service Selection Gateway Configuration Guide

	OL-4387-02				A-5
	OL-4387-02				A-5

Image 91

Cisco Systems OL-4387-02 manual Appendix A SSG Configuration Example

Contents

800 553-NETS Fax 408 JanuaryCorporate Headquarters Cisco Systems, Inc 170 West Tasman Drive San Jose, CACopyright 2004, Cisco Systems, Inc All rights reserved Audience Service Selection Gateway OverviewDefault Network C O N T E N T SConfiguration of SSG Autologoff Configuration Example for SSG AutoDomainConfiguration Example for SSG Prepaid Configuration Examples for Account Login and LogoutService-Defined Cookie Configuration Example for SSG Open GardenConfiguration of Mutually Exclusive Service Selection Service ProfilesLimiting Redirection for Unauthenticated Users Configuration of VPI/VCI Static Binding to a Service ProfileInterface Configuration Configuring Port-Based Redirection for Unauthenticated UsersService Translation SSG UnconfigPer-Service Statistics Restrictions for SSG UnconfigContents viiiOL-4387-02 Chapter About This GuideAudience Document OrganizationDescription Document ConventionsChapter TitleObtaining Documentation Cisco 10000 Series Router Feature MapCisco 10000 Series Router Software Configuration Guides Related DocumentationOrdering Documentation Documentation FeedbackObtaining Technical Assistance Documentation CD-ROMhttp//tools.cisco.com/RPF/register/register.do Cisco TAC WebsiteOpening a TAC Case TAC Case Priority DefinitionsObtaining Additional Publications and Information Service Selection Gateway Service Selection Gateway OverviewC H A P T E R Figure 1-1 SSG Topology Example Packets from the Default Network and Destined for an SSG User Default NetworkAccess Protocols Packets from a User and Destined for the Default NetworkService Profiles and Cached Service Profiles, page Supported SSG FeaturesSSG Logon and Logoff, page Authentication and Accounting, page Service Selection Methods, page Service Connection, pageAny interface requiring tunneling for example, L2TP or GRE tunneling Gaming SSG PrerequisitesSSG Architecture Model InternetIn Figure 1-2, subscribers access the SESM web portal application using any web browser on a variety of devices such as a desktop computer over DSL. The Cisco 10000 series router the SSG node forwards unauthenticated SSG traffic from the subscriber to SESM, configured as the captive portal and default network. The SSG feature set of the router allows the service provider to design a service selection access network OL-4387-02 Chapter 1 Service Selection Gateway Overview SSG Architecture ModelLimitations and Restrictions Scalability and PerformanceC H A P T E R Best-Access to network B at rate Good-Access to network B at rate Prerequisites for Single Host Logon SSG Prepaid Idle Timeout, page SSG Session and Idle Timeout, pageSSG Logon and Logoff Single Host LogonARP ping Configuration of SSG AutologoffSSG Autologoff Restrictions for SSG AutologoffConfiguration Example for SSG Autologoff SSG Prepaid Idle TimeoutService Reauthorization Service AuthorizationConfiguration Example for SSG Prepaid Idle Timeout Restrictions for SSG Prepaid Idle TimeoutPrerequisites for SSG Prepaid Idle Timeout Configuration of SSG Prepaid Idle TimeoutSSG Session and Idle Timeout Restrictions for SSG Full Username RADIUS Attribute Authentication and AccountingConfiguration Examples for SSG Full Username RADIUS Attribute SSG Full Username RADIUS AttributeService Connection and Termination, page Account Login and LogoutConfiguration Examples for Account Login and Logout Account Login and Logout, pageConfiguration Examples for Service Connection and Termination Service Connection and TerminationService-Type-Indicates the type of service PTA-Multidomain Service Selection MethodsWeb Service Selection, page PPP Terminated AggregationRestrictions for PTA-MD Web Service SelectionSESM and SSG Performance OL-4387-02 Chapter 5 Service Selection Methods Web Service SelectionSSG AutoDomain, page SSG Prepaid, page SSG Open Garden, page Service ConnectionMutually Exclusive Service Selection, page SSG AutoDomainConfiguration Example for SSG AutoDomain Configuration of SSG AutoDomainRestrictions for SSG AutoDomain Example 6-2 AutoDomain Exclude Profile SSG VSA Format Example 6-1 SSG AutoDomainExample 6-3 AutoDomain Exclude File Format SSG Prepaid Configuration of SSG PrepaidRestrictions for SSG Prepaid SSG Open Garden Configuration Example for SSG PrepaidSSG Port-Bundle Host Key Configuration of SSG Open GardenConfiguration Example for SSG Open Garden SSG Open Garden, Release 12.24B feature moduleRestrictions for SSG Port-Bundle Host Key Exclude Networks Mutually Exclusive Service SelectionConfiguration of SSG Port-Bundle Host Key SSG Port-Bundle Host Key, Release 12.24B feature moduleConfiguration Example for Mutually Exclusive Service Selection Configuration of Mutually Exclusive Service SelectionExample 6-5 Configuring a Mutually Exclusive Service Selection Group Chapter 6 Service Connection Mutually Exclusive Service Selection 6-10OL-4387-02 Service Profiles and Cached Service Profiles Service ProfilesDownstream Access Control List Service Profiles, page Cached Service Profiles, pageFull Username Upstream Access Control ListService Authentication Type Domain NameService Next-Hop Gateway Service-Defined CookieService Description Service ModeType of Service Cached Service ProfilesService Profile Example Configuration of Cached Service Profiles Cached Service Profiles Chapter 7 Service Profiles and Cached Service ProfilesOL-4387-02 C H A P T E R SSG Hierarchical PolicingSSG Hierarchical Policing Overview SSG Hierarchical Policing Token Bucket SchemeRestrictions for SSG Hierarchical Policing SSG Hierarchical Policing ConfigurationRouterconfig-prof# attribute 26 9 1 “QU1600030004000D2400040008000” Configuration Examples for SSG Hierarchical PolicingConfiguration Examples for SSG Hierarchical Policing Routerconfig# local-profile cisco.comChapter 8 SSG Hierarchical Policing Configuration Examples for SSG Hierarchical PolicingOL-4387-02 C H A P T E R Interface ConfigurationTransparent Passthrough Transparent Passthrough, pageAccess Side Interfaces Restrictions of Transparent Passthrough Configuration of Transparent PassthroughMulticast Protocols on SSG Interfaces Network Side InterfacesConfiguration of Multicast Protocols on SSG Interfaces SSG TCP Redirect Redirection for Unauthenticated UsersRedirection for Unauthenticated Users, page Redirection for Unauthorized Services, page Initial Captivation, page10-2 Redirection for Unauthorized Servicesgroup-name 10-3 Initial Captivation10-4 Configuration of SSG TCP RedirectRestrictions for SSG TCP Redirect Prerequisites for SSG TCP RedirectConfiguration Considerations for SSG TCP Redirect, page Configuration Considerations for SSG TCP RedirectConfiguring Port-Based Redirection for Unauthenticated Users Limiting Redirection for Unauthenticated Users10-6 Configuring SSG TCP RedirectCommand PurposeConfiguration Example for Server Groups, page Configuration Examples for SSG TCP RedirectConfiguration Example for Server Groups Configuration Example for Network ListsChapter 10 SSG TCP Redirect Configuration Example for Port Lists10-8 Example 10-5 Defining Port ListsConfiguration of VPI/VCI Static Binding to a Service Profile Miscellaneous SSG FeaturesVPI/VCI Static Binding to a Service Profile Restrictions for VPI/VCI Static Binding to a Service ProfileRADIUS Virtual Circuit Logging AAA Server Group Support for Proxy ServicesConfiguration of RADIUS Virtual Circuit Logging Restrictions for AAA Server Group Support for Proxy ServicesUpstream Access Control List-inacl, page Configuration of AAA Server Group Support for Proxy ServicesConfiguration Example for AAA Server Group Support for Proxy Services Downstream Access Control List-outacl, page11-4 Downstream Access Control List-outaclUpstream Access Control List-inacl Restrictions for Packet FilteringRestrictions for SSG Unconfig SSG UnconfigConfiguration of Packet Filtering Configuration Example for Packet Filtering11-6 Prerequisites for SSG UnconfigConfiguration of SSG Unconfig Configuration Examples for SSG Unconfig11-7 SSG Enhancements for Overlapping ServicesService Translation Service Translation, page Expansion of Service IDs, pageSet1 0.0.0.0/0.0.0.0 Set2 10.58.253.0/255.255.255.0 Set3 11-8Prerequisites for Service Translation Restrictions for Service Translation11-9 Service Definitions Configuration of Service TranslationConfiguration Example for Service Translation Enables service translation and indicates to the router to use the11-11 Expansion of Service IDsRestrictions for Expansion of Service IDs Configuration Example for Expansion of Service IDs11-12 Network SetsC H A P T E R Monitoring and Maintaining SSG12-1 CommandRemoves the specified service Troubleshooting RADIUSPer-Service Statistics Restrictions for Per-Service StatisticsCommand Monitoring the Parallel Express Forwarding EngineReference Guide 12-3OL-4387-02 12-4Chapter 12 Monitoring and Maintaining SSG Monitoring the Parallel Express Forwarding EngineA P P E N D I X A SSG Configuration ExampleAppendix A SSG Configuration Example Example A-1 Cisco 10000 Router SSG ConfigurationOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration ExampleOL-4387-02 Appendix A SSG Configuration Exampleexec-timeout 0 0 password lab ntp clock-period 17181406 ntp update-calendarImplementation Notes SSG FeatureSSG Implementation Notes A P P E N D I X BImplementation Notes SSG FeatureSSG Feature Also see the “Restrictions for SSG TCP Redirect” section on pageImplementation Notes OL-4387-02 Appendix B SSG Implementation NotesDigital Subscriber Line G L O S S A R YGL-1 GL-2 GL-3 GL-4 GL-5 OL-4387-02 GL-6xDSL GlossarySee CEF I N D EIN-1 inacl attribute IN-2idle timeout Idle Timeout Attribute 28 3-4See PPP See PXFIN-3 Exclude Networks 6-8 See RBEIN-4 AutoDomainIN-5 virtual channel identifier See VCI virtual circuit See VC See VPIIN-6 VC G-5 VCI G-5 vendor-specific attributes definition G-5VRF G-5 VSA definition G-5 IN-7VPI G-5 VPI/VCI implementation notes B-3 service profiles subscriber web service selection 5-2 web sites accessing through Open Garden 6-5Index IN-8OL-4387-02