Cisco IOS XE Intelligent Services User Manual

RADIUS-Based Policing
Configuration Examples for RADIUS-Based Policing
13
ISG Transient Policy
The ISG copies the service policy that is currently applied to the session and creates a transient policy
named New_Parent to which it makes the appropriate changes. Based on the Cisco VSA included in the
Access-Accept message, the ISG adds the policing rate to the Premium traffic class. The Premium class
is configured in the transient New_Child policy, which is applied to the New_Parent class-default class.
policy-map New_Child [New cloned child policy]
class Premium
police 200000 [New policing rate]
shape average 5000
!
policy-map New_Parent [New cloned parent policy]
class class-default
shape average 10000
service-policy New_Child [New cloned child policy attached to the new
cloned parent policy]
Setting the Policing Rate Using a CoA Message: Examples
The examples in this section illustrate how to set the policing rate of a service using a CoA message.
ISG Original Policy
This configuration example uses a RADIUS CoA message to change the policing rate of a service and
is based on the following ISG configuration:
policy-map Child
class Premium
police 12000
!
policy-map Parent
class class-default
shape average 10000
service-policy Child
RADIUS Configuration
The following Cisco VSA is configured in a user’s profile on RADIUS. This VSA modifies the Premium
class of the Child policy, which is applied to the class-default class of the Parent policy.
radius subscriber 1048
vsa cisco 250 S192.168.1.10
vsa cisco generic 1 string "qos-policy-out=add-class(sub,(class-default, Premium),
police(200000))"
RADIUS CoA Message
The ISG receives the following RADIUS CoA message. Notice that the above Cisco VSA configured in
the user profile is present in the CoA message.
1d21h: RADIUS: COA received from id 0 192.168.1.6:1700, CoA Request, len 106
1d21h: COA: 192.168.1.6 request queued
1d21h: RADIUS: authenticator FF A2 6B 63 06 F0 E6 A3 - 0D 04 6C DC 01 0A BE F1
1d21h: RADIUS: Vendor, Cisco [26] 18
1d21h: RADIUS: ssg-account-info [250] 12 "S192.168.1.10"
1d21h: RADIUS: Vendor, Cisco [26] 68
1d21h: RADIUS: Cisco AVpair [1] 62 "qos-policy-out=add-class(sub,(class-default, Premium),
police(200000))"
1d21h: ++++++ CoA Attribute List ++++++
1d21h: 63C829B0 0 00000009 ssg-account-info(427) 10 S192.168.1.10

Cisco IOS XE Intelligent Services Specifications

General

Brand	Cisco
Model	IOS XE Intelligent Services
Category	Gateway
Language	English