Configuring ISG Policies for Automatic Subscriber Logon
How to Configure ISG Policies for Automatic Subscriber Logon
3
The event that triggers automatic subscriber logon is session-start. For IP sessions, session-start occurs
when a DHCP DISCOVER request is received or when an unrecognized source IP address is detected.
For PPPoE sessions, session-start occurs when a client attempts to initiate a session by sending a PPPoE
Active Discovery Initiation (PADI) packet.
Supported Identifiers for ISG Automatic Subscriber Logon
For IP sessions, an ISG device can be configured to use the following identifiers in place of the username
in authorization requests: IP address, MAC address, circuit ID, remote ID, or a combination of the circuit
ID and remote ID.
For PPPoE sessions, an ISG device can be configured to use the remote ID in place of the username in
authorization requests.
Authorization Based on Circuit ID and Remote ID
The circuit ID and remote ID fields are part of the DHCP relay agent information option (also referred
to as Option 82) and the PPPoE Tag VSA. These fields are inserted into DHCP and PPPoE messages by
a DSLAM. An ISG device can be configured to use the circuit ID, remote ID, or a combination of circuit
ID and remote ID as the username in authorization requests.
By default, the ISG device will use the circuit ID and remote ID that are provided by the Layer 2 edge
access device for authorization. If the ip dhcp relay information option command is configured, the
ISG device will use the circuit ID and remote ID that are received in a DHCP message.
Accounting Behavior When ISG Automatic Subscriber Logon Is Configured
Accounting Behavior for MAC-Address-Based Authorization
If the MAC address is sent as the username in authorization requests, the MAC address will also be sent
as the Calling Station ID in accounting records.
Accounting Behavior for Remote-ID- and Circuit-ID-Based Authorization
For IP sessions that use DHCP Option 82 authorization, accounting messages are sent to the AAA server
with the Circuit ID and Remote ID Cisco VSAs. Although you can configure a combination of circuit
ID and remote ID as the username for authorization, the attributes are sent individually in accounting
records. You can also configure the circuit ID and remote ID to be sent together in accounting records
as the NAS Port ID.
For PPPoE sessions, the Remote ID VSA is sent in accounting records, and the remote ID is also sent as
the NAS Port ID.
If the radius-server attribute 31 remote-id command is configured, the remote ID is sent in accounting
records as the Calling Station ID.
How to Configure ISG Policies for Automatic Subscriber Logon
To configure ISG policies to automatically log on subscribers, perform the following tasks:
• Identifying Traffic for Automatic Logon in a Control Policy Class Map, page 4
To Next Page
Loading...
Need help?
General