Cisco IOS XE, Configuration Manual

Page: 323 / 358

Configuring ISG Integration with SCE
Information About Configuring ISG Integration with SCE
3
Overview of ISG-SCE Integration
The ISG Integration with SCE feature integrates ISG and SCE at the policy plane level so that for
purposes of subscriber provisioning, ISG and SCE function as a single logical entity. The ISG device
and SCE communicate to manage subscriber sessions jointly, minimizing the requirements for
coordination with additional external components. ISG handles subscriber management at Layer 4 and
below. SCE is primarily focused at Layer 4 and above. When ISG and SCE are configured to work
together, they provide tools for these functions:
•
Subscriber mapping—Subscriber awareness is distributed between ISG and the SCE. The shared
subscriber session is referenced by both devices using a unique session identifier allocated by the
ISG. Identity keys such as IP Address, IP Subnet, network access server (NAS) identifier, and NAS
port are also associated to the session. SCE policies that should be enabled on the session are
identified by their policy names.
• Subscriber policy updates—Change subscriber policies in real time.
ISG and SCE Roles in Subscriber Management
Table 1 shows the specific roles of ISG and SCE in subscriber management.
Table 1 ISG and SCE Roles in Subscriber Management
ISG pushes policies (or external services) to the SCE for a given subscriber session, in the form of
RADIUS change of authorization (CoA) messages. External service activation can be triggered by the
policy manager component inside the ISG or by an external authentication, authorization, and
accounting (AAA) server. The SCE sees the ISG as the policy manager. ISG serves as a proxy for service
activation requests from the external AAA server to the SCE. The SCE sends accounting records to the
ISG. The ISG, if configured to do so, serves as a proxy that sends the accounting records to an external
AAA server. SCE can also query the ISG about session information for unprovisioned sessions. ISG
informs SCE when a session terminates by means of a RADIUS Packet of Disconnect (PoD).
Provided by ISG Provided by SCE
Subscriber aggregation (broadband remote access
service—BRAS)
Subscriber authorization or authentication
Policy management
Policy enforcement for
• Quality of service (QoS)
• Multiprotocol label switching (MPLS) virtual
private network (VPN)
• Redirection
•
Session termination
• Postpaid billing
Policy enforcement for
•
Application-aware services
• Redirection and application-based policy
management
• Service security
• Behavioral classification
• URL caching and filtering
• Value-added services
•
Parental controls
• Usage and content billing