![background image](http://html.mh-extra.com/html/cisco/ios-xe/ios-xe_configuration-manual_64936221.webp)
Configuring ISG Subscriber Services
Configuration Examples for ISG Services
17
Service for Per-Subscriber Firewall: Examples
In the following examples, the service “SERVICE2” is configured with a per-subscriber firewall. The
service does not include a traffic class, so it will apply to the entire session. These examples are
equivalent and show the two methods of service configuration: in a service policy map that is configured
directly on the ISG, and in a service profile that is configured on a AAA server.
ISG Configuration
policy-map type service SERVICE2
ip access-group INTERNET_IN_ACL in
ip access-group INTERNET_OUT_ACL out
AAA Server Configuration
Attributes/
Cisco-AVPair = ip:inacl=INTERNET_IN_ACL
Cisco-AVPair = ip:outacl=INTERNET_OUT_ACL
Service for Redirecting Layer 4 Subscriber Traffic: Example
The following example shows the configuration of a service called
“UNAUTHORIZED_REDIRECT_SVC”. The control policy “UNAUTHEN_REDIRECT” is configured
to apply the service upon session start.
class-map type traffic match-any UNAUTHORIZED_TRAFFIC
match access-group input 100
policy-map type service UNAUTHORIZED_REDIRECT_SVC
class type traffic UNAUTHORIZED_TRAFFIC
redirect to ip 10.0.0.148 port 8080
policy-map type control UNAUTHEN_REDIRECT
class type control always event session-start
1 service-policy type service name UNAUTHORIZED_REDIRECT_SVC
Deactivating a Layer 4 Redirection Service Following Authorization: Example
In the following example, a service configured with Layer 4 redirection is deactivated when traffic
becomes authorized; that is, following activation of the appropriate service.
class-map traffic UNAUTHORIZED_TRAFFIC
match access-group input 100
policy-map type service UNAUTHORIZED_REDIRECT_SVC
class traffic UNAUTHORIZED_TRAFFIC
redirect to ip 10.0.0.148 port 8080
class-map control match-all CHECK_ISP1
match service ISP1
policy-map control UNAUTHEN_REDIRECT
class control always event session-start
1 service-policy type service name UNAUTHORIZED_REDIRECT_SVC
class control CHECK_ISP1 event service-start
1 service-policy type service unapply UNAUTHORIZED_REDIRECT_SVC
1 service-policy type service name ISP1
Содержание IOS XE
Страница 14: ...About Cisco IOS XE Software Documentation Additional Resources and Documentation Feedback xii ...
Страница 28: ...Using the Command Line Interface in Cisco IOS XE Software Additional Information xiv ...
Страница 36: ...Intelligent Services Gateway Features Roadmap 8 ...
Страница 46: ...Overview of ISG Feature Information for the Overview of ISG 10 ...
Страница 70: ...Configuring ISG Control Policies Feature Information for ISG Control Policies 24 ...
Страница 128: ...Configuring ISG Access for IP Subscriber Sessions Feature Information for ISG Access for IP Subscriber Sessions 44 ...
Страница 136: ...Configuring MQC Support for IP Sessions Feature Information for MQC Support for IP Sessions 8 ...
Страница 194: ...Configuring ISG Policies for Automatic Subscriber Logon Feature Information for ISG Automatic Subscriber Logon 12 ...
Страница 224: ...Configuring ISG Subscriber Services Feature Information for ISG Subscriber Services 20 ...
Страница 336: ...Configuring ISG Integration with SCE Feature Information for Configuring ISG Integration with SCE 16 ...
Страница 344: ...Service Gateway Interface Feature Information for Service Gateway Interface 8 ...