Cisco IOS XE, Руководство по настройке

Страница: 93 / 358

Configuring ISG Access for IP Subscriber Sessions
Information About ISG Access for IP Subscriber Sessions
9
•
Routed IP Subscriber Identity
• MAC Address as Secondary Identity
•
DHCP Lease Query Support
• Layer 2 Connected IP Subscriber Identity
Routed IP Subscriber Identity
If the access network is a routed network, subscriber IP addresses can be used to uniquely identify IP
subscribers because by definition subscriber IP addresses are at least routable in the access network.
When using a subscriber IP address as the identifier, ISG assumes that the subscriber IP address is
unique. If the access network is deployed with Layer 3 load balancing, redundancy, or asymmetric
routing, ISG also assumes that IP traffic from the same IP subscriber may arrive at different access
interfaces. To support this type of deployment, ISG assumes a single IP address space for all the access
interfaces connecting to the same access network.
If there is a requirement to support several IP address spaces over a single physical access network, the
access network must use some Layer 2 encapsulation to create a separate logical access network for each
IP address space. In this case, ISG can still have a single IP address space for all the logical access
interfaces that connect to a logical access network.
When subscriber IP addresses are private IP addresses, the access network must be able to route such
subscriber traffic. If the subscriber traffic is destined to the Internet, NAT must be performed.
For routed IP subscribers, the subscriber IP address serves as the key for an IP session. ISG associates
IP traffic with an IP session as follows:
• In the upstream direction, the source IP address of an IP packet is used to identify the IP session.
The source IP address is the subscriber IP address.
• In the downstream direction, the destination IP address of an IP packet is used to identify the IP
session. The destination IP address is the subscriber IP address.
If the IP subscriber is a VPN user, the subscriber IP address must be routable in both the global routing
table and the VPN routing table on the ISG.
In the case of an IP subnet subscriber, a subscriber IP address is defined as an IP prefix address instead
of a /32 IP host address. This IP prefix covers a range of IP addresses used by end users but represents
a single logical IP subscriber from the ISG point of view. In this deployment, all end users share the same
connectivity and services provided by the ISG.
To normalize the classification of IP subscribers that have different network masks, ISG uses the network
mask in conjunction with the subscriber IP address for routed IP subscribers.
MAC Address as Secondary Identity
You must configure the collect identifier mac-address command at the start of a session. This instructs
the ISG devices to store the MAC address as part of the session identifiers. For routed IP subscriber
sessions, the MAC address is collected from the DHCP server using the DHCP Lease Query Protocol.
For information about configuring the command, see the
“Configuring ISG Control Policies” module in
the Cisco IOS ISG Configuration Guide.