Page History

Будьте внимательны при изменении параметров скорости в тарифном плане нужно почистить кеш сессий в Cisco, иначе будут присваиваться старые настройки сессий.

Cisco-Service-Info = QU;640000;80000;160000;D;500000;62500;125000;,
cisco-avpair += ip:traffic-class=input access-group name ACL_IN_INTERNET_1 priority 200,
cisco-avpair += ip:traffic-class=output access-group name ACL_OUT_INTERNET_1 priority 200,
cisco-avpair += ip:traffic-class=out default drop,
cisco-avpair += ip:traffic-class=in default drop,
cisco-avpair += subscriber:accounting-list=BH_ACCNT_LIST_1

version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ISG-1
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$WWW/$4otH.1GYuWkFaQp25MJ.V1
!
aaa new-model
!
!
aaa group server radius ISG-RADIUS
 server 10.0.0.1 auth-port 1812 acct-port 1813
!
aaa authentication login default group tacacs+ local
aaa authentication login ISG-AUTH-1 group ISG-RADIUS
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa authorization network ISG-AUTH-1 group ISG-RADIUS
aaa authorization subscriber-service default local group ISG-RADIUS
aaa accounting update periodic 1 jitter maximum 0
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network ISG-AUTH-1 start-stop group ISG-RADIUS
!
!
!
!
! coa interface
aaa server radius dynamic-author
 client 10.0.0.1
 server-key isgcontrol
!
aaa session-id common
clock timezone AZST 5
ip subnet-zero
!
!
ip dhcp relay information policy keep
ip dhcp relay information trust-all
!
ip cef
ip domain name mydomain.com
ip ssh version 2
!
!
!
multilink bundle-name authenticated
!
!
archive
 log config
  hidekeys
username letsac privilege 15 secret 5 $1$jHQz$bkaihoHMi6.Eq4ifYnUgH/
!
redirect server-group REDIRECT_NOPAY
   server ip 10.0.0.1 port 80
class-map type traffic match-any CLASS-TO-REDIRECT
 match access-group input 197
 match access-group output 197
!
class-map type control match-all ISG-IP-UNAUTH
 match timer UNAUTH-TIMER
 match authen-status unauthenticated
!
policy-map type service LOCAL_L4R
 ip access-group 197 in
 ip access-group 197 out
 1 class type traffic CLASS-TO-REDIRECT
  redirect to group REDIRECT_NOPAY
 !
!
policy-map type control ISG-CUSTOMERS-POLICY
 class type control ISG-IP-UNAUTH event timed-policy-expiry
  1 service disconnect
 !
 class type control always event quota-depleted
  1 set-param drop-traffic FALSE
 !
 class type control always event credit-exhausted
  1 service-policy type service name LOCAL_L4R
 !
 class type control always event session-start
  10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address
  20 set-timer UNAUTH-TIMER 1
  30 service-policy type service name SERVICE_L4R
 !
 class type control always event session-restart
  10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address
  20 set-timer UNAUTH-TIMER 1
  30 service-policy type service name SERVICE_L4R
 !
 class type control always event account-logon
  10 authenticate aaa list ISG-AUTH-1
  20 service-policy type service unapply name SERVICE_L4R
 !

interface GigabitEthernet0/1.40
 description SUBSCRIBERS SUBNET 10.0.0.2/24
 encapsulation dot1Q 40
 ip dhcp relay information trusted
 ip address 10.0.0.2 255.255.255.0
 ip helper-address 10.0.0.1
 service-policy type control ISG-CUSTOMERS-POLICY
 ip subscriber routed
  initiator unclassified ip-address
! 
logging trap notifications
logging origin-id hostname
logging 10.0.0.1
logging host  10.0.0.1 transport udp port 6032
!Billing
access-list 195 permit ip host 10.0.0.1 any
access-list 195 permit ip any host 10.0.0.1
access-list 195 deny   ip any any
! Without billing
access-list 196 deny   ip host 10.0.0.1 any
access-list 196 deny   ip any host 10.0.0.1
access-list 196 permit ip any any
! Redirect rules
access-list 197 permit tcp any any eq www
access-list 197 permit tcp any eq www any
access-list 197 permit udp any any eq domain
access-list 197 permit udp any eq domain any
access-list 197 deny   ip any any
! Acces rule for guest users
access-list 198 permit tcp any any eq www
access-list 198 permit tcp any eq www any
access-list 198 permit udp any any eq domain
access-list 198 permit udp any eq domain any
access-list 198 permit tcp any any eq 9443
access-list 198 permit tcp any eq 9443 any
access-list 198 deny ip any any
!
radius-server attribute 44 include-in-access-req
radius-server attribute 44 extend-with-addr
radius-server attribute 8 include-in-access-req
radius-server attribute 32 include-in-accounting-req
radius-server attribute 55 include-in-acct-req
radius-server attribute 31 mac format unformatted
radius-server host 10.0.0.1 auth-port 1812 acct-port 1813 key radisg
radius-server vsa send cisco-nas-port
radius-server vsa send accounting
radius-server vsa send authentication
!