Page History

Будьте внимательны при изменении параметров скорости в тарифном плане нужно почистить кеш сессий в Cisco, иначе будут присваиваться старые настройки сессий.

Cisco-Service-Info = QU;640000;80000;160000;D;500000;62500;125000;,
cisco-avpair += ip:traffic-class=input access-group name ACL_IN_INTERNET_1 priority 200,
cisco-avpair += ip:traffic-class=output access-group name ACL_OUT_INTERNET_1 priority 200,
cisco-avpair += ip:traffic-class=out default drop,
cisco-avpair += ip:traffic-class=in default drop,
cisco-avpair += subscriber:accounting-list=BH_ACCNT_LIST_1

version 12.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ISG-1
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$WWW/$4otH.1GYuWkFaQp25MJ.V1
!
aaa new-model
!
!
aaa group server radius ISG-RADIUS
 server 10.0.0.1 auth-port 1812 acct-port 1813
!
aaa authentication login default group tacacs+ local
aaa authentication login ISG-AUTH-1 group ISG-RADIUS
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa authorization network ISG-AUTH-1 group ISG-RADIUS
aaa authorization subscriber-service default local group ISG-RADIUS
aaa accounting update periodic 1 jitter maximum 0
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network ISG-AUTH-1 start-stop group ISG-RADIUS
!
!
!
!
! coa interface
aaa server radius dynamic-author
 client 10.0.0.1
 server-key isgcontrol
!
aaa session-id common
clock timezone AZST 5
ip subnet-zero
!
!
ip dhcp relay information policy keep
ip dhcp relay information trust-all
!
ip cef
ip domain name mydomain.com
ip ssh version 2
!
!
!
multilink bundle-name authenticated
!
!
archive
 log config
  hidekeys
username letsac privilege 15 secret 5 $1$jHQz$bkaihoHMi6.Eq4ifYnUgH/
!
redirect server-group REDIRECT_NOPAY
   server ip 10.0.0.1 port 80
class-map type traffic match-any CLASS-TO-REDIRECT
 match access-group input 197
 match access-group output 197
!
class-map type control match-all ISG-IP-UNAUTH
 match timer UNAUTH-TIMER
 match authen-status unauthenticated
!
policy-map type service LOCAL_L4R
 ip access-group 197 in
 ip access-group 197 out
 1 class type traffic CLASS-TO-REDIRECT
  redirect to group REDIRECT_NOPAY
 !
!
policy-map type control ISG-CUSTOMERS-POLICY
 class type control ISG-IP-UNAUTH event timed-policy-expiry
  1 service disconnect
 !
 class type control always event quota-depleted
  1 set-param drop-traffic FALSE
 !
 class type control always event credit-exhausted
  1 service-policy type service name LOCAL_L4R
 !
 class type control always event session-start
  10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address
  20 set-timer UNAUTH-TIMER 1
  30 service-policy type service name SERVICE_L4R
 !
 class type control always event session-restart
  10 authorize aaa list ISG-AUTH-1 password ISG identifier source-ip-address
  20 set-timer UNAUTH-TIMER 1
  30 service-policy type service name SERVICE_L4R
 !
 class type control always event account-logon
  10 authenticate aaa list ISG-AUTH-1
  20 service-policy type service unapply name SERVICE_L4R
 !

interface GigabitEthernet0/1.40
 description SUBSCRIBERS SUBNET 10.0.0.2/24
 encapsulation dot1Q 40
 ip dhcp relay information trusted
 ip address 10.0.0.2 255.255.255.0
 ip helper-address 10.0.0.1
 service-policy type control ISG-CUSTOMERS-POLICY
 ip subscriber routed
  initiator unclassified ip-address
! 
logging trap notifications
logging origin-id hostname
logging 10.0.0.1
logging host  10.0.0.1 transport udp port 6032
!Billing
access-list 195 permit ip host 10.0.0.1 any
access-list 195 permit ip any host 10.0.0.1
access-list 195 deny   ip any any
! Without billing
access-list 196 deny   ip host 10.0.0.1 any
access-list 196 deny   ip any host 10.0.0.1
access-list 196 permit ip any any
! Redirect rules
access-list 197 permit tcp any any eq www
access-list 197 permit tcp any eq www any
access-list 197 permit udp any any eq domain
access-list 197 permit udp any eq domain any
access-list 197 deny   ip any any
! Acces rule for guest users
access-list 198 permit tcp any any eq www
access-list 198 permit tcp any eq www any
access-list 198 permit udp any any eq domain
access-list 198 permit udp any eq domain any
access-list 198 permit tcp any any eq 9443
access-list 198 permit tcp any eq 9443 any
access-list 198 deny ip any any
!
radius-server attribute 44 include-in-access-req
radius-server attribute 44 extend-with-addr
radius-server attribute 8 include-in-access-req
radius-server attribute 32 include-in-accounting-req
radius-server attribute 55 include-in-acct-req
radius-server attribute 31 mac format unformatted
radius-server host 10.0.0.1 auth-port 1812 acct-port 1813 key radisg
radius-server vsa send cisco-nas-port
radius-server vsa send accounting
radius-server vsa send authentication
!

aaa authentication ppp PPPoE group ISG-RADIUS
aaa authorization network PPPoE group ISG-RADIUS
aaa accounting network PPPoE start-stop group ISG-RADIUS
aaa accounting delay-start all
aaa accounting update periodic 1
!
aaa server radius dynamic-author
 client 10.0.0.1
 server-key 7 131612111909102922372B3C
 port 3799
 auth-type any


!
bba-group pppoe PPPoE
virtual-template 1
sessions per-mac limit 2 ! Сделано именно так, чтобы сессия пересоздавалась, не ожидая пока Циска убьет старую сессию
sessions per-vlan limit 1000
sessions auto cleanup

! Client interface
interface Port-channel1
 description To-SW-Core
 no ip address
 pppoe enable group PPPoE

!
interface Virtual-Template1
 mtu 1492
 ip unnumbered Loopback1
 no ip proxy-arp
 ip nat inside
 ip verify unicast source reachable-via rx
 ip tcp adjust-mss 1452
 no logging event link-status
 peer default ip address pool default
 keepalive 30 4
 ppp mtu adaptive
 ppp authentication chap PPPoE
 ppp authorization PPPoE
 ppp accounting PPPoE
 ppp ipcp dns 8.8.8.8
 ppp ipcp mask 255.255.255.255
 ppp ipcp address unique
 ppp timeout idle 2592000

$AUTH{cisco_isg} = 'Mac_auth2';
$ACCT{cisco_isg} = 'Acct2';

$conf{INTERNET_ISG}=1;

sh sss session

Current Subscriber Information: Total sessions 1
Uniq ID Interface    State         Service      Identifier           Up-time
179     IP           authen        Local Term   123.123.244.194       00:16:27

sh sss session detail

Session inbound features:
 Feature: Prepaid Idle Timeout
   Timeout configuration: 120 (seconds)
 Feature: Prepaid Volume Monitor
   Threshold:999999 - Quota:1000000
   Usage(since last update):161828 - Total:161828
   Current states: Start
Session outbound features:
 Feature: Prepaid Idle Timeout
   Timeout configuration: 120 (seconds)
 Feature: Prepaid Volume Monitor
   Threshold:999999 - Quota:1000000
   Usage(since last update):161828 - Total:161828
   Current states: Start
Configuration sources associated with this session:
Service: PREPAID_INTERNET, Active Time = 00:16:39

cle sss session all 

sh redirect translations   

ip rcmd rsh-enable
no ip rcmd domain-lookup
ip rcmd remote-host abills_admin 10.88.88.1 root enable 15
username abills_admin privilege 15 nopassword

#Также возможно нужно будет добавить telnet
line vty 0 4

 transport input telnet ssh
 transport output ssh

rsh -l abills_admin 10.88.88.10 "show run"

rad_recv: Access-Request packet from host 10.0.0.2 port 1645, id=178, length=121
      User-Name = "10.11.11.1"
      User-Password = "ISG"
      NAS-Port-Type = Virtual
      Cisco-NAS-Port = "0/0/1/40"
      NAS-Port = 0
      NAS-Port-Id = "0/0/1/40"
      Service-Type = Outbound-User
      NAS-IP-Address = 10.0.0.2
      Acct-Session-Id = "3ED4EBBB00057216"

Sending Access-Reject of id 178 to 10.0.0.2 port 1645
      Reply-Message = "User Not Exist '169.254.6.231' /0"

rad_recv: Access-Request packet from host 10.0.0.2 port 1645, id=179, length=119
      User-Name = "SERVICE_L4R"
      User-Password = "cisco"
      NAS-Port-Type = Virtual
      Cisco-NAS-Port = "0/0/1/40"
      NAS-Port = 0
      NAS-Port-Id = "0/0/1/40"
      Service-Type = Outbound-User
      NAS-IP-Address = 10.0.0.2
      Acct-Session-Id = "3ED4EBBB00057216"

Sending Access-Accept of id 179 to 10.0.0.2 port 1645
      Cisco-AVPair += "ip:l4redirect=redirect list 197 to group REDIRECT_NOPAY"
      Cisco-AVPair += "traffic-class=input access-group 198"
      Cisco-AVPair += "traffic-class=output access-group 198"
      Cisco-AVPair += "ip:traffic-class=out default drop"
      Cisco-AVPair += "ip:traffic-class=in default drop"
      Idle-Timeout = 600

rad_recv: Access-Request packet from host 10.0.0.2 port 1645, id=1179, length=119
      Framed-Protocol = PPP
      User-Name = "n9351779"
      CHAP-Password = 0x013d75d54fca0f2f4f189a03a1816b77bf
      NAS-Port-Type = PPPoEoVLAN
      NAS-Port = 0
      NAS-Port-Id = "0/1/1/939"
      Cisco-AVPair = "client-mac-address=0019.dbc7.d1cb"
      Service-Type = Framed-User
      NAS-IP-Address = 10.0.0.2
      Acct-Session-Id = "00D24ADF"
NAS-Identifier = "91.223.105.1"
Event-Timestamp = "Aug  7 2015 06:22:57 MSK"

Sending Access-Accept of id 179 to 10.0.0.2 port 1645
  Cisco-Control-Info = QV1000000
  Service-Type = Outbound-User
  Idle-Timeout = 120
  Cisco-Account-Info = NTP_10_0_48
  Cisco-Account-Info = ATP_10_0_48
  Cisco-Account-Info = ABILLING_ACCESS
  User-Name = n9351779
  Cisco-Service-Info = ATP_10_0_48

rad_recv: Access-Request packet from host 10.0.0.2 port 1645, id=1279, length=119
  User-Name = TP_10_0_48
  NAS-IP-Address = 10.0.0.2

Sending Access-Accept of id 179 to 10.0.0.2 port 1645
  Cisco-Service-Info = QU;1024000;128000;256000;D;1024000;128000;256000;
  Cisco-AVPair = ip:traffic-class=in access-group 196 priority 6
  Cisco-AVPair = ip:traffic-class=out access-group 196 priority 6
  Cisco-AVPair = ip:traffic-class=out default drop
  Cisco-AVPair = ip:traffic-class=in default drop
  Cisco-AVPair = subscriber:accounting-list=ISG-AUTH-1
  Acct-Interim-Interval = 86000