Cisco Intelligent Wireless Access Gateway User manual

Intelligent Wireless Access Gateway Configuration Guide
First Published: July 26, 2013
Last Modified: March 28, 2014
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-30226-03

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: http://
www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
©2014 Cisco Systems, Inc. All rights reserved.

CONTENTS
CHAPTER 1 Overview of the Intelligent Wireless Access Gateway 1
Finding Feature Information 1
Prerequisites for the iWAG 2
Restrictions for the iWAG 2
Information About the iWAG 2
Benefits of the iWAG 3
AAA Attributes 3
Supported Hardware and Software Compatibility Matrix for the iWAG 7
How to Configure the iWAG 8
Configuring the iWAG for Simple IP Users 8
Configuring the iWAG for 3G Mobile IP Users 8
Configuring Authentication, Authorization, and Accounting for the iWAG 8
Configuring DHCP when the iWAG Acts as a DHCP Proxy 10
Configuring the Cisco ISG Class Map and Policy Map for the iWAG 12
Configuring a Session Initiator for the iWAG 15
Configuring a Tunnel Interface for the iWAG 16
Enabling Mobile Client Service Abstraction 17
Configuring the GTP of the iWAG 18
Configuring the iWAG for 4G Mobile IP Users 21
Configuring PMIPv6 for the iWAG 21
Enabling Mobile Client Service Abstraction 21
Additional References 22
Feature Information for the Intelligent Wireless Access Gateway 23
24
CHAPTER 2 IP Sessions Over Gigabit EtherChannel 25
Finding Feature Information 25
Restrictions for IPoGEC 25
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 iii

Information About IP Sessions over Gigabit EtherChannel 26
Supported Features for IPoGEC 26
Configuring IP Sessions over Gigabit EtherChannel 26
Configuring Member Links for IP Sessions over Gigabit EtherChannel 28
Configuration Examples for IP Sessions Over Gigabit EtherChannel 29
Additional References 29
Feature Information for IP Sessions over Gigabit EtherChannel 30
31
CHAPTER 3 Multiple-Flow Tunnel 33
Finding Feature Information 33
Information About Multiple-Flow Tunnel 33
Additional References 34
Feature Information for Multiple-Flow Tunnel 35
35
CHAPTER 4 Service Provider WiFi: Support for Integrated Ethernet Over GRE 37
Finding Feature Information 37
Information About Ethernet Over GRE 38
Restrictions for Configuring Ethernet Over GRE 38
Prerequisites for Configuring Ethernet Over GRE 39
Information About Configuring Ethernet Over GRE 39
EoGRE Deployment with PMIPv6 Integrated for Mobility Service 42
EoGRE Deployment with GTP Integrated for Mobility Service 43
EoGRE Deployment with ISG Integrated for Simple IP Service 43
Supported Features 44
How to Configure the EoGRE Feature 45
Example: Configuring the EoGRE Feature 46
Additional References 48
Feature Information for Configuring Ethernet Over GRE 49
CHAPTER 5 GTPv2 Support in the iWAG 51
Finding Feature Information 51
Restrictions for GTPv2 of the iWAG 51
Information About GTPv2 in the iWAG 52
Intelligent Wireless Access Gateway Configuration Guide
iv OL-30226-03
Contents

GTPv2 Configuration 52
RADIUS Configuration 53
Intra-iWAG Roaming 53
Configuration for the GTPv1 and GTPv2 Roaming Scenario 53
Additional References 54
Feature Information for GTPv2 Support in the iWAG 55
55
CHAPTER 6 iWAG SSO Support for GTP 57
Finding Feature Information 57
Information About iWAG SSO Support for GTP 57
Enabling SSO Support for the GTP 58
Additional References 59
Feature Information for iWAG SSO Support for GTP 60
60
CHAPTER 7 Configuring ISG Policy Templates 61
Finding Feature Information 61
Restrictions for Configuring ISG Policy Templates 61
Information About Configuring ISG Policy Templates 61
How to Configure ISG Policy Templates 62
Additional References 62
Feature Information for Configuring ISG Policy Templates 63
63
CHAPTER 8 Cisco ISG Accounting Accuracy for LNS Sessions 65
Finding Feature Information 65
Information About Cisco ISG Accounting Accuracy for LNS Sessions 65
Additional References 66
Feature Information for Cisco ISG Accounting Accuracy for LNS Sessions 67
67
CHAPTER 9 Dual Stack Support for PMIPv6 and GTP 69
Finding Feature Information 69
Information About Dual-Stack Support for PMIPv6 69
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 v
Contents

Features Supported for Dual-Stack PMIPv6 Sessions 70
Information About Dual-Stack Support for GTP 70
Restrictions for Dual-Stack GTP 70
AAA Attributes for Dual Stack 70
Configuration Examples for Dual-Stack PMIPv6 71
Example: Configuring an Access List Traffic Classmap for Dual-Stack PMIPv6 71
Example: Configuring a Classmap for Dual-Stack PMIPv6 71
Example: Configuring a Policymap for Dual-Stack PMIPv6 72
Example: Configuring a Control Policy for Dual-Stack PMIPv6 72
Example: Configuring an Access Interface for Dual-Stack PMIPv6 73
Example: Configuring the Local Mobility Anchor for Cisco ASR 5000 Routers 73
Example: Configuring Mobile Access Gateways for Dual-Stack PMIPv6 74
Configuration Examples for Dual-Stack GTP 75
Example: Configuring Dual-Stack Sessions for GTP 75
Example: Configuring an Interface to PGW or GGSN 75
Example: Configuring a Control Policy for Dual-Stack GTP 75
Example: Configuring an Access Interface for Dual-Stack GTP 75
Enabling IPv6 Routing 76
Additional References 76
Feature Information for Dual-Stack Support for PMIPv6 and GTP 77
77
CHAPTER 10 Flow-Based Redirect 79
Finding Feature Information 79
Flow-Based Redirect for Adult Content Filtering 80
Flow-Based Redirect for Selective IP Traffic Offload 81
Activating and Deactivating the Flow-Based Redirect Feature Through Vendor-Specific
Attributes 82
Configuring Flow-Based Redirect for a Traffic Class Service 82
Examples 85
Best Practices for Configuring the NAT on the Cisco ASR 1000 Series Routers 87
NAT Overloading and Port Parity 88
NAT Interface Overloading with VRF 88
Additional References 89
Feature Information for Flow-Based Redirect 89
Intelligent Wireless Access Gateway Configuration Guide
vi OL-30226-03
Contents

90
CHAPTER 11 Call Flows for Simple IP Users 91
Finding Feature Information 91
Simple IP Unclassified MAC Authentication (MAC TAL and Web Login) Call Flows 91
Simple IP Unclassified MAC with MAC TAL Authentication Call Flow 93
Simple IP Unclassified MAC with Web Login Authentication Call Flow 95
Simple IP Unclassified MAC Authentication Call Flow Configuration 96
Additional References 98
Feature Information for Call Flows for Simple IP Users 99
99
CHAPTER 12 Call Flows for 3G and 4G Mobile IP Users 101
Finding Feature Information 101
3G DHCP Discover Call Flow 101
3G DHCP Discover Call Flow Configuration 104
4G DHCP Discover Call Flow 108
4G DHCP Discover Call Flow Configuration 110
4G Roaming Call Flow 111
4G Roaming Call Flow Configuration 114
Additional References 115
Feature Information for Call Flows for 3G and 4G Mobile IP Users 116
116
CHAPTER 13 Call Flows for Dual-Stack PMIPv6 and GTP 117
Finding Feature Information 117
Dual-Stack Mobile IPoE Session with DHCPv4 as FSOL for PMIPv6 Call Flow 118
Dual-Stack Mobile IPoE Session with IPv6 ND as FSOL for PMIPv6 Call Flow 121
Dual-Stack Mobile IPoE Session with DHCPv4 as FSOL for GTP Call Flow 124
Dual-Stack Mobile IPoE Session with IPv6 ND as FSOL for GTP Call Flow 126
Additional References 128
Feature Information for Call Flows for Dual-Stack PMIPv6 and GTP 129
130
CHAPTER 14 iWAG Scalability and Performance 131
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 vii
Contents

iWAG Scaling 131
Restrictions for iWAG Scalability 132
Layer 4 Redirect Scaling 133
Configuring Call Admission Control 133
Walk-by User Support for PWLAN in iWAG 133
Additional References 134
Feature Information for iWAG Scalability and Performance 135
Intelligent Wireless Access Gateway Configuration Guide
viii OL-30226-03
Contents

CHAPTER 1
Overview of the Intelligent Wireless Access
Gateway
Service providers use a combination of WiFi and mobility offerings to offload their mobility networks in
the area of high-concentration service usage. This led to the evolution of the Intelligent Wireless Access
Gateway (iWAG).
The iWAG provides a WiFi offload option to 4G and 3G service providers by enabling a single-box solution
that provides the combined functionality of Proxy Mobile IPv6 (PMIPv6) and GPRS Tunneling Protocol
(GTP) on the Cisco Intelligent Services Gateway (Cisco ISG) framework. This document provides information
about the iWAG and how to configure it, and contains the following sections:
•Finding Feature Information, page 1
•Prerequisites for the iWAG, page 2
•Restrictions for the iWAG, page 2
•Information About the iWAG, page 2
•How to Configure the iWAG, page 8
•Additional References, page 22
•Feature Information for the Intelligent Wireless Access Gateway, page 23
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest caveats and
feature information, see Bug Search Tool and the release notes for your platform and software release. To
find information about the features documented in this module, and to see a list of the releases in which each
feature is supported, see the feature information table at the end of this module.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support.
To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 1

Prerequisites for the iWAG
•Enable mobile client service abstraction (MCSA).
•Enable the ipv6 unicast-routing command.
Restrictions for the iWAG
•Roaming from a 3G mobility network to a WLAN is not supported for the GTP and Cisco ISG sessions.
•IP subscriber-routed (L3) sessions are not supported.
•IPv6 and quality of service (QoS) are not supported in a 3G mobility network.
•Only newly established calls are offloaded to the WLAN Third-Generation Partnership Project (3GPP)
IP access.
•The iWAG solution for WLAN offload is currently available only for the 3G Universal Mobile
Telecommunications System (UMTS).
Information About the iWAG
The iWAG deployment includes a combination of simple IP users (traditional ISG and WiFi) and mobile IP
users (PMIPv6 or GTP tunneling). The term mobility service is used to refer to either the GTP service or the
PMIPv6 service applied to user traffic. The iWAG provides mobility services to mobile IP users, and as a
result, a mobile client can seamlessly access a 3G or 4G mobility network. However, the iWAG does not
provide mobility services to simple IP users. Therefore, simple IP users can access the Public Wireless LAN
(PWLAN) network through the Cisco ISG. Clients are devices that access WiFi Internet (public wireless),
where possible. However, if WiFi is not available, the same clients can
connect to the Internet service using a 3G or 4G mobility network.
The iWAG has a transport or switching element with Cisco ISG subscriber awareness. The iWAG also has
RADIUS-based authentication and accounting, and policy-based subscriber routing for the WiFi wholesale
model.
For more information about the iWAG, see the Overview of iWAG video.
Intelligent Wireless Access Gateway Configuration Guide
2OL-30226-03
Overview of the Intelligent Wireless Access Gateway
Prerequisites for the iWAG

The following figure shows a deployment model of the iWAG on a Cisco ASR 1000 Series Aggregation
Services Router.
Figure 1: iWAG Deployment on a Cisco ASR 1000 Series Aggregation Services Router
Benefits of the iWAG
The iWAG offers the following benefits for mobile operators:
•Reduces network congestion by reducing OpEx and increasing network efficiency by offloading 3G
and 4G traffic.
•Provides access to 3G and 4G core inspite of a lack of or weak cell signal, leading to subscriber retention.
•Lowers CapEx on per user basis or bandwidth basis in dense metro environments.
The iWAG offers the following benefits for wireline and WiFi operators:
•Provides WiFi security and subscriber control. Delivers scalable, manageable, and secure wireless
connectivity.
•Enables new revenue-sharing business models, such as Mobile Virtual Network Operators (MVNO)
and others.
•Delivers a WiFi platform that offers new location-based services.
The iWAG offers the following benefits for subscribers:
•Provides enhanced quality of experience to subscribers on WiFi networks.
•Provides unified billing across access networks.
•Provides mobility across radio access technologies—3G or 4G to WiFi and WiFi to WiFi.
•Provides multiple options within the WiFi platform, thereby enabling location-based services.
AAA Attributes
The following table lists the authentication, authorization, and accounting (AAA) attributes required for the
iWAG configuration:
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 3
Overview of the Intelligent Wireless Access Gateway
Benefits of the iWAG

The following indicate the availability of the attributes:
C: Conditional
M: Mandatory
O: Optional
N: Not present
Note
Table 1: iWAG AAA Attributes
CoA5 AS4 ARj3 AA2 ARq1 DescriptionValueAttri
bute
Name
Attrib
ute
/Subattri
bute
COMMMNetwork Access
Identifier
StringUser Name1
OMNNMIP address of the
MAG
StringNAS-IP
-Address
4
MMMMMMAC address of the
mobile node
StringCalling-
Station-ID
31
ONNON3GPP IMSIString3GPP-
IMSI
26/
10415/
1
OONONRules for producing
charging information
String3GPP
-Charging
-Characteristics
26/
10415
/13
CNNCNService Identifier
(APN)
StringCisco-Service
-Selection
26
/9
/1
CMNMNMobile Node
Identifier
StringCisco
-Mobile
-Node
-Identifier
26
/9
/1
NCNNCSSID of the Access
Point
StringCisco
-WLAN
-SSID
26
/9/1
Intelligent Wireless Access Gateway Configuration Guide
4OL-30226-03
Overview of the Intelligent Wireless Access Gateway
AAA Attributes

CoA5 AS4 ARj3 AA2 ARq1 DescriptionValueAttri
bute
Name
Attrib
ute
/Subattri
bute
CCNCNMobile Subscriber
ISDN number
StringCisco
-MSISDN
26/9/1
OMNMNMobile Node Service
type
ENUM
•none
•ipv4
•ipv6
•dual
Cisco-MN
-Service
26/9/1
OONMNProtocol Interface to
be used for
interfacing with MPC
ENUM
•none
•pmipv6
•gtpv1
•pmipv4
Cisco-MPC
-Protocol
-Interface
26/9/1
ONNONTrue/False:
Multihoming support
for mobile node
BinaryCisco
-Multihoming
-Support
26/9/1
ONNON32-bit GRE Key to be
used on the uplink
path (4-octet hex
encoding)
IntegerCisco
-Uplink
-GRE
-Key
26/9/1
ONNON32-bit GRE Key to be
used on the downlink
path (4-octet hex
encoding)
IntegerCisco
-Downlink
-GRE
-Key
26/9/1
ONNCNMobile node's Home
LMA IPv6 address
StringCisco
-Home
-LMA
-IPv6
-Address
26/9/1
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 5
Overview of the Intelligent Wireless Access Gateway
AAA Attributes

CoA5 AS4 ARj3 AA2 ARq1 DescriptionValueAttri
bute
Name
Attrib
ute
/Subattri
bute
ONNCNMobile node's Visited
LMA IPv6 address
StringCisco
-Visited
-LMA
-IPv6
-Address
26/9/1
ONNCNMobile node's Home
LMA IPv4 address
IPv4 AddressCisco
-Home
-LMA
-IPv4
-Address
26/9/1
ONNCNMobile node's Visited
LMA IPv4 address
IPv4 AddressCisco
-Visited
-LMA
-IPv4
-Address
26/9/1
CNNONMobile node's Visited
LMA IPv4 address
IPv4 AddressCisco
-Home
-IPv4
-Home
-Address
26/9/1
CNNONMobile node's Visited
IPv4 address
IPv4 AddressCisco
-Visited
-IPv4
-Home
-Address
26/9/1
NNNONGRPS QoS ProfileStringTHREEGENPP
_GPRS
_QOS
_PROFILE
26
/10415
/5
Intelligent Wireless Access Gateway Configuration Guide
6OL-30226-03
Overview of the Intelligent Wireless Access Gateway
AAA Attributes

CoA5 AS4 ARj3 AA2 ARq1 DescriptionValueAttri
bute
Name
Attrib
ute
/Subattri
bute
NNNONGGSN's AddressIPv4 AddressTHREEGENPP
_GGSN
_ADDRESS
26
/10415
/7
NNNONAccess-side VRF IDStringCisco
-Access
-Vrf
-Id
26/9/1
NNNONGGSN's IPv4 addressIPv4 AddressCisco
-Apn
-Vrf
-Id
26/9/1
1Access Request
2Access Accept
3Access Reject
4Accounting Start
5Change of Authorization
Supported Hardware and Software Compatibility Matrix for the iWAG
ESPRP MemoryChassis
IntegratedIntegrated RP with 16 GBCisco ASR 1001 Router
IntegratedIntegrated RP with 16 GBCisco ASR 1002-X Router
ESP-40GRP2 16 GBCisco ASR 1004 Router
ESP-40GRP2 16 GBCisco ASR 1006 Router and Cisco
ASR 1013 Router offering duplex
RP or ESP setup
ESP-100GRP2 16 GBCisco ASR 1006 Router and Cisco
ASR 1013 Router offering duplex
RP or ESP setup
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 7
Overview of the Intelligent Wireless Access Gateway
Supported Hardware and Software Compatibility Matrix for the iWAG

For information about the field-replaceable units (FRUs) of the Cisco ASR 1000 Series Aggregation Services
Routers supported by each ROMmon release, see the "ROMmon Release Requirements" section in the Cisco
ASR 1000 Series Aggregation Services Routers Release Notes.
How to Configure the iWAG
Configuring the iWAG for Simple IP Users
You must configure the Cisco Intelligent Services Gateway (ISG) for the iWAG to enable simple IP users to
access Internet services.
The tasks listed below enable IP sessions and indicate how these sessions are identified. For detailed steps,
see the "Creating ISG Sessions for IP Subscribers" section in the Intelligent Services Gateway Configuration
Guide.
•Creating ISG IP interface sessions
•Creating ISG Static Sessions
•Creating ISG IP Subnet Sessions
•Configuring IP Session Recovery for DHCP-Initiated IP Sessions
•Verifying ISG IP Subscriber Sessions
•Clearing ISG IP Subscriber Sessions
•Troubleshooting ISG IP Subscriber Sessions
You must configure DHCP support in your network before performing the tasks listed below. For detailed
steps on assigning IP addresses using DHCP, see the "Assigning ISG Subscriber IP Addresses by Using
DHCP" section in the Intelligent Services Gateway Configuration Guide.
•Configuring an ISG Interface for Dynamic DHCP Class Association
•Configuring DHCP Server User Authentication
•Configuring a DHCP Class in a Service Policy Map
•Configuring a DHCP Class in a Service Profile or User Profile on the AAA Server
•Configuring a DHCP Server IP Address
Configuring the iWAG for 3G Mobile IP Users
You must configure GTP for the iWAG to allow access to 3G mobile IP users. The various tasks described
in the following sections are mandatory for configuring the iWAG for 3G mobile IP users.
Configuring Authentication, Authorization, and Accounting for the iWAG
This section describes how to configure authentication, authorization, and accounting (AAA) for the iWAG
on the Cisco ASR 1000 Series Aggregation Services Routers.
Intelligent Wireless Access Gateway Configuration Guide
8OL-30226-03
Overview of the Intelligent Wireless Access Gateway
How to Configure the iWAG

SUMMARY STEPS
1. enable
2. configure terminal
3. aaa new-model
4. aaa group server radius group-name
5. server-private ip-address [auth-port port-number | acct-port port-number ] [non-standard] [timeout
seconds ] [retransmit retries ] [ key string]
6. aaa authentication login {default | list-name} {[passwd-expiry] method1 [method2...]}
7. aaa authorization network authorization-name group server-group name
8. aaa authorization subscriber-service {default {cache | group | local} | list-name} method1 [method2...]
9. aaa accounting{auth-proxy| system | network | exec | connection | commands level | dot1x}{{default
|list-name } [vrf vrf-name] {start-stop | stop-only | none} [broadcast] group group-name
10. action-type {none | start-stop | stop-only}
11. group {tacacs+ server-group}
12. aaa accounting {auth-proxy | system | network | exec | connection | commands level | dot1x } {default
|list-name } [vrf vrf-name ]{start-stop | stop-only | none} [broadcast] group group-name
DETAILED STEPS
PurposeCommand or Action
Enables the privileged EXEC mode.enable
Step 1
Example:
Router# enable
Enter your password, if prompted.
Enters the global configuration mode.configure terminal
Example:
Router# configure terminal
Step 2
Enables the AAA access control model.aaa new-model
Example:
Router(config)# aaa new-model
Step 3
Groups different RADIUS server hosts into distinct
lists and methods.
aaa group server radius group-name
Example:
Router(config)# aaa group server radius AAA_SERVER_CAR
Step 4
Configures the IP address of the private RADIUS
server for the group server.
server-private ip-address [auth-port port-number | acct-port
port-number ] [non-standard] [timeout seconds ] [retransmit retries
][key string]
Step 5
Example:
Router(config-sg-radius)# server-private 5.3.1.76
auth-port 2145 acct-port 2146 key cisco
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 9
Overview of the Intelligent Wireless Access Gateway
Configuring the iWAG for 3G Mobile IP Users

PurposeCommand or Action
Sets AAA authentication at login.
aaa authentication login {default | list-name} {[passwd-expiry]
method1 [method2...]}
Step 6
Example:
Router(config-sg-radius)# aaa authentication login
default none
Runs authorization for all network-related service
requests.
aaa authorization network authorization-name group
server-group name
Example:
Router(config)# aaa authorization network ISG_PROXY_LIST
group AAA_SERVER_CAR
Step 7
Specifies one or more AAA authorization methods
for the Cisco ISG to provide subscriber service.
aaa authorization subscriber-service {default {cache | group |
local} | list-name} method1 [method2...]
Example:
Router(config)# aaa authorization subscriber-service
default local group AAA_SERVER_CAR
Step 8
Enables AAA accounting of requested services
for billing and security purposes when either the
RADIUS server or the TACACS+ server is used.
aaa accounting{auth-proxy| system | network | exec | connection
| commands level | dot1x}{{default | list-name } [vrf vrf-name]
{start-stop | stop-only | none} [broadcast] group group-name
Example:
Router(config)# aaa accounting network PROXY_TO_CAR
Step 9
Enables the type of actions to be performed on
accounting records.
action-type {none | start-stop | stop-only}
Example:
Router(cfg-acct-mlist)# action-type start-stop
Step 10
Specifies the AAA TACACS+ server group to use
for preauthentication.
group {tacacs+ server-group}
Example:
Router(cfg-preauth)# group AAA_SERVER_CAR
Step 11
Enables AAA accounting of requested services
for billing and security purposes when you use
aaa accounting {auth-proxy | system | network | exec | connection
| commands level | dot1x } {default |list-name } [vrf vrf-name ]
{start-stop | stop-only | none} [broadcast] group group-name
Step 12
either the RADIUS server or the TACACS+
server.
Example:
Router(config)# aaa accounting network ISG_PROXY_LIST
start-stop group AAA_SERVER_CAR
Configuring DHCP when the iWAG Acts as a DHCP Proxy
This section describes how to configure the Dynamic Host Configuration Protocol (DHCP) for the iWAG
solution when the iWAG acts as a DHCP proxy.
Intelligent Wireless Access Gateway Configuration Guide
10 OL-30226-03
Overview of the Intelligent Wireless Access Gateway
Configuring the iWAG for 3G Mobile IP Users

SUMMARY STEPS
1. enable
2. configure terminal
3. ip dhcp excluded-address [vrf vrf-name] ip-address
4. ip dhcp pool pool-name
5. network network-number [ mask [secondary] | /prefix-length [secondary]
6. default-router ip-address [last-ip-address]
7. domain-name domain
8. lease {days [hours [ minutes ]] | infinite}
DETAILED STEPS
PurposeCommand or Action
Enables the privileged EXEC mode.enable
Step 1
Example:
Router> enable
Enter your password, if prompted.
Enters the global configuration mode.configure terminal
Example:
Router# configure terminal
Step 2
Specifies the IP address that a DHCP server should not assign
to DHCP clients.
ip dhcp excluded-address [vrf vrf-name] ip-address
Example:
Router(config)# ip dhcp excluded-address
192.168.10.1
Step 3
Configures a DHCP address pool on a DHCP server and enters
the DHCP pool configuration mode.
ip dhcp pool pool-name
Example:
Router(config)# ip dhcp pool test
Step 4
Configures the network number and mask for a DHCP address
pool primary subnet or DHCP address pool secondary subnet on
a Cisco IOS DHCP server.
network network-number [ mask [secondary] |
/prefix-length [secondary]
Example:
Router(dhcp-config)# network 192.168.0.0
255.255.0.0
Step 5
Specifies the default router list for a DHCP client.
default-router ip-address [last-ip-address]
Example:
Router(dhcp-config)# default-router
192.168.10.1
Step 6
Intelligent Wireless Access Gateway Configuration Guide
OL-30226-03 11
Overview of the Intelligent Wireless Access Gateway
Configuring the iWAG for 3G Mobile IP Users

PurposeCommand or Action
Specifies the domain name for a DHCP client.
domain-name domain
Example:
Router(dhcp-config)# domain-name example.com
Step 7
Configures the duration of the lease for an IP address that is
assigned from a Cisco IOS DHCP server to a DHCP client.
The DHCP pool lease time is applicable only to simple
sessions. For mobile GTP sessions, lease time from the
GTP configuration will be used. Under the GTP
configuration, lease duration should be configured the
same way as the address hold timer in the GGSN or
PGW.
Note
lease {days [hours [ minutes ]] | infinite}
Example:
Router(dhcp-config)# lease 1 2 2
Step 8
Configuring the Cisco ISG Class Map and Policy Map for the iWAG
This section describes how to configure the Cisco ISG class map and policy map for the iWAG.
SUMMARY STEPS
1. enable
2. configure terminal
3. class-map type traffic match-any class-map-name
4. match access-group output {access-group | name access-group-name}
5. match access-group input {access-group | name access-group-name}
6. policy-map type service policy-map-name
7. [ priority ] class type traffic {class-map-name | default {in-out | input | output } }
8. accounting aaa list aaa-method-list
9. [ priority ] class type traffic { class-map-name | default {in-out | input | output}}
10. drop
11. policy-map type control policy-map-name
12. class type control control-class-name | always} [event{access-reject | account-logoff | account-logon |
acct-notification | credit-exhausted | dummy-event | quota-depleted | radius-timeout | service-failed |
service-start | service-stop | session-default-service | session-restart | session-service-found | session-start
|timed-policy-expiry}]
13. action-number service-policy type service [unapply] [aaa list list-name ] {name service-name |
identifier {authenticated-domain | authenticated-username | dnis | nas-port | tunnel-name |
unauthenticated-domain | unauthenticated-username }}
14. action-number authorize[aaa{list-name | list { list-name | default}} [password password]] [upon
network-service-found {continue | stop}] [use method authorization-type]identifier identifier-type
[plus identifier-type]
Intelligent Wireless Access Gateway Configuration Guide
12 OL-30226-03
Overview of the Intelligent Wireless Access Gateway
Configuring the iWAG for 3G Mobile IP Users