ISGv2 Control policies

Материал из noname.com.ua
Перейти к навигацииПерейти к поиску


Control policies

Политики управляют всей логикой

1

Что хочется получить

  • Для всех пользователей проверять скорость из радиуса и выставлять соответвующую скорость
    • Скорость пользователя в биллинге произвольна и нет заранее предопределенных тарифов
  • Если радиус не ответил (тайм-аут) то для пользователей из разрешенного диапазона адресов разрешать доступ в интернет (без ограничения скорости)
  • Если радиус ответил Reject то для разрешенного диапазона разрешать работу а для запрещенного диапазона - делать редирект

Определить диапазона адресов

"Нормальные" платящие абоненты

Три диапазона (в примере только два)

  • "Старый" пул адресов 192.168.128.0/20
  • Новый пул адресов, на который только планируется миграция 100.64.128.0/20
  • Реальные адреса заменены на сеть 100.127.252.0/22


no ip access-list extended FROM_PAID_CUSTOMERS
ip access-list extended FROM_PAID_CUSTOMERS
 remark From Paid customers, old and new IP ranges
 100   permit ip 192.168.128.0  0.0.15.255 any
 200   permit ip 100.64.128.0   0.0.15.255 any
 10000 deny   ip any any
exit

no ip access-list extended TO_PAID_CUSTOMERS
ip access-list extended TO_PAID_CUSTOMERS
 100   permit ip any 192.168.128.0  0.0.15.255
 200   permit ip any 100.64.128.0   0.0.15.255
 10000 deny   ip any any
 deny   ip any any
exit

Диапазон "неплатильщиков"

Абонентам у которых образовалась задолженность, выдаются адреса из диапазона 10.3.0.0/16 


no ip access-list extended FROM_NOT_PAID_CUSTOMERS
ip access-list extended FROM_NOT_PAID_CUSTOMERS
 remark From Not-Paid Customers
 100   permit ip 10.3.0.0  0.0.255.255 any
 10000 deny   ip any any
exit

no ip access-list extended TO_NOT_PAID_CUSTOMERS
ip access-list extended TO_NOT_PAID_CUSTOMERS
 remark TO Not-Paid Customers
 100   permit ip any 10.3.0.0  0.0.255.255
 10000 deny   ip any any
 deny   ip any any
exit




no ip access-list extended FROM_NOT_PAID_CUSTOMERS_TO_INET
ip access-list extended FROM_NOT_PAID_CUSTOMERS_TO_INET
 remark From Not-Paid Customers to internet except our network
 100   deny   ip 10.3.0.0  0.0.255.255 10.0.0.0       0.255.255.255
 200   deny   ip 10.3.0.0  0.0.255.255 192.168.0.0    0.0.255.255
 300   deny   ip 10.3.0.0  0.0.255.255 172.16.0.0     0.15.255.255
 400   deny   ip 10.3.0.0  0.0.255.255 100.64.128.0   0.0.15.255
 500   deny   ip 10.3.0.0  0.0.255.255 100.127.252.0  0.0.3.255
 600   permit ip 10.3.0.0  0.0.255.255 any
 10000 deny   ip any any
exit

no ip access-list extended FROM_NOT_PAID_CUSTOMERS_TO_LOCAL
ip access-list extended FROM_NOT_PAID_CUSTOMERS_TO_LOCAL
 remark From Not-Paid Customers to internet except our network
 100   permit ip 10.3.0.0  0.0.255.255 10.0.0.0       0.255.255.255
 200   permit ip 10.3.0.0  0.0.255.255 192.168.0.0    0.0.255.255
 300   permit ip 10.3.0.0  0.0.255.255 172.16.0.0     0.15.255.255
 400   permit ip 10.3.0.0  0.0.255.255 100.64.128.0   0.0.15.255
 500   permit ip 10.3.0.0  0.0.255.255 100.127.252.0  0.0.3.255
 10000 deny   ip any any
exit

no ip access-list extended FROM_LOCAL_TO_NOT_PAID_CUSTOMERS
ip access-list extended FROM_NOT_PAID_CUSTOMERS_TO_LOCAL
 remark From Not-Paid Customers to internet except our network
 100   permit ip 10.0.0.0       0.255.255.255 10.3.0.0  0.0.255.255
 200   permit ip 192.168.0.0    0.0.255.255   10.3.0.0  0.0.255.255
 300   permit ip 172.16.0.0     0.15.255.255  10.3.0.0  0.0.255.255
 400   permit ip 100.64.128.0   0.0.15.255    10.3.0.0  0.0.255.255
 500   permit ip 100.127.252.0  0.0.3.255     10.3.0.0  0.0.255.255
 10000 deny   ip any any
exit




no class-map type control match-all CLASS_MAP_NOT_PAID_CUSTOMERS
class-map type control match-all CLASS_MAP_NOT_PAID_CUSTOMERS
 match source-ip-address 10.3.0.0 255.255.0.0
exit



no class-map type traffic match-any CLASS_MAP_NOT_PAID_CUSTOMERS_TO_LOCAL
class-map type traffic match-any CLASS_MAP_NOT_PAID_CUSTOMERS_TO_LOCAL
 match access-group input  name FROM_NOT_PAID_CUSTOMERS_TO_LOCAL
 match access-group output name FROM_LOCAL_TO_NOT_PAID_CUSTOMERS
exit

Диапазон "неавторизованных"

Те абоненты что только что включились, но еще не ввели свой логин и пароль получают адреса из диапазона 10.2.0.0/16 

no ip access-list extended FROM_NOT_AUTH_CUSTOMERS
ip access-list extended FROM_NOT_AUTH_CUSTOMERS
 remark From Not-Auth Customers
 100   permit ip 10.2.0.0  0.0.255.255 any
 10000 deny   ip any any
exit

no ip access-list extended TO_NOT_AUTH_CUSTOMERS
ip access-list extended TO_NOT_AUTH_CUSTOMERS
 remark TO Not-Auth Customers
 100   permit ip any 10.2.0.0  0.0.255.255
 10000 deny   ip any any
 deny   ip any any
exit

no class-map type control match-all CLASS_MAP_NOT_AUTH_CUSTOMERS
class-map type control match-all CLASS_MAP_NOT_AUTH_CUSTOMERS
 match source-ip-address 10.2.0.0 255.255.0.0
exit

no class-map type traffic match-any CLASS_MAP_NOT_AUTH_CUSTOMERS
class-map type traffic match-any CLASS_MAP_NOT_AUTH_CUSTOMERS
 match access-group input name FROM_NOT_AUTH_CUSTOMERS
 match access-group output name TO_NOT_AUTH_CUSTOMERS
exit

Тестовый сервис

no policy-map type service POLICY_MAP_SERVICE_NOT_PAID_CUSTOMERS_TO_LOCAL
policy-map type service POLICY_MAP_SERVICE_NOT_PAID_CUSTOMERS_TO_LOCAL
 100 class type traffic CLASS_MAP_NOT_PAID_CUSTOMERS_TO_LOCAL
  police input 8000
  police output 8000
exit

999

policy-map type control ISG-CUSTOMERS-POLICY
 class type control ISG-IP-UNAUTH event timed-policy-expiry
  1 service disconnect
 !
 class type control always event session-start
  10 authorize aaa list AAA-LIST-ISG-AUTH password secret identifier source-ip-address
  20 set-timer UNAUTH-TIMER 5
  30 service-policy type service name POLICY_MAP_SERVICE_ON_SESSION_START_
 !
 class type control always event session-restart
  10 authorize aaa list AAA-LIST-ISG-AUTH password secret identifier source-ip-address
  20 set-timer UNAUTH-TIMER 5
  30 service-policy type service name POLICY_MAP_SERVICE_ON_SESSION_RESTART_
 !
 class type control always event service-stop
  1 service-policy type service unapply identifier service-name
  10 service-policy type service unapply identifier service-name
  20 log-session-state
 !
 class type control always event radius-timeout
  20 set-timer UNAUTH-TIMER 60
  30 service-policy type service name POLICY_MAP_SERVICE_ON_SESSION_RADIUS_TIMEOUT_
 !
 class type control always event access-reject
  20 set-timer UNAUTH-TIMER 60
  30 service-policy type service name ALLOW_172_31_100_2
  40 service-policy type service name ALLOW_172_31_100_3_SPEED_8k
  50 service-policy type service name NO_SERVICE
 !

999999

policy-map type control ISG-CUSTOMERS-POLICY
 class type control ISG-IP-UNAUTH event timed-policy-expiry
  1 service disconnect
 !
 class type control always event session-start
  10 authorize aaa list AAA-LIST-ISG-AUTH password secret identifier source-ip-address
  20 set-timer UNAUTH-TIMER 5
  30 service-policy type service name POLICY_MAP_SERVICE_ON_SESSION_START_
 !
 class type control always event session-restart
  10 authorize aaa list AAA-LIST-ISG-AUTH password secret identifier source-ip-address
  20 set-timer UNAUTH-TIMER 5
  30 service-policy type service name POLICY_MAP_SERVICE_ON_SESSION_RESTART_
 !
 class type control always event service-stop
  1 service-policy type service unapply identifier service-name
  10 service-policy type service unapply identifier service-name
  20 log-session-state
 !
 class type control always event radius-timeout
  20 set-timer UNAUTH-TIMER 60
  30 service-policy type service name POLICY_MAP_SERVICE_ON_SESSION_RADIUS_TIMEOUT_
 !
 class type control always event access-reject
  20 set-timer UNAUTH-TIMER 60
  30 service-policy type service name ALLOW_172_31_100_2
  40 service-policy type service name ALLOW_172_31_100_3_SPEED_8k
  50 service-policy type service name NO_SERVICE
 !
Источник — https://noname.com.ua/mediawiki/index.php?title=ISGv2_Control_policies&oldid=11481