Hi Alexander
I need help. A little.
Step 1:
I have done the both dynamic templates as "type service" as you advise. As before the session is not establish and user host don't get IP-address by dhcp (user get DHCP NAK).
==============================================================
Step 2:
I've found the guide "ASR9000/XR: BNG VSA's." and there is VSA "sub-pbr-policy-in" attribute in.
URL https://supportforums.cisco.com/docs/DOC-35624
I try to use the VSA "subscriber:sub-pbr-policy-in=" from it.
If I get this VSA in radius ACCEPT I have the same situation as in Step 1.
RADIUS: cisco-avpair="subscriber:sub-pbr-policy-in=l4_redirect"
ASR9k:
policy-map type pbr l4_redirect
class type traffic IPSUB_PERMIT_CLASS
transmit
!
class type traffic HTTP_TRAF_REDIRECT_CLASS
http-redirect http://10.10.10.10
!
class type traffic class-default
drop
!
class-map type traffic match-any IPSUB_PERMIT_CLASS
match access-group ipv4 110
end-class-map
!
class-map type traffic match-any HTTP_TRAF_REDIRECT_CLASS
match access-group ipv4 120
end-class-map
!
ipv4 access-list 110
10 permit tcp any 10.10.10.0/24 eq www
20 permit udp any any eq domain
30 permit icmp any any
100 deny ipv4 any any
!
ipv4 access-list 120
10 permit tcp any any eq www syn
20 permit tcp any any eq www ack
30 permit tcp any any eq www
100 deny ipv4 any any
!
And I cannot find VSA "sub-pbr-policy-in" in the official Configuration Guide Release 4.3.x for ASR9k.
==============================================================
Step 3:
OK. I move http-redirect rule to another ASR9k event "logoff" and then I do COA request (logoff).
1) ASR9k: Session IPoE is established
Policy Executed:
policy-map type control subscriber IPOE_POLICYMAP
event Session-Start match-all [at Thu Oct 17 01:12:45 2013]
class type control subscriber DHCP_INIT do-until-failure [Succeeded]
2 authorize aaa list default [Succeeded]
5 activate dynamic-template IBSUB_TEMPLATE [Succeeded]
Session Accounting: disabled
Last COA request received: unavailable
2) Sent COA request
# echo "User-Name=\"0015.582c.96cb\",cisco-avpair=\"subscriber:command=account-logoff\",Cisco-Account-Info=\"S0015.582c.96cb\",Idle-Timeout=200" | radclient -x :1700 coa coa-pass
3) ASR9k: Upgrade session
Policy Executed:
policy-map type control subscriber IPOE_POLICYMAP
event Session-Start match-all [at Thu Oct 17 01:12:45 2013]
class type control subscriber DHCP_INIT do-until-failure [Succeeded]
2 authorize aaa list default [Succeeded]
5 activate dynamic-template IBSUB_TEMPLATE [Succeeded]
event Account-Logoff match-all [at Thu Oct 17 01:13:02 2013]
class type control subscriber class-default do-until-failure [Succeeded]
10 activate dynamic-template IPSUB_UNAUTH_TEMPLATE [Succeeded]
20 set-timer UNAUTH-TIMER 1 [Succeeded]
Session Accounting: disabled
Last COA request: Thu Oct 17 01:13:02 2013
COA Request Attribute List: 0x500eba58
1: idletimeout len= 4 value= 200(c8)
2: command len= 15 value= account-logoff
Last COA response: Result ACK
COA Response Attribute List: 0x500ebc68
4) Checking...
TIMER UNAUTH-TIMER set to 1 minute
but HTTP-REDIRECT don't work !!!
5) Timer expire (1 minute)
6) Session IPoE destroy
So
- timer works fine
- HTTP REDIRECT don't work (dynamic-template IPSUB_UNAUTH_TEMPLATE)
I don't understand why.
==============================================================
