User Guide Addendum Nomadix Service Engine (NSE) - Release X.5 October 2007 Introduction

Transcription

1 User Guide Addendum Nomadix Service Engine (NSE) - Release X.5 October 2007 Introduction This User s Guide Addendum provides information and procedures that will enable system administrators to configure and use the specific features introduced in Release X.5 for the Nomadix Access Gateway product line. The features covered are: Ping via DNS...2 DNS name for RADIUS server IP address...3 Use hostname and DNS domain in URL sent to authorize.net...4 Configurable Failover Time...5 Extend Access Control to include Static Port Mapping Lists...6 Use Nomadix VSA when using Radius Proxy...7 NTP support on all platforms...9 EAPoL-Logoff DoS prevention (Wireless only)...11 XML command requested to get current subscriber table...12 XML command to get DAT table...13 Charge for idle time...14 Exclude users from SMTP redirection...15 User-Agent Filtering...16 Traffic Descriptors...17 Quality of Service (QoS)

2 Feature Configurations Ping via DNS This functionality can be accessed under the following Menus: Go to System -> ICMP Go to System -> Icmp -> Ping Cannot be done through SNMP IP/DNS name of host to ping This is the site that you want the Ping to be sent to from the NSE, and can be either a DNS name or an IP address. 2

3 DNS name for RADIUS server IP address This Configuration can be made from the following menus: Go to Configuration -> Realm Based Routing -> Add Radius service profile Go to Configuration -> RealmRouting -> RadProfiles -- Go to nse -> Realm based Router -> Service profile table (enterprises ) for Radius profile table Primary and Secondary IP/DNS: These fields can now be populated by DNS names to allow for changing the DNS resolution instead of having to change settings in the NSE When the IP of the Radius server changes. 3

4 Use hostname and dns domain in URL sent to authorize.net This configuration can be set from the following menus: Go to Configuration -> AAA Go to Configuration -> AAA -- Go to nse -> AAA -> AAACreditCardHostenameon (enterprises ) for Credit Card using NSE host and Domain name. Use NSE s Hostname and DNS domain name Check this box if you want the Hostname and domain name to be sent to the Credit Card server instead of the local NSE IP address. 4

5 Configurable Failover Time This parameter can be configured from these menus: Go to System -> Failover Go to System -> Failover Not available Secondary to Primary Fail Over Time The time set here is how long the Secondary will wait while not receiving messages from the Primary before it takes over. 5

6 Extend Access Control to include Static Port Mapping Lists This Configuration can be made from these menus: Go to System -> Static Port Mapping Add Go to System -> sadd Go to nse -> System -> StaticPortMappingTable (enterprises ) for configuration of the Static Port Mapping Table and Staticportmappingaddtoacc Protect with Source IP-based Access Control Enabling this will only allow address in the source based access control list to connect on this port mapping. Source based access control needs to be enabled for this to be in effect. 6

7 Use Nomadix VSA when using Radius Proxy These Configurations can be reached from these menus: Go to Configuration -> Radius Proxy -> Add new Radius NAS Go to Configuration -> radproxy -> nas Go to nse -> RadiusProxy -> RadProxyUpstreamNas table (enterprises ) for configuration of the Radius Proxy NAS profiles Enforce Bandwidth-Up VSA The Radius VSA for Bandwidth-Up will be passed on to the Upstream NAS when enabled. Enforce Bandwidth-Down VSA The Radius VSA for Bandwidth-Down will be passed on to the Upstream NAS when enabled. 7

8 Enforce Redirect-URL VSA The Radius VSA for Redirect-URL will be passed on to the Upstream NAS when enabled. Enforce IP-Upsell VSA The Radius VSA for Ip-Upsell will be passed on to the Upstream NAS when enabled. Enforce Subnet VSA The Radius VSA for Subnet will be passed on to the Upstream NAS when enabled. Enforce Bandwidth-Up VSA The Radius VSA for Bandwidth-Up will be passed on to the Upstream NAS when enabled. 8

9 NTP support on all platforms These Configurations can be reached from these menus: Go to Configuration -> Time Go to Configuration -> time Go to nse -> time (enterprises ) for configuration of the NTP servers External Time Server Server Timeout Select this Radio button if you want to use NTP instead of the internal clock of the NSE. The Number of seconds before the NSE gives up on receiving a time response from the NTP server. 9

10 Time Server 1-4 The IP addresses of up to 4 different NTP servers to query for the correct time. 10

11 EAPoL-Logoff DoS prevention (Wireless only). These Configurations can be reached from these menus: Go to System -> Wireless Configuration -> VAP Setup Go to System -> Wireless Not available Enable EAPOL-Logoff DOS attack prevention Enabling this will stop any malicious user from being able to send an EAPOL-Logoff for any user other than themselves. 11

12 XML command requested to get current subscriber table This command is only available from a Web browser sending an http Get request to this Site: 12

13 XML command to get DAT table This command is only available from a Web browser sending an http Get request to this Site: 13

14 Charge for idle time These Configurations can be reached from these menus: Go to Configuration -> Radius Client Go to Configuration -> radclient Go to nse -> aaa -> aaaradius -> aaachargeforidletimeon (enterprises ) for configuration of the charge for idle time parameter. Enable charging for idle time If enabled, this will now count idle time in the session time of Radius accounting packets. 14

15 Exclude users from SMTP redirection These Configurations can be reached from these menus: Go to Subscriber Administration -> Add User Go to Subscribers -> Add Not Available STMP Redirection When enabled, the specified user will have their SMTP traffic redirected by the global SMTP redirect configuration. 15

16 User-Agent Filtering These Configurations can be reached from these menus: Go to Configuration -> User Agent Filtering Go to Configuration -> useragentfilt Go to nse -> useragentfiltering (enterprises ) for configuration of the User Agent Filtering parameters User-Agent Filtering Enable this if you want to use the filtering capabilities for the User-Agents HTTP User-Agent Name Add the names of the different User-Agents that you want to filter here. Windows Update and Apple itunes are default filtered Agents. 16

17 Traffic Descriptors These Configurations can be reached from these menus: Go to Configuration -> QoS Go to Configuration -> qos Go to nse -> trafficdescriptors (enterprises ) for configuration of the Traffic Descriptor parameters Traffic Descriptor Main Page Add Select Add to create a new Traffic Descriptor, or select a link to an existing descriptor to modify it. 17

18 Traffic Descriptor Add/Modify Page Unique Name Description Match Condition List Add Descriptor Enter a name for the descriptor. Enter a brief summary about the descriptor. Set condition matching to require a match to all conditions or any one of the conditions. This displays a list of the conditions that have been defined for this descriptor. Select this button to accept the parameters and conditions defined and add the descriptor to the descriptor list on the main page. 18

19 Add Condition Select a condition type and define the matching parameters. Once added, conditions will be displayed in the list above. 19

20 Quality of Service (QoS) These Configurations can be reached from these menus: QoS Main Page Go to Configuration -> QoS Go to Configuration -> qos Go to nse -> qos (enterprises ) for configuration of the QoS parameters QoS Mode Enable this if you want to use QoS policies. QoS Classification Enable this to facilitate the classification mode desired. Classification can be based on internally defined policies, by incoming frames that are already classified, or both. 20

21 QoS Marking QoS Policies Enable this to mark packets using 802.1p Class of Service values. Select Add Policy to define a new QoS policy, or select a link to a policy that is already defined in order to modify it. QoS Add/Modify Page Name of QoS Policy Enter a name for the policy. Description Enter a brief summary about the policy. Rule List This displays a list of the rules that have been defined for this policy. 21

22 Submit Policy Add Rule Select this button to accept the parameters and rules defined and add the policy to the policy list on the main page. Select a descriptor and a Class of Service for the rule, and then click Add. Once added, rules will be displayed in the list above. 22