CHAPTER 3 The BAC software provides network and service management tools that enable the provisioning of devices and subscribers in broadband aggregation environments. BAC supports the role of the following devices as broadband aggregators: Cisco 7200 series router Cisco 7400 series router Cisco 10000 series router Table 3-1 lists the topics discussed in this chapter. Table 3-1 Topics If you want to... Understand more the provisioning scenarios for BAC Review an example use of BAC in a PTA over Ethernet over ATM environment Review an example use of BAC in offering subscribers differentiated classes of services Go to the... Overview of section on page 3-2. Provisioning in a PTA over Ethernet over ATM Environment section on page 3-3. Enabling Differentiated Classes of Service section on page 3-14. 3-1
Overview of Chapter 3 Overview of BAC supports the ability of access routers to aggregate the broadband facilities of network access providers and enables network service providers to provide Internet access to subscribers through these broadband facilities. BAC provides device management for these routers and supports their use in the following scenarios: As Layer 2 tunneling protocol (L2TP) access concentrators (LACs) As L2TP network servers (LNSs) As point-to-point protocol (PPP) termination aggregators (PTAs) Through routed bridged encapsulation (RBE) or PPPoX Figure 3-1 illustrates the role of BAC in a LAC/LNS architecture or a PTA architecture. The router at the center of the figure can act as both a LAC and a PTA depending on how you configure its interfaces. In a LAC/LNS scenario, an ATM permanent virtual connection (PVC) or an Ethernet packet passes through the LAC and terminates at an LNS. In the PTA scenario, the PVC or an Ethernet packet terminates at the PTA and traffic is routed onto a LAN. Figure 3-1 Role of Broadband Access Center in a LAC/LNS Scenario or PTA Scenario Figure 3-2 illustrates the role of BAC in an RBE scenario. In this scenario, no authentication occurs and traffic is routed directly to the Internet. 3-2
Chapter 3 Example Uses of Broadband Access Center Figure 3-2 Role of Broadband Access Center in RBE Scenario 827 XDSL DSLAM T3 IAD2421-T1 T1 Enterprise Broadband Access Center RBE In a broadband aggregation environment, a complete provisioning flow consists of the following high-level steps: 1. Service provider setup 2. Network and device configuration 3. Subscriber and service provisioning Cisco 7200 series router, Cisco 7400 series router, Cisco 10000 series router ISP Internet 89009 Example Uses of Broadband Access Center To help you understand how and where to use the BAC application, the sections that follow present a series of example use cases. Provisioning in a PTA over Ethernet over ATM Environment Scenario A retail service provider, called ISP1, wants to begin using BAC to configure Cisco routers as PTAs and to provision subscribers with PTAPPPoEoA service. The network configuration requirements are as follows: The subscriber s network device establishes a PPP session to the WAN through its CPE. The CPE establishes an ATM PVC through a digital subscriber line access multiplexer (DSLAM). The ATM PVC terminates at the PTA, which uses a AAA server to authenticate the subscriber. The PTA routes traffic from the subscriber onto a LAN. Figure 3-3 illustrates the network configuration. 3-3
Example Uses of Broadband Access Center Chapter 3 Figure 3-3 PTA over Ethernet over ATM Configuration ATM3 Routed LAN PC CPE DSLAM PTA AAA 89011 Business Goals Protect the integrity of the service provider s business and network information. Provide subscriber authentication. Identify the ATM and Ethernet interfaces associated with individual subscribers or subscriber groups. Create subscribers. Process 1. A BAC administrator creates ISP1, assigning to this service provider an identifier, as shown in Figure 3-4. Figure 3-4 Create Service Provider Page The identifier ensures that the BAC software partitions the network properly so that only ISP1 administrators and operators can view network device and subscriber information. 3-4
Chapter 3 Example Uses of Broadband Access Center Creating the service provider also automatically creates ISP1 on the Security Policy Engine (SPE) server, the BAC user management tool. You can later use this tool to create operators for ISP1 with differing levels of authority. 2. The BAC administrator adds network services. Network services are resources that support device and subscriber provisioning. For example, in a PTAPPPoEoA environment, an administrator might add a AAA server, an access list, a class map, and a policy map. For more detailed information about this process, see Enabling Differentiated Classes of Service section on page 3-14. a. For each of these services, the administrator selects an owner. Figure 3-5 illustrates selecting an owner of the AAA server. Figure 3-5 Select Owners Page b. The administrator then defines the properties of the resource. Figure 3-6 illustrates defining the properties of AAA server. For more information, see Chapter 5, Managing Network Services. 3-5
Example Uses of Broadband Access Center Chapter 3 Figure 3-6 Create AAA Page 3. The BAC administrator creates a logical grouping called an administrative network. To create an administrative network, the administrator does the following: a. Provides identifying information; that is, the name of the network and the domain to which it belongs. b. Assigns the owner of the network, using the method illustrated in Figure 3-5. c. Adds AAA resources, selecting from among those AAA resources defined in the second task. d. Adds system resources, as illustrated in Figure 3-7. Figure 3-7 Assign System Resources Page 3-6
Chapter 3 Example Uses of Broadband Access Center e. Defines access parameters for network devices, as illustrated in Figure 3-8. Figure 3-8 Device Access Parameters Settings Page For more information about administrative networks, see Chapter 6, Managing Devices. 4. The BAC administrator adds network devices and associates the devices with administrative networks and network resources. To add devices, the administrator does the following: a. Defines device properties, as illustrated in Figure 3-9. Figure 3-9 Device Properties Page b. Assigns the owner of the device, using the method illustrated in Figure 3-5. c. Adds AAA resources, selecting from among those AAA resources assigned to the administrative network. 3-7
Example Uses of Broadband Access Center Chapter 3 d. Adds system resources, as illustrated in Figure 3-7. The administrator might choose to inherit the system resources set on the parent administrative network or choose to override the parent settings. e. Sets the access parameters for this device, as illustrated in Figure 3-8. The administrator might choose to inherit the system resources set on the parent administrative network or choose to override the parent settings. For more information about adding devices, see Chapter 6, Managing Devices. 5. The BAC administrator adds PTAPPPoEoA service to the device. To add this service, the administrator does the following: a. Selects the PTAPPPoEoA service profile, as illustrated in Figure 3-10. Figure 3-10 Service Profile Selection Page b. Selects service features to add to the device, as illustrated in Figure 3-11. The administrator must check Basic. All other service features depend on the Basic feature. In Figure 3-11, the administrator checks Basic, Radius, Radius Group, and PVC Range. 3-8
Chapter 3 Example Uses of Broadband Access Center Figure 3-11 Service Feature Selection Page c. Selects service features to configure, as illustrated in Figure 3-12. Figure 3-12 Service Feature Data Page d. Adds data about each service feature. For example, for the PVC Range feature, the administrator defines: The name of the range The start and end of the range QoS characteristics ATM encapsulation type The virtual template number The administrator also selects the subscriber-facing interface and a subinterface to which to apply the PVC range characteristics. 3-9
Example Uses of Broadband Access Center Chapter 3 Figure 3-13 illustrates defining the PVC Range through the Device Provisioning Service Feature Data dialog box. Figure 3-13 Device Provisioning Service Feature Data Dialog Box e. Chooses a method for downloading the configuration, as illustrated in Figure 3-14. For more information, see Chapter 7, Provisioning Broadband Aggregators. Figure 3-14 Device Provisioning Device Configuration Download Dialog Box f. Downloads the configuration to the device. For more information about adding services to a device, see Chapter 7, Provisioning Broadband Aggregators. 6. The BAC administrator logs into the Cisco Security Policy Engine application to create an ISP1 operator account. For more information about adding operators and other users with authority to access BAC, see Appendix A, Cisco Security Policy Engine Administration Server User Interface. 7. The newly created operator logs in. 3-10
Chapter 3 Example Uses of Broadband Access Center 8. The operator creates a subscriber account by providing an account number, AAA server information, and other basic account data, as illustrated in Figure 3-15. Note When you enter the AAA username of the subscriber, use this format: user@example.com Figure 3-15 Create Subscriber Page 9. The operator adds PTAPPPoEoA service to the subscriber. To add this service, the administrator does the following: a. Selects the SubscriberPTAPPPoEoA profile, as illustrated in Figure 3-16. 3-11
Example Uses of Broadband Access Center Chapter 3 Figure 3-16 Service Profile Selection Page b. Enters subscriber interface feature data, as illustrated in Figure 3-17. Figure 3-17 Service Feature Data Page (Interface) c. Defines the subscriber s class of service, as illustrated in Figure 3-18. 3-12
Chapter 3 Example Uses of Broadband Access Center Figure 3-18 Service Feature Data Page (Class of Service) d. Selects a method for downloading the subscriber profile. e. Downloads the subscriber profile to a selected device. For more information about adding subscribers and subscriber profiles, see Chapter 8, Managing Subscribers. 3-13
Example Uses of Broadband Access Center Chapter 3 Enabling Differentiated Classes of Service Scenario A retail service provider, called ISP1, currently offers its subscribers one basic class of service. Now, ISP1 wants to begin offering differentiated classes of service. Business Goals Support applications that require guaranteed levels of service. Implement class-based weighted fair queuing, traffic policing, and traffic shaping. Offer Gold, Silver, and Bronze service to subscribers. Process 1. A technical operator with the appropriate BAC authorization logs in to the Web UI. 2. The operator clicks the Network Services tab and then goes to the QoS folder to create access lists, class maps, and policy maps. 3. To create an access list, the operator does the following: a. Selects the access list owner. b. Selects the access list configuration profile. c. Provides the basic access list information, as illustrated in Figure 3-19. Figure 3-19 Access List Resource Page d. Sets the permit/deny operation and wildcard bits information using the Create Access List Dialog Box, as illustrated in Figure 3-20. 3-14
Chapter 3 Example Uses of Broadband Access Center Figure 3-20 Create Access List Resource Dialog Box 4. To enable routers to handle network traffic based on classification, the operator creates a class map. The operator does the following: a. Selects the class map owner. b. Selects the class map configuration profile. c. Provides the basic class map information, as illustrated in Figure 3-21. Figure 3-21 Class Map Resource Page d. Provides class map details such as IP precedence values and IP differentiated services code point (DSCP) values using the Create Class Map Resource dialog box, as illustrated in Figure 3-22. 3-15
Example Uses of Broadband Access Center Chapter 3 Figure 3-22 Create Class Map Resource Dialog Box 5. To create a policy map that defines Quality of Service (QoS) actions and rules and to associate these with the class map, the operator does the following: a. Selects the policy map owner. b. Selects the policy action configuration profile. c. Provides the basic policy map information, as illustrated in Figure 3-23. Figure 3-23 Policy Resource Page d. Associates the policy with a class map and provides bandwidth, traffic policing, and traffic shaping information using the Create Policy Resource dialog box, as illustrated in Figure 3-24. 3-16
Chapter 3 Example Uses of Broadband Access Center Figure 3-24 Create Policy Resource Dialog Box 6. The operator creates Gold service. To create Gold service, the operator does the following: a. Selects the service owner. b. Selects the service configuration profile. c. Provides the service information, including the policies to apply to inbound and outbound interfaces, as illustrated in Figure 3-25. Note If you are applying the policy to the interfaces of Cisco 7200 series routers and Cisco 7400 series routers, make sure you set the Cisco-AVPair Cisco-Policy-Up and Cisco-AVPair Cisco-Policy-Down fields to None. 3-17
Example Uses of Broadband Access Center Chapter 3 Figure 3-25 Create Service Resource Page 7. Repeats the process as necessary to provide Silver and Bronze service. 3-18