This section explains how to configure the AAA RADIUS communication link between a universal gateway and a RADIUS-based PPM
server for RADIUS preauthentication.
Information about an incoming call is relayed through the gateway to the RADIUS-based PPM server in the network before the
call is connected. The RADIUS-based PPM server provides port policy management and preauthentication by evaluating the call
information against contracted parameter levels in SLAs. If the call falls within SLA limits, the server preauthenticates
the call and the universal gateway accepts it. If the server does not authorize the call, the universal gateway sends a disconnect
message to the public network switch to reject the call. The available call information includes one or more of the following:
-
DNIS number, also referred to as the called number.
-
CLID number (calling line identification number), also referred to as the calling number.
-
Call type, also referred to as the bearer capability.
-
IP address of the originating domain.
-
Interzone ClearToken (IZCT) information, which contains the origination gatekeeper zone name for intradomain calls or the
origination domain border gatekeeper zone name for interdomain calls. Whenever IZCT information is available, it is used to
preauthenticate leg-3 H.323 VoIP calls.
Note |
To enable IZCT, use the
security
izct
password command on the gatekeeper. For multiple gatekeeper zones, use the
lrq
forward-queries command. For information on IZCT configuration, see
Inter-Domain Gatekeeper Security Enhancement, Release 12.2(4)T.
|
A timer monitors the preauthentication query in case the RADIUS-based PPM server application is unavailable or slow to respond.
If the timer expires before an acceptance or rejection is provided, the universal gateway rejects the call.
The
RADIUS Pre-authentication for Voice Calls feature supports the use of RADIUS attributes that are configured in RADIUS preauthentication profiles to specify preauthentication
behavior. These attributes can also be used, for instance, to specify whether subsequent authentication should occur and,
if so, what authentication method should be used.
The commands in this section are used for both leg 1 calls (calls from a PSTN that enter an incoming, or originating, gateway)
and leg 3 calls (calls that exit the IP network to an outgoing, or terminating, gateway). The use of optional commands depends
on individual network factors.
Note |
Before configuring AAA preauthentication, you must make sure that the supporting preauthentication application is running
on a RADIUS-based PPM server in your network, such as a Cisco RPMS. You must also set up preauthentication profiles on the
RADIUS-based PPM server. For full information on AAA, see the
Cisco IOS Security Configuration Guide.
|
The RADIUS Pre-authentication for Voice Calls feature provides the means to evaluate and accept or reject call setup requests
for both voice and dial calls received at universal gateways. This process is known as preauthentication. The feature also
optionally allows voice calls to bypass this evaluation.
With universal gateways, voice customers and dial customers contend for the same gateway resources. This competition can
present problems for IP service wholesalers who lease their IP services to various customers such as Internet service providers
(ISPs), Internet telephony service providers (ITSPs), and telephony application service providers (T-ASPs). Wholesalers need
a way to implement and enforce with these customers service-level agreements (SLAs) that describe the levels of connectivity,
performance, and availability that they guarantee to provide. The
RADIUS Pre-authentication for Voice Calls feature allows a wholesaler to determine whether a call is within SLA limits before gateway resources are dedicated to terminating
the call.
With RADIUS preauthentication enabled, end customers from over-subscribed service providers are prevented from consuming
ports that exceed the number allotted to their service provider in its SLA. If the call is accepted in the preauthentication
step, it proceeds to full dial authentication and authorization or to voice dial-peer matching and voice session application
authentication and authorization.
RADIUS preauthentication uses a RADIUS-based port-policy management (PPM) server, such as the Cisco Resource Policy Management
System (RPMS), to interpret and enforce universal PPM and preauthentication SLAs. RADIUS provides the communication link between
the PPM server and universal gateways.
Customer profiles are defined in the PPM server with information from the SLA. Then, when a call is received at the universal
gateway, the server determines which specific customer SLA policy to apply to the call on the basis of information associated
with the call. For example, calls can be identified as either dial or voice on the basis of the called number (also called
the dialed number identification service number or DNIS). Then the PPM server might be set up to allow only a certain number
of dial calls. When a new dial call is received, it is rejected if adding it to the count makes the count exceed the number
of dial calls stipulated in the SLA.
Calls that are accepted by the PPM server continue with their normal call setup sequences after preauthentication. The response
from the PPM server is returned to the calling entity--such as an ISDN or SIP call signaling interface--which then proceeds
with the regular call flow. Calls that are rejected by the PPM server follow the given call model and apply the error codes
or rejection reasons that are specified by the signaling entity.
Feedback