Installing Components

Solaris

jetty/bin/start.sh

rdp/bin/runrdp.sh

Windows

jetty\bin\start.cmd

rdp\bin\runrdp.cmd

RADIUS mode

• NWSP requires a J2EE server (for example, jetty) on the same machine.

DESS mode

• NWSP requires a J2EE server (for example, jetty) and the DESS component on the same machine.

• CDAT requires a J2EE server (for example, jetty) and the DESS component on the same machine.

• RDP requires the DESS component on the same machine.

General installation parameters

Installation type and license number

Choose the type of installation:

The licensenum.txt file in your root installation directory records your license number and the software version number you installed. This information is important when you access Cisco technical support for this product.

License agreement

Read the displayed license agreement to ensure that you agree with the terms of the license. You must accept the agreement to proceed with installation.

Installation directory

Note   You must have write privileges to the installation directory.

To specify the installation directory, you can do any of the following:

• Accept the displayed default installation directory

• Click Browse to find a location

• Type the directory name in the box.

The default installation directories are:

• On Solaris:

/opt/cisco/sesm

• On Windows NT:

C:\Program Files\cisco\sesm

General installation parameters (continued)

Setup type

Select one of the following:

• Typical—Installs and configures all components on the same workstation.

If you are installing a RADIUS mode deployment, a typical installation includes the following components:

• NWSP—Includes the SESM core model.

• Jetty

If you are installing a DESS mode deployment, a typical installation includes the following components:

• NWSP—Includes the SESM core model.

• Jetty

• DESS

• RDP

• CDAT

See the "Software Component Descriptions" section for a description of what you are installing with each of these components.

• Custom—Allows you to choose the components to install and configure from a checklist. Choose this option to:

  • Install the NWSP application without the Jetty server (because you want to use a different J2EE server)

  • Reinstall one of the components

  • Distribute the solution components among different workstations. See the "Dependencies among the SESM Components" section for a list of components that must be installed on the same workstation.

• Demo—Installs and configures the NWSP application in DEMO mode. Use this option to demonstrate the capabilities of SESM  when other network components, such as SSG, are not available.

Web server configuration

NWSP port number

Specify the port on which the NWSP application's web server will listen for HTTP requests from subscribers. The installation program updates the application startup script to use this value.

• A secure socket listener (SSL) port is derived as follows:
  application port - 80 + 443

• A management console port is derived as follows:
  application port + 100

Run captive portal

Choose this option to configure the captive portal application.

Note   If you do not choose this option, the installation program installs the captive portal application but does not configure it.

The captive portal application runs on the same web server with the NWSP application. It captures the original URL that was requested by the subscriber and forwards it to the SESM web application along with the redirect. The SESM web application can then honor the subscriber's originally requested URL after authentication occurs.

Note   The following section applies only if you choose the captive portal option in the previous section.

Captive portal configuration

Host

Enter the host name or IP address for the host of the captive portal application.

This installation program installs the captive portal application on the same machine with the NWSP application.

Port

Enter 80, the port number on which the captive portal application's web server will listen.

This installation program configures the captive portal application to run in the same J2EE container with the NWSP application. Therefore, the port number must match the port number used for the NWSP port.

URI

Enter the URI of the SESM web application's home page (that is, the page you want the subscriber to see first). The URI is appended to the NWSP host and port entered previously to create the URL to which the captive portal application redirects the subscriber's browser.

For example, the URI for the NWSP application is:

/decorate/pages/home.jsp

The leading slash is required.

Continuing the example, if the NWSP host name is myhost and the NWSP port is 80, the captive portal application would redirect an unauthenticated subscriber to the following URL:

myhost:80/decorate/pages/home.jsp

The URI indicates the directory structure of the NWSP application's files within the J2EE container's directory. The URI is location-independent. You can deploy your SESM web application on many host machines, and, although the host and port would change for each host machine, the URI would not change.

Note   If you are installing SESM in Demo mode, you are finished with the installation.

SESM to SSG communication

SSG port number

Specify the port that SSG uses to listen for RADIUS requests from an SESM application. This value must match the value that was configured on the SSG host with the following command:

The default value is 1812.

SSG shared secret

Specify the shared secret used for communication between SSG and an SESM application. This value must match the value that was configured on the SSG host with the following command:

The default value is cisco.

SSG port bundle size

Enter the number of bits that SSG uses for port bundling when the host key feature is enabled. This value must match the value that was configured on the SSG host with the following command:

The value must be 0 or 4.

A value of 0 indicates that the SSG is not using the host key and port bundle mechanism.

Note   The host key feature is introduced in Cisco IOS Release 12.2(2)B. If you are using an earlier release, use a value of 0 in this field.

The default value is 0.

When the port bundle size is 0, you must map SSGs to client subnets. The following category of parameters lets you map one client subnet for one SSG. You must manually edit the configuration file to:

See the "Associating SSGs and Subscriber Requests" section for more information.

One non-host key SSG

SSG address

Enter the host name or IP address of the SSG host.

Client subnet

Enter one client subnet address handled by this SSG. For example, 177.52.0.0.

Subnet mask

Enter the mask that can be applied to subscriber IP addresses to derive their subnet. For example, 255.255.0.0.

Note   If you are installing SESM in DESS mode, skip the following two categories and continue with the "Directory server information" category.

SESM to RADIUS server communication

Primary AAA server IP

Enter the IP address or the host name of the primary RADIUS server.

Primary AAA server port

Enter the port number on the primary RADIUS server host that the RADIUS server listens on.

The default is 1812.

Secondary AAA server IP

Enter the IP address or the host name of the secondary RADIUS server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Secondary AAA server port

Enter the port number on the secondary RADIUS server host that the RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Shared secret

Enter the shared secret used between the RADIUS server and SESM. If you are using a primary and a secondary server, the shared secret must be the same for both servers.

The default value is cisco.

Service Password

RADIUS service password

Enter the password that the SESM application uses to request service and group profiles from RADIUS.

This password must match the value that was configured on the SSG host with the following command:

The service-password value must be the same on all of your SSGs.

The default value is servicecisco.

Note   If you are installing SESM in RADIUS mode, you are finished with the installation.

Directory server information

Directory address

Enter the IP address or the host name of the system where the directory server is running.

Directory port

Enter the port on which the directory server listens.

Directory admin user

Enter a user ID that has permissions to extend the directory schema.

Directory admin password

Enter the password for the directory administrator.

Note   The installation program attempts to access the directory server, using the information you just provided. If access is unsuccessful, the installation program displays a window with the header "Warning—Please confirm these options." You should verify the information you entered and also verify that the directory server is currently running. If the directory is not running, you can continue the installation of DESS components by clicking the Ignore button on the warning window. However, if you click Ignore, the installation program can not update the directory for SESM use. You must perform the updates at some later time before running SESM web applications or CDAT. See the "Extending the Directory Schema and Installing Initial RBAC Objects" section for instructions.

Directory container information

Directory container

Enter the organization and organizational unit that will hold the SESM service, subscriber, and policy information. Use the following format:

ou=orgUnit,o=org

For example, the installation program's default values are:

ou=sesm,o=cisco

The above defaults are the values used in the sample data file that comes with CDAT.

Directory user ID

Enter a user ID that has permissions to access and create objects in the organization and organizational unit named above. Use the following format:

Directory password

Enter the password associated with the directory user ID.

Note   The installation program attempts to access the container using the information you just provided. If it is unsuccessful, a warning message appears, as described in the previous note.

CDAT

CDAT port number

Enter the port number on which the CDAT web server will listen.

The default is 8081.

RDP

IP address

Enter the IP address or host name of the RDP.

Caution   This value must be a real IP address to which the NRP can route. You cannot use the values localhost or 127.0.0.1.

Port number

Enter the port on which the RDP will listen.

The default is 1812.

Shared secret

Enter the shared secret to be used for communication between SSG and RDP. It must be a different value from the shared secret used for RDP to RADIUS communication.

The default is cisco.

Service password

Enter the password that RDP uses to request service profiles from the directory.

This password must match the value that was configured on the SSG host with the following command:

The service-password value must be the same on all of your SSGs.

The default value is servicecisco.

Next hop password

Enter the password that SSG uses to request next hop tables from RDP.

This password must match the value that was configured on the SSG host with the following command:

The service-password value must be the same on all of your SSGs.

The default is nexthopcisco.

Proxy mode

Choose this option to run RDP in proxy mode. RDP has two modes:

• Proxy mode—In this mode, RDP forwards authentication requests to a RADIUS server. RDP uses the DESS API to send authorization requests to the directory.

• Non-proxy mode—In this mode, RDP performs authentication based on information it obtains from the directory. RDP uses the DESS API to send authorization requests to the directory.

RDP (continued)

Add services

Choose this option if you want SSG to perform automatic connections to services when a subscriber's profile includes the autoconnect attribute. When you choose this option, RDP includes the subscriber's service list and related information in replies to SSG. This service information consumes memory on the SSG host—the node route processor (NRP).

Do not choose this option if space is a consideration on the NRPs. Instead, you can configure the SESM application to initiate automatic connections. See the "autoConnect" section for more information.

If you choose Proxy mode for RDP, then the installation process prompts you for the following RADIUS server information.

RDP to RADIUS communication

Primary AAA server IP

Enter the IP address or the host name of the primary RADIUS AAA server that you want RDP to communicate with.

Primary AAA server port

Enter the port number on the primary RADIUS server host that the RADIUS server listens on.

Secondary AAA server IP

Enter the IP address or the host name of the secondary RADIUS server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Secondary AAA server port

Enter the port number on the secondary RADIUS server host that the RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Shared secret

Enter the shared secret used between RDP and the RADIUS server. The shared secret must be the same for both servers.

The default is cisco.

The installation program installs the components on your system. When it is finished installing the files, it displays an additional window about modifications to the LDAP directory.

LDAP directory modifications

Extend schema

Choose this option if you want the installation program to apply the DESS schema extensions to the LDAP directory. These extensions include the dess and auth classes and attributes. For more information about the extensions, see the Cisco Distributed Administration Tool Guide.

If you do not choose this option, you must extend the directory schema later, before running the SESM application in DESS mode and before logging into CDAT to create objects in the directory. See "Extending the Directory Schema and Installing Initial RBAC Objects" section for more information.

Note   If you are installing DESS in multiple locations, you only need to extend the schema one time.

Install RBAC

Choose this option if you want the installation program to load the top-level RBAC objects.

If you do not choose this option, you must install RBAC objects later, before running an SESM application in DESS mode and before logging into CDAT to create objects in the directory. See "Extending the Directory Schema and Installing Initial RBAC Objects" section for more information.

Note   If you are installing DESS in multiple locations, you only need to extend the schema one time.