Configuring Components after Installation

Container (Jetty)

config
IREFOB J:1139010web default.xml

This file sets attributes for the Jetty server's handling of HTTP requests and how they map to servlets and JSPs.

SESM web application (NWSP)

docroot
WEB-INF     _(_IR EFOBJ:1140102_) _web.xml

This file defines J2EE application parameters, including parameters related to Java Server Pages (JSPs).

SESM captive portal application

docroot
WEB-INF     web.xml

This file defines J2EE application parameters for the captive portal application.

CDAT

docroot
WEB-INF     web.xml

This file defines J2EE application parameters for CDAT.

Container (Jetty)

config
nwsp.jett y.xml cdat.jett y.xml yourapp.jetty.xml

You can configure the Jetty server instance associated with each application differently. These files configure:

• Logging and debugging for the Jetty server. This log file name is nnn.jetty.log.

• HTTP listener, which configures:

  • The application that is running in the container and the application port.

  • The web server's standard HTTP request log. This log file name is nnn.request.log.

SESM web application (NWSP)

config
nwsp.xml

This file configures:

• SESM deployment options

• Communication between an SESM web application and SSG

• Communication between an SESM web application and RADIUS servers

• Attributes for a captive portal application

• Logging and debugging for the SESM web application. The log file name is nnn.application.log.

• A management port for development and testing purposes

SESM captive portal application

—

Captive portal attributes are included in the MBean configuration file for the SESM web application.

RDP

config
rdp.xml

This file configures:

• RDP options and packet handlers

• RDP communication with SSG

• Optionally, RDP communication with a RADIUS server

• Logging and debugging for RDP

• A management port for development and testing purposes.

CDAT

config
cdat.xml

This file configures:

• System resource usage for the CDAT application

• Logging and debugging for the CDAT application

• A management port for development and testing purposes.

DESS

config
config.xm l

This file configures attributes used by the executing classes in the Dess and Auth application programming interfaces (APIs). The Dess and Auth APIs provide the underlying support for communication between an LDAP directory and the RDP, CDAT, and SESM web applications. If these applications are installed on the same machine, the same config.xml file applies to all of the applications.

This file contains attributes that control:

• Directory security

• Directory connections

• Caching

• Logging

LogMBean

append

Indicates if messages overwrite existing contents (false) or are appended to the existing file (true).

filename

Specifies the log file name and path, as follows:

• application.log—Is a Java system property. The same system property is used for all log files, so that they are all created in the same directory. Table 5-1 describes how the start script sets application.log.

• yyyy_mm_dd—Is the year, month, and day that the file was created.

• .jetty.log—Is a constant identifying the Jetty log files.

logTimezone

Installed default: empty

logDateFormat

Controls the format of the date stamp in the log messages.

Installed default: yyyyMMdd:HHmmss.sss

logLabels

Controls whether or not logging messages include frame details.

Installed default: false

logOneLine

Installed default: false

logStackSize

Controls whether or not logging messages include an indication of stack depth.

Installed default: false

logStackTrace

Controls whether or not logging messages include trace information.

Installed default: false

DebugMBean

debug

Controls whether or not debugging messages are produced.

Installed default: false

debugPatterns

By specifying one or more patterns, you turn on a filtering mechanism that excludes any message that does not match the pattern. The patterns are file, class, or method names. Pattern matching is based on substring matches. For example, if you specify the pattern RADIUS, the software focuses on RADIUS messages. To specify multiple patterns, separate the patterns using a comma.

Installed default: empty

debugTriggers

Installed default: empty

verbose

Specifies the level of detail reported in debugging messages. The range of allowed values is 0 (no details) to 255 (all details).

Installed default: 0

suppressStack

Controls whether or not stack information is included in debug messages.

Installed default: false

suppressWarnings

Controls whether or not warning messages are included in debug messages.

Installed default: false

HttpServer MBean—
AddListener for HTTP.SocketListener

port

Sets the port number that the web server listens on. The installed value is a Java system property named:

application.portno

Note   The startup script sets this system property. Unless you alter the startup script, the default value in the MBean configuration file is ignored during application startup.

To change the value of application.portno, edit the application-specific startup script. The SESM installation program sets application.portno in the startup script to the NWSP port that you provided during the installation process.

If you are running in captive portal mode, this port value must be 80, whether you explicitly set it here by removing the reference to the Java system property or change the value of application.portno in the startup script.

minThreads

Sets the minimum number of threads that this listener will maintain during periods of low load. This listener will always have system resources allocated for this number of threads.

Installed default: 5

maxThreads

Sets the maximum number of threads that this listener can allocate resources for, even during peak loads. This listener can have up to this number of threads.

Installed default: 255

maxIdleTimeMs

Specifies how long a thread can be idle (not used) before the listener deallocates it. The unit is milliseconds.

Installed default: 60000

maxReadTimeMs

Specifies the time that a read on a request can block. This is how long the web server waits for a request to come from a client after the client opens a socket connection. When maxReadTimeMs is exceeded, the web server closes the socket connection.

Installed default: 60000

HttpServer MBean—
AddListener for HTTP.SunJsseListener

port

Sets the port that the secure socket layer (SSL) listener uses. The installed value is a Java system property named:

MinThreads

Sets the minimum number of threads that this listener will maintain during periods of low load. This listener will always have system resources allocated for this number of threads.

Installed default: 5

MaxThreads

Sets the maximum number of threads that this listener can allocate resources for, even during peak loads. The listener can allocate up to this number of threads.

Installed default: 255

MaxIdleTimeMs

Specifies the length of time a thread can be idle (not used) before the listener deallocates it. The unit is milliseconds.

Installed default: 50000

Keystore

Sets the pathname of the SSL keystore file. The keystore file is a binary file created by keytool. A sample keystore file is included in the installation. The name and location of the sample is:

jetty.home/config/nwspkeystore

Where:

• jetty.home—Is a Java system property. The NWSP start script derives the value of jetty.home from an expected (installed) directory structure. To change the value of jetty.home, edit the start script. Unless you alter the start script, the default value for jetty.home specified in this MBean configuration file is ignored at run time.

---

Caution   A keystore file is required for deployments that use HTTPS. HTTPS does not function without a valid keystore file. The nwspkeystore file included with the SESM installation works, but you should replace it with a keystore valid for your specific deployment. See the "HTTPS Description" section for more information

---

Password

Must match the value in the keystore file referenced above.

KeyPassword

Must match the value in the keystore file referenced above.

HttpServerMBean—
LogSink

Configures a log file that records the incoming HTTP requests.

This is a positional argument.

The logSink class has one argument, which specifies the name and location of the request log. The installed value is:

• application.log—Is a Java system property. whose value is set in the generic startup script. The same system property is used for all log files, so that they are all created in the same directory. See Table 5-1 for a description of how the start script sets application.log.

• yyyy_mm_dd—Is the year, month, and day that the file was created. The installation program uses the appropriate pathname delimiter for the installation platform.

• .request.log—Is a constant identifying an HTTP request file.

retainDays

Indicates the number of days to keep an old log file before deleting it.

Installed default: 90

append

Indicates whether or not to append messages to an existing file or to create a new file for each application instance.

Installed default: true

HttpServer MBean— <Call AddWebApplication>

The first call to this class adds the NWSP application to run on the web server.

These are positional arguments.

AddWebApplication has five positional arguments:

1. The first positional argument specifies the virtual host name for the web server application.

2. The second positional argument specifies the context path for locating the web server application. For example, / or /pathname/*.

3. The third positional argument identifies the location of the application. The XML file sets this value to:

application.home/docroot

Where:

application.home is a Java system property.

jetty.home/config/webdefault.xml

Where:

jetty.home is a Java system property

HttpServer MBean— <Call AddWebApplication>

The second call to this class adds the captive portal application to run on the web server.

These are positional arguments.

AddWebApplication has five positional arguments:

1. The first positional argument is not used when calling the captive portal application.

2. The second positional argument specifies the context path for locating the web server application. For example, / or /pathname/*. (context)

3. The third positional argument identifies the location of the captive portal application. The XML file sets this value to:

install.root/captiveportal/docroot

Where:

install.root is a Java system property

jetty.home/config/webdefault.xml

Where:

jetty.home is a Java system property

ManagementConsole

Port

Specifies a port for a management console.

The management console displays the current settings of all attributes in all of the MBean configuration files. The console is useful in development and testing environments.

Note   The ManagementConsole is the HTML adaptor server included with the Sun example JMX server. However, the HTML adaptor server is not production quality. For example, configuration changes that you make using the management console are not persistent. You should remove the HTML adaptor server from your configuration before transitioning the SESM deployment to public use.

To remove the JMX HTML adaptor server, comment out the following lines in the configuration files:

<Configure jmxname="com.cisco.aggbu:name=ManagementConsole"> <Call name="start"/> </Configure>

The port attribute is set to a Java system property named:

management.portno

All of the installed startup scripts set this Java system property to the following value:

application.portno + 100

For example, if the application.portno is 8080, the management.portno is 8180.

This runtime setting overrides any value you enter in the configuration file. To change the value of this attribute, edit the start script.

AuthInfo

AuthInfo provides a level of access control on the Management Console. When a user attempts to access the management console port from a web browser, a logon window appears first. The user must enter a user ID and password that matches the values specified here.

Logger MBean

debug

Turns debugging on (value is true) or off (value is false).

debugPatterns

By specifying one or more patterns, you turn on a filtering mechanism that excludes any message that does not match the pattern. The patterns are file, class, or method names. Pattern matching is based on substring matches. For example, if you specify the pattern RADIUS, the software focuses on RADIUS messages. To specify multiple patterns, separate the patterns using a comma.

Installed default: empty, which means that you receive all messages.

debugThreads

Specifies a specific thread name for which to show debugging messages. You can specify multiple thread names, separating them using a comma. By default, no thread name is specified.

Because each user interaction with the SESM web application takes place in a thread named for that user, this parameter can be used to focus the logging trace on a specific user activity. (This feature is not implemented in SESM Release 3.1(1).)

Installed default: empty

debugVerbosity

Specifies the level of detail in debugging messages. When the debug attribute is set to false, this attribute is ignored. Values are:

• MAX

• MED

• LOW

Installed default: LOW

logDateFormat

Specifies format of dates in the log file.

Installed default: yyyyMMdd:HHmmss.SSS

LoggerMBean (continued)

logFile

Specifies the log file name and location. The installed default is:

application.log/yyyy_mm_dd.application.log

Where:

• application.log—Is a Java system property. The same system property is used for all log files, so that they are all created in the same directory. See Table 5-1 for a description of how the start script sets application.log.

• yyyy_mm_dd —Is the year, month, and day that the file was created.

• application.log—Is a constant identifying the application log files.

logFrame

Controls whether or not to log the calling member function.

Installed default: false

logStack

Controls whether or not to log stack traces.

Installed default: false

logThread

Controls whether or not to log thread IDs.

Installed default: true

logToErr

Controls whether or not to route log messages to stderr, in addition to the log file. This parameter is useful for monitoring the SESM web application at the command line. Displaying output to stderr is not recommended for production deployments.

Installed default: true

trace

Controls whether or not to log trace messages. These messages indicate entry and exit to code points.

Installed default: true

warning

Controls whether or not to log warning messages (nonfatal exceptions).

Installed default: true

SSD

mode

An SESM web application runs in one of the following modes. The SESM installation program sets the mode according to the options you choose during installation.

• RADIUS—In this mode, the SESM web application communicates with SSG and a RADIUS server.

• Demo—SESM runs in this mode when you choose the Demo option during installation. In this mode, the SESM web application does not communicate with other components. Rather, it simulates communication by reading data from a Merit flat file. This mode is intended for demonstrations only, when network components such as SSG, RADIUS, or an LDAP server are not available.

• DESS—In this mode, the SESM web application communicates with SSG and an LDAP directory. The LDAP directory communication relies on a Cisco application programming interface known as directory-enabled service selection (DESS).

• Reinstall the software.

• Edit the MBean configuration files, changing the mode and other attributes, as appropriate.

• Use the mode option on the SESM application startup script command line. This command line option provides a way to quickly switch between modes for testing purposes. You might need to alter the start script to access a different set of MBean configuration files for each mode, or use some other method to ensure that the attributes match the mode you are using. The syntax is:

  • on Solaris: jetty/bin/startNWSP.sh -mode {Demo | RADIUS | DESS}

  • on Windows: jetty\bin\startNWSP.cmd {Demo | RADIUS | DESS}

singleSignOn

Enables (true) or disables (false) the single sign-on feature.

If single sign-on is enabled, the SESM web application does not ask a PPP subscriber to authenticate (log on). Instead, the SESM web application uses the SSG's PPP authenticated identity. Installed default: false

SSD (continued)

profileCache
Period

Specifies the time in seconds that a service or group object must be idle in the cache before its resources are deallocated from memory.

autoConnect

In RADIUS mode, this parameter is ignored. The automatic connection feature is always available, regardless of parameter settings. In RADIUS mode, the SSG always performs automatic service connections for all services marked as auto connect in a subscriber's profile.

In DESS mode, the SSG performs automatic connections if it has the service list. If SSG does not have the service list, you can set this autoConnect parameter to allow the SESM application to perform the automatic connections.

The Add Services option, which is set during RDP installation, controls whether or not SSG has a service list in DESS mode. The Add Services option configures RDP to either:

• Return a service list to SSG—In this case, SSG performs automatic connections for services marked as auto connect in a subscriber's profile.

• Not return a service list to SSG—In this case, SSG cannot perform automatic connections. The advantage to this configuration is that it saves memory on the SSG host (the NRP on the Cisco 6400 UAC).

If you configure RDP so that it does not return a service list to SSG, change the value of this autoConnect parameter to true to enable automatic connections by the SESM web application.

SSDDemoMode

demoDataFile

Specifies the file that contains data for the demo mode. The installed value is:

SSG—Global attributes

throttle

The maximum number of simultaneous requests that SESM web applications can send to SSG. This is a RADIUS protocol attribute. The RADIUS protocol queues additional requests and issues them as SSG returns responses or timeout messages for previous requests. You cannot override this global value.

Installed default: 20

PORT

The global value for RADIUS ports on the SSG hosts. This value must match the value that was configured on the SSG host using the following command:

You can create subnet entries in the MBean configuration file to override this global value for specific SSGs.

TIMEOUTSECS

The number of seconds the SESM web application waits before timing out RADIUS packets that it sends to SSG. You cannot override this global value.

Installed default: 5

RETRIES

The number of times the SESM web application resends a RADIUS packet to SSG if no response is received. You cannot override this global value.

Installed default: 3

SECRET

The global value for the RADIUS protocol shared secret used for communication between the SESM web application and the SSGs. This value must match the value entered on the SSG host using the ssg radius-helper key command.

You can create subnet entries in the MBean configuration file to override this global value for specific SSGs.

MASK

The global value for the mask that the SESM web application applies to incoming subscriber IP addresses to derive an IP address for the SSG.

You can create subnet entries in the MBean configuration file to override this global value for specific subnets.

BUNDLE_
LENGTH

The global value for the port bundle length that SSGs use when the host key feature is enabled. Currently, this value can be either:

• 0—A value of 0 indicates that SSGs are not using the host key feature.

• 4—The port bundle length is the number of bits that SSG uses to indicate bundled slots. For example, a value of 4 indicates 16 bundled slots. This value must match the value used in the following command on the SSG host:

ssg port-map length

SSG—Subnet entries

Subnet entries use positional arguments.

The call to setSubnetAttribute has four positional arguments:

1. subnetAddress is the subnet for which you are explicitly setting a value, overriding the globally set value.

2. subnetMask is the mask that can be applied to the subscriber's IP address to derive the subnet.

3. argumentName is the argument that you are explicitly setting.

4. argumentValue is the value for argumentName.

See the "Associating SSGs and Subscriber Requests" section for more information.

AAA

Connection

The Configure element in the AAA MBean includes a connection attribute whose value is either:

• ServiceProfile—The MBean for this connection type includes the servicePassword attribute.

• GroupProfile—The MBean for this connection type includes the groupPassword attribute.

The connection name identifies the type of request.

throttle

The maximum number of simultaneous requests that SESM web applications can send to a RADIUS server. This is a RADIUS protocol attribute. The RADIUS protocol queues additional requests and issues them as the server returns responses or timeout messages for previous requests.

Installed default: 256

timeOut

The number of seconds the SESM web application waits before timing out RADIUS packets that it sends to the AAA server.

Installed default: 4

retryCount

The number of times the SESM web application resends packets to the AAA server if no response is received.

Installed default: 3

primaryIP

The IP address or the host name of the primary AAA server.

primaryPort

The port number that the primary RADIUS server listens on.

Default: 1812

secret

The shared secret used between the RADIUS server and the SESM web application. The shared secret must be the same for the primary and secondary servers. It must match the secret specified when you configured SESM as a NAS client on the RADIUS server.

Default: cisco.

secondaryIP

The IP address or the host name of the secondary AAA server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

AAA (continued)

secondaryPort

The port number that the secondary RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Default: 1812

servicePassword

The password that the SESM web application uses to request service and group profiles from the RADIUS server.

groupPassword

The password that the SESM web application uses to request group profiles from the RADIUS server.

Captive Portal

captureToURL

The URL of the NWSP application to which the captive portal application redirects the subscriber's browser. The captive portal application captures the original URL that was requested by the subscriber and forwards it to the SESM web application along with the redirect. The SESM web application can then honor the subscriber's originally requested URL after authentication occurs.

Options context parameters

useIcons

Controls whether the application uses icons or text when it displays, on the web page, the services that a subscriber is authorized to use.

Default: TRUE

confirmAtService
Logon

Controls whether or not the application prompts the user for confirmation before it acts on a request to start a service.

Default: FALSE

confirmAtService
Logoff

Controls whether or not the application prompts the user for confirmation before it acts on a request to log off.

Default: TRUE

confirmAtAccountLogoff

Controls whether or not the application prompts the user for confirmation before it acts on a request to log off of the SESM application.

Default: TRUE

sessionTimeOut

The number of seconds of inactivity allowed before the application closes a session. This value overrides the timeout value in the nwsp.jetty.xml file.

Default: 7200

Arbitrary context parameters

locations and brands

Defines specific locations and brands and the attributes associated with each one.

The NWSP application uses the location context parameter to define an initial URL and meaningful symbols (rivers and churches) related to the location. It uses the brand context parameter to define an initial URL and an email address.

You can define additional context parameters, for any arbitrary use, by copying the format used in the nwsp.xml file to define the location and brand parameters. See the "Sample Application MBean Configuration File" section section for context parameter examples.

To define a context parameter, use separate XML elements to define the following:

PORT

The SSG port for the specified subnet. Overrides the globally-set SSG port.

MASK

The mask used on the subscriber's IP address to derive the subnet. Overrides the globally-set mask.

SECRET

The shared secret used between SESM and SSG. Overrides the globally-set shared secret.

BUNDLE_LENGTH

The host key bundle length used on the SSG. Overrides the globally-set bundle length.

The bundle length is the number of bits that SSG uses for the port bundle feature. For example, a value of 4 indicates 16 bundled slots. A value of 0 indicates that the SSG is not using the host key and port bundle mechanism.

This value must match the value used in the following command on the SSG host:

ssg port-map length

To determine how SSG has configured the port bundle length, use the show run command on the SSG host.

IP

Explicitly sets the IP address for the SSG that services the specified subnetAddress.

SESSION_LOCATION

The location associated with the specified subnet. Valid values are defined as subcontext parameters under the location context parameter in the nwsp.xml configuration file. The installed file defines the following locations: London, Paris, and New York.

SESSION_BRAND

The brand of service associated with the specified subnet. Valid values are defined as subcontext parameters under the brand context parameter in the nwsp.xml configuration file. The installed file defines the following brands: acme, cisco, silver, and gold.

For the context parameters to have meaning, the SESM web application must support them. The NWSP application uses the brand context parameter to define an initial URL and an email address.

Logger

See the description for Logger MBean in Table 4-4.

RDPPacketFactory

The only attributes in this MBean that administrators are expected to change are the password attributes associated with service profile requests. These password attributes are used to identify a service request as one of the following: a single service request, a service group request, or a next hop table request. SSG sets the password in the request; RDP interprets the password. You must configure the values on both sides, as follows:

• On SSG, you set the values for these three passwords using IOS commands.

• On RDP, you set the values for the three passwords as described here.

If the password in a request from SSG does not match one of the three values you set on the RDP side, the request is discarded.

You can find the password attributes in this MBean by searching the file for the following string:

<arg>PASSWORD:

Note   There are no security implications to these attributes. It might be helpful to think of them as identifying keys, rather than passwords.

The three password attributes are:

• ServiceRequest—Requests containing this password are handled by the ServiceRequest packet handler. The ServiceRequest packet handler uses the DESS API to obtain a list of authorized services for a subscriber. On the SSG side, set this password using the following command:

• GroupRequest—Requests containing this password are handled by the GroupRequest packet handler. The GroupRequest packet handler forwards requests to a RADIUS server to obtain a list of authorized services for the group of which the subscriber is a member. Group requests are relevant only when RDP is configured in proxy mode.

• NextHopRequest—Requests containing this password are handled by the ProxyNextHop packet handler. The Proxy NextHop packet handler passes authentication requests to the AAAMBean when the RDP is configured in proxy mode, or through DESS to the directory when the RDP is not in proxy mode. On the SSG side, set this password using the following command:

See "RDP Packet Handlers," for more information about how RDP processes requests from SSG.

RDP

secret

Enter the RADIUS client shared secret to be used for communication between SSG and RDP. It must be a different value from the shared secret used for RDP to RADIUS communication.

The installation program's displayed default is cisco.

localIPAddress

Enter the IP address or host name of the RDP.

Note   This value cannot be localhost (127.0.0.1)

localPort

Enter the port on which the RDP will listen.

The installation program's displayed default is 1812.

minThreads

Sets the minimum number of threads that RDP will maintain during periods of low load. RDP will always have system resources allocated for this number of threads.

Installed default: 10

maxThreads

The total number of simultaneous requests that the RDP can handle. If the RDP is receiving more requests than the current setting, and the RDP host machine is not processor-bound, then you can increase this number for a potential performance improvement.

Installed default: 256

maxIdleTimeMs

The number of milliseconds that a thread can remain idle before the system deallocates its resources.

Installed default: 10000

ManagementConsole

See the description for "ManagementConsole" in Table 4-4.

AAA

This MBean applies only when RDP is configured in Proxy mode.

Connection

The Configure tag for the AAA MBean includes a connection attribute whose value is either:

• NextHop

• Proxy

throttle

The maximum number of simultaneous requests that RDP can send to a RADIUS server. This is a RADIUS protocol attribute. The RADIUS protocol queues additional requests and issues them as the RADIUS server returns responses or timeout messages for previous requests.

Installed default: 256

timeOut

The number of seconds RDP waits before timing out RADIUS packets that it sends to the AAA server.

Installed default: 4

retryCount

The number of times RDP resends packets to the AAA server if no response is received.

Installed default: 1

primaryIP

Enter the IP address or the host name of the primary RADIUS AAA server that you want RDP to communicate with.

primaryPort

Enter the port number on the primary RADIUS server host that the RADIUS server listens on.

AAASecret

Enter the RADIUS client shared secret used between RDP and the RADIUS server. The shared secret must be the same for both servers.

The installation program's displayed default value is cisco.

secondaryIP

Enter the IP address or the host name of the secondary RADIUS server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

secondaryPort

Enter the port number on the secondary RADIUS server host that the RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Logger

See the description for Logger MBean in Table 4-4.

ManagementConsole

See the description for ManagementConsole in Table 4-4.

CDAT

sessionTimeout

The maxmimum period of inactivity allowed during a CDAT login, after which the user will be logged out. Values are in seconds. A negative value will prevent the user from ever being logged out. Changes will only take effect for subsequent logins.

Default: 600

maxVariables

The maximum number of page/page instance variables allowed for each CDAT session. This number affects how many pages can be visited before their state is lost, though it is not a one-to-one mapping. If you see many StateTimedOut errors, you should increase this number.

Default: 40

queryMaxResults

The maximum number of results to return from any one directory query. Changes will take immediate effect. A value of zero will remove any limits.

Default: 500

queryTimeout

The timeout (in milliseconds) for directory queries. Changes will take immediate effect. A value of zero will cause an infinite timeout.

Default: 0

Directory MBean

factory

The full class name of the JNDI connection factory.

poolSize

The number of active connections allowed to the LDAP server used for authorization.

URL

The URL of the LDAP server used for authorization.

principal

The name used when connecting to the LDAP server.

credentials

The credentials (such as password) used for connecting to the LDAP server.

context

The default LDAP context used for LDAP operations.

alwaysGetAllAttributes

If set to true then all the attributes of an LDAP entry are returned for every query.

traceFileName

The name of the directory log file.

traceLevel

Should be one of: NONE, ERROR, BRIEF, VERBOSE, or DEBUG.

printTraceToConsole

If set to true, the application sends trace messages to the console as well as writing them into the log file.

stackTrace

If set to true, print a stack trace with each trace message.

cacheMaxObjects

Specifies the maximum number of software objects to hold in the cache. Objects represent subscribers, services, privileges, roles, and so on.

When the cache contains cacheMaxObjects, old objects are deleted from cache, regardless of available cache space.

Set this value high to allow the available cache space to be the determining factor for cache management.

Installed default: 50000

Directory MBean

cacheMinFreeMem

Specifies the percentage of Java virtual memory that must remain available (that is, not used by the cache) after the application is loaded into memory.

cacheSessionTimeout

Specifies the timeout of inactive client sessions in seconds.

Installed default: 600

cacheExpireInterval

Specifies the interval in seconds after which the cache attempts to expire objects.

Note   Do not set this attribute to 0. A value of 0 causes every request to go to the directory, bypassing caching and any memory storage from a recent request for the same object. A value of 0 would degrade performance substantially.

Installed default: 600

cacheObjectTimeout

Specifies the number of seconds before objects time out.

Installed default: 600

Single sign-on

On SESM Host

Edit the following line in the application MBean configuration file (for example, nwsp/config/nwsp.xml):

Automatic connections

On SSG Host

No action required.

On SESM Host—RADIUS Mode

In RADIUS mode, the autoconnect feature is always on, regardless of parameter settings. In RADIUS mode, the SSG always performs automatic service connections for all services marked as auto connect in a subscriber's profile.

In Subscriber's Profile—RADIUS Mode

The A attribute in a subscriber's profile marks a service as one that should be automatically connected for the subscriber. For example:

On SESM Host—DESS Mode

In DESS mode, the SSG performs automatic connections if it has the service list. If SSG does not have the service list, the SESM application can perform the automatic connections. During RDP installation, the Add Services option configures RDP to either:

• Return a service list to SSG—In this case, RDP includes the subscriber's service list and related information in replies to SSG, and SSG performs automatic connections for services marked for autoconnection in the subscriber's profile.

The service information consumes memory on the SSG host.

• Not return a service list to SSG—In this case, SSG cannot perform automatic connections. The advantage to this configuration is that it saves memory on the SSG host.

In this case, you can configure the SESM application to perform automatic connections. The following line in the application MBean configuration file (for example, nwsp/config/nwsp.xml) controls whether the SESM web application performs automatic connections:

<Set name="autoConnect" type="boolean">false</Set>

Change the value to true to enable automatic connections by the SESM web application.

To change the setting of the RDP service list option, either reinstall RDP or edit the configuration files to enable the correct set of packet handlers. See "RDP Packet Handlers," for information about the packet handlers that are used in the various configurations.

In Subscriber's Profile—DESS Mode

See the Cisco Distributed Administration Tool Guide for instructions about marking services for autoconnection in subscriber profiles.

Application Interface Options

On SESM Host

Edit the following lines in the application MBean configuration file (for example, nwsp/config/nwsp.xml):

Captive portal

On SSG Host

Enable the TCP redirect feature using the http-redirect Cisco IOS commands.

Walled garden

In SSG

Enter Cisco IOS ssg commands. For example:

In SESM

Create JSPs that implement the desired interface. See the Cisco Subscriber Edge Services Manager Web Developer Guide for information.

Retail pages and service ads

In SSG

No configuration required.

In SESM

Create JSPs that implement the desired interface. See the Cisco Subscriber Edge Services Manager Web Developer Guide for information.

Host Key

In SSG

Enable the SSG host key feature using the Cisco IOS ssg port-map commands.

ssg port-map enable ssg port-map source ip loopback 0 ssg port-map destination range lowPort to highPort ip SSDaddress

Disable the host key feature using the following command:

In SESM

Edit the BUNDLE_LENGTH attributes in the application MBean configuration file (for example, nwsp/config/nwsp.xml):

In the SSG MBean, the BUNDLE_LENGTH attributes must match the bundle lengths specified on the SSG side.

Note   A BUNDLE_LENGTH of zero indicates that host key is not being used.