Installing Components

Solaris and Linux

jetty/bin/start.sh

rdp/bin/runrdp.sh

Windows

jetty\bin\start.cmd

rdp\bin\runrdp.cmd

RADIUS mode

• An SESM portal application requires a J2EE server (for example, jetty) on the same machine.
  
  

LDAP mode

• An SESM portal application requires a J2EE server (for example, jetty) and the SPE component on the same machine.
  
  
• CDAT requires a J2EE server (for example, jetty) and the SPE component on the same machine.
  
  
• RDP requires the SPE component on the same machine.
  
  

General installation parameters

Installation type and license number

Choose the type of installation:

The licensenum.txt file in your root installation directory records your license number and the software version number you installed. This information is important when you access Cisco technical support for this product.

License agreement

Read the displayed license agreement to ensure that you agree with the terms of the license. You must accept the agreement to proceed with installation.

Installation directory

Note   You must have write privileges to the installation directory.

To specify the installation directory, you can accept the displayed default installation directory, click Browse to find a location, or type the directory name in the box.

The default installation directories are:

• On Solaris and Linux: /opt/cisco/sesm_3.1.3
  
  
• On Windows NT: C:\Program Files\cisco\sesm_3.1.3
  
  

General installation parameters (continued)

Setup type

Select one of the following:

• Typical—If you are installing a RADIUS evaluation or a RADIUS license, the Typical installation includes the following components:
  
  
• Web Applications—Includes the NWSP, WAP, and PDA sample applications and the SESM core model.
  
  
• Jetty—Includes the Jetty web server, the JMX server, and JNDI.
  
  

If you are installing an LDAP evaluation or LDAP license, the Typical installation includes the following components:

• Web Applications—Includes the NWSP, WAP, and PDA sample applications and the SESM core model.
  
  
• Jetty
  
  
• SPE
  
  
• RDP
  
  
• CDAT
  
  

• Custom—Allows you to choose the components to install and configure from a checklist. Choose this option to:
  
  
• Include the SESM captive portal solution in your installation.
  
  
• Reinstall one of the components.
  
  
• Distribute the SESM components among different workstations.
  
  
• Demo—Installs and configures the NWSP, WAP, and PDA applications to run in Demo mode. The configuration files are not set up to communicate with an SSG, a RADIUS server, or an LDAP directory. Choose this option when those components are not available.
  
  

Web server configuration

Web Application Port Number

Specify the port on which the container (the J2EE web server) for the SESM portal applications will listen for HTTP requests from subscribers. The installation program updates the application startup scripts for NWSP, WAP, and PDA to use this value. If you want to run these applications simultaneously, you must edit the start scripts to ensure that each application uses a different port.

• A secure socket listener (SSL) port is derived as follows:
  
  
application port - 80 + 443

• A management console port is derived as follows:
  
  
application port + 100

Note   If you are installing SESM in Demo mode, you are finished with the installation.

SESM to SSG communication

SSG port number

Specify the port that SSG uses to listen for RADIUS requests from an SESM application. This value must match the value that was configured on the SSG host with the following command:

The default value is 1812.

SSG shared secret

Specify the shared secret used for communication between SSG and an SESM application. This value must match the value that was configured on the SSG host with the following command:

The default value is cisco.

SSG port bundle size

Enter the number of bits that SSG uses for port bundling when the port-bundle host key feature is enabled. This value must match the value that was configured on the SSG host with the following command:

We recommend using the value 4.

A value of 0 indicates that the SSG is not using the port-bundle host key mechanism.

Note   The port-bundle host key feature was introduced in Cisco IOS Release 12.2(2)B. If you are using an earlier release, use a value of 0 in this field.

The default value is 0.

When the port bundle size is 0, you must map SSGs to client subnets. The following category of parameters lets you map one client subnet for one SSG. You must manually edit the configuration file to:

See the "Associating SSGs and Subscriber Requests" section for more information.

One non-host key SSG

SSG address

Enter the host name or IP address of the SSG host.

Client subnet

Enter one client subnet address handled by this SSG. For example, 177.52.0.0.

Subnet mask

Enter the mask that can be applied to subscriber IP addresses to derive their subnet. For example, 255.255.0.0.

Note   If you are installing SESM in LDAP mode, skip the following two categories and continue with the "Directory server information" category later in this table.

SESM to RADIUS server communication

Primary AAA server IP

Enter the IP address or the host name of the primary RADIUS server.

Primary AAA server port

Enter the port number on the primary RADIUS server host that the RADIUS server listens on.

The default is 1812.

Secondary AAA server IP

Enter the IP address or the host name of the secondary RADIUS server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Secondary AAA server port

Enter the port number on the secondary RADIUS server host that the RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Shared secret

Enter the shared secret used between the RADIUS server and SESM. If you are using a primary and a secondary server, the shared secret must be the same for both servers.

The default value is cisco.

Passwords

Service password

Enter the password that the SESM application uses to request service profiles from RADIUS. It must match the service password values used in the service profiles in the RADIUS database.

This password must also match the value that was configured on the SSG host with the following command:

The service-password value must be the same on all of your SSGs.

The default value is servicecisco.

Service group password

Enter the password that the SESM application uses to request service group profiles from RADIUS. It must match the service group password values used in the service group profiles in the RADIUS database.

The default value is groupcisco.

Note   If you are installing SESM in RADIUS mode, you are finished with the installation.

Directory server information

Directory address

Enter the IP address or the host name of the system on which the directory server is running.

Directory port

Enter the port on which the directory server listens.

Directory admin user

Enter a user ID that has permissions to extend the directory schema. Use cn or uid as appropriate. For example:

• For NDS, enter:
  
  

• For iPlanet, enter:
  
  

Directory admin password

Enter the password for the directory administrator. This is the password you entered during directory installation and configuration. For example:

• For NDS, enter the password you specified for the admin user during installation.
  
  
• For iPlanet, enter the password you entered for the Directory Manager user during installation.
  
  

Meta Schema

Choose the component in distinguished name (dn) that your LDAP directory uses to allow access to the directory.

• common name (cn)—NDS, for example, uses cn.
  
  
• unique identifier (uid)—iPlanet, for example, uses uid.
  
  

Note   The SESM sample data uses cn. If you choose uid, you must edit the sample data before loading it into the directory. See the "Loading Sample Data and Logging into CDAT for the First Time" section.

Note   The installation program attempts to access the directory server, using the information you provided. If access is unsuccessful, the installation program displays a window with the header "Warning—Please confirm these options." Verify the information you entered and also verify that the directory server is running. If the directory is not running, you can continue the installation of SPE components by clicking the Ignore button on the warning window. However, if you click Ignore, the installation program cannot update the directory for SESM use. You must perform the updates at a later time before you run SESM web applications or CDAT. See the "Extending the Directory Schema and Loading Initial RBAC Objects" section for instructions.

Directory container information

Directory container

Enter the organization and organizational unit that will hold the SESM service, subscriber, and policy information. Use the following format:

ou=orgUnit,o=org

For example, the installation program's default values are:

ou=sesm,o=cisco

The above defaults are the values used in the sample data file that is shipped with CDAT.

Directory user ID

Enter a user ID that has permissions to access and create objects in the organization and organizational unit named above. Use cn or uid as appropriate. For example:

• For NDS, the container administrator is the same as the directory administrator you entered on the previous window:
  
  

• For iPlanet, the container administrator is not the same. You created this directory administrator after installation.
  
  

Directory password

Enter the password associated with the directory user ID.

Note   The installation program attempts to access the container using the information you provided. If it is unsuccessful, a warning message appears, as described in the previous note.

CDAT

CDAT port number

Enter the port number on which the CDAT web server will listen.

The default is 8081.

RDP

IP address

Enter the IP address or host name of the RDP.

Caution   This value must be a real IP address to which the SSG host device can route. You cannot use the values localhost or 127.0.0.1.

Port number

Enter the port on which the RDP will listen.

The default is 1812.

Shared secret

Enter the shared secret to be used for communication between the SSGs and RDP when the restricted client feature is turned off. This value must match the value configured on the SSG host devices, using the following command:

When the restricted client feature is turned off, the shared secret must be the same on all SSGs.

When the restricted client feature is turned on, this attribute is ignored. Instead, you configure a specific shared secret for each client (each SSG). See the RDP MBean description in Table 6-6 for more information.

The next set of prompts from the installation program lets you choose whether to turn the restricted client feature on or off.

The default shared secret value is cisco.

Service password

Enter the password that RDP uses to request service profiles from the directory. This value must match two other configured values:

1. This password must match the value that was configured on the SSG host with the following command:

ssg service-password password

The service-password value must be the same on all the SSGs that communicate with this RDP server.

2. This value must also match the service password value you entered for the SESM portal. See the SESM "Passwords" section.

The default value is servicecisco.

Group password

Enter the password that RDP uses to request service group profiles from the directory.

This password must match the group password value you entered for the SESM portal. See the SESM "Passwords" section.

The default value is groupcisco.

Next hop password

Enter the password that SSG uses to request next hop tables from RDP.

This password must match the value that was configured on the SSG host with the following command:

The service-password value must be the same on all of the SSGs that communicate with this RDP server.

The default is nexthopcisco.

RDP Options

Proxy mode

Choose this option to run RDP in proxy mode. RDP has two modes:

• Proxy mode—In this mode, RDP forwards authentication requests to a RADIUS server. RDP uses the SPE API to send authorization requests to the directory.
  
  
• Non-proxy mode—In this mode, RDP performs authentication based on information it obtains from the directory. RDP uses the SPE API to send authorization requests to the LDAP directory.
  
  

Add services

Choose this option if you want the SSG to perform automatic connections to services when a subscriber's profile includes the autoconnect attribute. When you choose this option, RDP includes the subscriber's service list and related information in replies to SSG. The service information consumes memory on the SSG device.

Do not choose this option if space is a consideration on the SSG device. Instead, you can configure the SESM application to initiate automatic connections. See the "autoConnect" section for more information.

Add client

Choose this option if you want to turn on the RDP restricted client feature, which allows RDP to service requests only from a preconfigured list of clients. The RDP clients are SSGs.

If you check this option, the installation program prompts for configuration information for one client. You must manually edit the rdp.xml file to add more clients.

If you do not check this option, the RDP accepts requests from any client (any SSG).

If you choose the Add client option, the installation program prompts you for the following information about one RDP client. To add more clients, manually edit the rdp.xml file

RDP Client

Client name

Identifies the SSG. This value is used in logs and traces and does not have to match any other configured value.

Client IP address

The IP address of the SSG.

Shared Secret

The shared secret used for SSG to RDP communication. This value must match the value configured on the SSG devices, using the following command:

If you are doing a Custom installation and you checked the Captive Portal item, the installation program prompts you for the following information.

Note   Captive portal installation parameters must match TCP redirect configuration values on the SSG. The easiest way to ensure that values match in both places is to accept all of the default values presented during SESM captive portal installation. Then configure the SSG based on the example captiveportal/config/ssgconfig.txt file. See "Deploying a Captive Portal Solution,"for more information.

Captive Portal Server Configuration

Captive portal address

Enter the IP address of the hardware platform on which you are installing the captive portal solution.

Captive portal port number

Enter the port number on which the first listener in the captive portal web server will listen.

This installation program sets up the captiveportal.jetty.xml file to create 7 listeners in the web server, as follows:

• 1 Subscriber redirection listener
  
  
• 1 Initial logon redirection listener
  
  
• 1 Advertising redirection listener
  
  
• 1 Default service redirection listener
  
  
• 3 Service redirection listeners
  
  

Later in this installation procedure, you are prompted for a port number for each of these listeners. The port you enter now is used as the default value for the first listener.

Note   If you use the same port number for more than one listener, some redirections will not work.

Default: 8090

Install Message Portal

Choose this option if you want to install the Message Portal application. The Message Portal application is an example of an SESM portal that provides content for:

• Initial logon redirections
  
  
• Advertising redirections.
  
  

For those redirection types, the default URIs displayed later in this installation procedure refer to pages in the Message Portal application.

If you choose the Message Portal option above, the installation program prompts you for the following information:

Message Portal Server Configuration

Message Portal Port Number

Enter the port number on which the Message Portal web server will listen. The Message Portal web server has one listener.

Default: 8085

Redirect after message page

Choose this option if you want the Message Portal application to redirect the subscriber to the originally requested URL after the message duration time elapses. If you do not choose this option, the subscriber must enter an URL to leave the message page.

Default: true

Portal for service and error redirections

Host

Enter the host name or IP address of the web server for the NWSP or other application that will respond to:

• Unauthenticated user redirection
  
  
• Default unconnected service redirection
  
  
• Specific unconnected service redirections
  
  
• Error handling due to captive portal misconfiguration (if a port has been used which is not configured for redirection).
  
  

This value becomes the default value for the serviceportal.host system property in the captiveportal.xml file.

Port

Enter the port number on which the web server named above will listen.

This value becomes the default value for the serviceportal.port system property in the captiveportal.xml file.

Unauthenticated User Redirection

Enable

Check this box to configure unauthenticated user redirections.

Port In

Enter the port that the web server for the Captive Portal application will listen on for unauthenticated user redirections received from the SSG. The installation program displays the value that you entered earlier in the Captive Portal Port Number field. You can accept this default value.

Note   You must configure the SSG TCP redirect feature to send unauthenticated user redirections to this port.

Default: 8090

URL Out: Host

URL Out: Port

URL Out: URI

These fields define the URL to which browsers are redirected for unauthenticated user redirections. The default values reference the NWSP application.

• Host—Enter the name or IP address for the web server that contains the content application for unauthenticated user redirections.
  
  
• Port—Enter the listener port number for this content application. The default is the port number you entered for the NWSP application.
  
  
• URI—The absolute page name you want the subscriber to see. The default is /home, which is the NWSP logon page.
  
  

Initial Captivation

Enable

Check this box to configure initial logon redirections.

Port In

Enter the port that the Captive Portal web server will listen on for initial logon redirections.

Note   You must configure the SSG TCP redirect feature to send initial logon redirections to this port.

Default: 8091

URL Out: Host

URL Out: Port

URL Out: URI

These fields define the URL to which browsers are redirected for initial logon redirections. The default values reference the Message Portal application.

• Host—Enter the name or IP address for the web server that contains the content application for initial logon redirections.
  
  
• Port—Enter the listener port number for this content application. The default is the port number you entered for the Message Portal application.
  
  
• URI—The absolute page name you want the subscriber to see. The default is /initial, which is the Message Portal greeting page.
  
  

Duration

The length of time that the Message Portal application waits before attempting to redirect the browser to the user's originally requested URL.

Default: 15

Advertising Captivation

Enable

Check this box to configure advertising redirections.

Port In

Enter the port that the Captive Portal web server will listen on for advertising redirections.

Note   You must configure the SSG TCP feature to send advertising redirections to this port.

Default: 8092

URL Out: Host

URL Out: Port

URL Out: URI

These fields define the URL to which browsers are redirected for advertising redirections. The default values reference the Message Portal application.

• Host—Enter the name or IP address for the web server that contains the content application for advertising redirections.
  
  
• Port—Enter the listener port number for this content application. The default is the port number you entered for the Message Portal application.
  
  
• URI—The absolute page name you want the subscriber to see. The default is /advertising, which is the Message Portal advertising page.
  
  

Duration

The length of time that the Message Portal application waits before attempting to redirect the browser to the user's originally requested URL.

Default: 15

Unconnected Service Redirection

Enable

Check this box to configure service redirections, including a default service redirection.

Default Service Redirect Port In

Enter the port that the Captive Portal web server will listen on for default service redirections. Default service redirections are used for services whose address does not belong to the destination network of any of the specific service redirections

Note   You must configure the SSG TCP feature to send default service redirections to this port.

Default: 8093

First Service Redirect Port In

Second Service Redirect Port In

Third Service Redirect Port In

Enter the ports that the Captive Portal web server will listen on for service redirections for Service1, Service2, and Service3.

Note   You must configure the SSG TCP feature to send redirections to these ports.

Defaults: 8094, 8095, 8096

URL Out

Enter the URL to which browsers are redirected for any type of service redirection. The default value references the NWSP application, as follows:

• The host and port values are the ones you entered earlier for the service application.
  
  
• The page name is /serviceRedirect, which is a generalized NWSP page. Configuration parameters in nwsp.xml define more specific pages.
  
  

This installation program assumes that the same URL is used for all service redirections. You can change this default configuration in the captiveportal.xml file. There is no requirement that all service redirections use the same page, port, or application.

Details for Service Redirection

Pass Service Names

Choose this option if you want the Captive Portal application to pass the service names to the content application that handles service redirections (NWSP in the default configuration). NWSP uses the service name to connect to the service.

If you do not check this option, NWSP displays the page specified in the serviceNotGivenURI attribute in nwsp.xml. (The default installation setting for the serviceNotGivenURI attribute is the NWSP status page.)

Redirect Service Names

Provide the service name as specified in the service profile. The default values provided in the installation program match services in the sample data installed with SESM.

If you choose Proxy mode for RDP, then the installation process prompts you for the following RADIUS server information.

RDP to RADIUS communication

Primary AAA server IP

Enter the IP address or the host name of the primary RADIUS AAA server that you want RDP to communicate with.

Primary AAA server port

Enter the port number on the primary RADIUS server host that the RADIUS server listens on.

Secondary AAA server IP

Enter the IP address or the host name of the secondary RADIUS server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Secondary AAA server port

Enter the port number on the secondary RADIUS server host that the RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Shared secret

Enter the shared secret used between RDP and the RADIUS server. The shared secret must be the same for both servers.

The default is cisco.

The installation program installs the components on your system. When it is finished installing the files, it displays an additional window about modifications to the LDAP directory.

LDAP directory modifications

Extend schema

Choose this option if you want the installation program to apply the SPE schema extensions to the LDAP directory. These extensions include the dess and auth classes and attributes. For more information about the extensions, see the Cisco Distributed Administration Tool Guide.

If you do not choose this option, you must extend the directory schema later, before running the SESM application in LDAP mode and before logging into CDAT to create objects in the directory. See the "Extending the Directory Schema and Loading Initial RBAC Objects" section for more information.

Note   If you are installing the SPE components in multiple locations, you only need to extend the schema one time.

Install RBAC

Choose this option if you want the installation program to load the top-level RBAC objects.

If you do not choose this option, you must install RBAC objects later, before running an SESM application in LDAP mode and before logging into CDAT to create objects in the directory. See the "Extending the Directory Schema and Loading Initial RBAC Objects" section for more information.

Note   If you are installing the SPE components in multiple locations, you only need to install the RBAC objects one time.