Summary of SESM Communication Attributes

On the SSG side

Set these values using Cisco IOS commands on the SSG host. If the SSG is already configured, use show run to view the settings.

IP Address—Use the following command to specify the network that the SESM web application is running on:

Port—Use the following command to specify the port on the SSG host that handles RADIUS protocol communication between the SSG and the SESM web application:

Shared Secret—Use the following command to specify the shared secret used in RADIUS protocol communication between the SSG and the SESM web application:

(Optional) Host Key Port Bundle Length—When the host key feature is enabled on the SSG, the port bundle length defaults to 4 bits. You can use the following command to specify a different port bundle length:

Note   Additional commands are required on SSG to enable and configure the host key feature. For more information, see the "Configuring the Host Key Port Bundle Feature on SSG" section.

On the SESM web application side

IP Address—Make sure to install SESM web applications and their containers (the J2EE web servers) on the SSG default network.

Set the following values in the SSG MBean in the application MBean configuration file (nwsp.xml, for example):

Port—Use the following attributes to set the RADIUS protocol ports for communication between the SSGs and SESM. These settings must match the settings on the SSG hosts.

• PORT global attribute
  
  
• PORT subnet attribute—Overrides the global setting if all of the SSGs are not configured the same.
  
  

Shared Secret—Use the following attributes to set the RADIUS protocol shared secrets for communication between the SSGs and SESM. These settings must match the settings on the SSG hosts.

• SECRET global attribute
  
  
• SECRET subnet attribute—Overrides the global setting if all of the SSGs are not set the same.
  
  

Host Key Port Bundle Length—Use the following attributes to set the port-bundle length to match the settings on the SSG hosts.

• BUNDLE_LENGTH global attribute
  
  
• BUNDLE_LENGTH subnet attribute—Overrides the global setting if all of the SSGs are not configured the same.
  
  

On the SESM and SSG sides

See Table 9-1, "Setting Attributes for SESM to SSG Communication in All Modes"

On the RADIUS side

Set these values using the RADIUS product's native configuration procedures:

Define SSG as a RADIUS Client—Define SSG as a NAS client.

IP address/port—The IP address is the address of the RADIUS server host machine. The port is the port the RADIUS server uses to listen for authentication and authorization requests. If you do not specifically set the authentication port, it usually defaults to port 1812.

Shared secret—The shared secret value is specified when defining the SSG as a NAS client.

Service password—The service password is included in the service profiles stored in the RADIUS database. Use the same password value in all service profiles.

(Optional) Next hop password—The password used in the next hop table profile stored in the RADIUS database. Next hop profiles are an optional feature in an SESM deployment. Use the same password value in all next hop profiles.

On the SSG side

Set these values using Cisco IOS commands on the SSG host:

Set up SSG as a RADIUS client—Use the following commands:

Note   If the SSG is not supporting PPP connections, you do not need the aaa authentication ppp command.

IP address/port—Use the following command:

Shared secret—Use the following command:

Service Password—Use the following command:

(Optional) Next Hop Password—Use the following command:

On the RADIUS side

Set these values using the RADIUS product's native configuration procedures:

Define a RADIUS client—Define SESM as a NAS client.

IP address/port—You can set the port on the RADIUS server host machine that the RADIUS server uses to listen for authentication requests. The port is usually port 1812, which is the industry's default port for a RADIUS server.

Shared secret—You set the shared secret value when you define the SESM application as a NAS client.

Service password—The service password is included in the service profiles stored in the RADIUS database. Use the same password value in all service profiles.

Group password—The service group password is included in the service group profiles stored in the RADIUS database. Use the same password value in all service group profiles.

On the SESM web application side

Set the following value in the SESM MBean in the SESM web application configuration file (nwsp.xml, for example):

Define a RADIUS client—The attribute name is mode. To deploy SESM in RADIUS mode, the value for mode must be RADIUS.

Note   You can override the value for mode on the command line when you start the SESM application. For more information, see the "Starting the SESM Portals" section.

Set the following values in the AAA MBean in the SESM application configuration file (nwsp.xml, for example):

IP Address/Port—The attribute names for identifying IP addresses and authentication ports on primary and secondary RADIUS servers are:

• primaryIP
  
  
• primaryPort
  
  
• (Optional) secondaryIP
  
  
• (Optional) secondaryPort
  
  

Shared Secret—The attribute name is secret. There is only one secret attribute because the the secret value must be the same on both the primary and secondary servers.

Service Password—The attribute name is servicePassword. Use this attribute to provide SESM with the generic password used in the service profiles.

Group Password—The attribute name is groupPassword. Use this attribute to provide SESM with the generic password used in the service group profiles.

On the SESM and SSG sides

See Table 9-1, "Setting Attributes for SESM to SSG Communication in All Modes"

On the RDP side

Set the following values in the RDP MBean in the rdp.xml file on the RDP host machine.

IP address/port—The attribute names are:

• localIPAddress—The IP Address or host name of the RDP host machine. (You cannot enter the value localhost or 127.0.0.1.)
  
  
• localPort—The port on which RDP will listen for RADIUS authentication and authorization requests. The value is usually 1812, which is the industry's default authentication and authorization port.
  
  

Shared secret—The attribute name is secret. This is the RADIUS protocol shared secret value used for communication between SSG and RDP.

Set the following values in the RDPPacketFactory MBean in the rdp.xml file on the RDP host machine. These values are arguments to a programming call, rather than named attributes.

Service password—Identify the correct argument by searching for:

(Optional) Next hop password—Identify the correct argument by searching for:

Replace nexthopcisco with the next hop password set on the SSG side. Next hop profiles are an optional feature in an SESM deployment.

On the SSG side

Set the following values using Cisco IOS commands on the SSG:

IP address/port—Use the following command:

Shared secret—Use the following command:

Service password—Use the following command to set the key that SSG will use to identify service requests:

(Optional) Next hop password—Use the following command to set the key that SSG will use to identify next hop table requests:

SPE configuration on the RDP side

Set these values in the dess-auth configuration file on the RDP host machine (dess-auth/config/config.xml, for example).

IP Address/Port—The attribute name is URL. Provide the complete URL of the directory server, including the ldap protocol label and a port number. A sample entry is:

Context—The attribute name is context. Provide the organizational unit and organization in the LDAP directory that holds the SESM data. A sample entry is:

Directory administrator—The attribute names are:

Context administrator—The attribute name is DESSPrincipal. This is an administrator ID with permissions to access and create objects in the organization and organizational unit identified by the context attribute described above. An example entry is:

On the LDAP Directory side

Use native administration tools for the LDAP directory product to configure the directory for SESM deployment. See the "LDAP Directory Configuration Requirements" section for guidelines and requirements.

SPE configuration on the SESM application side

If the RDP and SESM applications are installed on the same machine, the same config.xml file applies to both applications. In that case, the values you configured for fields 9 to 12 above are also used for communication between the SESM application and the directory.

On the LDAP directory side

You only need to configure the LDAP directory one time.

See Table 9-3.

See Table 9-3, "Setting Communication Attributes in an LDAP Mode Deployment"

On the RDP side

Set the following values in the rdp.xml file on the RDP host machine, in the AAA MBean that contains the connection=Proxy parameter:

Define RDP as a RADIUS client—To configure RDP as a RADIUS client, you need to install RDP in Proxy mode. The content of the rdp.xml file contains different packet handlers depending on the RDP mode. Therefore, to change the RDP mode, we recommend reinstalling the RDP component. (Choose a Custom installation, and then check RDP, to reinstall only the RDP component.)

IP Address/Port—The attribute names for identifying ports on a primary and secondary RADIUS server are:

Shared Secret—The attribute name is AAASecret. The RADIUS shared secret value must be the same on both the primary and secondary servers, so there is only one secret attribute.

Set the following value in the RDPPacketFactory MBean in the rdp.xml file on the RDP host machine. This value is an argument to a programming call, rather than a named attribute.

Service Group Password—Identify the correct argument by searching for:

On the RADIUS side

Set these values using the RADIUS product's native configuration procedures:

Set up a RADIUS Client—Define RDP as a NAS client.

IP Address/Port—You can set the port on the RADIUS server host machine that the RADIUS server uses to listen for authentication requests. The port is usually port 1812, which is the industry's default authentication and authorization port for a RADIUS server.

Shared secret—You set the shared secret value when you define the RDP application as a NAS client.

Note   If you are configuring primary and secondary RADIUS servers, the shared secret value must be the same on both RADIUS servers.