Installing SESM

General installation parameters

Installation type and license number

Choose the type of installation:

The licensenum.txt file in your root installation directory records your license number and the software version number you installed. This information is important when you access Cisco technical support for this product.

License agreement

Read the displayed license agreement to ensure that you agree with the terms of the license. You must accept the agreement to proceed with installation.

Installation directory

Note   You must have write privileges to the installation directory.

To specify the installation directory, you can either: accept the displayed default installation directory, click Browse to find a location, or type the directory name in the box.

The default installation directories are:

• On Solaris and Linux: /opt/cisco/sesm_3.1.x
  
  
• On Windows NT: C:\Program Files\cisco\sesm_3.1.x
  
  

General installation parameters (continued)

Setup type

Select one of the following:

• Typical—Installs all of the following components in the same directory on the same machine:
  
  
• Web Applications—Includes the NWSP, WAP, and PDA sample applications and the SESM core model.
  
  
• Jetty—Includes the Jetty web server, the JMX server, and JNDI.
  
  
• RDP—Installed only when installation type is LDAP evaluation or LDAP license.
  
  
• CDAT—If the installation type is RADIUS evaluation or RADIUS license, CDAT includes only the remote management interface. If the installation type is LDAP evaluation or LDAP license, CDAT includes both the remote management and the LDAP directory management interfaces.
  
  
• SPE—Installed only when installation type is LDAP evaluation or LDAP license.
  
  
• Bundled SESM RADIUS Server and Proxy RADIUS Server—Installed in the tools directory for all installation types
  
  
• Custom—Allows you to choose the components to install and configure from a checklist. Choose this option to:
  
  
• Include the SESM captive portal solution in your installation. The captive portal solution supports several types of redirection capabilities for subscriber access management solutions.
  
  
• Include the SESM web services gateway (WSG) application software in your installation. WSG provides a SOAP-based interface enabling third-party web portals and subscriber management systems to integrate with the SESM and SSG solution.
  
  
• Reinstall one of the components.
  
  
• Distribute the SESM components among different workstations.
  
  
• Demo—Installs and configures the NWSP, WAP, and PDA applications to run in Demo mode. The configuration files are not set up to communicate with an SSG, a RADIUS server, or an LDAP directory. Choose this option when those components are not available.
  
  

Note   If you install SESM in Demo mode and later want to run the portals in RADIUS or LDAP mode, we recommend that you perform another SESM installation in RADIUS or LDAP mode. Otherwise, you must make extensive adjustments to configuration attributes in the MBeans.

Demo mode simulates the actions of an SESM deployment in both RADIUS and LDAP modes. It uses a local copy of a Merit RADIUS file to obtain profile information. See the Subscriber Edge Services Manager Solution Guide for more information about installing and using SESM in Demo mode.

Configuration and Deployment

Web Application Host

Specify the IP address or host name of the host on which the SESM portal applications will run. For Demo mode, you can use the value localhost.

Caution   For LDAP and RADIUS modes, this value must be a real IP address. You cannot use the values localhost or 127.0.0.1.

Web Application Port Number

Specify the port on which the container (the J2EE web server) for the SESM portal applications will listen for HTTP requests from subscribers. The installation program updates the application startup scripts for NWSP, WAP, and PDA to use this value. If you want to run these applications simultaneously, you must edit the start scripts to ensure that each application uses a different port.

• A secure socket listener (SSL) port is derived as follows:
  
  
application port - 80 + 443

• A management console port is derived as follows:
  
  
application port + 100

SSG Deployment Option

Check this option if you are deploying SESM for a solution that uses the SSG. When you choose this option, the installation program configures the SESM components to work with one or more SSGs.

Uncheck this option if you are deploying SESM for a self care solution that does not require an SSG component. In this case, the installation program does not prompt for any SSG information. The self care solutions require LDAP evaluation or LDAP license installations.

Note   If you are installing SESM in Demo mode, you are finished with the installation.

SSG details

SSG port number

Specify the port that SSG uses to listen for RADIUS requests from an SESM application. This value must match the value that was configured on the SSG host with the following command:

Default: 1812.

SSG shared secret

Specify the shared secret used for communication between SSG and an SESM application. This value must match the value that was configured on the SSG host with the following command:

Default: cisco.

SSG port bundle size

Enter the number of bits that SSG uses for port bundling when the port-bundle host key feature is enabled. This value must match the value that was configured on the SSG host with the following command:

We recommend using the value 4.

A value of 0 indicates that the SSG is not using the port-bundle host key mechanism.

Note   The port-bundle host key feature was introduced in Cisco IOS Release 12.2(2)B. If you are using an earlier release, use a value of 0 in this field.

Default: 0.

When the port bundle size is 0, you must map SSGs to client subnets. The following category of parameters lets you map one client subnet for one SSG. You must manually edit the configuration file to:

See the "Associating SSGs with Subscriber Requests" section for more information.

One non-host key SSG

SSG address

Enter the host name or IP address of the SSG host.

Client subnet

Enter one client subnet address handled by this SSG. For example, 177.52.0.0.

Subnet mask

Enter the mask that can be applied to subscriber IP addresses to derive their subnet. For example, 255.255.0.0.

Note   If you are installing SESM in LDAP mode, skip the following two categories and continue with the "Directory server information" category later in this table.

RADIUS server details

Primary AAA server IP

Enter the IP address or the host name of the primary RADIUS server.

Primary AAA server port

Enter the port number on the primary RADIUS server host that the RADIUS server listens on.

The default is 1812.

Secondary AAA server IP

Enter the IP address or the host name of the secondary RADIUS server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Secondary AAA server port

Enter the port number on the secondary RADIUS server host that the RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Shared secret

Enter the shared secret used between the RADIUS server and SESM. If you are using a primary and a secondary server, the shared secret must be the same for both servers.

Default: cisco.

Passwords

Service password

Enter the password that the SESM application uses to request service profiles from RADIUS. It must match the service password values used in the service profiles in the RADIUS database.

This password must also match the value that was configured on the SSG host with the following command:

The service-password value must be the same on all of your SSGs.

Default: servicecisco.

Service group password

Enter the password that the SESM application uses to request service group profiles from RADIUS. It must match the service group password values used in the service group profiles in the RADIUS database.

Default: groupcisco.

Note   If you are installing SESM in RADIUS mode, you are finished with the installation of the standard components. If you are selected to install the captive portal solution from the custom installation window, go to the Captive Portal category later in this table.

Directory server information

Directory address

Enter the IP address or the host name of the system on which the directory server is running.

Directory port

Enter the port on which the directory server listens.

Directory admin user

Enter a user ID that has permissions to extend the directory schema. Use cn or uid as appropriate. For example:

• For NDS, enter:
  
  

• For Sun ONE (or iPlanet), enter:
  
  

Note   The default configuration by the Sun ONE installation process uses cn for the Directory Manager. See the "Sun ONE and iPlanet Installation and Configuration Requirements" section for more information.

Directory admin password

Enter the password for the directory administrator. This is the password you entered during directory installation and configuration. For example:

• For NDS, enter the password you specified for the admin user during installation.
  
  
• For Sun ONE, enter the password you entered for the Directory Manager user during Sun ONE installation.
  
  

Note   The installation program attempts to access the directory server, using the information you provided. If access is unsuccessful, the installation program displays a window with the header "Warning—Please confirm these options." Verify the information you entered and also verify that the directory server is running. If the directory is not running, you can continue the installation of SPE components by clicking the Ignore button on the warning window. However, if you click Ignore, the installation program can not update the directory for SESM use. You must perform the updates at a later time before you run SESM web applications or CDAT. See the "Extending the Directory Schema and Loading Initial RBAC Objects" section for instructions.

Directory container information

Directory container

Enter the organization and organizational unit that will hold the SESM service, subscriber, and policy information. Use the following format:

ou=orgUnit,o=org

For example, the installation program's default values are:

ou=sesm,o=cisco

The above defaults are the values used in the sample data file that comes with CDAT.

Directory user ID

Enter a user ID that has permissions to access and create objects in the organization and organizational unit named above. Use cn or uid as appropriate. For example:

• For NDS, the container administrator is the same as the directory administrator you entered on the previous window:
  
  

• For Sun ONE (or iPlanet), the container administrator is not the same as the directory administrator. You created this container administrator after Sun ONE installation.
  
  

Directory password

Enter the password associated with the directory user ID.

Naming attribute

inetorgPerson

Choose the component in distinguished name (dn) that allows access to the SESM container.

• common name (cn)—NDS, for example, uses cn.
  
  
• unique identifier (uid)—Sun ONE, for example, uses uid for the SESM container. See the "Sun ONE and iPlanet Installation and Configuration Requirements" section for more information.
  
  

Note   The SESM sample data uses cn. If you choose uid, you must edit the sample data before loading it into a Sun ONE or other directory that uses uid. See the "Loading Sample Data" section.

Note   The installation program attempts to access the container using the information you provided. If it is unsuccessful, a warning message appears, as described in the previous note.

RDP

RDP host

Enter the IP address or host name on which the RDP will run.

Caution   Use a routable IP address. Do not use the values localhost or 127.0.0.1.

Port number

Enter the port on which the RDP will listen.

Default: 1812.

Shared secret

Enter the shared secret to be used for communication between the SSGs and RDP when the restricted client feature is turned off. This value must match the value configured on the SSG host devices, using the following command:

When the restricted client feature is turned off, the shared secret must be the same on all SSGs.

When the restricted client feature is turned on, this attribute is ignored. Instead, you configure a specific shared secret for each client (each SSG). See the "RDP MBean" section for more information.

The next set of prompts from the installation program lets you choose whether to turn the restricted client feature on or off.

Default: cisco.

Service password

Enter the password that RDP uses to request service profiles from the directory. This value must match two other configured values:

1. This password must match the value that was configured on the SSG host with the following command:

ssg service-password password

The service-password value must be the same on all the SSGs that communicate with this RDP server.

2. This value must also match the service password value you entered for the SESM portal. See the SESM "Passwords" section.

Default: servicecisco.

Group password

Enter the password that RDP uses to request service group profiles from the directory.

This password must match the group password value you entered for the SESM portal. See the SESM "Passwords" section.

Default: groupcisco.

Next hop password

Enter the password that SSG uses to request next hop tables from RDP.

This password must match the value that was configured on the SSG host with the following command:

The service-password value must be the same on all of the SSGs that communicate with this RDP server.

Default: nexthopcisco.

RDP Options

Proxy mode

Choose this option to run RDP in proxy mode. RDP has two modes:

• Proxy mode—In this mode, RDP forwards authentication requests to a RADIUS server. RDP uses the SPE API to send authorization requests to the directory.
  
  
• Default (non-proxy) mode—In this mode, RDP performs authentication based on information it obtains from the directory. RDP uses the SPE API to send authorization requests to the LDAP directory.
  
  

Add services

Choose this option if you want the SSG to perform automatic connections to services when a subscriber's profile includes the autoconnect attribute. When you choose this option, RDP includes the subscriber's service list and related information in replies to SSG. The service information consumes memory on the SSG device.

Do not choose this option if space is a consideration on the SSG device. Instead, you can configure the SESM application to initiate automatic connections with the autoConnect attribute in the SESM MBean. See the "SESM MBean" section for more information.

Add client

Choose this option if you want to turn on the RDP restricted client feature, which allows RDP to service requests only from a preconfigured list of clients. The RDP clients are SSGs.

If you check this option, the installation program prompts for configuration information for one client. You can add more clients by adding elements to the allowedClients attribute in the RADIUSServerSocket MBean.

If you do not check this option, the RDP accepts requests from any client (any SSG).

If you choose the RDP Proxy mode option, the installation process prompts you for the following RADIUS server information.

AAA Server Details

Primary IP

Enter the IP address or the host name of the primary AAA server that you want RDP to communicate with.

Primary port

Enter the port number on the primary RADIUS server host that the RADIUS server listens on.

Secondary IP

Enter the IP address or the host name of the secondary RADIUS server. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Secondary port

Enter the port number on the secondary RADIUS server host that the RADIUS server listens on. If you are not using a secondary RADIUS server, enter the same value used for the primary server.

Shared secret

Enter the shared secret used between RDP and the RADIUS server. The shared secret must be the same for both servers.

Default: cisco.

If you choose the RDP Add client option, the installation program prompts you for the following information about one RDP client. You can add more clients by adding elements to the allowedClients attribute in the RDPMBean, RADIUSServerSocket component. See the "RDP MBean" section for more information.

RDP Client

Client IP address

Enter the IP address of the SSG.

Shared Secret

Enter the shared secret used for SSG to RDP communication. This value must match the value configured on the SSG, using the following command:

If you are performing a Custom installation and you check the Captive Portal item, the installation program prompts you for captive portal configuration information.

Note   The configuration information you enter in the following parameters must match TCP redirect configuration values on the SSG. The easiest way to ensure that values match in both places is to accept all of the default values presented by the installation process. Then configure the SSG based on the example captiveportal/config/ssgconfig.txt file. See "Deploying a Captive Portal Solution,"for more information.

Captive Portal Server Configuration

Captive portal host

Enter the IP address or host name on which the captive portal solution will run.

Captive portal port number

Enter the port number on which the first listener in the captive portal web server will listen.

This installation program sets up the captiveportal.jetty.xml file to create seven listeners in the web server, as follows:

• Subscriber redirection listener
  
  
• Initial logon redirection listener
  
  
• Advertising redirection listener
  
  
• Default service redirection listener
  
  
• Three service redirection listeners
  
  

Later in this installation procedure, you are prompted for a port number for each of these listeners. The port you enter now is used as the default value for the first listener.

Note   If you use the same port number for more than one listener, some redirections will not work.

Default: 8090

Install Message Portal

Choose this option if you want to install the Message Portal application. The Message Portal application is an example of an SESM portal that provides content for:

• Initial logon redirections
  
  
• Advertising redirections
  
  

For those redirection types, the default URIs displayed later in this installation procedure refer to pages in the Message Portal application.

If you choose the Message Portal option above, the installation program prompts you for the following information.

Message Portal Server Configuration

Message Portal Port Number

Enter the port number on which the Message Portal web server will listen. The Message Portal web server has one listener.

Default: 8085

Redirect after message page

Choose this option if you want the Message Portal application to redirect the subscriber to the originally requested URL after the message duration time elapses. If you do not choose this option, the subscriber must enter an URL to leave the message page.

Default: true

Main web server configuration

Host

Enter the host name or IP address of the web server for the NWSP or other application that will respond to:

• Unauthenticated user redirection
  
  
• Default unconnected service redirection
  
  
• Specific unconnected service redirections
  
  
• Error handling due to captive portal misconfiguration (if a port has been used which is not configured for redirection).
  
  

This value becomes the default value for the serviceportal.host system property in the captiveportal.xml file.

Port

Enter the port number on which the web server named above will listen.

This value becomes the default value for the serviceportal.port system property in the captiveportal.xml file.

Unauthenticated User Redirection

Enable

Check this box to configure unauthenticated user redirections.

Port In

Enter the port that the web server for the Captive Portal application will listen on for unauthenticated user redirections received from the SSG. The installation program displays the value that you entered earlier in the Captive Portal Port Number field. You can accept this default value.

Note   You must configure the SSG TCP redirect feature to send unauthenticated user redirections to this port.

Default: 8090

URL Out: Host

URL Out: Port

URL Out: URI

These fields define the URL to which browsers are redirected for unauthenticated user redirections. The default values reference the NWSP application.

• Host—Enter the name or IP address for the web server that contains the content application for unauthenticated user redirections.
  
  
• Port—Enter the listener port number for this content application. The default is the port number you entered for the NWSP application.
  
  
• URI—The absolute page name you want the subscriber to see. The default is /home, which is the NWSP logon page.
  
  

Initial Captivation

Enable

Check this box to configure initial logon redirections.

Port In

Enter the port that the Captive Portal web server will listen on for initial logon redirections.

Note   You must configure the SSG TCP redirect feature to send initial logon redirections to this port.

Default: 8091

URL Out: Host

URL Out: Port

URL Out: URI

These fields define the URL to which browsers are redirected for initial logon redirections. The default values reference the Message Portal application.

• Host—Enter the name or IP address for the web server that contains the content application for initial logon redirections.
  
  
• Port—Enter the listener port number for this content application. The default is the port number you entered for the Message Portal application.
  
  
• URI—The absolute page name you want the subscriber to see. The default is /initial, which is the Message Portal greeting page.
  
  

Duration

The length of time that the Message Portal application waits before attempting to redirect the browser to the user's originally requested URL.

Default: 15

Advertising Captivation

Enable

Check this box to configure advertising redirections.

Port In

Enter the port that the Captive Portal web server will listen on for advertising redirections.

Note   You must configure the SSG TCP feature to send advertising redirections to this port.

Default: 8092

URL Out: Host

URL Out: Port

URL Out: URI

These fields define the URL to which browsers are redirected for advertising redirections. The default values reference the Message Portal application.

• Host—Enter the name or IP address for the web server that contains the content application for advertising redirections.
  
  
• Port—Enter the listener port number for this content application. The default is the port number you entered for the Message Portal application.
  
  
• URI—The absolute page name you want the subscriber to see. The default is /advertising, which is the Message Portal advertising page.
  
  

Duration

The length of time that the Message Portal application waits before attempting to redirect the browser to the user's originally requested URL.

Default: 15

Unconnected Service Redirection

Enable

Check this box to configure service redirections, including a default service redirection.

Default Service Redirect Port In

Enter the port that the Captive Portal web server will listen on for default service redirections. Default service redirections are used for services whose address does not belong to the destination network of any of the specific service redirections.

Note   You must configure the SSG TCP feature to send default service redirections to this port.

Default: 8093

First Service Redirect Port In

Second Service Redirect Port In

Third Service Redirect Port In

Enter the ports that the Captive Portal web server will listen on for service redirections for Service1, Service2, and Service3.

Note   You must configure the SSG TCP feature to send redirections to these ports.

Defaults: 8094, 8095, 8096

URL Out

Enter the URL to which browsers are redirected for any type of service redirection. The default value references the NWSP application, as follows:

• The host and port values are the ones you entered earlier for the service application.
  
  
• The page name is /serviceRedirect, which is a generalized NWSP page. Configuration parameters in nwsp.xml define more specific pages.
  
  

This installation program assumes that the same URL is used for all service redirections. You can change this default configuration in the captiveportal.xml file. There is no requirement that all service redirections use the same page, port, or application.

Details for Unconnected Service Redirection

Pass Service Names

Choose this option if you want the Captive Portal application to pass the service names to the content application that handles service redirections (NWSP in the default configuration). NWSP uses the service name to connect to the service.

If you do not check this option, NWSP displays the page specified in the serviceNotGivenURI attribute in nwsp.xml. (The default installation setting for the serviceNotGivenURI attribute is the NWSP status page.)

Redirect Service Names

Provide the service name as specified in the service profile. The default values provided in the installation program match services in the sample data installed with SESM.

CDAT

CDAT host

Enter the IP address or host name on which the CDAP application will run.

Caution   Use a routable IP address. Do not use the values localhost or 127.0.0.1.

CDAT port number

Enter the port number on which the CDAT web server will listen.

The default is 8081.

Links for CDAT main window

Hosts and port numbers for remote SESM applications

The installation program prompts for host names and port numbers of all applications that you did not install during the current session. It uses this information to configure links on the CDAT main window pointing to the management consoles of these remote SESM applications. To skip the prompts for applications that you have not installed on any system or do not want CDAT to manage, click Next.

For applications that you installed during the current session, the installation program already has the link information.

The installation program installs the components on your system. When it is finished installing the files, and if it successfully connected to your LDAP directory, it displays the following additional prompts about modifications to the directory.

LDAP directory modifications

Extend schema

Choose this option if you are installing SESM to run with a new LDAP directory and you want the installation program to apply the SPE schema extensions to the directory.

The extensions include the dess and auth classes and attributes. For more information about the extensions, see the Cisco Distributed Administration Tool Guide.

If you do not choose this option, you must extend the directory schema later, before running the SESM application in LDAP mode and before logging into CDAT to create objects in the directory. See the "Post-Installation Configuration Tasks" section.

Note   The schema must be extended for each LDAP directory used in the SESM deployment. If multiple instances of SESM using just one LDAP directory exist, then the schema need only be extended in one of the installs where the SPE component is selected.

Install RBAC

Choose this option if you want the installation program to load the top-level RBAC objects.

Some initial top-level rules and roles must be created in the directory before an administrator can log into CDAT and create additional objects. If you do not choose this option, you must install RBAC objects later, before running the SESM application in LDAP mode and before logging into CDAT to create objects in the directory. See the "Post-Installation Configuration Tasks" section.

Note   The RBAC objects must be installed into each LDAP directory used in the SESM deployment. If multiple instances of SESM using just one LDAP directory exist, then the RBAC objects must only be loaded in one of the installs where the SPE component is selected.