9. Which Of The Following Is Used To Configure A Service Template?
Configuring Identity Service Templates
Identity service templates contain a fix of policy attributes or features that can be applied to i or more subscriber sessions through a control policy, a RADIUS Modify of Authorization (CoA) request, or a user contour or service profile. This module provides information about how to configure local service templates for Session Aware Networking. Your software release may not back up all the features documented in this module. For the latest characteristic information and caveats, meet the release notes for your platform and software release. To detect data about the features documented in this module, and to see a list of the releases in which each feature is supported, run across the Characteristic Data Table at the end of this certificate. Use Cisco Characteristic Navigator to discover data almost platform support and Cisco software image support. To admission Cisco Feature Navigator, go to world wide web.cisco.com/go/cfn. An account on Cisco.com is non required. For downloadable service templates, the switch uses the default password "cisco123" when downloading the service templates from the authentication, authorisation, and accounting (AAA) server, Cisco Secure Admission Control Server (ACS), or Cisco Identity Services Engine (ISE). The AAA, ACS, and ISE server must include the password "cisco123" in the service template configuration. Data About Identity Service Templates A service template contains a ready of service-related attributes or features, such as access command lists (ACLs) and VLAN assignments, that tin can be activated on 1 or more subscriber sessions in response to session life-wheel events. Templates simplify the provisioning and maintenance of network session policies where policies fall into distinct groups or are office-based. A service template is applied to sessions through its reference in a control policy, through RADIUS Change of Authorization (CoA) requests, or through a user profile or service profile. User profiles are divers per subscriber; service profiles tin can use to multiple subscribers. Session Aware Networking supports two types of service templates: Session Enlightened Networking tin can download a service template divers on an external AAA server. The template defines a drove of AAA attributes. These templates are practical to sessions through the utilise of vendor-specific attributes (VSAs) included in RADIUS CoA messages received from the external AAA server or ACS. The name of the template is referenced in a user profile or a control policy, which triggers a download of the service template during processing. The downloadable template is cached on the device and subsequent requests for a download volition refer to the available cached template. The template however is buried simply for the duration of its active usage. The downloaded template cached on the device is protected and cannot be deleted through the CLI or through other applications. This ensures that the template is deleted only when there are no active references to it. Service templates can be configured locally through the CLI. These service templates can exist applied to subscriber sessions by a reference in a command policy. When an agile local template is updated, changes to that local template volition be reflected beyond all sessions for which the template is active. If a template is deleted, all content from that template that is applied against sessions is removed. How to Configure Identity Service Templates A service template defines the local policies that can be practical to a subscriber session. Activate this service template on sessions on which the local policies must be applied. SUMMARY STEPS one. enable ii. configure terminal iii. service-template template-name 4. absolute-timer minutes 5. access-grouping access-list-name 6. clarification clarification 7. inactivity-timer minutes probe eight. redirect url url nine. tag tag-name 10. vlan vlan-id xi. end 12. show service-template [template-proper noun] DETAILED STEPS Case: Enables privileged EXEC mode. Case: Enters global configuration manner. Instance: Creates a service template and enters service template configuration mode. Example: (Optional) Enables an absolute timeout for subscriber sessions. Example: (Optional) Applies an access list to sessions using a service template. Case: (Optional) Adds a description for a service template. Example: (Optional) Enables an inactivity timeout for subscriber sessions. Example: (Optional) Redirects clients to a detail URL. Case: (Optional) Associates a user-defined tag with a service template. Instance: (Optional) Applies a VLAN to sessions using a service template. Instance: Exits service template configuration style and returns to privileged EXEC mode. Example: Displays information about configured service templates. What to Practise Next To activate a service template on a subscriber session, specify the service template in a control policy. See "Configuring a Command Policy." Configuration Examples for Identity Service Templates The following example shows the configuration of a service template defined locally on the device. This template contains attributes that are practical to sessions that use the control policy named POSTURE_VALIDATION, shown below: The post-obit example shows a command policy that activates the service template named DOT1X with replace-all enabled. The successfully activated template volition replace the existing authorization data and any service template previously applied to the session. The post-obit example shows the configuration of a service template defined locally on the device. This template contains attributes that are applied to sessions that utilise the control policy named POSTURE_VALIDATION, shown below: The following example shows a command policy that runs authentication methods dot1x and MAB. If dot1x authentication fails, MAB authentication is attempted. If MAB fails, the organisation provides a default authorization profile using the FALLBACK template. The following instance shows the configuration of an access control list (ACL) that is used by the local service template named LOW_IMPACT_TEMPLATE, shown below. The following example shows the configuration of the local service template that provides limited access to all hosts even when hallmark fails. The following example shows the configuration of a command policy that uses the template named LOW_IMPACT_TEMPLATE to provide express admission to all hosts even when hallmark fails. If authentication succeeds, the policy manager removes the service template and provides access based on the policies downloaded by the RADIUS server. Standard/RFC Title RFC 5176 Dynamic Authorization Extensions to RADIUS Description Link The Cisco Support and Documentation website provides online resource to download documentation, software, and tools. Apply these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. http://world wide web.cisco.com/cisco/web/support/index.html The post-obit table provides release information well-nigh the feature or features described in this module. This table lists simply the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release railroad train also support that feature. Utilise Cisco Feature Navigator to detect data about platform support and Cisco software epitome back up. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required. Feature Name Releases Characteristic Information Downloadable Identity Service Template Cisco IOS XE Release 3.2SE Enables a service template to exist downloaded from an ACS and its attributes applied against a session. Identity Service Template Cisco IOS XE Release three.2SE Enables identity service templates to be configured locally and available at all times. The following commands were introduced: absolute-timer, access-group (service template), clarification (service template), inactivity-timer, redirect url, service-template, show service-template, tag (service template), vlan (service template).
Configuring Identity Service Templates
Finding Feature Information
Prerequisites for Identity Service Templates
Service Templates for Session Enlightened Networking
Downloadable Service Templates
Locally Configured Service Templates
Configuring a Local Service Template
Command or Action Purpose Step 1 enable Device> enable
Step 2 configure concluding Device# configure terminal
Step iii service-template template-name Device(config)# service-template SVC_2
Step iv absolute-timer minutes Device(config-service-template)# absolute-timer 15
Pace 5 access-group admission-list-name Device(config-service-template)# access-group ACL_2
Footstep 6 clarification description Device(config-service-template)# description characterization for SVC_2
Step vii inactivity-timer minutes probe Device(config-service-template)# inactivity-timer fifteen
Step 8 redirect url url Device(config-service-template)# redirect url www.cisco.com
Stride 9 tag tag-proper name Device(config-service-template)# tag TAG_2
Step 10 vlan vlan-id Device(config-service-template)# vlan 215
Pace xi end Device(config-service-template)# end
Step 12 evidence service-template [template-name] Device# show service-template SVC_2
Case: Service Template
service-template SVC_2 clarification characterization for SVC_2 access-group ACL_2 redirect url www.cisco.com vlan 215 inactivity-timer 15 absolute-timer 15 tag TAG_2
Example: Activating a Service Template and Supercede All
Local Service Template Configuration
service-template DOT1X access-group SVC1_ACL redirect url www.cisco.com match URL_REDIRECT_ACL inactivity-timer sixty absolute-timer 300 ! ip admission-list extended URL_REDIRECT_ACL permit tcp any host 5.5.5.5 eq www
Control Policy Configuration
policy-map blazon command subscriber POSTURE_VALIDATION upshot session-started lucifer-all ten class e'er practice-until-failure 10 cosign using dot1x priority ten 20 authenticate using webauth priority twenty event hallmark-success match-all 10 class DOT1X do-all 10 terminate webauth 20 activate service-template DOT1X replace-all
Case: Activating a Service Template for Fallback Service
Local Service Template Configuration
service-template FALLBACK description fallback service access-group ACL_2 redirect url world wide web.cisco.com inactivity-timer 15 accented-timer 15 tag TAG_2
Command Policy Configuration
policy-map blazon control subscriber POSTURE_VALIDATION event session-started lucifer-all 10 form e'er do-all 10 authenticate using dot1x event hallmark-failure match-all 10 grade DOT1X practice-all x authenticate using mab 20 grade MAB practise-all 10 activate service-template FALLBACK
Example: Deactivating a Service Template
Access Control List Configuration
ip access-list extended LOW_IMPACT_ACL permit udp whatsoever any eq bootps permit tcp any whatever eq www permit tcp whatever whatever eq 443 allow ip any 172.30.0.0 0.0.255.255
Local Service Template Configuration
service-template LOW_IMPACT_TEMPLATE clarification Service template for Low touch fashion admission-grouping LOW_IMPACT_ACL inactivity-timer 60 tag LOW_IMPACT_TEMPLATE
Control Policy Configuration
class-map type control subscriber friction match-all DOT1X_MAB_FAILED no-friction match result-type method dot1x success no-lucifer result-type method mab success ! policy-map type control subscriber CONCURRENT_DOT1X_MAB_LOW_IMP_MODE result session-started friction match-all 10 class always practise-until-failure 10 authorize xx actuate service-template LOW_IMPACT_TEMPLATE thirty authenticate using mab 40 authenticate using dot1x event authentication-success match-all ten grade always do-until-failure 10 deactivate service-template LOW_IMPACT_TEMPLATE event authentication-failure lucifer-first 10 grade DOT1X_MAB_FAILED do-until-failure 10 qualify 20 end dot1x 30 terminate mab consequence agent-establish match-all 10 class always do-until-failure 10 authenticate using dot1x event inactivity-timeout match-all 10 class always practice-until-failure 10 clear-session
Additional References
Related Documents
Standards and RFCs
Technical Help
Characteristic Information for Identity Service Templates
9. Which Of The Following Is Used To Configure A Service Template?,
Source: https://www.cisco.com/en/US/docs/ios-xml/ios/san/configuration/xe-3se/3850/san-svc-temp.html
Posted by: andersonwhishis.blogspot.com
0 Response to "9. Which Of The Following Is Used To Configure A Service Template?"
Post a Comment