Настройка cisco с поддеркой ISG

!
aaa new-model
aaa session-mib disconnect
!
!
aaa group server radius SERVER_GROUP1
server 10.10.10.1 auth-port 1812 acct-port 1813
!
aaa authentication login AUTHEN_LIST1 group SERVER_GROUP1
aaa authorization network default group SERVER_GROUP1
aaa authorization subscriber-service AUTHOR_LIST1 group SERVER_GROUP1
aaa accounting delay-start all
aaa accounting update periodic 5
aaa accounting network ACCNT_LIST1 start-stop group SERVER_GROUP1
!
aaa nas port extended
!
!
!
!
aaa session-id unique
!
!
ip dhcp relay information policy keep
ip dhcp relay information trust-all
!
no ip domain lookup
redirect server-group REDIRECT_SERVER_GROUP1
server ip 10.10.10.9 port 80           // куда релееть
!
!
!
subscriber authorization enable
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
!
policy-map type control RULE_IP_SESSION2a
class type control always event session-start
30 authorize aaa list AUTHOR_LIST1 password 123 identifier circuit-id
40 service-policy type service name SERVICE_406_L4R
!
class type control always event session-restart
30 authorize aaa list AUTHOR_LIST1 password 123 identifier circuit-id
40 service-policy type service name SERVICE_406_L4R
!
class type control always event account-logon
10 authenticate aaa list AUTHEN_LIST1
!
class type control always event service-stop
1 service-policy type service unapply identifier service-name
10 log-session-state
!
!
!
!
!
!
!
interface Loopback0
!
interface Loopback12
no ip address
!
interface FastEthernet0/0
no ip address
no ip redirects
no ip mroute-cache
duplex full
no cdp enable
!
interface FastEthernet0/0.300
encapsulation dot1Q 300
ip address 10.10.10.25 255.255.255.248
ip helper-address 10.10.10.1
no cdp enable
service-policy type control RULE_IP_SESSION2a
ip subscriber routed
initiator dhcp class-aware
!
interface FastEthernet1/0
ip address 10.10.10.18 255.255.255.252
no ip redirects
ip nat outside
ip flow ingress
no ip mroute-cache
duplex full
no cdp enable
!
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.10.10.17
no ip http server
no ip http secure-server
!
!
!
ip radius source-interface FastEthernet1/0
access-list 135 permit ip any host 10.10.10.9
access-list 135 deny ip any any
access-list 199 deny ip any host 10.10.10.9
access-list 199 permit tcp any any eq www
no cdp run
 
radius-server attribute 44 include-in-access-req vrf default
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 32 include-in-access-req
radius-server attribute 32 include-in-accounting-req
radius-server attribute 55 include-in-acct-req
radius-server attribute 55 access-request include
radius-server attribute 25 access-request include
radius-server attribute nas-port format e UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
radius-server host 10.10.10.1 auth-port 1812 acct-port 1813 key aaacisco
radius-server retransmit 5
radius-server timeout 30
radius-server directed-request
radius-server vsa send accounting
radius-server vsa send authentication
!

import bitel.billing.server.radius.*;
 
prefix = "circuit-id-tag";
prefixRemote = "remote-id-tag";
 
length = prefix.length();
lengthRemote = prefixRemote.length();
 
userName = request.getStringAttribute( RadiusStandartAttributes.User_Name );
circuitId = null;
remoteId = null;
 
attributes = request.getVendorAttributes( Vendors.CISCO, CiscoVendor.Cisco_AVPair );
if( attributes != null )
for( it = attributes.iterator(); it.hasNext(); )
{
ra = (RadiusAttribute)it.next();
value = ra.getStringValue();
 
if( value.startsWith( prefix ) )
{
circuitId = value.substring( length + 1 );
}
else if( value.startsWith( prefixRemote ) )
{
remoteId = value.substring( lengthRemote + 1 );
}
}
 
if( userName != null && circuitId != null && remoteId != null && userName.equals( circuitId ) )
{
vlan = circuitId.substring( 4, 8 );
port = circuitId.substring( 8, 12 );
 
request.setStringAttribute( RadiusStandartAttributes.User_Name, vlan + ":" + port + ":" + remoteId );
}
 
if( circuitId != null )
{
sessionId = request.getStringAttribute( RadiusStandartAttributes.Acct_Session_Id );
if( sessionId != null )
{
request.setStringAttribute( RadiusStandartAttributes.Acct_Session_Id, sessionId + ":" + circuitId );
}
}