Navigation
Back up to About Overview
[+] Expand All
[-] Collapse All
A
- access lines 1
- accesses
- configuring subscriptions
- accounting
- anonymous subscriber
- attributes
- authenticated subscriber
- authentication plug-ins
- authorization plug-ins
B
C
- captive portal
- classification scripts
- conditions 1
- configuring
- descriptions
- DHCP classification, C Series Controller
- interface classification, C Series Controller
- structure
- subscriber classification, C Series Controller
- target, C Series Controller
- component interactions
- conventions
- COPS (Common Open Policy Service)
- custom RADIUS accounting plug-ins 1
- configuring
- custom RADIUS authentication plug-ins 1
- configuring
- customer support 1
D
- default retailer authentication plug-ins
- configuring
- default retailer DHCP authentication plug-ins
- configuring
- denial-of-service attacks
- DHCP (Dynamic Host Configuration Protocol)
- address assignment
- classification scripts. See classification scripts
- options
- profiles
- subscribers
- documentation
E
- enterprise
- enterprise subscribers 1
- adding
- enterprise subscribers, login process
- event publishers
- configuring
- default retailer authentication, configuring
- default retailer DHCP authentication, configuring
- description
- retailer-specific
- service-specific
- virtual router-specific
- external plug-ins
- configuring
F
- file upload settings for log rotation
- configuring
- flat file accounting plug-ins 1
- flexible RADIUS accounting plug-ins 1
- attributes, defining
- configuring
- RADIUS packets, defining
- flexible RADIUS authentication plug-ins 1
- attributes, defining
- configuring
- RADIUS packets, defining
- setting responses
- FTP server for log rotation
G
- general properties
- configuring
H
- HTTP proxy 1, 2
- HTTPS traffic
I
- interface classification scripts. See classification scripts
- interim accounting, configuring on SAE
- internal plug-ins
- configuring
L
- LDAP authentication plug-in 1
- configuring
- limiting subscribers plug-in 1
- configuring
- log rotation
- overview
- logging
- login events, description
- login process
- login registration
- configuring
- logout process, residential
M
- managers
- manuals
N
- NAT (Network Address Translation)
- notice icons
P
- plug-ins
- activating service sessions
- authentication
- authorization
- basic RADIUS accounting 1
- basic RADIUS authentication 1
- creating subscriber sessions
- custom RADIUS accounting 1
- custom RADIUS authentication 1
- defining RADIUS packets
- DHCP address assignment
- event publishers. See event publishers
- external
- flat file accounting 1
- flexible RADIUS accounting 1
- flexible RADIUS authentication 1
- internal 1
- LDAP authentication 1
- limiting subscribers 1
- state synchronization
- tracking
- policy groups
- policy management
- PPP subscribers
- prevention, use of unauthorized resources
- protocols
- proxy HTTP 1, 2
- proxy request management
- public addresses, VPNs
Q
R
- RADIUS accounting
- RADIUS attributes
- defining in RADIUS plug-ins
- examples, defining in RADIUS plug-ins
- RADIUS client library, custom RADIUS plug-ins
- RADIUS packets, customizing in plug-ins
- RADIUS peers
- configuring in plug-ins
- RADIUS plug-ins 1, See also plug-ins
- redirect server
- assessing load
- configuration statements
- configuring
- configuring DNS server for
- configuring HTTP proxy support
- configuring redundant
- directory connection
- failover
- file extensions
- logging
- number of requests
- protection against denial-of-service attacks
- redundancy 1, 2, 3
- static route to router
- traffic definition
- verifying
- redundancy
- residential subscribers 1
- adding
- login process. See login process
- retailers
- subscribers 1
- router subscribers 1
- adding
- routing instances
- routing scheme
S
- SAE (service activation engine)
- classification scripts. See classification scripts
- login events
- login process. See login process
- SAE (service activation engine), configuring
- service activation engine. See SAE
- service sessions
- sites 1, 2, 3
- subscriber 1
- state synchronization plug-in interface
- configuring
- static IP subscribers, login process
- static routing
- subscriber classification scripts. See classification scripts
- subscriber folders 1
- adding
- subscriber sessions
- subscribers
- 3gpp attributes (Gx router driver)
- adding
- enterprise 1
- inheriting properties
- inheriting subscriptions
- residential 1
- retailer 1
- router 1
- sessions
- sites 1
- types
- subscriptions 1
- access, configuring
- an orderly deactivation, activation order, specifying
- configuring
- multiple per subscriber
- support, technical See technical support
T
- targets. See classification scripts
- technical support
- text conventions defined
- tracking plug-ins 1
- configuring
U
- UDP ports
- User Datagram Protocol. See UDP
V
- validating
- virtual private networks. See VPNs
- VPNs (virtual private networks)
- adding
- configuration requirements
- configuration statements
- extranet clients, modifying
- invalid subscriptions
- modifying
- routing schemes
- using NAT
- validating
Download This Guide
Related Documentation
- Classification Scripts Overview
- Configuring Classification Scripts Overview
- Classifying Subscribers (SRC CLI)
- Syntax for DHCP Classification Targets
- Classifying DHCP Subscribers (C-Web Interface)
Subscriber Classification Targets
The target of the subscriber classification script is an LDAP search string. The search string uses a syntax similar to an LDAP URL (see RFC 2255—The LDAP URL Format (December 1997).
The syntax is:
“baseDN [ ? [ attributes ] [ ? [ scope ] [ ? [ filter
] ] ] ]”
- baseDN—Distinguished name of object where the LDAP search starts
- attributes—Can be used to override attributes in
the loaded LDAP object. For example, for static IP subscribers the
SAE must learn the IP address assigned to a particular subscriber.
This address is defined in the ipAddress attribute of the subscriber
profile. A target of the form baseDN?ipAddress=<-function(interfaceName)->
invokes function after the subscriber profile is loaded from LDAP
and sets the IP address to the return value of function. The function
is defined in the subscriber classification script, and can be used
for a variety of things; for example, to query an external database.
Note: You can use subscriber classification to override only the ipAddress, loginName, or accountingId attributes. If you configure values to override other attributes, the value is lost when the SAE recovers from a network or server failure.
- scope—Scope of search
- base—Is the default, searches the base DN only.
- one—Searches the direct children of the base DN.
- sub—Searches the complete subtree below the base DN.
- filter—Is an RFC 2254–style LDAP search filter expression; for example, (uniqueId=<-userName->). See RFC 2254—The String Representation of LDAP Search Filters (December 1997).
With the exception of baseDN all the fields are optional.
Along with the set shared sae subscriber-classifier rule name target command, you can either enter the fields as per the syntax or type the ? symbol to see the possible fields that you can use to set the target for the rule. The possible fields are listed based on the configured subscriber level.
For example, to display a list of all the possible fields that you can define to find a target (an LDAP query), type ? with the set shared sae subscriber-classifier rule name target command.
set shared sae subscriber-classifier rule r1 target ?Possible Completions: /retailer=retailerName/set shared sae subscriber-classifier rule r1 target /retailer=retailerName/? Possible Completions: /retailer=retailerName/subscriberfolder=subscriberfolderName/
The result of the LDAP search must be exactly one directory object. If no object or more than one object is found, the subscriber session is terminated.
Related Documentation
- Classification Scripts Overview
- Configuring Classification Scripts Overview
- Classifying Subscribers (SRC CLI)
- Syntax for DHCP Classification Targets
- Classifying DHCP Subscribers (C-Web Interface)
