Configuring MS-MPC-Based or MX-SPC3-Based Converged HTTP Redirect Services

When you configure the walled garden as a firewall service filter, traffic that is destined to servers within the walled garden is identified and skipped. Because this traffic does not flow to the line card, handling requirements are reduced.

All other HTTP traffic is destined for addresses outside the walled garden. Because this traffic does not match the filter conditions, it flows to the line card for handling.

You can configure the service filter so that the walled garden contains a single server as the captive portal or a list of servers.

• Configure the walled garden with a single server as the captive portal:

  1. Create the service filter.

     content_copy zoom_out_map

     [edit]
     user@host# edit firewall family address-family service-filter filter-name
     

  2. Define a filter term to identify and skip processing for traffic to the captive portal.

     1. Specify filter conditions to match traffic that is destined for the captive portal by specifying the destination address of the captive portal and the destination port.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name from destination-address ip-address
        user@host# set term name from destination-port port-number
        

     2. Specify that the matching traffic skips processing on the line card.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name then skip
        

  3. Define a filter term to identify HTTP traffic from all the traffic that did not match the previous term and send it for processing by CPCD service rules.

     1. Specify one or more HTTP port numbers to match the skipped HTTP traffic.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name from destination-port http-port-number
        

     2. Specify that the matching traffic is processed by a CPCD service.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name then service
        

  4. Define a filter term to skip further action for any remaining, non-HTTP traffic.

     content_copy zoom_out_map

     [edit firewall family inet service-filter filter-name]
     user@host# set term name then skip
     

  For example, the following configuration creates a filter for IPv4 HTTP traffic, walled-v4, with the captive portal on 192.0.2.0. Traffic matching the address is skipped. Nonmatching traffic goes to term http, where HTTP traffic is picked out of all skipped traffic and sent to be processed according to a CPCD service. Finally, term skip causes all the remaining, non-HTTP traffic to be skipped.

  content_copy zoom_out_map

  [edit]
  user@host# edit firewall family inet service-filter walled-v4
  [edit firewall family inet service-filter walled-v4]
  user@host# set term portal from destination-address 192.0.2.0
  user@host# set term portal from destination-port 80
  user@host# set term portal then skip
  user@host# set term http from destination-port 80
  user@host# set term http then service
  user@host# set term skip then skip
  

• Configure the walled garden as a list or subnet of servers.

  1. Create the service filter.

     content_copy zoom_out_map

     [edit]
     user@host# edit firewall family address-family service-filter filter-name
     

  2. Define a filter term.

     1. Specify filter conditions to match traffic that is destined for any server in the walled garden by specifying a destination prefix list of servers.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name from destination-prefix-list list-name
        user@host# set term name from destination-port port-number
        

     2. Specify that the matching traffic skips processing on the line card.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name then skip
        

  3. Define a filter term to identify HTTP traffic from all the traffic that did not match the previous term and send it for processing by CPCD service rules.

     1. Specify one or more HTTP port numbers to match the skipped HTTP traffic.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name from destination-port http-port-number
        

     2. Specify that the matching traffic is processed by a CPCD service.

        content_copy zoom_out_map

        [edit firewall family inet service-filter filter-name]
        user@host# set term name then service
        

  4. Define a filter term to skip further action for any remaining, non-HTTP traffic.

     content_copy zoom_out_map

     [edit firewall family inet service-filter filter-name]
     user@host# set term name then skip
     

  5. (Optional) Define a prefix list that specifies servers within the walled garden. You can specify a subnet or multiple individual addresses.

     content_copy zoom_out_map

     [edit policy-options]
     user@host# set prefix-list list- name ip-address/mask
     user@host# set prefix-list list- name ip-address1
     user@host# set prefix-list list- name ip-address2
     

  For example, the following configuration creates a service filter for IPv6 HTTP traffic, walled-v6-list, with a prefix list, wg-list, that specifies two servers in the walled garden. Filter term portal6 identifies IPv6 traffic that is destined for the walled garden. Nonmatching traffic goes to term http6, where HTTP traffic is picked out of all skipped traffic and sent to be processed according to a CPCD service. Finally, term skip causes all the remaining, non-HTTP traffic to skipped.

  content_copy zoom_out_map

  [edit]
  user@host# edit firewall family inet6 service-filter walled-v6-list
  user@host# set term portal6 from destination-prefix-list wg-list
  user@host# set term portal6 then skip
  user@host# set term http6 from destination-port [80 8080]
  user@host# set term http6 then service
  user@host# set term skip6 then skip
  [edit policy-options]
  user@host# set prefix-list wg-list 2001:db8::10.10
  user@host# set prefix-list wg-list 2001:db8::10.22
  

When HTTP requests are made for sites outside the walled garden, CPCD can redirect the traffic to a captive portal for authentication and authorization.

Configure a CPCD service rule that specifies the action to be taken for the HTTP traffic identified by the walled garden service filter and passed to the service. The action you configure depends on whether you are using a local or a remote HTTP redirect server:

• If you are using a local HTTP redirect server on the router, you specify the redirect action.

• If you are using a remote HTTP redirect server, which resides in a walled garden behind the router, then you cannot simply specify a redirect URL. In this case, the service rule must rewrite the IP destination address for the traffic. The new destination address is the address of the remote HTTP redirect server. The remote server then supplies a redirect URL to send the traffic to a captive portal.

You can optionally choose to parameterize the redirect URL and the rewrite destination address by specifying user-defined variables in the dynamic profile. Parameterizing means that URL or address becomes a dynamic variable. The value is provided by RADIUS when the subscriber is authenticated or when a CoA is received. Consequently, you can use the RADIUS attributes to provide different URLs or destination addresses for different subscribers.

Service sets define one or more services to be performed by the MS-MPC/MS-MIC, or by the MX-SPC3 services card if you have enabled Next Gen Services on the MX Series router. For HTTP redirect services, you define a CPCD service profile that includes CPCD rules. The service set applies the CPCD service profile to a specific service interface.

To use the HTTP redirect services, you must attach the CPCD service set to a logical interface. Because the walled garden is configured as a service filter, you must attach it to the same interface as the service set. Traffic arriving on and leaving that interface is filtered by the service filter. Traffic identified for servicing is sent to the MS-MPC or MX-SPC3 service interface where the CPCD profile is applied.

To use CPCD services on an MS-MPC/MS-MIC, or on an MX-SPC3 services card if you have enabled USF on the MX Series router, you configure a service interface on the MS-MIC or MX-SPC3. You must install the required service packages on each MS-MIC that has a service interface or on an MX-SPC3.