Configuring ISP domain attributes

In an ISP domain, you can configure the following attributes:

• Domain status—By placing the ISP domain in active or blocked state, you allow or deny network service requests from users in the domain.

• Authorization attributes—The device assigns the authorization attributes in the ISP domain to the authenticated users who do not receive these attributes from the server. However, if the idle cut attribute is configured in the ISP domain, the device assigns the attribute to the authenticated users. If no idle cut attribute is configured in the ISP domain, the device uses the idle cut attribute assigned by the server. The device supports the following authorization attributes:

  • Authorization ACL—The device restricts authenticated users to access only the network resources permitted by the ACL. For portal users, the authorization ACL can be configured in a preauthentication domain to authorize access to network resources before users pass authentication.

  • Authorization CAR action—The attribute controls the traffic flow of authenticated users. For portal users, the authorization CAR action can be configured in a preauthentication domain to control traffic flow before users pass authentication.

  • Idle cut—It enables the device to check the traffic of each online user in the domain at the idle timeout interval. The device logs out any users in the domain whose total traffic in the idle timeout period is less than the specified minimum traffic.

  • IPv4 address pool—The device assigns IPv4 addresses from the pool to authenticated users in the domain.

  • Default authorization user profile—When a user passes authentication, it typically obtains an authorization user profile from the local or remote server. If the user does not obtain a user profile, the device authorizes the default user profile of the ISP domain to the user. The device will restrict the user's behavior based on the profile. For portal users, the authorization user profile can be configured in a preauthentication domain to restrict user behaviors before users pass authentication.

  • Authorization session group profile—The device restricts authenticated users' behaviors based on the settings in the authorization session group profile. For portal users, the authorization session group profile can be configured in a preauthentication domain to restrict user behaviors before users pass authentication.

  • Authorization IPv6 address prefix—The device authorizes the IPv6 address prefix to authenticated users in the domain.

  • IPv6 address pool—The device assigns IPv6 addresses from the pool to authenticated users in the domain.

  • DNS server address—The attribute specifies the DNS server that offers DNS services to the authenticated users in the domain.

  • Redirect URL—The device redirects users in the domain to the URL after they pass authentication.

  • Authorization user group—Authenticated users in the domain obtain all attributes of the user group.

  • Authorization VPN instance—The device allows authenticated users in the domain to access network resources in the authorization VPN.

  • Maximum number of multicast groups—The attribute restricts the maximum number of multicast groups that an authenticated user can join concurrently.

• User online duration including idle cut period—If a user goes offline due to connection failure or malfunction, its online duration sent to the server includes the idle cut period or user online detection period. The online duration that is generated on the server is longer than the actual online duration of the user. The user online detection period is supported only by portal authentication.

• ITA policy—The attribute allows the device to perform accounting at different charge rates for user data based on destination addresses. The ITA policy assigned from an AAA server takes precedence over the ITA policy in an ISP domain.

An ISP domain attribute applies to all users in the domain.

To configure ISP domain attributes: