Cisco ASA 5580 - Page 907

40-13
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Chapter 40 Configuring Inspection for Management Application Protocols
RADIUS Accounting Inspection
RADIUS Accounting Inspection Overview
One of the well known problems is the over-billing attack in GPRS networks. The over-billing attack
can cause consumers anger and frustration by being billed for services that they have not used. In this
case, a malicious attacker sets up a connection to a server and obtains an IP address from the SGSN.
When the attacker ends the call, the malicious server will still send packets to it, which gets dropped by
the GGSN, but the connection from the server remains active. The IP address assigned to the malicious
attacker gets released and reassigned to a legitimate user who will then get billed for services that the
attacker will use.
RADIUS accounting inspection prevents this type of attack by ensuring the traffic seen by the GGSN is
legitimate. With the RADIUS accounting feature properly configured, the security appliance tears down
a connection based on matching the Framed IP attribute in the Radius Accounting Request Start message
with the Radius Accounting Request Stop message. When the Stop message is seen with the matching
IP address in the Framed IP attribute, the security appliance looks for all connections with the source
matching the IP address.
You have the option to configure a secret pre-shared key with the RADIUS server so the security
appliance can validate the message. If the shared secret is not configured, the security appliance does
not need to validate the source of the message and will only check that the source IP address is one of
the configured addresses allowed to send the RADIUS messages.
Note When using RADIUS accounting inspection with GPRS enabled, theadaptive security appliance checks
for the 3GPP-Session-Stop-Indicator in the Accounting Request STOP messages to properly handle
secondary PDP contexts. Specifically, the adaptive security appliance requires that the Accounting
Request STOP messages include the 3GPP-SGSN-Address attribute before it will temrinate the user
sessions and all associated connections. Some third-party GGSNs might not send this attribute by
default.
Select RADIUS Accounting Map
The Select RADIUS Accounting Map dialog box lets you select a defined RADIUS accounting map or
define a new one.
Fields
• Add—Lets you add a new RADIUS accounting map.
Modes
The following table shows the modes in which this feature is available:
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
••••—