Configuring AppleTalk Remote Access

This chapter describes how to configure your router to act as an AppleTalk Remote Access (ARA) server. It does not describe how to configure or use the client Macintosh. Refer to the Apple Computer, Inc. Apple Remote Access Client User's Guide and the Apple Remote Access Personal Server User's Guide for information about how to use ARA software on your Macintosh. For a complete description of the commands in this chapter, refer to the chapter "AppleTalk Remote Access Commands" in the Access Services Command Reference.

AppleTalk Remote Access

Cisco's implementation of ARA gives Macintosh users direct access to information and resources in remote AppleTalk networks over standard telephone lines. For example, if you have a PowerBook at home and need to get a file from your Macintosh at the office, ARA software can make the connection between your home and office computers over telephone lines.

You can configure your router to act as an ARA server by enabling AppleTalk and ARA protocol on physical terminal (TTY) or virtual terminal (VTY) lines. Configuring your router to act as an ARA server allows remote Macintosh users to dial in, become a network node, and connect to devices on other networks. ARA protocol support is transparent to the Macintosh end user. Macintosh users can also use SLIP to access remote IP network resources and PPP to access both Appletalk and IP resources.

The following Macintosh and Cisco IOS software support is required for ARA connectivity:

• A Macintosh running ARA software and a connection control language (CCL) script.

• A router configured as an ARA server.

Figure 18 shows how your router can act as an ARA server between remote Macintosh computers (in Figure 18, a Power Macintosh and a PowerBook) and devices on another network.

ARA Task List

To set up the Cisco IOS software to act as an ARA server, complete the following tasks:

• Connect Cables

• Configure the Line and the Modem

• Configure ARA

• Configure ARA

The following tasks are optional:

• Customize ARA

• Customize the AppleTalk Configuration

• Configure System Security

• Monitor an ARA Server

To enable asynchronous callback to ARA clients, refer to the section "Call Back ARA Clients" in the "Configuring Terminal Lines and Modem Support" chapter.

Connect Cables

Figure 19 shows how to connect a Macintosh using internal and external modems.

Use the MMOD version of the RJ-45-to-DB-25 adapter (labeled "Modem" if from Cisco) to connect a "rolled" RJ-45 cable from the router to the modem. Use a high-speed modem cable with hardware flow control to connect a modem to your Macintosh (refer to the user documentation for your modem for more specific information).

For more information about connecting cables, refer to the hardware installation and maintenance or product user's guide for your router.

Configure the Line and the Modem

Configure the line as follows:

• Specify line speed--115200 bps on high-speed modems is recommended.

• Set hardware flow control--Use the flowcontrol hardware command to enable hardware flow control.

• Specify your modem control parameters--Use the modem inout command to configure the line for both incoming and outgoing calls, or use the modem dialin command to configure the line for incoming calls only.

• Configure security on your dialin lines.

For more information about configuring lines and modem control, refer to the chapter "Configuring Terminal Lines and Modem Support" earlier in this publication. For information about configuring security, refer to the chapter "Managing the System" in the Configuration Fundamentals Configuration Guide.

Configure ARA

To configure ARA, perform the following tasks:

• Enable AppleTalk Routing

• Enable ARA Support

• Enable Transmission of Routing Updates

• Configure an AppleTalk Interface

• Enable ARA

The sections that follow describe each of these tasks. Refer to the chapter "AppleTalk Remote Access Commands" in the Access Services Command Reference publication for information about commands listed in these tasks.

Enable AppleTalk Routing

To enable AppleTalk routing, perform the following task in global configuration mode:

For more information about configuring AppleTalk, refer to the chapter "Configuring AppleTalk in the Network Protocols Configuration Guide, Part 1.

Enable ARA Support

To create a new network or zone, perform the following task in global configuration mode:

The network-number argument must be a unique network number.

Enable Transmission of Routing Updates

To ensure that a new internal network is advertised, make sure that Routing Table Maintenance Protocol (RTMP) is not disabled by performing the following task in interface configuration mode:

Configure an AppleTalk Interface

You can manually configure an interface for AppleTalk or, if an interface is connected to a network that has at least one other router configured for AppleTalk, you can dynamically configure the interface using discovery mode.

If the AppleTalk network already exists, the zone and cable range must match the existing configuration. To identify existing cable ranges and zone names, configure the Cisco IOS software for discovery mode.

You can also configure an AppleTalk interface on a segment for which there are no AppleTalk routers.

For more information, refer to the chapter "Configuring AppleTalk" in the Network Protocols Configuration Guide, Part 1.

Enable ARA

To enable ARA on a line, perform the following task in line configuration mode:

Customize ARA

• Configure Automatic ARA Detection (Automatic Protocol Startup)

• Set the Session Time Limit

• Set the Disconnect Warning Time

• Set a Dedicated ARA Line

The following sections describe these tasks. Refer to the chapter "AppleTalk Remote Access Commands" in the Access Services Command Reference for information about commands listed in these tasks.

Configure Automatic ARA Detection

To configure the Cisco IOS software to allow an ARA session to start automatically, perform the following task in global configuration mode:

The autoselect command permits the device to allow an appropriate process to start automatically when a starting character is received. The device detects either a Return character, which is the start character for an EXEC session, or the start character for the ARA protocol. By issuing the command with the during-login argument, you can display the username or password prompt without pressing the Return key. While the Username or Password name is being presented, you can choose to answer these prompts or to start sending packets from an autoselected protocol.

For information on using ARA with TACACS, Extended TACACS, and AAA/TACACS+, refer to the "Managing the System" chapter in the Configuration Fundamentals Configuration Guide.

Set a Dedicated ARA Line

Set the Session Time Limit

Set the Disconnect Warning Time

Configure System Security

• ARA Server Security, including required manual password entry, limited network visibility, and no guest access.

• Cisco router-based security, including username and password authentication and access lists

• Terminal Line Security, including TACACS and TACACS+/AAA, Kerberos, and Radius

The following sections describe these tasks. Refer to the chapter "AppleTalk Remote Access Commands" in the Access Services Command Reference for information about commands listed in these tasks.

ARA Server Security

This section describes the following security features, which are specific to the ARA protocol:

• Require Manual Password Entry

• Limit Network Visibility

• Disallow Guests

Require Manual Password Entry

You can control access by requiring that users enter their password manually at the time they log in. To force manual password entry, perform the following task in line configuration mode:

Limit Network Visibility

Disallow Guests

A guest is a person who connects to the network without having to give a name or a password. To prohibit Macintosh guests from logging in through the router, perform the following task in line configuration mode. Use the optional if-needed argument to allow users to log in as guests if they are already authenticated with a username or password.

Task	Command
Prohibit guests from logging in to the ARA network.	arap noguest [if-needed]

Caution Do not use the arap noguest command if you are using modified CCL scripts and the login tacacs command.

Cisco Router-based Security

You can prevent unauthenticated users from accessing your network resources using the following local security mechanisms:

• Configure Internal Username Authentication

• Use Access Lists to Control Access to AppleTalk Networks

Configure Internal Username Authentication

Use Access Lists to Control Access to AppleTalk Networks

An access list is a list of AppleTalk network numbers or zones that is maintained by the Cisco IOS software and used to control access to or from specific zones or networks. For more information about AppleTalk access lists, refer to the section "Control Access to AppleTalk Networks." in the chapter "Configuring AppleTalk" in the Network Protocols Configuration Guide, Part 1.

Terminal Line Security

You can prevent unauthenticated users from accessing your network resources using the following security mechanisms:

• TACACS and AAA/TACACS+ user authentication, with username and password information stored on a TACACS or TACACS+ server

• Kerberos, which is configured through the AAA facility

• Radius, which is configured through the AAA facility

For more information about each of these security mechanisms, refer to the section "Security Management" in the chapter "Managing the System" in the Configuration Fundamentals Configuration Guide.

Configure TACACS Security

• Enable Standard and Extended TACACS or AAA/TACACS+ for ARA Authentication.

• Modify Scripts to Support a Standard EXEC Security Dialog. This is only necessary if you are running Standard TACACS on your Cisco device and on your TACACS server.

Enable Standard and Extended TACACS or AAA/TACACS+ for ARA Authentication

Use the arap use-tacacs command with Standard and Extended TACACS servers for authentication within ARA sessions. You must already have set up an Extended TACACS server using the Cisco Extended TACACS server software, available from the ftp.cisco.com directory. Refer to the README in this directory for more information.

When you use the arap use-tacacs command with Standard TACACS, the remote user logs in by entering username at the ARA username prompt, and their password at the password prompt.

When you use the arap use-tacacs command and the single-line keyword with Standard TACACS, the remote user logs in by entering username*password at the ARA username prompt, and arap at the password prompt.

Use the aaa authentication arap command with AAA/TACACS+.

To configure the Cisco device to use TACACS with ARA, perform one of the following tasks in line configuration mode:

For an example of enabling TACACS for ARA authentication, see the section "Configuration Examples" later in this chapter.

Modify Scripts to Support a Standard EXEC Security Dialog

This section tells you how to modify your CCL script to work with TACACS security and how to configure a line to use a TACACS server for user authentication.

Caution Because of the underlying structure of the ARA protocol, modem layer error control is disabled during the exchange of username and password. This makes the exchange highly susceptible to line noise, especially at higher baud rates enabled by V.34 modems. For this reason, we do not recommend the use of modified scripts, and encourage users to either upgrade to later versions of TACACS or to use the arap use-tacacs single-line command.

For information on how to use TACACS without modifying scripts, refer to "Enable Standard and Extended TACACS or AAA/TACACS+ for ARA Authentication" earlier in this chapter. For information about the arap commands, refer to the Access Services Command Reference.

If you are currently using modified CCL scripts and want to migrate to nonmodified scripts, see "Configure to Use Modified and Unmodified Scripts Example" at the end of this chapter for information on how to use both in the same environment.

For several popular modems, we provide CCL files that you can use as examples to modify your CCL scripts to support TACACS security. This section explains how to use the CCL files provided by Cisco with TACACS security.

We recommend using the ARA Modem Toolkit provided through the AppleTalk Programmers and Developers Association (APDA); it provides both syntax checking and a script tester.

The client uses ARA CCL scripts to establish point-to-point links with the modem to the AppleTalk network. When the connection has been established, the script ends and ARA is activated. TACACS authentication occurs after the connection is established and the ARA script ends, but before the protocol becomes active after the ARA script ends.

Insert TACACS logic just before the end of a script. The CCL TACACS logic performs the following user authentication tasks:

• When the "Username:" prompt is received from the router, the TACACS server queries the user for a username.

• When the "Password:" prompt is received from the router, the TACACS server queries the user for a password.

• After a successful login, indicated by an EXEC prompt at the router, the arap EXEC command is executed.

• The script ends and ARA begins on the client.

CCL scripts control logical flow by jumping to labels. The labels are the numbers 1 through 128 and are not necessarily in sequential order in script files. The TACACS logic in the Cisco IOS software CCL files have label numbers from 100 through 127. In most environments, you can copy the complete TACACS logic from a sample file.

The steps for creating a new TACACS CCL file are as follows:

Step 1 Copy the TACACS logic from a sample CCL script that contains TACACS logic into the new CCL script.

In most cases, you can insert the TACACS logic at the appropriate place in your CCL script. The one case that requires extra attention is when the original CCL script has labels that conflict with the logic in the new file. The labels must be resolved on a case-by-case basis, usually by changing the label numbers used by the original script. This is a fairly simple programming job, but you should read and understand the manual that comes with the Modem Toolkit before beginning.

Step 2 Locate the logical end of the script and insert the command jump 100.

You can locate the logical end of the script by following its flow. Most scripts have the following basic structure:

• Initialize the modem

• Dial the number

• Exit

The characteristic logical end of the script is as follows:

@label N
! N is any integer between 1 and 128
if ANSWER N+1
! If we're answering the phone, jump directly
! to the label N+1
pause 30
! We're not answering the phone, therefore we
! must be calling. Wait three seconds for the
! modems to sync up.
@label N+1
exit 0
! quit and start up ARA

It is common in this case to replace "pause 30" with "jump 100." In fact, this is usually the only change made to the logic of the original script.

Configure TACACS Server User Authentication

To configure a line to use a TACACS server for user authentication, perform the following task in line configuration mode:

Use the login tacacs command in Standard and Extended TACACS. Use the login authentication command in AAA/TACACS+. Figure 20 shows the TACACS login screen on the Macintosh.

Figure 21 shows the TACACS password screen on the Macintosh.

Enable Kerberos Security for ARA Authentication

You can use Kerberos as an authentication method within ARA sessions. To do so, you configure it using the TACACS+/AAA configuration facility. Perform the following task in global configuration mode:

For more information about Kerberos authentication, refer to the chapter "Managing the System" chapter in the Configuration Fundamentals Configuration Guide.

Enable Radius Security for ARA Authentication

You can use Radius as an authentication method within ARA sessions. To do so, you configure it using the TACACS+/AAA configuration facility. Perform the following task in global configuration mode:

For more information about Kerberos authentication, refer to the chapter "Managing the System" chapter in the Configuration Fundamentals Configuration Guide.

Connect to an AppleTalk Network from a Client Running a Different Virtual Terminal Protocol

ARA can run on any point-to-point link, such as a Public Switched Telephone Network (PSTN) or an X.25 WAN. This permits remote Macintosh users to dial into a remote network and access AppleTalk services (such as file sharing and printing). For example, you can enable a Macintosh client on the remote side of an X.25 WAN to connect to an AppleTalk network through the router. To do so, you configure a virtual terminal (VTY) line on the router so that the client sees one of two scenarios:

• A client clicks Connect in an ARA application dialog box and connects to a VTY line on the router. ARA automatically starts up on the outgoing VTY line, and the client is connected to the AppleTalk network. This section describes how to configure the Cisco IOS software for this process.

• A client clicks Connect in an ARA application dialog box and connects directly through the router to the AppleTalk network. This process is described in the section "Enable Tunneling of SLIP, PPP, and ARA" in the chapter "Configuring Protocol Translation."

To enable ARA on VTY lines and enable clients running different virtual terminal protocols to connect to an AppleTalk network through the router, perform the following tasks, beginning in global configuration mode. The first four steps are required. The next eight steps (Step 5 through Step 12) are optional. Step 5, configure automatic protocol startup, dedicates the line to ARA:

Customize the AppleTalk Configuration

Monitor an ARA Server

Monitor the AppleTalk Network

The Cisco IOS software provides several commands that you can use to monitor an AppleTalk network. In addition, you can use Apple Computer's Inter·Poll, which is a tool to verify that a device is configured and operating properly. Use the commands described in this section to monitor an AppleTalk network using both Cisco IOS software commands and Inter·Poll.

To monitor the AppleTalk network, perform one or more of the following tasks:

Configuration Examples

This section contains the following examples of ARA configuration.

• Extended AppleTalk Network Configuration Example

• Extended Network in Discovery Mode Configuration Example

• ARA Configuration Example

• Cable Range Expansion Example

• TACACS Username Authentication Configuration Examples

• Enable TACACS for ARA Authentication Examples

• Dedicated ARA Line Configuration Example

• Configure a Multiuse Line Example

• Configure to Use Modified and Unmodified Scripts Example

• Configure an ARA Server Example

• Telebit T-3000 Modem Setup Example

Extended AppleTalk Network Configuration Example

The following example configures the interface for an extended AppleTalk network. It defines the zones Orange and Brown. The cable range of one allows compatibility with nonextended AppleTalk networks.

Router(config)# appletalk routing
Router(config)# interface ethernet 0
Router(config-if)# appletalk cable-range 69-69 69.128
Router(config-if)# appletalk zone Orange
Router(config-if)# appletalk zone Brown

Extended Network in Discovery Mode Configuration Example

The following example configures an extended network in discovery mode. In Figure 22, access server A provides the zone and network number information to the interface when it starts.

appletalk routing
interface ethernet 0
 appletalk cable-range 0-0 0.0

ARA Configuration Example

! Enable AppleTalk on the router
appletalk routing	
!
interface Ethernet 0
 ip address 172.30.1.1 255.255.255.0
!
! On interface Ethernet 0, assign network number 103 to the physical cable and
! assign zone name "Marketing Lab" to the interface. Assign a zone name if 
! you are creating a new AppleTalk internet. If the internet already exists,
! the zone and cable range must match exactly, or you can leave the cable
! range at 0 to enter discovery mode. The suggested AppleTalk
! address for the interface in this example is 103.1
interface Ethernet 0
 appletalk cable-range 103-103 103.1
 appletalk zone Marketing Lab
! Configure a username and password for the router. 
username jake password sesame
! On lines 4 through 8, InOut modems are specified, the lines are configured
! to automatically start an EXEC session or enable AppleTalk, AppleTalk Remote 
! Access Protocol is enabled, the modem speed is specified as 38400 bps, and 
! hardware flow control is enabled.
line 4 8
 modem InOut
 autoselect
 arap enabled
 speed 38400
 flowcontrol hardware

Connect to an AppleTalk Network over a Foreign Protocol Example

The following example enables a Macintosh client running ARA on a remote network to connect across an X.25 network, through the router, to an AppleTalk network. In this example, VTY lines 0 through 19 are configured for ARA.

Router(config)# appletalk routing
Router(config)# line vty 0 19
Router(config-line)# arap enable
Router(config-line)# autocommand arap
Router(config-line)# arap dedicated
Router(config-line)# arap timelimit 45
Router(config-line)# arap warningtime 5
Router(config-line)# arap noguest
Router(config-line)# arap require-manual-password
Router(config-line)# arap net-access-list 611

The Macintosh client connects to any VTY line from 0 through 19. When the EXEC prompt appears, ARA begins automatically on the line (because of the autocommand arap command). The VTY lines 0 through 19 are dedicated to ARA dial-in clients, and those clients have a 45-minute time limit. Five minutes before the line is disconnected, a warning message appears, indicating that the session will be disconnected in five minutes. Guest access is denied, and manual password entry is required. The AppleTalk access list 611 has been applied to the VTY lines, meaning that access to other networks through these VTY lines has been limited.

Cable Range Expansion Example

In the following example, the cable range is changed and the zone name is reentered.

The initial configuration is as follows:

 appletalk cable-range 100-103
 appletalk zone Twilight Zone

The cable range is expanded as follows:

 appletalk cable-range 100-109

At this point, you must reenter the zone name as follows:

 appletalk zone Twilight Zone

TACACS Username Authentication Configuration Examples

In the following example for TACACS and Extended TACACS, line 1 is configured for ARA and username authentication is performed on a TACACS server:

line 1
 login tacacs
 arap enable

In the following example of AAA/TACACS+, line 1 is configured for ARA and username authentication is performed on a TACACS server:

line 1
 login authentication
 arap authentication

Enable TACACS for ARA Authentication Examples

The following example shows regular TACACS enabled for ARA authentication:

line 3
 arap use-tacacs

The following example shows AAA/TACACS+ enabled for ARA authentication:

line 3
 aaa authentication arap

Dedicated ARA Line Configuration Example

username jsmith password woof
line 2
 arap dedicated
 arap noguest

Configure a Multiuse Line Example

username jsmith password woof
line 2 16
 autoselect 
 arap enabled
 arap noguest

Configure to Use Modified and Unmodified Scripts Example

If you are currently using modified CCL scripts and want to migrate to nonmodified scripts, you can set your system to accept logins using both modified (CCL) and unmodified scripts by entering the following commands in line configuration mode:

 autoselect arap
 autoselect during-login
 arap noguest if-needed 
!

Configure an ARA Server Example

appletalk routing
arap network 104 ARAP Dialin Zone
interface ethernet 0
 appletalk cable-range 0-0 0.0
! puts router in discovery mode
line 5 6
 modem inout
 speed 38400
 arap enabled
 autoselect

Telebit T-3000 Modem Setup Example

ATS51=6 E0 Q1 S0=2 &D3 &R3 S58=2 &W

AT&V

 arap enable
 autoselect
 no escape-character
 flowcontol hardware
 modem ri-is-cd
 speed 38400