Virtual Interface Template Service

Description

Beginning with Cisco IOS Release 11.2, virtual interface templates can be configured independently of any physical interface and applied dynamically, as needed, to create virtual access interfaces. When a user dials in, a predefined configuration template is used to configure a virtual access interface; when the user is done, the virtual access interface goes down and the resources are freed for other dialin uses.

The Virtual Interface Template Service feature provides a generic service that can be used to apply predefined configurations (virtual interface templates) in creating and freeing virtual access interfaces on the fly, as needed.

Virtual interface templates are serial interface configurations with no hardware associations, and virtual access interfaces are virtual interfaces that are created, configured dynamically, and freed as needed. The following limitations apply:

• Although a system can have as many as ten virtual interface templates, four is a more realistic limit.

• When in use, each virtual access interface cloned from a template requires the same amount of memory as a serial interface. Cisco routers support a maximum of 300 virtual interfaces per system.

• Virtual access interfaces are not directly configurable by users, except by configuring a virtual interface template or including a user's configuration information on an AAA server. However, information about an in-use virtual access interface can be displayed and the virtual access interface can be cleared.

• Virtual interface templates provide no direct value to users; they must be applied to or associated with a feature by use of a command with the virtual-template keyword.

For example, the interface virtual-template command can be used to create the virtual interface template and the multilink virtual-template command can be used to apply the virtual template to a multilink stack group. The virtual-profile virtual-template command is used to specify that a virtual interface template will be used as a source of configuration information for virtual profiles.

Applying Virtual Interface Templates to Configure Virtual Access Interfaces

Virtual interface templates are one possible source of configuration information for a virtual access interface.

Some applications use only virtual interface templates; for example, Multilink PPP and Multichassis Multilink PPP.

Some applications can take configuration information from multiple sources; for example, virtual profiles can take configuration information from a virtual interface template, or from a user's configuration information stored on an AAA server, or both. The result of using both sources is a virtual access interface uniquely configured for a specific dialin user.

Figure 21 illustrates that a router can create a virtual access interface by first using the information from a virtual interface template (if any is defined for the application) and then using the information in a per-user configuration (if AAA is configured on the router and per-user configuration is defined for the specific user).

Benefits

The virtual interface template service provides the following benefits to customers with large numbers of dial-in users:

• For easier maintenance, allows customized configurations to be predefined and then applied dynamically when the specific need arises.

• For scalability, allows interface configuration to be separated from physical interfaces. Virtual interfaces can share characteristics, no matter what specific type of interface the user called on.

• For consistency and configuration ease, allows the same predefined template to be used for all users dialing in for a specific application.

• For efficient router operation, frees the virtual access interface memory for another dial-in use when the user's call ends.

List of Terms

cloning--Creating and configuring a virtual access interface by applying a specific virtual template. The virtual template is the source of the generic user information and router-dependent information. The result of cloning is a virtual access interface configured with all the commands in the template.

virtual access interface--Instance of a unique virtual interface that is created dynamically and exists temporarily. Virtual access interfaces can be created and configured differently by different applications, such as virtual profiles and virtual private dialup networks.

virtual interface template--Generic configuration of an interface for a certain purpose or configuration common to certain users, plus router-dependent information. This takes the form of a list of Cisco IOS interface commands to be applied to the virtual interface as needed. Several applications can apply virtual interface templates, but generally each application uses a single template. Each virtual interface template is identified by number.

virtual profile--Unique virtual access interface created dynamically for a specific user when the user calls in and torn down dynamically when the call disconnects. The sources of configuration information for the virtual profile can be

• a virtual interface template (general configuration and router-specific information stored on the local router)--for a group of users.

• per-user configuration (stored on an AAA server)--for the specific user who dials in.

• both a virtual interface template and per-user configuration.

Configuration of a virtual access interface begins with a virtual interface template (if any), followed by application of per-user configuration for the particular user's dial-in session (if any).

Features that Apply Virtual Interface Templates

This is a partial list of features that apply virtual interface templates to create virtual access interfaces dynamically and the Cisco IOS software releases in which they were introduced:

• Virtual Profiles--Release 11.2 F

• Virtual Private Dialup Networks--Release 11.2

• Multichassis Multilink PPP (MMP)--Release 11.2

• Virtual Templates for Protocol Translation--Release 11.2 F

• PPP over ATM--Release 11.2 F

Platforms

This feature is supported on all platforms that support Multilink PPP:

• Cisco 1003, Cisco 1004

• Cisco 2500 series

• Cisco 4000 series (Cisco 4000, 4000-M, 4500, 4500-M, 4700, 4700-M)

• Cisco AS5200

• Cisco 7000 series

• Cisco 7200 series

• Cisco 7500 series

Prerequisites

All prerequisites depend on the feature that is applying a virtual interface template to create a virtual access interface. Virtual interface templates themselves have no other prerequisites.

The order in which you create virtual interface templates and virtual profiles, and configure the features that use the templates and profiles, is not important. They must exist, however, before someone calling in can use them.

Configuration Tasks

To create and configure a virtual interface template, compete the tasks in this section. To apply a virtual interface template, refer to the specific features that apply the virtual template.

Create and Configure a Virtual Interface Template

Because a virtual interface template is a serial interface, all the configuration commands that apply to serial interfaces can also be applied to virtual interface templates, except shutdown and dialer commands.

To create and configure a virtual interface template, complete the following tasks beginning in global configuration mode:

Other optional PPP configuration commands can be added to the virtual template configuration. For example, you can add the ppp authentication chap command.

Monitor and Maintain a Virtual Access Interface

When a virtual interface template or a user's configuration on an AAA server or both are applied dynamically, a virtual access interface is created. Although a virtual access interface cannot be created and configured directly, it can be displayed and cleared.

To display or clear a specific virtual access interface, perform the relevant task:

Configuration Examples

The following example enabled virtual profiles by virtual template only and configures a virtual interface template that can be applied to any dial-in user.

virtual-profile virtual-template 1
interface virtual-template 1
ip unnumbered ethernet 0
encapsulation ppp
ppp authentication chap

The following two examples configure a virtual interface template and then display the configuration of a virtual access interface when the template interface has been applied. The first example uses a named IPX access list.

interface virtual-template 1
ip unnumbered Ethernet0
ipx ppp-client Loopback2
no cdp enable
ppp authentication chap

This example displays the configuration of the active virtual access interface that was configured by virtual-template 1, defined in the example immediately above:

Router# show interface virtual-access 1 configuration 
Virtual-Access1 is a L2F link interface
interface Virtual-Access1 configuration...
ip unnumbered Ethernet0
ipx ppp-client Loopback2
no cdp enable
ppp authentication chap

Command Reference

MLP and MMP commands that use virtual access templates were introduced in Cisco IOS Release 11.2.

New features that define and use virtual interface templates are described in other chapters of this feature guide.

Debug Commands

This section documents new or modified debug commands. All other commands used with this feature are documented in the Cisco IOS Release 11.2 command references.

debug vtemplate

To display cloning information for a virtual access interface from the time it is cloned from a virtual template to the time the virtual access interface comes down when the call ends, use the debug vtemplate privileged EXEC command.

Sample Display

Figure 22 shows sample output from the debug vtemplate command.

seraph# debug vtemplate
Virtual Template debugging is on
seraph#
VTEMPLATE Reuse vaccess8, New Recycle queue size:50
 
VTEMPLATE set default vaccess8 with no ip address
 
Virtual-Access8 VTEMPLATE hardware address 0000.0c09.ddfd
VTEMPLATE vaccess8 has a new cloneblk vtemplate, now it has vtemplate
VTEMPLATE undo default settings vaccess8
 
VTEMPLATE ************* CLONE VACCESS8 *****************
 
VTEMPLATE Clone from vtemplate1 to vaccess8
interface Virtual-Access8
no ip address
encap ppp
ip unnumbered Ethernet0
no ip mroute-cache
fair-queue 64 256 0
no cdp enable
ppp authentication chap
end
 
%LINK-3-UPDOWN: Interface Virtual-Access8, changed state to up
%LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access8, changed state to up

%LINK-3-UPDOWN: Interface Virtual-Access8, changed state to down
VTEMPLATE Free vaccess8
 
%LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access8, changed state to down
VTEMPLATE clean up dirty vaccess queue, size:1
 
VTEMPLATE Found a dirty vaccess8 clone with vtemplate
VTEMPLATE ************ UNCLONE VACCESS8 **************
VTEMPLATE Unclone to-be-freed vaccess8 command#7
interface Virtual-Access8
default ppp authentication chap
default cdp enable
default fair-queue 64 256 0
default ip mroute-cache
default ip unnumbered Ethernet0
default encap ppp
default ip address
end
 
VTEMPLATE set default vaccess8 with no ip address
 
VTEMPLATE remove cloneblk vtemplate from vaccess8 with vtemplate
 
VTEMPLATE Add vaccess8 to recycle queue, size=51

Table 20 explains the lines in the sample output.

What to Do Next

You can configure the feature that applies the virtual interface template you have defined. Refer to the documentation for that feature.