|
|
This chapter describes the commands required to configure virtual private dialup networks. For information about configuring this feature, see the "Configuring Virtual Private Dialup Networks" chapter of the Dial Solutions Configuration Guide.
To shut down a specified tunnel and all the MIDs within it, use the clear vpdn tunnel EXEC command.
clear vpdn tunnel network-access-server gateway-name| network-access-server | Name of the network access server at the far end of the tunnel, probably the point of presence of the public data network or the Internet Service Provider's. |
| gateway-name | Host name of home gateway at the local end of the tunnel. |
EXEC
This command first appeared in Cisco IOS Release 11.2.
This command is used primarily for troubleshooting. You can use the command to force the tunnel to come down without unconfiguring it (the tunnel could be restarted immediately by a user logging in).
The following example clears a tunnel between a network access server called orion and a home gateway called sampson:
clear vpdn tunnel orion sampson
To display information about active Level 2 Forwarding (L2F) protocol tunnel and Level 2 Forwarding (L2F) message identifiers in a virtual private dialup network, use the show vpdn EXEC command.
show vpdnThis command has no keywords or arguments.
EXEC
This command first appeared in Cisco IOS Release 11.2.
The following is sample output of the show vpdn command:
Router# show vpdn
Active L2F tunnels
NAS Name Gateway Name NAS CLID Gateway CLID State
nas gateway 4 2 open
L2F MIDs
Name NAS Name Interface MID State
phil@cisco.com nas As7 1 open
sam@cisco.com nas As8 2 open
Table 125 describes the fields in this sample display.
| Field | Description |
|---|---|
| Active L2F tunnels | |
| NAS Name | Host name of the network access server, which is the remote termination point of the tunnel. |
| Gateway Name | Host name of the home gateway, which is local termination point of the tunnel. |
| NAS CLID | A number uniquely identifying the VPDN tunnel on the network access server. |
| Gateway CLID | A number uniquely identifying the VPDN tunnel on the gateway |
| State | Indicates whether the tunnel is open, opening, closing, or closed. |
| L2F MIDs | |
| Name | Username of the person from whom a protocol message was forwarded over the tunnel. |
| NAS Name | Host name of the network access server. |
| Interface | Interface from which the protocol message was sent. |
| MID | A number uniquely identifying this user in this tunnel. |
| State | Indicates status for the individual user in the tunnel. The states are: opening, open, closed, closing, and waiting_for_tunnel.
The waiting_for_tunnel state means that the user connection is waiting until the main tunnel can be brought up before it moves to the opening state. |
You can use the master indexes or search online to find documentation of related commands.
vpdn enable
vpdn incoming
vpdn outgoing
To specify the characters to be use to delimit the domain prefix or domain suffix, use the vpdn domain-delimiter global configuration command.
vpdn domain-delimiter characters [suffix | prefix]| characters | One or more specific characters to be used as suffix or prefix delimiters. Available characters are %, -, @, \ , #, and /.
If a backslash (\) is the last delimiter in the command line, enter it as a double backslash (\\). |
| suffix | prefix | Usage of the specified characters. |
This command is disabled.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
You can enter one vpdn domain-delimiter command to list the suffix delimiters and another vpdn domain-delimiter command to list the prefix delimiters. However, no character can be both a suffix delimiter and a prefix delimiter.
This command allows the network access server to parse a list of home gateway DNS domain names and addresses sent by an AAA server. The AAA server can store domain names or IP addresses in the following AV pair:
cisco-avpair = "lcp:interface-config=ip address 1.1.1.1 255.255.255.255.0",
cisco-avpair = "lcp:interface-config=ip address bigrouter@excellentinc.com,
The following example lists three suffix delimiters and three prefix delimiters:
vpdn domain-delimiter %-@ suffix vpdn domain-delimiter #/\\ prefix
This example allows the following host and domain names:
cisco.com#houstonddr houstonddr@cisco.com
You can use the master indexes or search online to find documentation of related commands.
vpdn enable
vpdn incoming
vpdn outgoing
vpdn search-order
To enable virtual private dialup networking on the router and inform the router to look for tunnel definitions in a local database and on a remote authorization server (home gateway), if one is present, use the vpdn enable global configuration command.
vpdn enableThis command has no keywords or arguments.
Disabled
Global configuration
This command first appeared in Cisco IOS Release 11.2.
The following example enables virtual private dialup networking on the router:
vpdn enable
You can use the master indexes or search online to find documentation of related commands.
To cause the home gateway to issue its own CHAP challenge even if one has already been issued from the network access server, use the vpdn force-local-chap global configuration command. To disable the home gateway's issuing its own CHAP challenge, use the no form of this command.
vpdn force-local-chapThis command has no arguments or keywords.
The home gateway does not issue its own CHAP challenge.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
The following example configures a virtual template interface on the home gateway and then enables VPDN and forces the home gateway to issue its own CHAP challenge.
interface virtual-template 1 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! vpdn enable vpdn incoming world12 troll virtual-template 1 vpdn force-local-chap
To specify the local name to use for authenticating and the virtual template to use for building interfaces for incoming connections when a Level 2 Forwarding (tunnel) connection is requested from a certain remote host, use the vpdn incoming global configuration command.
vpdn incoming remote-name local-name virtual-template number| remote-name | Case-sensitive name of the remote host requesting the connection. |
| local-name | Case-sensitive local name to use when authenticating back to the remote host. |
| virtual-template number | Virtual template to use for building interfaces for incoming calls. |
Disabled. No host name, IP address, or local name for authentication are provided.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
The remote-name and local-name arguments are case sensitive.
This command is usually used on a home gateway, not on the network access server in the ISP or public data network.
The following partial example specifies use of local host go_blue and virtual template interface 6 for connections with remote host dallas_wan:
vpdn incoming dallas_wan go_blue virtual-template 6
To enable local authentication of users on the network access server before the connection is forwarded to the home gateway, use the vpdn local-authentication global configuration command. To reset the network access server to the default in which local authentication is disabled, use the no form of this command.
vpdn local-authenticationThis command has no arguments and keywords.
This command is disabled.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
In the following example, the network access server is configured to select tunnels based on the dialed number of incoming calls and to authenticate users locally:
vpdn enable vpdn outgoing dnis 4592367 spartan ip 172.34.16.244 vpdn local-authentication
You can use the master indexes or search online for documentation of related commands.
vpdn enable
vpdn outgoing
To specify use of Dialed Number Information Service (DNIS) or use of a domain name when selecting a tunnel for forwarding traffic to the remote host (the home gateway) on a virtual private dialup network, use the vpdn outgoing global configuration command.
vpdn outgoing {dnis dialed-number | domain-name} local-name ip ip-address| dnis dialed-number | Dialed number to be used for selecting a specific tunnel to be used for forwarding traffic to a home gateway. |
| domain-name | Case-sensitive name of the domain to forward traffic to. |
| local-name | Case-sensitive local name to use when authenticating the tunnel to the remote host. |
| ip ip-address | IP address of the remote host (home gateway). |
Disabled. No remote names and local names are defined.
Global configuration
This command first appeared in Cisco IOS Release 11.2
The domain-name and local-name arguments are case sensitive.
This command is usually used on a network access server, not on a home gateway.
When use of the Dialed Number Information Service is enabled and a dialed number is provided, the network service provider can use the dialed number to select a specific tunnel destination.
The domain name can be used to choose a tunnel destination. For example, if a user dials in as "joe@company-a.com," then matching on "company-a.com," a tunnel destination can be chosen.
If both DNIS information and a CHAP or PAP name map to a valid tunnel, the DNIS information is used.
If TACACS+ is used to get tunnel information, the string "dnis:" is prepended to the phone number before attempting to look up the information in AAA.
The following example selects a tunnel destination based on the domain name:
vpdn outgoing chicago-main go-blue ip 172.17.33.125
The following example selects a tunnel destination based on the use of DNIS and a specific dialed number:
vpdn outgoing dnis 2387765 gocardinal ip 170.16.44.56
You can use the master indexes or search online to find documentation of related commands.
vpdn enable
vpdn incoming
To specify how the service provider's network access server is to perform VPDN tunnel authorization searches, use the vpdn search-order global configuration command. To remove a prior specification, use the no form of the command.
vpdn search-order {dnis domain | domain dnis | domain | dnis}| dnis domain | Search first on the Dialed Number Information Service (DNIS) information provided on ISDN lines and then search on the domain name. |
| domain dnis | Search first on the domain name and then search on the DNIS information. |
| domain | Search on the domain name only. |
| dnis | Search on the DNIS information only. |
When this command is not used, the default is to search first on the Dialed Number Information Service (DNIS) information provided on ISDN lines and then search on the domain name. This is equivalent to using the vpdn search-order dnis domain command.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
VPDN authorization searches are performed only as specified.
The configuration shows the vpdn search-order command setting only if the command is explicitly configured.
The following example configures a network access server to select a tunnel destination based on the use of DNIS and a specific dialed number and to perform tunnel authorization searches based on the DNIS information only.
vpdn enable vpdn outgoing dnis 2387765 gocardinal ip 170.16.44.56 vpdn search-order dnis
You can use the master indexes or search online to find documentation of related commands.
vpdn outgoing
To set the source IP address of the network access server, use the vpdn source-ip global configuration command.
vpdn source-ip address| address | IP address of the network access server. |
This command is disabled. No default IP address is provided.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
One source IP address is configured on the network access server. The source IP address is configured per network access server, not per domain.
This example enables VPDN on the network access server and sets an IP source address of 171.4.48.3.
vpdn enable vpdn source-ip 171.4.48.3
You can use the master indexes or search online for documentation of related commands.
vpdn enable
|
|