Mailing List Archive

VPDN Problems
Hi all,

Am a newbie around here looking for any assistance possible. We are
currently purchasing a wholesale ADSL product off our backbone provider,
which terminates on our LNS via L2TP (which is a Cisco 2611XM).

The setup works great, all ADSL customers terminate with us. But is it
possible to act as a "virtual LAC" of sorts, so depending on the domain the
customer is connecting from, our LNS then tunnels the connection via L2TP to
another LNS? Below is an excerpt of the config from the router;

vpdn enable
vpdn multihop
vpdn ip udp ignore checksum
vpdn search-order domain
vpdn domain-delimiter @ suffix
!
vpdn-group ACIS
request-dialin
protocol l2tp
domain acis.com.au
initiate-to ip 203.14.230.5
!
vpdn-group connect-dsl-direct
! Default L2TP VPDN group
description Terminate local PPP ADSL sessions here
accept-dialin
protocol l2tp
virtual-template 1
local name lns.core1.can.infinite.net.au
lcp renegotiation on-mismatch
l2tp tunnel password 7 06152B241B19380B03344152
ip mtu adjust
!

As I said, this works great for our clients, but when someone logs in with
the domain @acis.com.au, we want the LNS to then tunnel it off to another
LNS, but its still trying to authenticate and terminate locally.

Any help would be appreciated.


--
Nikolas Geyer
Systems Administration
Infinite Networks
Ph: 02 6239 2152
Fax: 02 6239 2041

13 Wiluna Street
Fyshwick ACT 2609

http://www.infinite.net.au/

IMPORTANT NOTICE: This message may contain privileged and confidential
information intended only for the above named addressee. If you are not the
intended recipient of this message, you are hereby notified that any use,
distribution or reproduction of this message or any part thereof is
prohibited. Any views expressed in this message are those of the individual
sender and may not necessarily reflect the views of Infinite Networks.
Re: VPDN Problems [ In reply to ]
On Tue, Dec 09, 2003 at 10:25:51AM +1100, Nikolas Geyer wrote:
> The setup works great, all ADSL customers terminate with us. But is it
> possible to act as a "virtual LAC" of sorts, so depending on the domain the
> customer is connecting from, our LNS then tunnels the connection via L2TP to
> another LNS?

I'd be interested how this can be done controlled on a per-user basis,
not per-domain.

> l2tp tunnel password 7 06152B241B19380B03344152

Consider changing this one now. :-)


Best regards,
Daniel
RE: VPDN Problems [ In reply to ]
> On Tue, Dec 09, 2003 at 10:25:51AM +1100, Nikolas Geyer wrote:
> > The setup works great, all ADSL customers terminate with us. But is
> > it possible to act as a "virtual LAC" of sorts, so depending on the
> > domain the customer is connecting from, our LNS then tunnels the
> > connection via L2TP to another LNS?
>
> I'd be interested how this can be done controlled on a per-user basis,
> not per-domain.

use "vpdn authen-before-forward", and just pass the tunnel attributes in
the AAA profile. So just like the way authen-before-forward works on the
NAS/LAC, if IOS finds tunnel attributes, it forwards the session, if it
doesn't, it terminates the user locally.

oli
Re: VPDN Problems [ In reply to ]
On Tue, Dec 09, 2003 at 08:51:03PM +0100, Oliver Boehmer (oboehmer) wrote:
> use "vpdn authen-before-forward", and just pass the tunnel attributes in
> the AAA profile. So just like the way authen-before-forward works on the
> NAS/LAC, if IOS finds tunnel attributes, it forwards the session, if it
> doesn't, it terminates the user locally.

Thanks Oli, as usual. :-)

Is there a way to configure that statically in IOS? Or does this
forwarding configuration _has_ to come via RADIUS?


Best regards,
Daniel
RE: VPDN Problems [ In reply to ]
Daniel,

> > use "vpdn authen-before-forward", and just pass the tunnel
> > attributes in the AAA profile. So just like the way
> > authen-before-forward works on the NAS/LAC, if IOS finds tunnel
> > attributes, it forwards the session, if it doesn't, it terminates
> > the user locally.
>
> Is there a way to configure that statically in IOS? Or does this
> forwarding configuration _has_ to come via RADIUS?

No, not yet. Currently per-user vpdn information needs to come from AAA.
See also
http://www.cisco.com/warp/public/793/access_dial/vpdn-username.shtml

Please note that globally enabling "vpdn authen-before-forward" changes
the way the LAC authorizes vpdn users as it no longer tries to authorize
the domain, it rather forwards the full username (user@domain.com) to
Radius. You can also enable authen-before-forward within a vpdn-group
(selected on DNIS, so not all sessions are subject to per-user
authorization.

oli