|
|
This chapter describes how to configure Virtual Profiles for use with virtual access interfaces.
Virtual Profiles is a unique Point-to-Point Protocol (PPP) application that can create and configure a virtual access interface dynamically when a dial-in call is received, and tear down the interface dynamically when the call ends. Virtual Profiles works with straightforward PPP and with Multilink PPP (MLP).
The configuration information for a Virtual Profiles virtual access interface can come from a virtual template interface, or from user-specific configuration stored on an authentication, authorization, and accounting (AAA) server, or both.
See the "How Virtual Profiles WorkFour Configuration Cases" section for a description of the possible configuration sequences for configuration by virtual template or AAA or both. See the "Interoperability with Other Cisco Dial Features" section for a description of the possible configuration sequences that depend on the presence or absence by MLP or another virtual access feature that clones a virtual template interface.
This feature runs on all Cisco IOS platforms that support MLP.
For a complete description of the commands mentioned in this chapter, refer to the "Virtual Profiles Commands" chapter in the Dial Solutions Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
This section presents background information about Virtual Profiles to help you understand this application before you start to configure it.
This release does not support fast switching.
We recommend that unnumbered addresses be used in virtual template interfaces to ensure that duplicate network addresses are not created on virtual access interfaces.
Use of user-specific AAA interface configuration information with Virtual Profiles requires the router to be configured for AAA and requires the AAA server to have user-specific interface configuration AV-pairs. The relevant AV-pairs (on a RADIUS server) begin as follows:
cisco-avpair = "lcp:interface-config=...",
The information that follows the equal sign (=), could be any Cisco IOS interface configuration command. For example, the line might be the following:
cisco-avpair = "lcp:interface-config=ip address 200.200.200.200 255.255.255.0",
Use of a virtual template interface with Virtual Profiles requires a virtual template to be defined specifically for Virtual Profiles.
Virtual Profiles interoperates with Cisco DDR, Multilink PPP (MLP), and dialers such as ISDN.
Virtual Profiles fully interoperates with physical interfaces in the following DDR configuration states when no other virtual access interface application is configured:
As shown in Table 23, exactly how a virtual access interface will be configured depends three factors:
In Table 23, "(Multilink VT)" means that a virtual template interface is cloned if one is defined for MLP or a virtual access feature that uses MLP.
| Virtual Profiles Configuration | MLP No Dialer | MLP Dialer | No MLP No Dialer | No MLP Dialer |
|---|---|---|---|---|
VP VT only | VP VT | VP VT | VP VT | VP VT |
VP AAA only | (Multilink VT) | (Multilink VT) | VP AAA | VP AAA |
VP VT and VP AAA | VP VT | VP VT | VP VT | VP VT |
No VP at all | (Multilink VT)1 | Dialer2 | No virtual access interface is created. | No virtual access interface is created. |
The order of items in any cell of the table is important. Where VP VT is shown above VP AAA, it means that first the Virtual Profiles virtual template is cloned on the interface, and then the AAA interface configuration for the user is applied to it. The user-specific AAA interface configuration adds to the configuration and overrides any conflicting physical interface or virtual template configuration commands.
Virtual Profiles also interoperates with virtual access applications that clone a virtual template interface. Each virtual access application can have at most one template to clone from but can clone from multiple AAA configurations.
The interaction between Virtual Profiles and other virtual template applications is as follows:
The following new or uncommon terms are used in this chapter:
AV pair---A configuration parameter on an AAA server; part of the user configuration that the AAA server sends to the router, in response to user-specific authorization requests. The router interprets each AV pair as a Cisco IOS router configuration command and applies the AV pairs in order. In this chapter, the term AV pair refers to an interface configuration parameter on a RADIUS server.
An interface configuration AV pair for Virtual Profiles can take a form such as this:
cisco-avpair = "lcp:interface-config=ip address 1.1.1.1 255.255.255.255.0",
cloning---Creating and configuring a virtual access interface by applying configuration commands from a specific virtual template. The virtual template is the source of the generic user information and router-dependent information. The result of cloning is a virtual access interface configured with all the commands in the template.
virtual access interface---Instance of a unique virtual interface that is created dynamically and exists temporarily. Virtual access interfaces can be created and configured differently by different applications, such as Virtual Profiles and virtual private dialup networks.
virtual template interface---Generic interface configuration for certain users or for a certain purpose, plus router-dependent information. This takes the form of a list of Cisco IOS interface commands to be applied to the virtual interface as needed.
virtual profile---Instance of a unique virtual access interface created dynamically when certain users call in and torn down dynamically when the call disconnects. A specific user's virtual profile can be configured by a virtual template interface, user-specific interface configuration stored on an AAA server, or both a virtual template interface and user-specific interface configuration from AAA.
Configuration of a virtual access interface begins with a virtual template interface (if any), followed by application of user-specific configuration for the particular user's dial-in session (if any).
This section describes Virtual Profiles and the various ways they can work with virtual template interfaces, user-specific AAA interface configuration, and MLP or another feature that requires MLP.
Virtual Profiles separates configuration information into two logical parts:
These logical parts can be used separately or together.
Four separate cases are possible:
In the case of Virtual Profiles by virtual template, the software functions as follows:
The router applies the configuration commands that are in the virtual template interface to create and configure the virtual profile. The template includes generic interface information and router-specific information, but no user-specific information. No matter whether a user dialed in on a synchronous serial, an asynchronous serial, or an ISDN interface, the dynamically created virtual profile for the user is configured as specified in the virtual template.
Then the router interprets the lines in the AAA server's authorization approval response as Cisco IOS commands to apply to the virtual profile for the user.
Data flows through the virtual profile, and the higher layers treat it as the user's interface.
For example, if a virtual template included only the three commands ip unnumbered ethernet 0, encapsulation ppp, and ppp authentication chap, the virtual profile for any dial-in user would include those three commands.
In Figure 117, the dotted box represents the virtual profile configured with the commands that are in the virtual template, no matter which interface the call arrives on.
See the "Configure Virtual Profiles by Virtual Template" section for configuration tasks for this case.
In this case, no dialer profile (DDR feature) is defined for the specific user and no virtual template for Virtual Profiles is defined, but Virtual Profiles by AAA is enabled on the router.
During the PPP authorization phase for the user, the AAA server responds as usual to the router. The authorization approval contains configuration information for the user. The router interprets each of the lines in the AAA server's response as Cisco IOS commands to apply to the virtual profile for the user.
The router applies all the user-specific interface commands received from the AAA server.
Suppose, for example, that the router interpreted the AAA server's response as including only the following two commands for this user:
ip address 10.10.10.10 255.255.255.255 keepalive 30
In Figure 118, the dotted box represents the virtual profile configured only with the commands received from the AAA server, no matter which interface the incoming call arrived on. On the AAA RADIUS server, the AV-pair might have read as follows, where "\n" means to start a new command line:
cisco-avpair = "lcp:interface-config=ip address 10.10.10.10 255.255.255.0\nkeepalive 30",
See the "Configure Virtual Profiles by AAA Configuration" section for configuration tasks for this case.
The router performs the following tasks in order:
1. Dynamically creates a virtual access interface cloned from the virtual template defined for Virtual Profiles.
2. Applies the user-specific interface configuration received from the AAA server.
If any command in the user's configuration conflicts with a command on the original interface or a command applied by cloning the virtual template, the user-specific command overrides the other command.
Suppose that the router had the virtual template as defined in Case 1 and the AAA user configuration as defined in Case 2. In Figure 119 the dotted box represents the virtual profile configured with configuration information from both sources, no matter which interface the incoming call arrived on. The ip address command has overridden the ip unnumbered command.
See the "Configure Virtual Profiles by Both Virtual Template and AAA Configuration" section for configuration tasks for this case.
The router performs the following tasks in order:
1. Dynamically creates a virtual access interface and clones the virtual template from the other virtual access application onto it.
2. Applies the user-specific interface configuration received from the AAA server.
If any command in the virtual template conflicts with a command on the original interface, the template overrides it.
If any command in the user's AAA interface configuration conflicts with a command in the virtual template, the user's AAA interface configuration conflicts overrides the virtual template.
If Per-User Configuration also happens to be configured on the AAA server, that network protocol configuration is applied to the virtual access interface last.
The result is a virtual interface unique to that user.
To configure Virtual Profiles for dial-in users, complete the tasks in one of the first three sections and then troubleshoot the configuration by performing the tasks in the last section:
As indicated earlier in the "Interoperability with Other Cisco Dial Features" section, do not define a DDR dialer profile for a user if you intend to define Virtual Profiles for the user.
To configure Virtual Profiles by virtual template, complete these two tasks:
Because a virtual template interface is a serial interface, all the configuration commands that apply to serial interfaces can also be applied to virtual template interfaces, except shutdown and dialer commands.
To create and configure a virtual template interface, use the following commands beginning in global configuration mode:
| Step | Command | Purpose | ||
|---|---|---|---|---|
| interface virtual-template number | Create a virtual template interface, and enter interface configuration mode. | ||
| Enable IP without assigning a specific IP address on the LAN. | |||
| Enable PPP encapsulation on the virtual template interface. |
Other optional PPP configuration commands can be added to the virtual template configuration. For example, you can add the ppp authentication chap command.
To specify a virtual template interface as the source of information for Virtual Profiles, use the following command in global configuration mode.
| Command | Purpose |
|---|---|
Specify the virtual template interface as the source of information for Virtual Profiles. |
Virtual template numbers range from 1 to 25.
To configure Virtual Profiles by AAA only, complete these three tasks in any order. All tasks must be completed before Virtual Profiles are used.
To specify AAA as the source of information for Virtual Profiles, use the following command in global configuration mode:
| Command | Purpose |
|---|---|
Specify AAA as the source of user-specific interface configuration. |
If you also want to use Per-User Configuration for network protocol access lists or route filters for individual users, see the "Per-User Configuration" chapter of this manual.
In this case, no virtual template interface is defined for Virtual Profiles.
To configure Virtual Profiles by both virtual template interface and AAA configuration, complete these tasks in any order. All tasks must be completed before Virtual Profiles are used.
To create and configure a virtual template interface, use the following command beginning in global configuration mode:
| Step | Command | Purpose | ||
|---|---|---|---|---|
| interface virtual-template number | Create a virtual template interface, and enter interface configuration mode. | ||
| Enable IP without assigning a specific IP address on the LAN. | |||
| Enable PPP encapsulation on the virtual template interface. |
Because the software treats a virtual template interface as a serial interface, all the configuration commands that apply to serial interfaces can also be applied to virtual template interfaces, except shutdown and dialer commands. Other optional PPP configuration commands can also be added to the virtual template configuration. For example, you can add the ppp authentication chap command.
To specify both the virtual template interface and the AAA Per-User Configuration as sources of information for Virtual Profiles, use the following commands in global configuration mode:
| Command | Purpose |
|---|---|
Define the virtual template interface as the source of information for Virtual Profiles. | |
Specify AAA as the source of user-specific configuration for Virtual Profiles. |
If you also want to use Per-User Configuration for network protocol access lists or route filters for individual users, see the "Per-User Configuration" chapter of this manual.
You can troubleshoot the Virtual Profiles configuration by using the following commands in EXEC mode:
| Command | Purpose |
|---|---|
debug dialer | Display information about dial calls and negotiations and virtual profile events. |
Display information about the Per-User Configuration downloaded from the AAA server. | |
Display cloning information for a virtual access interface from the time it is cloned from a virtual template to the time it comes down. |
The following sections provide examples for the four cases described in this chapter:
In these examples, BRI 0 is configured for Legacy DDR, and interface BRI 1 is configured for dialer profiles. Note that interface dialer 0 is configured for Legacy DDR. Interface dialer 1 is a dialer profile.
The intention of the examples is to show how to configure Virtual Profiles. In addition, the examples show the interoperability of DDR and dialer profiles in the respective cases with various forms of Virtual Profiles.
The same user names (John and Rick) occur in all these examples. Note the different configuration allowed to them in each of the four examples.
John is a normal user and can dial in to BRI 0 only. Rick is a privileged user who can dial in to BRI 0 and BRI 1. If Rick dials into BRI 1, the dialer profile will be used. If Rick dials into BRI 0, Virtual Profiles will be used. Since John doesn't have a dialer profile, only Virtual Profiles can be applied to him.
In this example, the router is configured for Virtual Profiles by virtual template. (Virtual Profiles does not have any interface-specific AAA configuration.) Comments in the example draw attention to specific features or ignored lines.
In this example, the same virtual template interface applies to both users; they have the same interface configurations.
! Enable AAA on the router. aaa new-model aaa authentication ppp default radius ! The following command is required. aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! ! Specify configuration of Virtual Profiles by virtual template. ! This is the key command for this example. virtual-profile virtual-template 1 ! ! Define the virtual template. interface Virtual-Template 1 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! interface BRI 1 description Connected to 104 encapsulation ppp ! Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR for John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp ! Enable legacy DDR. dialer in-band ! Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! ! ! Configure dialer interface 1 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 ! Disable fast switching. no ip route-cache ppp authentication chap dialer-list 1 protocol ip permit
This example shows the router configuration for Virtual Profiles by AAA and the AAA server configuration for user-specific interface configurations. John and Rick have different IP addresses.
In the AAA configuration cisco-avpair lines, "\n" is used to indicate the start of a new Cisco IOS command line.
john Password = "welcome"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 75\nip address 100.100.100.100 255.255.255.0",
rick Password = "emoclew"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 100\nip address 200.200.200.200 255.255.255.0"
! Enable AAA on the router. aaa new-model aaa authentication ppp default radius ! This is a key command for this example. aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! ! Specify configuration of Virtual Profiles by aaa. ! This is a key command for this example. virtual-profiles aaa ! ! Interface BRI 0 is configured for Legacy DDR. interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! ! Interface BRI 1 is configured for Dialer Profiles. interface BRI 1 description Connected to 104 encapsulation ppp ! Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR for John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp ! Enable legacy DDR. dialer in-band ! Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! ! Configure dialer interface 1 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 ! Disable fast switching. no ip route-cache ppp authentication chap dialer-list 1 protocol ip permit
In this example, Virtual Profiles are configured by both virtual templates and AAA configuration. John and Rick can dial in from anywhere and have their same keepalive settings and their own IP addresses.
The remaining AV-pair settings are not used by Virtual Profiles. They are the network-protocol access lists and route filters used by AAA-based Per-User Configuration.
In the AAA configuration cisco-avpair lines, "\n" is used to indicate the start of a new Cisco IOS command line.
john Password = "welcome"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 75\nip address 100.100.100.100 255.255.255.0",
cisco-avpair = "ip:rte-fltr-out#0=router igrp 60",
cisco-avpair = "ip:rte-fltr-out#3=deny 171.0.0.0 0.255.255.255",
cisco-avpair = "ip:rte-fltr-out#4=deny 172.0.0.0 0.255.255.255",
cisco-avpair = "ip:rte-fltr-out#5=permit any"
rick Password = "emoclew"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 100\nip address 200.200.200.200 255.255.255.0",
cisco-avpair = "ip:inacl#3=permit ip any any precedence immediate",
cisco-avpair = "ip:inacl#4=deny igrp 0.0.1.2 255.255.0.0 any",
cisco-avpair = "ip:outacl#2=permit ip any any precedence immediate",
cisco-avpair = "ip:outacl#3=deny igrp 0.0.9.10 255.255.0.0 any"
! Enable AAA on the router. aaa new-model aaa authentication ppp default radius ! This is a key command for this example. aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! ! Specify use of Virtual Profiles and a virtual template. ! The following two commands are key for this example. virtual-profile virtual-template 1 virtual-profile aaa ! ! Define the virtual template. interface Virtual-Template 1 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! ! Interface BRI 0 is configured for Legacy DDR. interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! ! Interface BRI 1 is configured for Dialer Profiles. interface BRI 1 description Connected to 104 encapsulation ppp ! Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR to dial out to John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp dialer in-band ! Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 ! Disable fast switching. no ip route-cache ppp authentication chap ! dialer-list 1 protocol ip permit
In this case, however, the router is also configured as the VPDN home gateway. It clones the VPDN virtual template interface first, and then clones the Virtual Profiles AAA interface configuration. If Per-User Configuration were configured on this router and the AAA server's users file had network protocol information for the two users, that information would be applied to the virtual access interface last.
In the AAA configuration cisco-avpair lines, "\n" is used to indicate the start of a new Cisco IOS command line.
john Password = "welcome"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 75\nip address 100.100.100.100 255.255.255.0",
rick Password = "emoclew"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 100\nip address 200.200.200.200 255.255.255.0"
!Configure the router as the VPDN home gateway. ! !Enable VPDN and specify the VPDN virtual template to use on incoming calls from the !network access server. vpdn enable vpdn incoming dallas_wan go_blue virtual-template 6 ! !Configure the virtual template interface for VPDN. interface virtual template 6 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! !Enable AAA on the router. aaa new-model aaa authentication ppp default radius aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! !Specify configuration of Virtual Profiles by aaa. virtual-profiles aaa ! !Configure the physical synchronous serial 0 interface. interface Serial 0 description Connected to 101 encapsulation ppp !Disable fast switching. no ip route-cache ppp authentication chap ! !Configure serial interface 1 for DDR. S1 uses dialer rotary group 0, which is !defined on BRI interface 0. interface serial 1 description Connected to 102 encapsulation ppp dialer in-band ! Disable fast switching. no ip route-cache dialer rotary-group 0 ppp authentication chap ! interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! interface BRI 1 description Connected to 104 encapsulation ppp !Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! !Configure dialer interface 0 for DDR to call and receive calls from John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp !Enable legacy DDR. dialer in-band !Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! !Configure dialer interface 1 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 !Disable fast switching. no ip route-cache ppp authentication chap dialer-list 1 protocol ip permit
Posted: Mon May 3 12:38:11 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.