|
|
This chapter describes the commands required to configure virtual private dialup networks. For information about configuring this feature, see the "Configuring Virtual Private Dialup Networks" chapter of the Dial Solutions Configuration Guide.
To clear the content of the failure history table, use the clear vpdn history failure EXEC command.
clear vpdn history failureThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 11.3 T.
The following example clears the content of the failure history table:
clear vpdn history failure
To shut down a specified tunnel and all the MIDs within it, use the clear vpdn tunnel EXEC command.
clear vpdn tunnel network-access-server gateway-name
network-access-server | Name of the network access server at the far end of the tunnel, probably the point of presence of the public data network or the Internet Service Provider's. |
gateway-name | Host name of home gateway at the local end of the tunnel. |
EXEC
This command first appeared in Cisco IOS Release 11.2.
This command is used primarily for troubleshooting. You can use the command to force the tunnel to come down without unconfiguring it (the tunnel could be restarted immediately by a user logging in).
The following example clears a tunnel between a network access server called orion and a home gateway called sampson:
clear vpdn tunnel orion sampson
To display information about active Level 2 Forwarding (L2F) protocol tunnel and Level 2 Forwarding (L2F) message identifiers in a virtual private dialup network, use the show vpdn EXEC command.
show vpdnThis command has no keywords or arguments.
EXEC
This command first appeared in Cisco IOS Release 11.2.
The following is sample output of the show vpdn command:
Router# show vpdn Active L2F tunnels NAS Name Gateway Name NAS CLID Gateway CLID State nas gateway 4 2 open L2F MIDs Name NAS Name Interface MID State phil@cisco.com nas As7 1 open sam@cisco.com nas As8 2 open
Table 139 describes the fields in this sample display.
| Field | Description |
|---|---|
| Active L2F tunnels |
|
NAS Name | Host name of the network access server, which is the remote termination point of the tunnel. |
Gateway Name | Host name of the home gateway, which is local termination point of the tunnel. |
NAS CLID | A number uniquely identifying the VPDN tunnel on the network access server. |
Gateway CLID | A number uniquely identifying the VPDN tunnel on the gateway |
State | Indicates whether the tunnel is open, opening, closing, or closed. |
| L2F MIDs |
|
Name | Username of the person from whom a protocol message was forwarded over the tunnel. |
NAS Name | Host name of the network access server. |
Interface | Interface from which the protocol message was sent. |
MID | A number uniquely identifying this user in this tunnel. |
State | Indicates status for the individual user in the tunnel. The states are: opening, open, closed, closing, and waiting_for_tunnel. The waiting_for_tunnel state means that the user connection is waiting until the main tunnel can be brought up before it moves to the opening state. |
You can use the master indexes or search online to find documentation of related commands.
vpdn enable
vpdn history failure table-size
vpdn logging history failure
To show the content of the failure history table, use the show vpdn history failure with the optional username keyword EXEC command.
show vpdn history failure [username]
username | (Optional) Specifies the username. The specified username helps to display only the entries mapped to that particular user. |
EXEC
This command first appeared in Cisco IOS Release 11.3 T.
If a username is specified, only the entries mapped to that username are displayed; when the username is not specified, the whole table is displayed.
The following is a sample output from the show vpdn history failure command, which displays the failure history table for a specific user:
router> show vpdn history failureTable size: 20 Number of entries in table: 1 User: jcchan@cisco.com, MID = 1 NAS: isp, IP address = 172.21.9.25, CLID = 1 Gateway: hp-gw, IP address = 172.21.9.15, CLID = 1 Log time: 13:08:02, Error repeat count: 1 Failure type: The remote server closed this session Failure reason: Administrative intervention
Table 140 describes the fields shown in the sample output.
| Field | Description |
|---|---|
Table size | Configurable VPDN history table size. |
Number of entries in table | Number of entries currently in the history table. |
User | Username for the entry displayed. |
MID | VPDN user session ID that correlates to the logged event. The MID is a unique ID per user session. |
NAS | Network access server identity. |
IP address | IP address of the NAS or home gateway (HGW). |
CLID | Tunnel endpoint for the NAS and HGW. |
Gateway | HGW end of the VPDN tunnel. |
Log time | The event logged time. |
Error repeat count | Number of times a failure entry has been logged under a specific user. Only one log entry is allowed per user and is unique to its MID, with the older one being overwritten. |
Failure type | Description of failure. |
Failure reason | Reason for failure. |
You can use the master indexes or search online to find documentatin of related commands.
To specify the characters to be use to delimit the domain prefix or domain suffix, use the vpdn domain-delimiter global configuration command.
vpdn domain-delimiter characters [suffix | prefix]
characters | One or more specific characters to be used as suffix or prefix delimiters. Available characters are %, -, @, \ , #, and /. If a backslash (\) is the last delimiter in the command line, enter it as a double backslash (\\). |
suffix | prefix | (Optional) Usage of the specified characters. |
This command is disabled.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
You can enter one vpdn domain-delimiter command to list the suffix delimiters and another vpdn domain-delimiter command to list the prefix delimiters. However, no character can be both a suffix delimiter and a prefix delimiter.
This command allows the network access server to parse a list of home gateway DNS domain names and addresses sent by an AAA server. The AAA server can store domain names or IP addresses in the following AV pair:
cisco-avpair = "lcp:interface-config=ip address 1.1.1.1 255.255.255.255.0",
cisco-avpair = "lcp:interface-config=ip address bigrouter@excellentinc.com,
The following example lists three suffix delimiters and three prefix delimiters:
vpdn domain-delimiter %-@ suffix vpdn domain-delimiter #/\\ prefix
This example allows the following host and domain names:
cisco.com#houstonddr houstonddr@cisco.com
You can use the master indexes or search online to find documentation of related commands.
vpdn enable
vpdn history failure table-size
vpdn logging history failure
vpdn search-order
To enable virtual private dialup networking on the router and inform the router to look for tunnel definitions in a local database and on a remote authorization server (home gateway), if one is present, use the vpdn enable global configuration command.
vpdn enableThis command has no keywords or arguments.
Disabled
Global configuration
This command first appeared in Cisco IOS Release 11.2.
The following example enables virtual private dialup networking on the router:
vpdn enable
You can use the master indexes or search online to find documentation of related commands.
vpdn history failure table-size
vpdn logging history failure
To cause the home gateway to issue its own CHAP challenge even if one has already been issued from the network access server, use the vpdn force-local-chap global configuration command. To disable the home gateway's issuing its own CHAP challenge, use the no form of this command.
vpdn force-local-chapThis command has no arguments or keywords.
The home gateway does not issue its own CHAP challenge.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
The following example configures a virtual template interface on the home gateway and then enables VPDN and forces the home gateway to issue its own CHAP challenge.
interface virtual-template 1 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! vpdn enable vpdn incoming world12 troll virtual-template 1 vpdn force-local-chap
To set the failure history table depth, use the vpdn history failure table-size global configuration command.
vpdn history failure table-size entries
entries | Defines the number of entries. Valid entries are 20 to 50. |
20 entries
Global configuration
This command first appeared in Cisco IOS Release 11.3 T.
The logging of a failure history event is triggered by event logging by the Syslog facility. The Syslog facility creates a failure history table entry, which keeps records of failure events. The table starts with 20 entries and the size of the table can be expanded to a maximum of 50 entries.
All failure entries for the user are kept chronologically in the history table. Each entry records the relevant information of a failure event. Only the most recent failure event per user, unique to its name and tunnel client ID (CLID), is kept.
When the total number of entries in the table reaches the configured table size, the oldest record is deleted and a new entry is added.
The following example sets the history failure table size to 40 entries:
vpdn history failure table-size 40
To specify the local name to use for authenticating and the virtual template to use for building interfaces for incoming connections when a Level 2 Forwarding (tunnel) connection is requested from a certain remote host, use the vpdn incoming global configuration command.
vpdn incoming remote-name local-name virtual-template number
remote-name | Case-sensitive name of the remote host requesting the connection. |
local-name | Case-sensitive local name to use when authenticating back to the remote host. |
virtual-template number | Virtual template to use for building interfaces for incoming calls. |
Disabled. No host name, IP address, or local name for authentication are provided.
Global configuration
This command first appeared in Cisco IOS Release 11.2.
The remote-name and local-name arguments are case sensitive.
This command is usually used on a home gateway, not on the network access server in the ISP or public data network.
The following partial example specifies use of local host go_blue and virtual template interface 6 for connections with remote host dallas_wan:
vpdn incoming dallas_wan go_blue virtual-template 6
To enable local authentication of users on the network access server before the connection is forwarded to the home gateway, use the vpdn local-authentication global configuration command. To reset the network access server to the default in which local authentication is disabled, use the no form of this command.
vpdn local-authenticationThis command has no arguments and keywords.
This command is disabled.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
The following example configures the network access server to select tunnels based on the dialed number of incoming calls and to authenticate users locally:
vpdn enable vpdn outgoing dnis 4592367 spartan ip 172.34.16.244 vpdn local-authentication
You can use the master indexes or search online for documentation of related commands.
vpdn enable
vpdn outgoing
To enable the logging of VPDN events, use the vpdn logging global configuration command. To disable the logging of VPDN events, use the no form of this command.
vpdn logging [local | remote]
local | (Optional) Log VPDN events locally. |
remote | (Optional) Log VPDN events to a remote tunnel endpoint. |
Enabled
Global configuration
This command first appeared in Cisco IOS Release 11.3 T.
This command logs VPDN events. By default, VPDN logging is enabled; therefore, if you wish to disable VPDN event logging, you must explicitly configure the router using the no form of the command.
The default behavior is to log VPDN events; however, if you wish to reenable the feature after removal, the following example shows how to reenable VPDN logging locally:
vpdn logging local
You can use the master indexes or search online for documentation of related commands.
vpdn logging history failure
To enable the logging of failure events to the failure history table, use the vpdn logging history failure global configuration command. To disable the logging of failure events, use the no form of this command.
vpdn logging history failureThis command has no arguments or keywords.
Enabled
Global configuration
This command first appeared in Cisco IOS Release 11.3 T.
The default behavior is to enable logging of VPDN history failures; however, if you wish to reenable the feature after removal, the following example shows how to reenable the logging of history failures:
vpdn logging history failure
You can use the master indexes or search online to find documentation of related commands.
show vpdn history failure
To specify use of Dialed Number Information Service (DNIS) or use of a domain name when selecting a tunnel for forwarding traffic to the remote host (the home gateway) on a virtual private dialup network, use the vpdn outgoing global configuration command.
vpdn outgoing {dnis dialed-number | domain-name} local-name ip ip-address
dnis dialed-number | Dialed number to be used for selecting a specific tunnel to be used for forwarding traffic to a home gateway. |
domain-name | Case-sensitive name of the domain to forward traffic to. |
local-name | Case-sensitive local name to use when authenticating the tunnel to the remote host. |
ip ip-address | IP address of the remote host (home gateway). |
Disabled. No remote names and local names are defined.
Global configuration
This command first appeared in Cisco IOS Release 11.2
The domain-name and local-name arguments are case sensitive.
This command is usually used on a network access server, not on a home gateway.
When use of the Dialed Number Information Service is enabled and a dialed number is provided, the network service provider can use the dialed number to select a specific tunnel destination.
The domain name can be used to choose a tunnel destination. For example, if a user dials in as "joe@company-a.com," then matching on "company-a.com," a tunnel destination can be chosen.
If both DNIS information and a CHAP or PAP name map to a valid tunnel, the DNIS information is used.
If TACACS+ is used to get tunnel information, the string "dnis:" is prepended to the phone number before attempting to look up the information in AAA.
The following example selects a tunnel destination based on the domain name:
vpdn outgoing chicago-main go-blue ip 172.17.33.125
The following example selects a tunnel destination based on the use of DNIS and a specific dialed number:
vpdn outgoing dnis 2387765 gocardinal ip 170.16.44.56
You can use the master indexes or search online to find documentation of related commands.
vpdn enable
vpdn history failure table-size
To specify how the service provider's network access server is to perform VPDN tunnel authorization searches, use the vpdn search-order global configuration command. To remove a prior specification, use the no form of the command.
vpdn search-order {dnis domain | domain dnis | domain | dnis}
dnis domain | Search first on the Dialed Number Information Service (DNIS) information provided on ISDN lines and then search on the domain name. |
domain dnis | Search first on the domain name and then search on the DNIS information. |
domain | Search on the domain name only. |
dnis | Search on the DNIS information only. |
When this command is not used, the default is to search first on the Dialed Number Information Service (DNIS) information provided on ISDN lines and then search on the domain name. This is equivalent to using the vpdn search-order dnis domain command.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
VPDN authorization searches are performed only as specified.
The configuration shows the vpdn search-order command setting only if the command is explicitly configured.
The following example configures a network access server to select a tunnel destination based on the use of DNIS and a specific dialed number and to perform tunnel authorization searches based on the DNIS information only.
vpdn enable vpdn outgoing dnis 2387765 gocardinal ip 170.16.44.56 vpdn search-order dnis
You can use the master indexes or search online to find documentation of related commands.
vpdn outgoing
To set the source IP address of the network access server, use the vpdn source-ip global configuration command.
vpdn source-ip address
address | IP address of the network access server. |
This command is disabled. No default IP address is provided.
Global configuration
This command first appeared in Cisco IOS Release 11.3.
One source IP address is configured on the network access server. The source IP address is configured per network access server, not per domain.
This example enables VPDN on the network access server and sets an IP source address of 171.4.48.3.
vpdn enable vpdn source-ip 171.4.48.3
You can use the master indexes or search online for documentation of related commands.
vpdn enable
Posted: Tue Apr 27 11:05:38 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.