|
|
This chapter describes how to configure virtual profiles for use with virtual access interfaces. It includes the following main sections:
Virtual profiles run on all Cisco IOS platforms that support Multilink PPP (MLP).
We recommend that unnumbered addresses be used in virtual template interfaces to ensure that duplicate network addresses are not created on virtual access interfaces.
Virtual profiles interoperate with Cisco dial-on-demand routing (DDR), MLP, and dialers such as ISDN.
For a complete description of the commands mentioned in this chapter, see the Cisco IOS Dial Services Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
A virtual profile is a unique application that can create and configure a virtual access interface dynamically when a dial-in call is received, and tear down the interface dynamically when the call ends. Virtual profiles support these encapsulation methods:
Any commands for these encapsulations that can be configured under a serial interface can be configured under a virtual profile stored in a user file on an authentication, authorization, and accounting (AAA) server and a virtual profile virtual template configured locally. The AAA server daemon downloads them as text to the network access server, and is able to handle multiple download attempts.
The configuration information for a virtual profiles virtual access interface can come from a virtual template interface, or from user-specific configuration stored on a AAA server, or both.
If a B interface is bound by the calling line identification (CLID) to a created virtual access interface cloned from a virtual profile or a virtual template interface, only the configuration from the virtual profile or the virtual template takes effect. The configuration on the D interface is ignored unless successful binding occurs by PPP name. Both the link and network protocols run on the virtual access interface instead of the B channel, unless the encapsulation is PPP.
Moreover, in previous releases of the Cisco IOS software, downloading a profile from an AAA server and creating and cloning a virtual access interface was always done after the PPP call answer and link control protocol (LCP) up processes. The AAA download is part of authorization. But in the current release, these operations must be performed before the call is answered and the link protocol goes up. This restriction is a new AAA nonauthenticated authorization step. The virtual profile code handles multiple download attempts, and identifies whether a virtual access interface was cloned from a downloaded virtual profile.
When a successful download is done through nonauthenticated authorization, and the configuration on the virtual profile has encapsulation PPP and PPP authentication, authentication is negotiated as a separate step after LCP comes up.
The per-user configuration feature also uses configuration information gained from a AAA server. However, per-user configuration uses network configurations (such as access lists and route filters) downloaded during Network Control Protocol (NCP) negotiations.
Two rules govern virtual access interface configuration by virtual profiles virtual template interfaces and AAA configurations:
See the section "How Virtual Profiles WorkFour Configuration Cases" for a description of the possible configuration sequences for configuration by virtual template or AAA or both. See the section "Multilink PPP Effect on Virtual Access Interface Configuration" for a description of the possible configuration sequences that depend on the presence or absence by MLP or another virtual access feature that clones a virtual template interface.
Virtual profiles fully interoperate with physical interfaces in the following DDR configuration states when no other virtual access interface application is configured:
 |
Note If a dialer interface is used (including any ISDN dialer), its configuration is used on the physical interface instead of the virtual profiles configuration. |
As shown in Table 4, exactly how a virtual access interface will be configured depends on the following three factors:
In Table 4, "(Multilink VT)" means that a virtual template interface is cloned if one is defined for MLP or a virtual access feature that uses MLP.
| Virtual Profiles Configuration | MLP No Dialer | MLP Dialer | No MLP No Dialer | No MLP Dialer |
|---|---|---|---|---|
VP VT only | VP VT | VP VT | VP VT | VP VT |
VP AAA only | (Multilink VT) | (Multilink VT) | VP AAA | VP AAA |
VP VT and VP AAA | VP VT | VP VT | VP VT | VP VT |
No VP at all | (Multilink VT)1 | Dialer2 | No virtual access interface is created. | No virtual access interface is created. |
The order of items in any cell of the table is important. Where VP VT is shown above VP AAA, it means that first the virtual profile virtual template is cloned on the interface, and then the AAA interface configuration for the user is applied to it. The user-specific AAA interface configuration adds to the configuration and overrides any conflicting physical interface or virtual template configuration commands.
Virtual profiles also interoperate with virtual access applications that clone a virtual template interface. Each virtual access application can have at most one template to clone from but can clone from multiple AAA configurations.
The interaction between virtual profiles and other virtual template applications is as follows:
This section describes virtual profiles and the various ways they can work with virtual template interfaces, user-specific AAA interface configuration, and MLP or another feature that requires MLP.
Virtual profiles separate configuration information into two logical parts:
These logical parts can be used separately or together. Four separate cases are possible:
|
Note All cases assume that AAA is configured globally on the router, the user has configuration information in the user file on the AAA server, PPP authentication and authorization proceed as usual, and the AAA server sends user-specific configuration information in the authorization approval response packet to the router. The cases also assume that AAA works as designed and the AAA server sends configuration information for the dial-in user to the router, even when virtual profiles by virtual template are configured. |
See the sections "Virtual Profiles Configured by Virtual Templates," "Virtual Profiles Configured by AAA Configuration," "Virtual Profiles Configured by Virtual Templates and AAA Configuration," and "Virtual Profiles Configured by AAA Plus a VPDN Virtual Template on a VPDN Home Gateway" later in this chapter for examples of how to configure these cases.
In the case of virtual profiles by virtual template, the software functions as follows:
Then the router interprets the lines in the AAA authorization approval response from the server as Cisco IOS commands to apply to the virtual profile for the user.
Data flows through the virtual profile, and the higher layers treat it as the interface for the user.
For example, if a virtual template included only the three commands ip unnumbered ethernet 0, encapsulation ppp, and ppp authentication chap, the virtual profile for any dial-in user would include those three commands.
In Figure 6, the dotted box represents the virtual profile configured with the commands that are in the virtual template, no matter which interface the call arrives on.
See the section "Configuring Virtual Profiles by Virtual Template" later in this chapter for configuration tasks for this case.
In this case, no dialer profile (a DDR feature) is defined for the specific user and no virtual template for virtual profiles is defined, but virtual profiles by AAA are enabled on the router.
During the PPP authorization phase for the user, the AAA server responds as usual to the router. The authorization approval contains configuration information for the user. The router interprets each of the lines in the AAA response from the server as Cisco IOS commands to apply to the virtual profile for the user.
The router applies all the user-specific interface commands received from the AAA server.
Suppose, for example, that the router interpreted the response by the AAA server as including only the following two commands for this user:
ip address 10.10.10.10 255.255.255.255 keepalive 30
In Figure 7, the dotted box represents the virtual profile configured only with the commands received from the AAA server, no matter which interface the incoming call arrived on. On the AAA RADIUS server, the attribute-value (AV) pair might have read as follows, where "\n" means to start a new command line:
cisco-avpair = "lcp:interface-config=ip address 10.10.10.10 255.255.255.0\nkeepalive 30",
See the section "Configuring Virtual Profiles by AAA Configuration" later in this chapter for configuration tasks for this case.
The router performs the following tasks in order:
1. Dynamically creates a virtual access interface cloned from the virtual template defined for virtual profiles.
2. Applies the user-specific interface configuration received from the AAA server.
If any command in the user's configuration conflicts with a command on the original interface or a command applied by cloning the virtual template, the user-specific command overrides the other command.
Suppose that the router had the virtual template as defined in Case 1 and the AAA user configuration as defined in Case 2. In Figure 8 the dotted box represents the virtual profile configured with configuration information from both sources, no matter which interface the incoming call arrived on. The ip address command has overridden the ip unnumbered command.
See the section "Configuring Virtual Profiles by Both Virtual Template and AAA Configuration" later in this chapter for configuration tasks for this case.
The router performs the following tasks in order:
1. Dynamically creates a virtual access interface and clones the virtual template from the other virtual access application onto it.
2. Applies the user-specific interface configuration received from the AAA server.
If any command in the virtual template conflicts with a command on the original interface, the template overrides it.
If any command in the AAA interface configuration for the user conflicts with a command in the virtual template, the user AAA interface configuration conflicts will override the virtual template.
If per-user configuration is also configured on the AAA server, that network protocol configuration is applied to the virtual access interface last.
The result is a virtual interface unique to that user.
To configure virtual profiles for dial-in users, perform the tasks in one of the first three sections and then troubleshoot the configuration by performing the tasks in the last section:
|
Note Do not define a DDR dialer profile for a user if you intend to define virtual profiles for the user. |
See the section "Virtual Profiles Configuration Examples" at the end of this chapter for examples of how to use virtual profiles in your network configuration.
To configure virtual profiles by virtual template, complete these two tasks:
|
Note The order in which these tasks is performed is not crucial. However, both tasks must be completed before virtual profiles are used. |
To create and configure a virtual template interface, use the following commands beginning in global configuration mode:
| Command | Purpose | |
|---|---|---|
Step 1 | interface virtual-template number | Creates a virtual template interface, and enters interface configuration mode. |
Step2 | ip unnumbered ethernet 0 | Enables IP without assigning a specific IP address on the LAN. |
Step3 | encapsulation ppp | Enables PPP encapsulation on the virtual template interface. |
Other optional PPP configuration commands can be added to the virtual template configuration. For example, you can add the ppp authentication chap command.
To specify a virtual template interface as the source of information for virtual profiles, use the following command in global configuration mode:
| Command | Purpose |
|---|---|
virtual-pr ofile virtual-template number | Specifies the virtual template interface as the source of information for virtual profiles. |
Virtual template numbers range from 1 to 25.
To configure virtual profiles by AAA only, complete these three tasks in any order. All tasks must be completed before virtual profiles are used.
To specify AAA as the source of information for virtual profiles, use the following command in global configuration mode:
| Command | Purpose |
|---|---|
virtual-profile aaa | Specifies AAA as the source of user-specific interface configuration. |
If you also want to use per-user configuration for network protocol access lists or route filters for individual users, see the chapter "Configuring Per-User Configuration" in this publication. In this case, no virtual template interface is defined for virtual profiles.
Use of user-specific AAA interface configuration information with virtual profiles requires the router to be configured for AAA and requires the AAA server to have user-specific interface configuration AV-pairs. The relevant AV-pairs (on a RADIUS server) begin as follows:
cisco-avpair = "lcp:interface-config=...",
The information that follows the equal sign (=) could be any Cisco IOS interface configuration command. For example, the line might be the following:
cisco-avpair = "lcp:interface-config=ip address 200.200.200.200 255.255.255.0",
Use of a virtual template interface with virtual profiles requires a virtual template to be defined specifically for virtual profiles.
To configure virtual profiles by both virtual template interface and AAA configuration, complete the following tasks in any order. All tasks must be completed before virtual profiles are used.
To create and configure a virtual template interface, use the following commands beginning in global configuration mode:
| Command | Purpose | |
|---|---|---|
Step1 | interface virtual-template number | Creates a virtual template interface, and enter interface configuration mode. |
Step2 | ip unnumbered ethernet 0 | Enables IP without assigning a specific IP address on the LAN. |
Step3 | encapsulation ppp | Enables PPP encapsulation on the virtual template interface. |
Because the software treats a virtual template interface as a serial interface, all the configuration commands that apply to serial interfaces can also be applied to virtual template interfaces, except shutdown and dialer commands. Other optional PPP configuration commands can also be added to the virtual template configuration. For example, you can add the ppp authentication chap command.
To specify both the virtual template interface and the AAA per-user configuration as sources of information for virtual profiles, use the following commands in global configuration mode:
| Command | Purpose | |
|---|---|---|
Step1 | virtual-profile virtual-template number | Defines the virtual template interface as the source of information for virtual profiles. |
Step2 | virtual-profile aaa | Specifies AAA as the source of user-specific configuration for virtual profiles. |
If you also want to use per-user configuration for network protocol access lists or route filters for individual users, see the chapter "Configuring per-User Configuration" in this publication.
To troubleshoot the virtual profiles configurations, use any of the following debug commands in EXEC mode:
| Command | Purpose |
|---|---|
debug dialer | Displays information about dial calls and negotiations and virtual profile events. |
debug aaa per-user | Displays information about the per-user configuration downloaded from the AAA server. |
debug vtemplate | Displays cloning information for a virtual access interface from the time it is cloned from a virtual template to the time it comes down. |
The following sections provide examples for the four cases described in this chapter:
In these examples, BRI 0 is configured for legacy DDR, and interface BRI 1 is configured for dialer profiles. Note that interface dialer 0 is configured for legacy DDR. Interface dialer 1 is a dialer profile.
The intention of the examples is to show how to configure virtual profiles. In addition, the examples show the interoperability of DDR and dialer profiles in the respective cases with various forms of virtual profiles.
The same user names (John and Rick) occur in all these examples. Note the different configuration allowed to them in each of the four examples.
John is a normal user and can dial in to BRI 0 only. Rick is a privileged user who can dial in to BRI0 and BRI 1. If Rick dials into BRI 1, the dialer profile will be used. If Rick dials into BRI 0, virtual profiles will be used. Because John does not have a dialer profile, only virtual profiles can be applied to John.
To see an example of a configuration using virtual profiles and the Dynamic Multiple Encapsulations feature, see the "Multiple Encapsulations over ISDN" example in the chapter "Configuring Peer-to-Peer DDR with Dialer Profiles" in the Cisco IOS Dial Services Configuration Guide: Terminal Services publication.
The following examples show a router configured for virtual profiles by virtual template. (Virtual profiles do not have any interface-specific AAA configuration.) Comments in the example draw attention to specific features or ignored lines.
In this example, the same virtual template interface applies to both users; they have the same interface configurations.
Router Configuration
! Enable AAA on the router. aaa new-model aaa authentication ppp default radius ! The following command is required. aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! ! Specify configuration of virtual profiles by virtual template. ! This is the key command for this example. virtual-profile virtual-template 1 ! ! Define the virtual template. interface Virtual-Template 1 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! switch-type basic-dms100 interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! interface BRI 1 description Connected to 104 encapsulation ppp ! Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR for John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp ! Enable legacy DDR. dialer in-band ! Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! ! Configure dialer interface 1 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 ! Disable fast switching. no ip route-cache ppp authentication chap dialer-list 1 protocol ip permit
The following example shows the router configuration for virtual profiles by AAA and the AAA server configuration for user-specific interface configurations. John and Rick have different IP addresses.
In the AAA configuration cisco-avpair lines, "\n" is used to indicate the start of a new Cisco IOS command line.
AAA Configuration for John and Rick
john Password = "welcome"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 75\nip address 100.100.100.100 255.255.255.0",
rick Password = "emoclew"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 100\nip address 200.200.200.200 255.255.255.0"
Router Configuration
! Enable AAA on the router. aaa new-model aaa authentication ppp default radius ! This is a key command for this example. aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! ! Specify configuration of virtual profiles by aaa. ! This is a key command for this example. virtual-profiles aaa ! ! Interface BRI 0 is configured for legacy DDR. interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! ! Interface BRI 1 is configured for dialer profiles. interface BRI 1 description Connected to 104 encapsulation ppp ! Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR for John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp ! Enable legacy DDR. dialer in-band ! Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! ! Configure dialer interface 1 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 ! Disable fast switching. no ip route-cache ppp authentication chap dialer-list 1 protocol ip permit
The following example shows how virtual profiles can be configured by both virtual templates and AAA configuration. John and Rick can dial in from anywhere and have their same keepalive settings and their own IP addresses.
The remaining AV-pair settings are not used by virtual profiles. They are the network protocol access lists and route filters used by AAA-based per-user configuration.
In the AAA configuration cisco-avpair lines, "\n" is used to indicate the start of a new Cisco IOS command line.
AAA Configuration for John and Rick
john Password = "welcome"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 75\nip address 100.100.100.100 255.255.255.0",
cisco-avpair = "ip:rte-fltr-out#0=router igrp 60",
cisco-avpair = "ip:rte-fltr-out#3=deny 171.0.0.0 0.255.255.255",
cisco-avpair = "ip:rte-fltr-out#4=deny 172.0.0.0 0.255.255.255",
cisco-avpair = "ip:rte-fltr-out#5=permit any"
rick Password = "emoclew"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 100\nip address 200.200.200.200 255.255.255.0",
cisco-avpair = "ip:inacl#3=permit ip any any precedence immediate",
cisco-avpair = "ip:inacl#4=deny igrp 0.0.1.2 255.255.0.0 any",
cisco-avpair = "ip:outacl#2=permit ip any any precedence immediate",
cisco-avpair = "ip:outacl#3=deny igrp 0.0.9.10 255.255.0.0 any"
Router Configuration
! Enable AAA on the router. aaa new-model aaa authentication ppp default radius ! This is a key command for this example. aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! ! Specify use of virtual profiles and a virtual template. ! The following two commands are key for this example. virtual-profile virtual-template 1 virtual-profile aaa ! ! Define the virtual template. interface Virtual-Template 1 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! ! Interface BRI 0 is configured for legacy DDR. interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! ! Interface BRI 1 is configured for dialer profiles. interface BRI 1 description Connected to 104 encapsulation ppp ! Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR to dial out to John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp dialer in-band ! Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! ! Configure dialer interface 0 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 ! Disable fast switching. no ip route-cache ppp authentication chap ! dialer-list 1 protocol ip permit
In this case, however, the router is also configured as the VPDN home gateway. It clones the VPDN virtual template interface first, and then clones the virtual profiles AAA interface configuration. If per-user configuration were configured on this router and the user file on the AAA server had network protocol information for the two users, that information would be applied to the virtual access interface last.
In the AAA configuration cisco-avpair lines, "\n" is used to indicate the start of a new Cisco IOS command line.
AAA Configuration for John and Rick
john Password = "welcome"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 75\nip address 100.100.100.100 255.255.255.0",
rick Password = "emoclew"
User-Service-Type = Framed-User,
Framed-Protocol = PPP,
cisco-avpair = "lcp:interface-config=keepalive 100\nip address 200.200.200.200 255.255.255.0"
Router Configuration
!Configure the router as the VPDN home gateway. ! !Enable VPDN and specify the VPDN virtual template to use on incoming calls from the !network access server. vpdn enable vpdn incoming dallas_wan go_blue virtual-template 6 ! !Configure the virtual template interface for VPDN. interface virtual template 6 ip unnumbered ethernet 0 encapsulation ppp ppp authentication chap ! !Enable AAA on the router. aaa new-model aaa authentication ppp default radius aaa authorization network radius enable secret 5 $1$koOn$/1QAylov6JFAElxRCrL.o/ enable password lab ! !Specify configuration of virtual profiles by aaa. virtual-profiles aaa ! !Configure the physical synchronous serial 0 interface. interface Serial 0 description Connected to 101 encapsulation ppp !Disable fast switching. no ip route-cache ppp authentication chap ! !Configure serial interface 1 for DDR. S1 uses dialer rotary group 0, which is !defined on BRI interface 0. interface serial 1 description Connected to 102 encapsulation ppp dialer in-band ! Disable fast switching. no ip route-cache dialer rotary-group 0 ppp authentication chap ! interface BRI 0 description Connected to 103 encapsulation ppp no ip route-cache dialer rotary-group 0 ppp authentication chap ! interface BRI 1 description Connected to 104 encapsulation ppp !Disable fast switching. no ip route-cache dialer pool-member 1 ppp authentication chap ! !Configure dialer interface 0 for DDR to call and receive calls from John and Rick. interface dialer 0 ip address 1.1.1.1 255.255.255.0 encapsulation ppp !Enable legacy DDR. dialer in-band !Disable fast switching. no ip route-cache dialer map ip 1.1.1.2 name john 1111 dialer map ip 1.1.1.3 name rick 2222 dialer-group 1 ppp authentication chap ! !Configure dialer interface 1 for DDR to dial out to Rick. interface dialer 1 ip address 2.2.2.2 255.255.255.0 encapsulation ppp dialer remote-name rick dialer string 3333 dialer pool 1 dialer-group 1 !Disable fast switching. no ip route-cache ppp authentication chap dialer-list 1 protocol ip permit
Posted: Tue Jul 18 15:14:06 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.