This documentation has been moved
Configuring Multihop VPDN
Downloads: This chapterpdf (PDF - 204.0KB) The complete bookPDF (PDF - 2.05MB) | Feedback

Configuring Multihop VPDN

Table Of Contents

Configuring Multihop VPDN

Finding Feature Information

Contents

Prerequisites for Multihop VPDN

Restrictions for Multihop VPDN

Information About Multihop VPDN

Tunnel Switching Using Multihop VPDN

How to Configure Multihop VPDN

Configuring a Multihop Tunnel Switch

Prerequisites for Configuring a Multihop Tunnel Switch

Enabling Multihop VPDN on the Tunnel Switch

Configuring the Multihop Tunnel Switch to Terminate Incoming VPDN Tunnels

Configuring the Multihop Tunnel Switch to Initiate Outgoing VPDN Tunnels

Configuration Examples for Multihop VPDN

Example: Configuring Multihop VPDN Tunnel Switching

Where to Go Next

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Multihop VPDN


Configuring Multihop VPDN


First Published: September 26, 2005
Last Updated: June 8, 2010

Multihop virtual private dialup networking (VPDN) is a specialized VPDN configuration that allows packets to pass through multiple tunnels. Ordinarily, packets are not allowed to pass through more than one tunnel. In a multihop deployment, the VPDN tunnel is terminated after each hop and a new tunnel is initiated to the next hop destination.

Multihop VPDN deployments can also be used to configure a device as a tunnel switch. A tunnel switch acts as both a network access server (NAS) and a tunnel server, able to receive packets from an incoming VPDN tunnel and send them out over an outgoing VPDN tunnel. Tunnel switch configurations can be used between Internet service providers (ISPs) to provide wholesale VPDN services.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Multihop VPDN" section.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

Prerequisites for Multihop VPDN

Restrictions for Multihop VPDN

Information About Multihop VPDN

How to Configure Multihop VPDN

Configuration Examples for Multihop VPDN

Where to Go Next

Additional References

Feature Information for Multihop VPDN

Prerequisites for Multihop VPDN

Before you configure multihop VPDN, a VPDN deployment must be configured. For more information about VPDN deployments that are compatible with multihop VPDN scenarios, see the "Configuring a Multihop Tunnel Switch" section.

Restrictions for Multihop VPDN

Only the Layer 2 Tunneling Protocol (L2TP) is supported on the Cisco ASR 1000 Series Aggregation Services Routers.

Information About Multihop VPDN

Multihop VPDN allows packets to pass through multiple tunnels. Ordinarily, packets are not allowed to pass through more than one tunnel. In a multihop deployment, the VPDN tunnel is terminated after each hop and a new tunnel is initiated to the next hop destination. A maximum of four hops is supported on the Cisco ASR 1000 Series Aggregation Services Routers.

This section contains information about multihop VPDN deployments:

Tunnel Switching Using Multihop VPDN

Tunnel Switching Using Multihop VPDN

Multihop VPDN can be used to configure a device as a tunnel switch. A tunnel switch acts as both a NAS and a tunnel server, receiving packets from an incoming VPDN tunnel and sending them out over an outgoing VPDN tunnel. Tunnel switch configurations can be used between ISPs to provide wholesale VPDN services. A VPDN tunnel switch on the Cisco ASR 1000 Series Aggregation Services Routers can forward L2TP sessions. L2F or Point-to-Point Tunneling Protocol (PPTP) are not supported.

In an L2TP tunnel switching deployment, the tunnel endpoints are considered the originating NAS and the terminating tunnel server. The tunnel switch is not considered a tunnel endpoint.

Figure 1 shows a network scenario using a basic L2TP tunnel switching deployment.

Figure 1 Tunnel Switching Using Multihop VPDN

The tunnel switch can be configured to terminate incoming VPDN tunnels from multiple devices, and to initiate outgoing VPDN tunnels to one or more tunnel servers.

The Subscriber Service Switch (SSS) framework is supported for VPDN tunnel switching. SSS supports additional Layer 2 protocols, including PPP over Ethernet (PPPoE) and generic routing encapsulation (GRE). Configuring SSS for VPDN tunnel switching is optional. SSS profiles increase the scalability of tunnel switching configurations, particularly in multiprotocol environments.

How to Configure Multihop VPDN

Configuring a Multihop Tunnel Switch (optional)

Configuring a Multihop Tunnel Switch

Multihop VPDN can be used to configure a device as a tunnel switch. A tunnel switch acts as both a NAS and a tunnel server, and must be configured with both a NAS VPDN group and a tunnel server VPDN group.

Tunnel switching using the SSS infrastructure is supported. SSS allows L2TP, L2F, PPTP, PPPoE, PPPoA, GRE, and general packet radio service (GPRS) sessions to be switched over virtual links using a tunnel switch. SSS configurations are not required for tunnel switching data over L2TP, L2F, or PPTP tunnels, but SSS increases the scalability of tunnel switching deployments.


Note On the Cisco ASR 1000 Series Aggregation Services Router, a multihop VPDN tunnel switch can be configured to forward L2TP tunnels only.


Perform these tasks to configure a device as a multihop VPDN tunnel switch:

Enabling Multihop VPDN on the Tunnel Switch (required)

Configuring the Multihop Tunnel Switch to Terminate Incoming VPDN Tunnels (required)

Configuring the Multihop Tunnel Switch to Initiate Outgoing VPDN Tunnels (required)

Prerequisites for Configuring a Multihop Tunnel Switch

The tunnel endpoints must be configured for VPDN tunneling as described in the Configuring NAS-Initiated Dial-In VPDN Tunneling module.

If you want to perform VPDN tunnel authorization searches based on the multihop hostname, you must configure the search to use the multihop hostname as described in the Configuring AAA for VPDNs module.

Enabling Multihop VPDN on the Tunnel Switch

In tunnel switching deployments, packets must traverse multiple tunnels. Multihop VPDN must be enabled on the tunnel switch for the deployment to function.

Perform this task on the tunnel switch to enable multihop VPDN.

SUMMARY STEPS

1. enable

2. configure terminal

3. vpdn multihop

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

vpdn multihop

Example:

Router(config)# vpdn multihop

Enables VPDN multihop.

What to Do Next

You must perform the task in the "Configuring the Multihop Tunnel Switch to Terminate Incoming VPDN Tunnels" section.

Configuring the Multihop Tunnel Switch to Terminate Incoming VPDN Tunnels

A tunnel switch must be configured as a tunnel server, allowing it to terminate incoming VPDN tunnels.

Perform this task to configure the tunnel switch to terminate incoming VPDN tunnels. You can configure a tunnel switch to terminate tunnels from multiple devices.

SUMMARY STEPS

1. enable

2. configure terminal

3. vpdn-group name

4. description string

5. accept-dialin

6. protocol l2tp

7. (Optional) virtual-template number

8. exit

9. terminate-from hostname host-name

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

vpdn-group name
Example:

Router(config)# vpdn-group 1

Creates a VPDN group and to enters VPDN group configuration mode.

Step 4 

description string
Example:

Router(config-vpdn)# description myvpdngroup

(Optional) Adds a description to a VPDN group.

Step 5 

accept-dialin

Example:
Router(config-vpdn)# accept-dialin

Configures a tunnel switch to accept requests from a NAS to establish a tunnel, creates an accept-dialin VPDN subgroup, and enters VPDN accept dial-in subgroup configuration mode.

Step 6 

protocol l2tp

Example:

Router(config-vpdn-acc-in)# protocol l2tp

Specifies the Layer 2 Tunneling Protocol that the VPDN group will use.

Step 7 

virtual-template number

Example:
Router(config-vpdn-acc-in)# virtual-template 1

(Optional) Specifies which virtual template will be used to clone virtual access interfaces.

This step is not required if the virtual access interface is not going to be cloned when a user connects.

Step 8 

exit

Example:

Router(config-vpdn-acc-in)# exit

Exits to VPDN group configuration mode.

Step 9 

terminate-from hostname host-name

Example:
Router(config-vpdn)# terminate-from hostname 
NAS12

Specifies the hostname of the remote NAS that will be required when accepting a VPDN tunnel.

What to Do Next

You must perform the task in the "Configuring the Multihop Tunnel Switch to Initiate Outgoing VPDN Tunnels" section.

Configuring the Multihop Tunnel Switch to Initiate Outgoing VPDN Tunnels

A tunnel switch must be configured as a NAS, allowing it to initiate outgoing VPDN tunnels.

Perform this task to configure the tunnel switch to initiate outgoing VPDN tunnels. You can configure a tunnel switch to initiate tunnels to multiple devices.

SUMMARY STEPS

1. enable

2. configure terminal

3. vpdn-group name

4. description string

5. request-dialin

6. protocol l2tp

7. domain domain-name
or
dnis {dnis-number | dnis-group-name}
or
multihop-hostname ingress-tunnel-name

8. exit

9. initiate-to ip ip-address [limit limit-number] [priority priority-number]

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

vpdn-group name
Example:

Router(config)# vpdn-group 1

Creates a VPDN group and enters VPDN group configuration mode.

Step 4 

description string
Example:

Router(config-vpdn)# description myvpdngroup

(Optional) Adds a description to a VPDN group.

Step 5 

request-dialin

Example:
Router(config-vpdn)# request-dialin

Configures a tunnel switch to request the establishment of a tunnel to a tunnel server, creates a request-dialin VPDN subgroup, and enters VPDN request dial-in subgroup configuration mode.

Step 6 

protocol l2tp

Example:

Router(config-vpdn-req-in)# protocol l2tp

Specifies the Layer 2 Tunneling Protocol that the VPDN group will use.

Step 7 

domain domain-name

or

dnis {dnis-number | dnis-group-name}


or

multihop-hostname ingress-tunnel-name

Example:
Router(config-vpdn-req-in)# domain company.com

or

Example:

Router(config-vpdn-req-in)# dnis 5687


or

Example:
Router(config-vpdn-req-in)# multihop-hostname 
nas1

Requests that PPP calls from a specific domain name be tunneled.

or

Requests that PPP calls from a specific DNIS number or DNIS group be tunneled.

or

Enables the tunnel switch to initiate a tunnel based on the NAS host name or the ingress tunnel ID.

Note If you use the multihop-hostname command to configure your tunnel switch, you must configure vpdn search-order command with the multihop-hostname keyword. For more information on configuring the VPDN tunnel authorization search order, see the Configuring AAA for VPDNs module.

Step 8 

exit

Example:

Router(config-vpdn-req-in)# exit

Exits to VPDN group configuration mode.

Step 9 

initiate-to ip ip-address [limit limit-number] [priority priority-number]

Example:
Router(config-vpdn)# initiate-to ip 10.1.1.1 
limit 12

Specifies an IP address that will be used for Layer 2 tunneling.

limit—Maximum number of connections that can be made to this IP address.

priority—Priority for this IP address.

Note The priority keyword is typically not configured on a tunnel switch. Information used for load balancing and failover is configured on a remote authentication, authorization, and accounting (AAA) server instead. For more information about configuring load balancing and failover priorities using a remote AAA server, see the Configuring AAA for VPDNs module.

Multiple tunnel servers can be configured on the tunnel switch by configuring multiple initiate-to commands.

What to Do Next

You can perform any of the relevant optional tasks in the Configuring Additional VPDN Features and the VPDN Tunnel Management modules.

Configuration Examples for Multihop VPDN

Example: Configuring Multihop VPDN Tunnel Switching

Example: Configuring Multihop VPDN Tunnel Switching

The following example configures a NAS, tunnel switch, and tunnel server to establish a multihop VPDN tunnel using L2TP:

NAS Configuration

! Configure the NAS to initiate VPDN dial-in sessions to the tunnel switch
vpdn-group 1
 request-dialin
  protocol l2tp
  domain cisco.com
!
 initiate-to ip 172.22.66.25 
 local name ISP-NAS

Tunnel Switch Configuration

!Enable VPDN
vpdn enable
!
!Enable multihop
vpdn multihop

!

! Configure the tunnel switch to use the multihop hostname in the authentication search.

 vpdn search-order multihop-hostname domain dnis

!

! Configure the tunnel switch to accept dial-in sessions from the NAS
vpdn-group tunnelin
 accept-dialin
  protocol l2tp
  virtual-template 1 
!
 terminate-from hostname ISP-NAS
 local name ISP-Sw
!
! Configure the tunnel switch to initiate VPDN dial-in sessions to the tunnel server
vpdn-group tunnelout
 request-dialin
  protocol l2tp
  multihop-hostname ISP-NAS
!
 initiate-to ip 10.2.2.2
 local name ISP-Sw

Tunnel Server Configuration

! Configure the tunnel server to accept dial-in sessions from the NAS
vpdn-group 1
 accept-dialin 
  protocol l2tp
  virtual-template 1 
! 
 terminate-from hostname ISP-Sw
 local name ENT-TS

Where to Go Next

You can perform any of the relevant optional tasks in the Configuring Additional VPDN Features and the VPDN Tunnel Management modules.

Additional References

Related Documents

Related Topic
Document Title

Cisco IOS commands

Cisco IOS Master Commands List, All Releases

VPDN commands

Cisco IOS VPDN Command Reference

VPDN technology overview

VPDN Technology Overview

Broadband access aggregation and DSL commands

Cisco IOS Broadband Access Aggregation and DSL Command Reference


Standards

Standard
Title

No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature.


MIBs

MIB
MIBs Link

No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature.

To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFC
Title

RFC 2661

Layer Two Tunneling Protocol "L2TP"


Technical Assistance

Description
Link

The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

http://www.cisco.com/cisco/web/support/index.html


Feature Information for Multihop VPDN

Table 1 lists the features in this module and provides links to specific configuration information.

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.


Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.


Table 1 Feature Information for Multihop VPDN 

Feature Name
Software Releases
Feature Configuration Information

Multihop VPDN

Cisco IOS XE Release 2.2

This feature was introduced on Cisco ASR 1000 Series Routers.

Multihop VPDN is a specialized VPDN configuration that allows packets to pass through multiple tunnels. Ordinarily, packets are not allowed to pass through more than one tunnel. In a multihop deployment, the VPDN tunnel is terminated after each hop and a new tunnel is initiated to the next hop destination.

The following sections provide information about this feature:

Information About Multihop VPDN

How to Configure Multihop VPDN

No commands were introduced or modified by this feature.

Subscriber Service Switch

Cisco IOS XE Release 2.2.1

This feature provides flexibility on where and how many subscribers are connected to available services and how those services are defined. The primary focus of SSS is to direct PPP from one point to another using a Layer 2 subscriber policy. The policy will manage tunneling of PPP in a policy-based bridging fashion.

The following sections provide partial information about this feature:

Tunnel Switching Using Multihop VPDN

Configuring a Multihop Tunnel Switch

The following VPDN commands were introduced or modified by this feature:

multihop-hostname and vpdn search-order.



Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)