Downloads |
Table Of Contents
Supported Standards, MIBs, and RFCs
Enabling VPDN and Multihop Functionality
Verifying VPDN and Multihop Functionality
Terminating the Tunnel from the LAC
Verifying Termination of the Tunnel from the LAC
Mapping the Ingress Tunnel Name to an LNS
Verifying the Ingress Tunnel Name to LNS Map
Performing VPDN Tunnel Authorization Searches by Ingress Tunnel Name
Verifying VPDN Tunnel Authorization Searches by Ingress Tunnel Name
L2TP Tunnel Switch Configuration
L2TP Tunnel Switching
This feature module describes the L2TP Tunnel Switching feature. It includes information on the benefits of the new feature, supported platforms, related documents, and configuration information.
This document includes the following sections:
•
Supported Standards, MIBs, and RFCs
Feature Overview
The L2TP Tunnel Switching feature enables the Cisco 6400 NRP to terminate tunnels from LACs and forward the sessions through new L2TP tunnels selected independently of the client-supplied domains. The NRP as a tunnel switch performs VPDN tunnel authorization based on the ingress tunnel names that are mapped to specified LNSes.
Figure 1 shows an example network topology using the L2TP tunnel switching feature.
Figure 1 Example Network Topology Using the L2TP Tunnel Switching Feature
Benefits
Improved Provisioning Scalability
Aggregating LAC tunnels with an L2TP tunnel switch improves provisioning scalability on both the LAC and wholesaler ends.
Improved Permanent Virtual Circuit Interconnect Scalability
In a B-ISDN network, a multihop node can improve PVC interconnect scalability.
Restrictions
When using a RADIUS service profile for tunnel service authorization, the NRP configured as an L2TP tunnel switch must forward all sessions through L2TP tunnels. The L2TP tunnel switch must not terminate any of the sessions.
Related Documents
•
•
•
Supported Platforms
The L2TP Tunnel Switching feature is supported on the node route processor (NRP) of the Cisco 6400 UAC.
Supported Standards, MIBs, and RFCs
Standards
None
MIBs
None
RFCs
No new or modified RFCs are supported by this feature.
Configuration Tasks
See the following sections for configuration tasks for the L2TP Tunnel Switching feature. All of the listed tasks are required to configure the L2TP tunnel switch.
•
•
•
•
Note
Enabling VPDN and Multihop Functionality
To use the L2TP Tunnel Switching feature, you must first enable VPDN and multihop capabilities by entering the following commands beginning in global configuration mode:
Step 1
Router(config)# vpdn enable
Enables VPDN functionality.
Step 2
Router(config)# vpdn multihop
Enables VPDN multihop functionality.
Verifying VPDN and Multihop Functionality
To verify that you enabled VPDN and multihop functionality, use the show running-config EXEC command.
Terminating the Tunnel from the LAC
To terminate the tunnel from the LAC, enter the following commands beginning in global configuration mode:
Verifying Termination of the Tunnel from the LAC
To verify that you successfully configured the tunnel switch to terminate tunnels from the LAC, use the show running-config EXEC command.
Mapping the Ingress Tunnel Name to an LNS
To map the ingress tunnel name to an LNS, complete the following steps beginning in global configuration mode:
Verifying the Ingress Tunnel Name to LNS Map
To verify that you successfully mapped the ingress tunnel name to the LNS, use the show running-config EXEC command.
Performing VPDN Tunnel Authorization Searches by Ingress Tunnel Name
To specify how to perform VPDN tunnel authorization searches, enter the following command in global configuration mode:
Verifying VPDN Tunnel Authorization Searches by Ingress Tunnel Name
To verify that you successfully configured the tunnel switch to perform VPDN tunnel authorization searches by ingress tunnel name, use the show running-config EXEC command.
Configuration Examples
The examples in this section show the configurations necessary for the basic L2TP tunnel switch topology shown in Figure 2. In this topology, a tunnel switch terminates tunnels from two LACs and forwards all the sessions through one tunnel to the LNS.
Figure 2 Example L2TP Tunnel Switch Topology
This section provides the following configuration examples:
•
LAC-1 Configuration
In the following example, LAC-1 performs tunnel authorization based on domain name and initiates a tunnel to the L2TP tunnel switch:
!vpdn enable!username net.com password Secret1username Tunnel-Switch-In password Secret1!vpdn-group 1request-dialinprotocol l2tpdomain service1.net.cominitiate-to ip 10.1.1.1local name net.com!LAC-2 Configuration
In the following example, LAC-2 also performs tunnel authorization based on domain name and initiates a tunnel to the L2TP tunnel switch:
!vpdn enable!username net.com password Secret2username Tunnel-Switch-In password Secret2!vpdn-group 1request-dialinprotocol l2tpdomain service2.net.cominitiate-to ip 10.1.1.1local name net.com!L2TP Tunnel Switch Configuration
In the following example, the NRP is configured as an L2TP tunnel switch. VPDN groups 1 and 2 are used to terminate the tunnels from the LAC. VPDN group 11 is used to initiate the tunnel to the LNS, and it performs tunnel authorization based on the configured ingress tunnel name.
!vpdn enablevpdn multihopvpdn search-order multihop-hostname domain!username net.com password Secret1username Tunnel-Switch-In password Secret1username net.com password Secret2username Tunnel-Switch-In password Secret2username LNS password Secret3username Tunnel-Switch-Out password Secret3!vpdn-group 1accept-dialinprotocol l2tpvirtual-template 1terminate-from hostname net.comlocal name Tunnel-Switch-In!vpdn-group 11request-dialinprotocol l2tpmultihop hostname net.cominitiate-to ip 10.2.2.2local name Tunnel-Switch-Out!interface ATM 0/0/0.1001 point-to-pointip address 10.1.1.1 255.255.255.0pvc 5/10encapsulation aal5snap!
interface Virtual-Template 1ip unnumbered FastEthernet 0/0/0no ip directed-broadcastno keepaliveno peer default ip addressppp authentication chap!LNS Configuration
In the following example, the LNS terminates the tunnel from the L2TP tunnel switch:
vpdn enable!username LNS password Secret3username Tunnel-Switch-Out password Secret3!vpdn-group 1accept-dialinprotocol l2tpvirtual-template 1terminate-from hostname Tunnel-Switchlocal name LNS!interface Virtual-Template 1ip unnumbered FastEthernet 0/0/0no ip directed-broadcastip mroute-cacheno keepalivepeer default ip address pool pool-1ppp authentication chap!Command Reference
This section documents new or modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.1 command reference publications.
multihop hostname
To enable the L2TP tunnel switch to initiate a tunnel based on the LAC host name or ingress tunnel ID, use the multihop hostname VPDN request-dialin group configuration mode command. To disable this option, use the no form of this command.
multihop hostname ingress-tunnel-name
no multihop hostname ingress-tunnel-name
Syntax Description
Defaults
No default behavior or values.
Command Modes
VPDN request-dialin group
Command History
Examples
The following example enables the L2TP tunnel switch to forward sessions from LAC-1 through an outgoing tunnel to IP address 10.3.3.3:
!vpdn-group 11request-dialinprotocol l2tpmultihop hostname LAC-1initiate-to ip 10.3.3.3local name Tunnel-Switch!Related Commands
domain domain-name
Selects VPDN group for tunnel initiation based on domain name.
dnis dnis-number
Selects VPDN group for tunnel initiation based on DNIS.
vpdn search-order
To specify how the service provider's NAS is to perform VPDN tunnel authorization searches, use the vpdn search-order global configuration command. To remove a prior specification, use the no form of the command.
vpdn search-order {multihop-hostname [domain] [dnis] | domain [dnis] [multihop-hostname] | dnis [domain] [multihop-hostname]}
no vpdn search-order {multihop-hostname [domain] [dnis] | domain [dnis] [multihop-hostname] | dnis [domain] [multihop-hostname]}
Syntax Description
multihop-hostname
Specifies a search on LAC host name or ingress tunnel ID.
domain
Specifies a search on the domain name.
dnis
Specifies a search on the DNIS information.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
11.3(5)AA
This command was introduced.
12.1(1) DC1
The multihop-hostname keyword was added for the Cisco 6400 NRP.
Usage Guidelines
VPDN authorization searches are performed only as specified.
The configuration shows the vpdn search-order command setting only if the command is explicitly configured.
Examples
The following example configures an L2TP tunnel switch to perform each VPDN authorization search by the multihop-hostname, and if unsuccessful, search by the domain name.
vpdn search-order multihop-hostname domainGlossary
B-ISDN—Broadband ISDN. ITU-T communication standards designed to handle high-bandwidth applications such as video. B-ISDN currently uses ATM technology over SONET-based transmission circuits to provide data rates from 155 to 622 Mbps and beyond.
DNIS—Dialed Number Identification Service. The called party number. Typically, this is a number used by call centers or a central office where different numbers are each assigned to a specific service.
L2TP—Layer 2 Tunnel Protocol. An Internet Engineering Task Force (IETF) standards track protocol defined in RFC 2661 that provides tunneling of PPP. Based upon the best features of L2F and PPTP, L2TP provides an industry-wide interoperable method of implementing VPDN.
LAC—L2TP Access Concentrator. A node that acts as one side of an L2TP tunnel endpoint and is a peer to the L2TP network server (LNS). The LAC sits between an LNS and a remote system and forwards packets to and from each. Packets sent from the LAC to the LNS requires tunneling with the L2TP protocol as defined in this document. The connection from the LAC to the remote system is either local or a PPP link.
LNS—L2TP network server. A node that acts as one side of an L2TP tunnel endpoint and is a peer to the L2TP access concentrator (LAC). The LNS is the logical termination point of a PPP session that is being tunneled from the remote system by the LAC. Analogous to the Layer 2 Forwarding (L2F) home gateway (HGW).
NAS—Network access server. A device providing local network access to users across a remote access network such as the PSTN. A NAS can also serve as a LAC, LNS, or both.
PVC—Permanent virtual circuit or connection. Virtual circuit that is permanently established. PVCs save bandwidth associated with circuit establishment and tear down in situations where certain virtual circuits must exist all the time. In ATM terminology, called a permanent virtual connection.
VPDN—Virtual Private Dialup Networking. A system that permits the physical dialup connection to appear to be connected directly to a home network while actually residing elsewhere on the network. A virtual pipe is connected between the physical dialup connections and the termination point at the home network.
