Downloads |
Table Of Contents
RADIUS Tunnel Attribute Extensions
Supported Standards, MIBs, and RFCs
Verifying RADIUS Attribute 90 and RADIUS Attribute 91
L2TP Network Server (LNS) Configuration Example
RADIUS User Profile with RADIUS Tunneling Attributes 90 and 91 Example
RADIUS Tunnel Attribute Extensions
Feature History
This feature module describes the RADIUS Tunnel Attribute Extensions feature. It includes the following sections:
•
Supported Standards, MIBs, and RFCs
Feature Overview
The RADIUS Tunnel Attribute Extensions feature introduces RADIUS attribute 90 (Tunnel-Client-Auth-ID) and RADIUS attribute 91 (Tunnel-Server-Auth-ID). Both attributes help support the provision of compulsory tunneling in virtual private networks (VPNs) by allowing the user to specify authentication names for the network access server (NAS) and the RADIUS server.
How It Works
Once a NAS has set up communication with a RADIUS server, you can enable a tunneling protocol. Some applications of tunneling protocols are voluntary, but others involve compulsory tunneling; that is, a tunnel is created without any action from the user and without allowing the user any choice in the matter. In those cases, new RADIUS attributes are needed to carry the tunneling information from the NAS to the RADIUS server to establish authentication. These new RADIUS attributes are listed in Table 1.
Note
Table 1 RADIUS Tunnel Attributes
90
Tunnel-Client-Auth-ID
tunnel-id
•
•
Specifies the name used by the tunnel initiator (also known as the NAS1 ) when authenticating tunnel setup with the tunnel terminator.
91
Tunnel-Server-Auth-ID
gw-name
•
•
Specifies the name used by the tunnel terminator (also known as the Home Gateway2 ) when authenticating tunnel setup with the tunnel initiator.
1 When L2TP is used, the NAS is referred to as an L2TP access concentrator (LAC).
2 When L2TP is used, the Home Gateway is referred to as an L2TP network server (LNS).
RADIUS attribute 90 and RADIUS attribute 91 are included in the following situations:
•
•
Benefits
The RADIUS Tunnel Attribute Extensions feature allows you to specify a name (other than the default) of the tunnel initiator and the tunnel terminator. Thus, you can establish a higher level of security when setting up VPN tunneling.
Restrictions
Your RADIUS server must support tagged attributes to use RADIUS tunnel attributes 90 and 91.
Related Documents
The following documents provide information related to the RADIUS Tunnel Attribute Extensions feature:
•
•
•
•
Supported Platforms
Cisco IOS Release 12.1(5)T Only
•
•
Cisco IOS Releases 12.2(4)B3 and 12.2(13)T Only
Cisco 6400-NRP-1
Cisco 6400-NRP-2
Cisco 6400-NRP-2SV
Determining Platform Support Through Cisco Feature Navigator
Cisco IOS software is packaged in feature sets that are supported on specific platforms. To get updated information regarding platform support for this feature, access Cisco Feature Navigator. Cisco Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.
Cisco Feature Navigator is a web-based tool that enables you to determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image. You can search by feature or release. Under the release section, you can compare releases side by side to display both the features unique to each software release and the features in common.
To access Cisco Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
Cisco Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Cisco Feature Navigator home page at the following URL:
Availability of Cisco IOS Software Images
Platform support for particular Cisco IOS software releases is dependent on the availability of the software images for those platforms. Software images for some platforms may be deferred, delayed, or changed without prior notice. For updated information about platform support and availability of software images for each Cisco IOS software release, refer to the online release notes or, if supported, Cisco Feature Navigator.
Supported Standards, MIBs, and RFCs
Standards
None
MIBs
None
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
http://tools.cisco.com/ITDIT/MIBS/servlet/index
If Cisco MIB Locator does not support the MIB information that you need, you can also obtain a list of supported MIBs and download MIBs from the Cisco MIBs page at the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
To access Cisco MIB Locator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:
RFCs
•
Prerequisites
To use RADIUS attributes 90 and 91, you must complete the following tasks:
•
•
•
Configuration Tasks
None
Verifying RADIUS Attribute 90 and RADIUS Attribute 91
To verify that RADIUS attribute 90 and RADIUS attribute 91 are being sent in access accepts and accounting requests, use the following command in privileged EXEC mode:
Configuration Examples
This section provides the following configuration examples:
•
•
L2TP Network Server (LNS) Configuration Example
The following example shows how to configure the LNS with a basic L2F and L2TP configuration using RADIUS tunneling attributes 90 and 91:
aaa new-modelaaa authentication login default noneaaa authentication login console noneaaa authentication ppp default local group radiusaaa authorization network default group radius if-authenticated!username l2f-cli-auth-id password 0 l2f-cli-passusername l2f-svr-auth-id password 0 l2f-svr-passusername l2tp-svr-auth-id password 0 l2tp-tnl-pass!vpdn enablevpdn search-order domain!vpdn-group 1accept-dialinprotocol l2fvirtual-template 1terminate-from hostname l2f-cli-auth-idlocal name l2f-svr-auth-id!vpdn-group 2accept-dialinprotocol l2tpvirtual-template 2terminate-from hostname l2tp-cli-auth-idlocal name l2tp-svr-auth-id!interface Ethernet1/0ip address 10.0.0.3 255.255.255.0no ip route-cacheno ip mroute-cache!interface Virtual-Template1ip unnumbered Ethernet1/0ppp authentication pap!interface Virtual-Template2ip unnumbered Ethernet1/0ppp authentication pap!radius-server host 1.1.1.1 auth-port 1645 acct-port 1646radius-server key <deleted>!RADIUS User Profile with RADIUS Tunneling Attributes 90 and 91 Example
The following is an example of a RADIUS user profile that includes RADIUS tunneling attributes 90 and 91. This entry supports two tunnels, one for L2F and the other for L2TP. The tag entries with :1 support L2F tunnels, and the tag entries with :2 support L2TP tunnels.
cisco.com Password = "cisco", Service-Type = OutboundService-Type = Outbound,Tunnel-Type = :1:L2F,Tunnel-Medium-Type = :1:IP,Tunnel-Client-Endpoint = :1:"10.0.0.2",Tunnel-Server-Endpoint = :1:"10.0.0.3",Tunnel-Client-Auth-Id = :1:"l2f-cli-auth-id",Tunnel-Server-Auth-Id = :1:"l2f-svr-auth-id",Tunnel-Assignment-Id = :1:"l2f-assignment-id",Cisco-Avpair = "vpdn:nas-password=l2f-cli-pass",Cisco-Avpair = "vpdn:gw-password=l2f-svr-pass",Tunnel-Preference = :1:1,Tunnel-Type = :2:L2TP,Tunnel-Medium-Type = :2:IP,Tunnel-Client-Endpoint = :2:"10.0.0.2",Tunnel-Server-Endpoint = :2:"10.0.0.3",Tunnel-Client-Auth-Id = :2:"l2tp-cli-auth-id",Tunnel-Server-Auth-Id = :2:"l2tp-svr-auth-id",Tunnel-Assignment-Id = :2:"l2tp-assignment-id",Cisco-Avpair = "vpdn:l2tp-tunnel-password=l2tp-tnl-pass",Tunnel-Preference = :2:2Command Reference
No new or modified Cisco IOS commands were added for this feature.
Glossary
Layer 2 Forwarding (L2F)—A Layer 2 tunneling protocol that enables an ISP or other access service to create a virtual tunnel to link customer remote sites or remote users with corporate home networks. In particular, a network access server (NAS) at the ISP point of presence (POP) exchanges PPP messages with the remote users and communicates by L2F or L2TP requests and responses with the customer tunnel server to set up tunnels.
Layer 2 Tunnel Protocol (L2TP)—A Layer 2 tunneling protocol that enables an ISP or other access service to create a virtual tunnel to link customer remote sites or remote users with corporate home networks. In particular, a network access server (NAS) at the ISP point of presence (POP) exchanges PPP messages with the remote users and communicates by L2F or L2TP requests and responses with the customer tunnel server to set up tunnels.
L2TP access concentrator (LAC)—A network access server (NAS) to which the client directly connects and through which PPP frames are tunneled to the L2TP network server (LNS). The LAC need only implement the media over which L2TP is to operate to pass traffic to one or more LNSs. The LAC may tunnel any protocol carried within PPP. The LAC initiates incoming calls and receives outgoing calls. A LAC is analogous to an L2F network access server.
L2TP network server (LNS)—A termination point for L2TP tunnels, and an access point where PPP frames are processed and passed to higher-layer protocols. An LNS can operate on any platform that terminates PPP. The LNS handles the server side of the L2TP protocol. L2TP relies only on the single medium over which L2TP tunnels arrive. The LNS initiates outgoing calls and receives incoming calls. An LNS is analogous to a home gateway in L2F technology.
network access server (NAS)—A Cisco platform, or collection of platforms, such as an AccessPath system, that interfaces between the packet world (such as the Internet) and the circuit-switched world (such as the PSTN).
tunnel—A virtual pipe between the L2TP access concentrator (LAC) and L2TP network server (LNS) that can carry multiple PPP sessions.
virtual private network (VPN)—A system that permits dial-in networks to exist remotely to home networks, while giving the appearance of being directly connected. VPNs use L2TP and L2F to terminate the Layer 2 and higher parts of the network connection at the L2TP network server (LNS) instead of the L2TP access concentrator (LAC).
