Cisco IOS Broadband Access Aggregation and DSL Configuration Guide, Release 12.4T - Identifying the Physical Subscriber Line for RADIUS Access and Accounting [Cisco IOS Software Releases 12.4 T]

Table Of Contents

Identifying the Physical Subscriber Line for RADIUS Access and Accounting

Contents

Prerequisites for Identifying the Physical Subscriber Line for RADIUS Access and Accounting

Information About Identifying the Physical Subscriber Line for RADIUS Access and Accounting

PPP over ATM and PPPoE over ATM NAS-Port Attribute Field Format

PPPoE over IEEE 802.1Q VLANs Format

How to Configure the Physical Subscriber Line for RADIUS Access and Accounting

Configuring the LAC for RADIUS Port Identification for PPP

Configuring the LNS for RADIUS Port Identification for PPP

Configuration Examples for Identifying the Physical Subscriber Line

RADIUS Port Identification for PPPoE over ATM: Example

RADIUS Port Identification for PPPoE over an 802.1Q VLAN: Example

LNS Configuration for RADIUS Port Identification for PPP: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Feature Information for Identifying the Physical Subscriber Line for RADIUS Access and Accounting

Identifying the Physical Subscriber Line for RADIUS Access and Accounting

First Published: May 2, 2005

Last Updated: January 2, 2008

Identifying a physical subscriber line for communication to a RADIUS server enables an L2TP access concentrator (LAC) and an L2TP network server (LNS) to identify and forward RADIUS NAS-Port and NAS-Port-Type attribute values for PPP over ATM, PPPoE over ATM, and PPPoE over IEEE 802.1Q VLANs.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all of the features documented in this module. For the latest feature information and caveats, see the release notes for your Cisco IOS software release. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for Identifying the Physical Subscriber Line for RADIUS Access and Accounting" section.

Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Contents

•Prerequisites for Identifying the Physical Subscriber Line for RADIUS Access and Accounting

•Information About Identifying the Physical Subscriber Line for RADIUS Access and Accounting

•How to Configure the Physical Subscriber Line for RADIUS Access and Accounting

•Configuration Examples for Identifying the Physical Subscriber Line

•Additional References

•Feature Information for Identifying the Physical Subscriber Line for RADIUS Access and Accounting

Prerequisites for Identifying the Physical Subscriber Line for RADIUS Access and Accounting

•RADIUS port identification for PPP requires the PPP extended NAS-Port format. The PPP extended NAS-Port format increases the size of the NAS-Port attribute field to 32 bits and changes the NAS-Port attribute format to provide the RADIUS server with details about the ATM port, the virtual path identifier (VPI), the virtual channel identifier (VCI), and, for IEEE 802.1Q VLANs, the VLAN ID.

•For more general information about configuring RADIUS, see the "Configuring RADIUS" chapter in the Cisco IOS Security Configuration Guide.

•You must perform the PPP over ATM configuration procedures in the "Providing Protocol Support for Broadband Access Aggregation of PPP over ATM Sessions" module.

•You must perform the PPPoE configuration procedures in the "Providing Protocol Support for Broadband Access Aggregation of PPPoE Sessions" module.

Information About Identifying the Physical Subscriber Line for RADIUS Access and Accounting

To successfully identify the physical subscriber line for communication to the RADIUS server, you should understand the following concepts:

•PPP over ATM and PPPoE over ATM NAS-Port Attribute Field Format

•PPPoE over IEEE 802.1Q VLANs Format

PPP over ATM and PPPoE over ATM NAS-Port Attribute Field Format

For PPP over ATM and PPPoE over ATM, the PPP extended format enables the NAS-Port attribute field to provide details about the ATM interface, VPI, and VCI. Figure 1 shows the format of the NAS-Port attribute field when the PPP extended NAS-Port format is configured and PPP over ATM or PPPoE over ATM is being used.

Figure 1 Format of the NAS-Port Attribute Field for PPP over ATM and PPPoE over ATM

The interface, VPI, and VCI correspond to the interface and virtual circuit (VC) on which the session entered the router. For Cisco 6400 series routers, the interface, VPI, and VCI correspond to the interface and VC on which the session entered the Cisco 6400 node switch processor (NSP).

Figure 2 shows the format of the 8-bit interface field. For platforms that do not have slots or modules, the slot and module fields will be 0.

Figure 2 Format of the Interface Field for PPP over ATM and PPPoE over ATM

The NAS-Port-Type value for PPP over ATM and PPPoE over ATM is 5, which is the value for virtual port types.

PPPoE over IEEE 802.1Q VLANs Format

For PPPoE over 802.1Q VLANs, the PPP extended format provides details about the interface and the VLAN ID. Figure 3 shows the format of the NAS-Port attribute field when the PPP extended NAS-Port format is configured and PPPoE over an IEEE 802.1Q VLAN is being used.

Figure 3 Format of the NAS-Port Attribute Field for PPPoE over 802.1Q VLANs

Figure 4 shows the format of the 8-bit interface field. For platforms that do not have slots or modules, the slot and module fields will be 0.

Figure 4 Format of the Interface Field for PPPoE over 802.1Q VLANs

The NAS-Port-Type value for PPPoE over 802.1Q VLANs is 15.

How to Configure the Physical Subscriber Line for RADIUS Access and Accounting

This section contains the following procedures:

•Configuring the LAC for RADIUS Port Identification for PPP (required)

•Configuring the LNS for RADIUS Port Identification for PPP (required)

Configuring the LAC for RADIUS Port Identification for PPP

Perform this task to configure the LAC for RADIUS port identification for PPP.

SUMMARY STEPS

1. enable

2. configure terminal

3. radius-server attribute nas-port format d

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

radius-server attribute nas-port format d
Example:

Router(config)# radius-server attribute nas-port format d

Specifies that PPP extended NAS-Port format will be used for RADIUS accounting.

Configuring the LNS for RADIUS Port Identification for PPP

Perform this task to configure the LNS for RADIUS port identification for PPP.

Note In order for the LNS to forward PPP extended NAS-Port format values to the RADIUS server, both the LAC and the LNS must be Cisco routers running a Cisco IOS image that supports RADIUS port identification for PPP.

SUMMARY STEPS

1. enable

2. configure terminal

3. radius-server attribute nas-port format d

4. vpdn aaa attribute nas-port vpdn-nas

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

radius-server attribute nas-port format d
Example:

Router(config)# radius-server attribute nas-port format d

Specifies that PPP extended NAS-Port format will be used for RADIUS accounting.

Step 4

vpdn aaa attribute nas-port vpdn-nas
Example:

Router(config)# vpdn aaa attribute nas-port vpdn-nas

Enables the LNS to send PPP extended NAS-Port format values to the RADIUS server for accounting.

Configuration Examples for Identifying the Physical Subscriber Line

This section provides the following configuration examples:

•RADIUS Port Identification for PPPoE over ATM: Example

•RADIUS Port Identification for PPPoE over an 802.1Q VLAN: Example

•LNS Configuration for RADIUS Port Identification for PPP: Example

RADIUS Port Identification for PPPoE over ATM: Example

The following example shows the configuration of the PPP extended NAS-Port format on an LAC using PPPoE over ATM:
vpdn enable 
! 
vpdn-group 1 
 request-dialin 
 protocol l2tp 
domain vpn1
initiate-to ip 10.12.1.64  priority 1 
 local name NAS1-1 
! 
virtual-template 1 pre-clone 20 
virtual-template 2 pre-clone 20 
!
! 
bba-group pppoe vpn1 
 virtual-template 1 
 sessions per-vc limit 2 
 sessions per-mac limit 1 
! 
!
interface ATM4/0.1 multipoint
 pvc 1/33
 encapsulation aal5snap
 protocol pppoe group vpn1
!
!
aaa new-model
aaa authentication ppp default local group radius
aaa authorization network default local group radius
aaa accounting network default start-stop group radius
radius-server host 172.69.69.66 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server attribute nas-port format d
radius-server key rad123
!

RADIUS Port Identification for PPPoE over an 802.1Q VLAN: Example

The following example shows the configuration of the PPP extended NAS-Port format on an LAC running PPPoE over an 802.1Q VLAN:
vpdn enable 
! 
vpdn-group 1 
 request-dialin 
 protocol l2tp 
 domain vpn1 
 initiate-to ip 10.12.1.64  priority 1 
 local name NAS1-1 
! 
vpdn-group 2 
 request-dialin 
 protocol l2tp 
 domain vpn2 
 initiate-to ip 10.12.2.64  priority 1 
 local name NAS1-2 
! 
virtual-template 1 pre-clone 20 
virtual-template 2 pre-clone 20 
! 
bba-group pppoe global 
 virtual-template 1 
 sessions max limit 8000 
 sessions per-vc limit 8 
sessions per-mac limit 2
! 
bba-group pppoe vpn1 
 virtual-template 1 
 sessions per-vc limit 2 
 sessions per-mac limit 1 
! 
bba-group pppoe vpn2 
 virtual-template 2 
 sessions per-vc limit 2 
 sessions per-mac limit 1 ! 
vc-class atm class-pppoe-global 
 protocol pppoe 
! !
interface FastEthernet2/0.2
 encapsulation dot1Q 2
 pppoe enable group vpn1
!
interface FastEthernet2/0.3
 encapsulation dot1Q 3
 pppoe enable group vpn2
!
aaa new-model
aaa authentication ppp default local group radius
aaa authorization network default local group radius
aaa accounting network default start-stop group radius
radius-server host 172.69.69.66 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server attribute nas-port format d
radius-server key rad123

LNS Configuration for RADIUS Port Identification for PPP: Example

In the following example, the LNS is configured to recognize and forward PPP extended NAS-Port format values to the RADIUS server. The PPP extended NAS-Port format must also be configured on the LAC for this configuration to be effective.
vpdn enable
no vpdn logging
!
vpdn-group L2TP-tunnel
 accept-dialin
 protocol l2tp
 virtual-template 1
 terminate-from hostname lac1
 local name lns1
!         
!
aaa new-model
aaa authentication ppp default local group radius
aaa authorization network default local group radius
aaa accounting network default start-stop group radius
radius-server host 172.79.79.76 auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server attribute nas-port format d
radius-server key lns123
!
vpdn aaa attribute nas-port vpdn-nas

Additional References

The following sections provide references related to the Identifying the Physical Subscriber Line for RADIUS Access and Accounting feature.

Related Documents

Related Topic

Document Title

Configuring PPP over ATM sessions

"Providing Protocol Support for Broadband Access Aggregation of PPP over ATM Sessions" module

Configuring PPPoE sessions

"Providing Protocol Support for Broadband Access Aggregation of PPPoE Sessions"

RADIUS configuration

"Configuring RADIUS" chapter of the Cisco IOS Security Configuration Guide, Release 12.3

RADIUS attributes

"RADIUS Attributes" appendix to the Cisco IOS Security Configuration Guide, Release 12.3

Tunneling configuration

"Configuring Virtual Private Networks" chapter of the Cisco IOS Dial Technologies Configuration Guide, Release 12.3

RADIUS virtual circuit (VC) logging

Cisco IOS Software Releases 11.3 Feature Guide, RADIUS VC Logging

Standards

Standard

Title

No new or modified standards are supported by this feature.

—

MIBs

MIB

MIBs Link

No new or modified MIBs are supported by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFC

Title

None

—

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport

Feature Information for Identifying the Physical Subscriber Line for RADIUS Access and Accounting

Table 1 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Release 12.2(1) or later releases appear in the table.

Not all commands may be available in your Cisco IOS software release. For details on when support for specific commands was introduced, see the command reference documents.

For information on a feature in this technology that is not documented here, see the "Configuring Broadband Access Aggregation Features Roadmap."

Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.

Note Table 1 lists only the Cisco IOS software release that introduced support for a given feature in a given Cisco IOS software release train. Unless noted otherwise, subsequent releases of that Cisco IOS software release train also support that feature.

Table 1 Feature Information for Identifying the Physical Subscriber Line for RADIUS Access and Accounting

Feature Name

Releases

Feature Information

RADIUS Port Identification

12.2(1)
12.2(33)SRC

Configuring RADIUS port identification for PPP enables an L2TP access concentrator (LAC) and an L2TP network server (LNS) to identify and forward RADIUS NAS-Port and NAS-Port-type attribute values for PPP over ATM, PPPoE over ATM, and PPPoE over IEEE 802.1Q VLANs.

The following sections provide information about this feature:

•"Information About Identifying the Physical Subscriber Line for RADIUS Access and Accounting" section

•"How to Configure the Physical Subscriber Line for RADIUS Access and Accounting" section

In 12.2(1), this feature was introduced.

In 12.2(33)SRC, this feature was integrated into the SRC release.

CCDE, CCENT, Cisco Eos, Cisco Lumin, Cisco Nexus, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, the Cisco logo, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0809R)

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2008 Cisco Systems, Inc. All rights reserved.