How to Configure RADIUS Authentication for VPDNs

Available Languages

Download Options

  • PDF     (32.6 KB)
    View with Adobe Reader on a variety of devices
Updated:February 26, 2008
Document ID:4675

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

A Virtual Private Dial-up Network (VPDN) allows a private network dial in service to span across to remote access servers (defined as the L2TP Access Concentrator [LAC]). When a Point-to-Point Protocol (PPP) client dials into a LAC, the LAC determines that it should forward that PPP session on to an L2TP Network Server (LNS) for that client, which then authenticates the user and starts the PPP negotiation. Once PPP setup has completed, all frames are sent through the LAC to the client and the LNS.

This sample configuration allows you to use RADIUS authentication with VPDNs. The LAC queries the RADIUS server, determines which LNS to forward the user, and establishes the appropriate tunnel.

For more information on VPDNs refer to Understanding VPDN.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions:

  • Cisco Secure ACS UNIX version 2.x.x and later or Merit RADIUS

  • Cisco IOS® Software Release 11.2 and later

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

For more information on document conventions, refer to Cisco Technical Tips Conventions.

Background Information

In this example, the user is "jsmith@hp.com" with password "test". When "jsmith@hp.com" dials into the ISP router, the ISP router sends "hp.com" userid to the ISP RADIUS server. The ISP server finds the "hp.com" userid and sends its tunnel-id ("isp"), the IP address of the home gateway (HGW) router (10.31.1.50), the Network Access Server (NAS) password ("hello"), and the gateway password ("there") back to the ISP router.

The ISP router initiates a tunnel and connects to the 10.31.1.50 HGW router, which authenticates the user "hp-gw" locally and forwards the password for userid "isp" ("hello") to the HGW RADIUS server. Once the tunnels is established, the ISP router forwards to the HGW router, and the userid ("jsmith@hp.com") and password ("test") of the user dialing in this user is authenticated on the HGW server. In this example, the ISP router is called "Koala" and the HGW router is called "sneetches".

Configure

In this section, you are presented with the information to configure the features described in this document.

Network Diagram

This document uses the network setup shown in this diagram.

vpdn_rad.gif

Server Configurations

Merit RADIUS Configuration 


!--- The RADIUS Server must support Cisco av-pairs. !--- This user is on the ISP RADIUS server.

hp.com Password = "cisco"
Service-Type = Outbound-User,
cisco-avpair = "vpdn:tunnel-id=isp",
cisco-avpair = "vpdn:ip-addresses=10.31.1.50",
cisco-avpair = "vpdn:nas-password=hello",
cisco-avpair = "vpdn:gw-password=there"

!--- The next two users are on the HGW Server.

isp Password = "hello",
Service-Type = Framed,
Framed-Protocol = PPP

jsmith@hp.com Password = "test",
Service-Type = Framed,
Framed-Protocol = PPP

Cisco Secure ACS UNIX 2.x.x Configuration 


!--- This user is on the ISP server.

# ./ViewProfile -p 9900 -u hp.com
User Profile Information
user = hp.com{
profile_id = 86
profile_cycle = 1
RADIUS=Cisco {
check_items= {
2="cisco"
}
reply_attributes= {
9,1="vpdn:tunnel-id=isp"
9,1="vpdn:ip-addresses=10.31.1.50"
9,1="vpdn:NAS-password=hello"
9,1="vpdn:gw-password=there"
}
}

}

!--- The next two users are on the HGW Server.


# ./ViewProfile -p 9900 -u isp
User Profile Information
user = isp{
profile_id = 70
profile_cycle = 1
RADIUS=Cisco {
check_items= {
2="hello"
}
reply_attributes= {
6=2
7=1
}
}

}

# ./ViewProfile -p 9900 -u jsmith@hp.com
User Profile Information
user = jsmith@hp.com{
profile_id = 84
profile_cycle = 1
RADIUS=Cisco {
check_items= {
2="test"
}
reply_attributes= {
6=2
7=1
}
}

}

Router Configurations

ISP Router Configuration 
koala#show running config

Building configuration...


Current configuration:
!
version 11.3
no service password-encryption
service udp-small-servers
service tcp-small-servers
!
hostname koala
!
aaa new-model
aaa authentication ppp default if-needed RADIUS
aaa authorization network default RADIUS
aaa accounting network default start-stop RADIUS
enable password ww
!
vpdn enable

!--- VPDN is enabled.

!
interface Ethernet0
ip address 10.31.1.5 255.255.255.0
!
interface Serial0
shutdown
!
interface Serial1
shutdown
!
interface Async1
ip unnumbered Ethernet0
encapsulation ppp
async mode dedicated
no peer default ip address
no cdp enable
ppp authentication chap
!
ip default-gateway 10.31.1.1
no ip classless
ip route 0.0.0.0 0.0.0.0 10.31.1.1
logging trap debugging
logging 171.68.118.101
snmp-server community public RW
snmp-server enable traps config
snmp-server host 171.68.118.105 traps public
RADIUS-server host 171.68.120.194 auth-port 1645 acct-port 1646
RADIUS-server key cisco

!--- Specify RADIUS server information on the NAS.

!
line con 0
password WW
line 1
password WW
autoselect ppp
modem InOut
transport input all
stopbits 1
speed 115200
flowcontrol hardware
line 2 16
autoselect during-login
line aux 0
line vty 0 4
exec-timeout 0 0
password WW
!
end

HGW Router Configuration 
Sneetches#show running config
Building configuration...

Current configuration:
!
version 11.3
no service password-encryption
service udp-small-servers
service tcp-small-servers
!
hostname Sneetches
!
aaa new-model
aaa authentication ppp default RADIUS local
aaa authorization network default RADIUS local
aaa accounting network default start-stop RADIUS
!
username hp-gw password 0 there
username isp password 0 hello
vpdn enable

!--- Enable VPDN.

vpdn incoming isp hp-gw virtual-template 1

!--- Specify the remote host (the network access server) !--- the local name (the home gateway) to use for authenticating !--- and the virtual template to use.

!
interface Ethernet0
ip address 10.31.1.50 255.255.255.0
!
interface Ethernet1
no ip address
shutdown
!


interface Virtual-Template1

!--- Create a virtual template interface.

ip unnumbered Ethernet0

!--- Un-number the Virtual interface to an available LAN interface.

peer default ip address pool async

!--- Use the pool "async" to assign the IP address for incoming connections.

ppp authentication chap

!--- Use CHAP authentication for the incoming connection.

!
interface Serial0
shutdown
!
interface Serial1
shutdown
!
ip local pool async 1.1.1.1 1.1.1.6
ip default-gateway 10.31.1.1
no ip classless
ip route 0.0.0.0 0.0.0.0 10.31.1.1
RADIUS-server host 171.68.118.101 auth-port 1645 acct-port 1646
RADIUS-server timeout 20
RADIUS-server key cisco

!--- Specify RADIUS server information on the NAS.

!
line con 0
exec-timeout 3600 0
line aux 0
line vty 0 4
password WW
!
end

Verify

There is currently no verification procedure available for this configuration.

Troubleshoot

This section provides information you can use to troubleshoot your configuration.

Troubleshooting Commands

Certain show commands are supported by the Output Interpreter tool, which allows you to view an analysis of show command output.

Note: Before issuing debug commands, please see Important Information on Debug Commands.

  • debug aaa authentication—Displays information on AAA/Terminal Access Controller Access Control System Plus (TACACS+) authentication.

  • debug aaa authorization—Displays information on AAA/TACACS+ authorization.

  • debug ppp negotiation—Displays PPP packets transmitted during PPP startup, where PPP options are negotiated.

  • debug RADIUS—Displays detailed debugging information associated with RADIUS.

  • debug vpdn errors—Displays errors that prevent a PPP tunnel from being established or errors that cause an established tunnel to be closed.

  • debug vpdn events—Displays messages about events that are part of normal PPP tunnel establishment or shutdown.

  • debug vpdn l2f-errors—Displays Layer 2 protocol errors that prevent Layer 2 establishment or prevent its normal operation.

  • debug vpdn l2f-events—Displays messages about events that are part of normal PPP tunnel establishment or shutdown for Layer 2.

  • debug vpdn l2f-packets—Displays messages about Layer 2 Forwarding protocol headers and status.

  • debug vpdn packets—Displays Layer 2 Tunnel Protocol errors and events that are a part of normal tunnel establishment or shutdown for VPDNs.

  • debug vtemplate—Displays cloning information for a virtual access interface from the time it is cloned from a virtual template to the time the virtual access interface comes down when the call ends.

Debug Output

ISP Router Good Debug 

koala#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
koala#
%LINK-3-UPDOWN: Interface Async1, changed state to up
17:28:19: VPDN: Looking for tunnel -- hp.com --
17:28:19: AAA/AUTHEN: create_user (0x15D28C) user='hp.com' ruser='' port='Async1' 
 rem_addr='' authen_type=NONE service=LOGIN priv=0
17:28:19: AAA/AUTHOR/VPDN (982041598): Port='Async1' list='default' service=NET
17:28:19: AAA/AUTHOR/VPDN: (982041598) user='hp.com'
17:28:19: AAA/AUTHOR/VPDN: (982041598) send AV service=ppp
17:28:19: AAA/AUTHOR/VPDN: (982041598) send AV protocol=vpdn
17:28:19: AAA/AUTHOR/VPDN (982041598) found list "default"
17:28:19: AAA/AUTHOR/VPDN: (982041598) Method=RADIUS
17:28:19: RADIUS: authenticating to get author data
17:28:19: RADIUS: Computed extended port value 0:1:
17:28:19: RADIUS: Initial Transmit id 62 171.68.120.194:1645, Access-Request, len 70
17:28:19: Attribute 4 6 0A1F0105
17:28:19: Attribute 5 6 00000001
17:28:19: Attribute 61 6 00000000
17:28:19: Attribute 1 8 68702E63
17:28:19: Attribute 2 18 8070079C
17:28:19: Attribute 6 6 00000005
17:28:19: RADIUS: Received from id 62 171.68.120.194:1645, Access-Accept, len 143
17:28:19: Attribute 26 26 0000000901147670
17:28:19: Attribute 26 36 00000009011E7670
17:28:19: Attribute 26 31 0000000901197670
17:28:19: Attribute 26 30 0000000901187670

!--- These messages can be decrypted using the OI tool. !--- As of Cisco IOS Software Release 12.2(11)T, !--- the output was changed to be readable.

17:28:19: RADIUS: saved authorization data for user 15D28C at 10EE74
17:28:19: RADIUS: cisco AVPair "vpdn:tunnel-id=isp"
17:28:19: RADIUS: cisco AVPair "vpdn:ip-addresses=10.31.1.50"
17:28:19: RADIUS: cisco AVPair "vpdn:nas-password=hello"
17:28:19: RADIUS: cisco AVPair "vpdn:gw-password=there"
17:28:19: AAA/AUTHOR (982041598): Post authorization status = PASS_ADD
17:28:19: AAA/AUTHOR/VPDN: Processing AV service=ppp
17:28:19: AAA/AUTHOR/VPDN: Processing AV protocol=vpdn
17:28:19: AAA/AUTHOR/VPDN: Processing AV tunnel-id=isp
17:28:19: AAA/AUTHOR/VPDN: Processing AV ip-addresses=10.31.1.50
17:28:19: AAA/AUTHOR/VPDN: Processing AV nas-password=hello
17:28:19: AAA/AUTHOR/VPDN: Processing AV gw-password=there
17:28:19: VPDN: Get tunnel info with NAS isp GW hp.com, IP 10.31.1.50

!--- The RADIUS server returns the attributes the !--- NAS should use for the tunnel. !--- Tunnel-id is "ISP" and the IP address of HGW is 10.31.1.50.

17:28:19: AAA/AUTHEN: free_user (0x15D28C) user='hp.com' ruser='' port='Async1' 
 rem_addr='' authen_type=NONE service=LOGIN priv=0
17:28:19: VPDN: Forward to address 10.31.1.50
17:28:19: As1 VPDN: Forwarding...
17:28:19: AAA/AUTHEN: create_user (0x15D334) user='jsmith@hp.com' ruser=''
 port='Async1' rem_addr='async' authen_type=CHAP service=PPP priv=1
17:28:19: As1 VPDN: Bind interface direction=1
17:28:19: As1 VPDN: jsmith@hp.com is forwarded
17:28:19: AAA/ACCT/NET/START User jsmith@hp.com, Port Async1, List ""
17:28:19: AAA/ACCT/NET: Found list "default"
17:28:19: RADIUS: Computed extended port value 0:1:
17:28:19: RADIUS: Initial Transmit id 63 171.68.120.194:1646, Accounting-Request,
 len 93
17:28:19: Attribute 4 6 0A1F0105
17:28:19: Attribute 5 6 00000001
17:28:19: Attribute 61 6 00000000
17:28:19: Attribute 1 15 6A736D69
17:28:19: Attribute 40 6 00000001
17:28:19: Attribute 45 6 00000002
17:28:19: Attribute 6 6 00000002
17:28:19: Attribute 44 10 30303030
17:28:19: Attribute 7 6 7670646E
17:28:19: Attribute 41 6 00000000
17:28:19: RADIUS: Received from id 63 171.68.120.194:1646, Accounting-response,
 len 20
%LINEPROTO-5-UPDOWN: Line protocol on Interface Async1, changed state to up
koala#

!--- The user finishes and disconnects.

%LINEPROTO-5-UPDOWN: Line protocol on Interface Async1, changed state to down
%LINK-5-CHANGED: Interface Async1, changed state to reset
17:28:48: As1 VPDN: Cleanup
17:28:48: As1 VPDN: Reset
17:28:48: As1 VPDN: Reset
17:28:48: As1 VPDN: Unbind interface
17:28:48: AAA/ACCT/NET/STOP User jsmith@hp.com, Port Async1:
task_id=20 start_time=900759730 timezone=UTC service=vpdn disc-cause=2 
disc-cause-ext=1011 pre-bytes-in=-226131998 pre-bytes-out=-1034130241
pre-paks-in=-63570 pre-paks-out=-64410 bytes_in=1999 bytes_out=364 paks_in=29 
paks_out=12 pre-session-time=5 elapsed_time=29 data-rate=0
xmit-rate=0 
17:28:48: RADIUS: Computed extended port value 0:1:
17:28:48: RADIUS: Initial Transmit id 64 171.68.120.194:1646, Accounting-Request,
 len 129
17:28:48: Attribute 4 6 0A1F0105
17:28:48: Attribute 5 6 00000001
17:28:48: Attribute 61 6 00000000
17:28:48: Attribute 1 15 6A736D69
17:28:48: Attribute 40 6 00000002
17:28:48: Attribute 45 6 00000002
17:28:48: Attribute 6 6 00000002
17:28:48: Attribute 44 10 30303030
17:28:48: Attribute 7 6 7670646E
17:28:48: Attribute 49 6 00000002
17:28:48: Attribute 42 6 000007CF
17:28:48: Attribute 43 6 0000016C
17:28:48: Attribute 47 6 0000001D
17:28:48: Attribute 48 6 0000000C
17:28:48: Attribute 46 6 0000001D
17:28:48: Attribute 41 6 00000000
17:28:48: RADIUS: Received from id 64 171.68.120.194:1646, Accounting-response,
 len 20
%LINK-3-UPDOWN: Interface Async1, changed state to down
17:28:51: AAA/AUTHEN: free_user (0x15D334) user='jsmith@hp.com' ruser=''
 port='Async1' rem_addr='async' authen_type=CHAP service=PPP priv=1
koala#

HGW Router Good Debug 

Sneetches#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
Sneetches#
17:28:21: AAA/AUTHEN: create_user (0x14A914) user='hp-gw' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN/START (496523999): port='' list='default' 
action=SENDAUTH service=PPP
17:28:21: AAA/AUTHEN/START (496523999): found list default
17:28:21: AAA/AUTHEN/START (496523999): Method=RADIUS
17:28:21: RADIUS: SENDPASS not supported (action=4)
17:28:21: AAA/AUTHEN (496523999): status = ERROR
17:28:21: AAA/AUTHEN/START (496523999): Method=LOCAL
17:28:21: AAA/AUTHEN (496523999): status = PASS
17:28:21: AAA/AUTHEN: free_user (0x14A914) user='hp-gw' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN: create_user (0x14A914) user='isp' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN/START (3095573082): port='' list='default' 
action=SENDAUTH service=PPP
17:28:21: AAA/AUTHEN/START (3095573082): found list default
17:28:21: AAA/AUTHEN/START (3095573082): Method=RADIUS
17:28:21: RADIUS: SENDPASS not supported (action=4)
17:28:21: AAA/AUTHEN (3095573082): status = ERROR
17:28:21: AAA/AUTHEN/START (3095573082): Method=LOCAL
17:28:21: AAA/AUTHEN (3095573082): status = PASS
17:28:21: AAA/AUTHEN: free_user (0x14A914) user='isp' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN: create_user (0x14ADB4) user='isp' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN/START (3506257139): port='' list='default'
action=LOGIN service=PPP
17:28:21: AAA/AUTHEN/START (3506257139): found list default
17:28:21: AAA/AUTHEN/START (3506257139): Method=RADIUS
17:28:21: RADIUS: Initial Transmit id 53 171.68.118.101:1645, Access-Request, len 68
17:28:21: Attribute 4 6 0A1F0132
17:28:21: Attribute 61 6 00000000
17:28:21: Attribute 1 5 69737003
17:28:21: Attribute 3 19 10C82B7A
17:28:21: Attribute 6 6 00000002
17:28:21: Attribute 7 6 00000001
17:28:21: RADIUS: Received from id 53 171.68.118.101:1645, Access-Accept, len 32
17:28:21: Attribute 6 6 00000002
17:28:21: Attribute 7 6 00000001
17:28:21: AAA/AUTHEN (3506257139): status = PASS
17:28:21: VPDN: Chap authentication succeeded for isp
17:28:21: AAA/AUTHEN: free_user (0x14ADB4) user='isp' ruser='' port='' rem_addr='' 
authen_type=CHAP service=PPP priv=1
17:28:21: Vi1 VPDN: Virtual interface created for jsmith@hp.com
17:28:21: Vi1 VPDN: Set to Async interface
17:28:21: Vi1 VPDN: Clone from Vtemplate 1 filterPPP=0 blocking
%LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
17:28:23: Vi1 VPDN: Bind interface direction=2
17:28:23: Vi1 VPDN: PPP LCP accepted sent & rcv CONFACK
17:28:23: AAA/AUTHEN: create_user (0x143368) user='jsmith@hp.com' ruser=''
 port='Virtual-Access1' rem_addr='async' authen_type=CHAP service=PPP priv=1
17:28:23: AAA/AUTHEN/START (637397616): port='Virtual-Access1' list=''
 action=LOGIN service=PPP
17:28:23: AAA/AUTHEN/START (637397616): using "default" list
17:28:23: AAA/AUTHEN/START (637397616): Method=RADIUS
17:28:23: RADIUS: Computed extended port value 0:60100:
17:28:23: RADIUS: Initial Transmit id 54 171.68.118.101:1645, Access-Request, len 78
17:28:23: Attribute 4 6 0A1F0132
17:28:23: Attribute 5 6 0000EAC4
17:28:23: Attribute 1 15 6A736D69
17:28:23: Attribute 3 19 186C2AC9
17:28:23: Attribute 6 6 00000002
17:28:23: Attribute 7 6 00000001
17:28:23: RADIUS: Received from id 54 171.68.118.101:1645, Access-Accept, len 32
17:28:23: Attribute 6 6 00000002
17:28:23: Attribute 7 6 00000001
17:28:23: AAA/AUTHEN (637397616): status = PASS
17:28:23: AAA/AUTHOR/LCP Vi1: Authorize LCP
17:28:23: AAA/AUTHOR/LCP Vi1 (1528831370): Port='Virtual-Access1' list=''
 service=NET
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) user='jsmith@hp.com'
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) send AV service=ppp
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) send AV protocol=lcp
17:28:23: AAA/AUTHOR/LCP (1528831370) found list "default"
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) Method=RADIUS
17:28:23: AAA/AUTHOR (1528831370): Post authorization status = PASS_REPL
17:28:23: AAA/AUTHOR/LCP Vi1: Processing AV service=ppp
17:28:23: AAA/ACCT/NET/START User jsmith@hp.com, Port Virtual-Access1, List ""
17:28:23: AAA/ACCT/NET: Found list "default"
17:28:23: AAA/AUTHOR/FSM Vi1: (0): Can we start IPCP?
17:28:23: AAA/AUTHOR/FSM Vi1 (4249637449): Port='Virtual-Access1' list=''
 service=NET
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) user='jsmith@hp.com'
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) send AV service=ppp
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) send AV protocol=ip
17:28:23: AAA/AUTHOR/FSM (4249637449) found list "default"
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) Method=RADIUS
17:28:23: AAA/AUTHOR (4249637449): Post authorization status = PASS_REPL
17:28:23: AAA/AUTHOR/FSM Vi1: We can start IPCP
17:28:23: RADIUS: Computed extended port value 0:60100:
17:28:23: RADIUS: Initial Transmit id 55 171.68.118.101:1646, Accounting-Request,
 len 87
17:28:23: Attribute 4 6 0A1F0132
17:28:23: Attribute 5 6 0000EAC4
17:28:23: Attribute 1 15 6A736D69
17:28:23: Attribute 40 6 00000001
17:28:23: Attribute 45 6 00000001
17:28:23: Attribute 6 6 00000002
17:28:23: Attribute 44 10 30303030
17:28:23: Attribute 7 6 00000001
17:28:23: Attribute 41 6 00000000
17:28:23: RADIUS: Received from id 55 171.68.118.101:1646, Accounting-response,
 len 20
17:28:23: AAA/AUTHOR/IPCP Vi1: Start. Her address 0.0.0.0, we want 0.0.0.0
17:28:23: AAA/AUTHOR/IPCP Vi1: Processing AV service=ppp
17:28:23: AAA/AUTHOR/IPCP Vi1: Authorization succeeded
17:28:23: AAA/AUTHOR/IPCP Vi1: Done. Her address 0.0.0.0, we want 0.0.0.0
17:28:23: AAA/AUTHOR/IPCP Vi1: Start. Her address 0.0.0.0, we want 1.1.1.1
17:28:23: AAA/AUTHOR/IPCP Vi1: Processing AV service=ppp
17:28:23: AAA/AUTHOR/IPCP Vi1: Authorization succeeded
17:28:23: AAA/AUTHOR/IPCP Vi1: Done. Her address 0.0.0.0, we want 1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1: Start. Her address 1.1.1.1, we want 1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1 (923857566): Port='Virtual-Access1' list=''
 service=NET
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) user='jsmith@hp.com'
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) send AV service=ppp
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) send AV protocol=ip
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) send AV addr*1.1.1.1
17:28:24: AAA/AUTHOR/IPCP (923857566) found list "default"
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) Method=RADIUS
17:28:24: AAA/AUTHOR (923857566): Post authorization status = PASS_REPL
17:28:24: AAA/AUTHOR/IPCP Vi1: Reject 1.1.1.1, using 1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1: Processing AV service=ppp
17:28:24: AAA/AUTHOR/IPCP Vi1: Processing AV addr*1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1: Authorization succeeded
17:28:24: AAA/AUTHOR/IPCP Vi1: Done. Her address 1.1.1.1, we want 1.1.1.1
%LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
Sneetches#

!--- The user finishes and disconnects.

Sneetches#
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Reset
%LINK-3-UPDOWN: Interface Virtual-Access1, changed state to down
17:28:50: Vi1 VPDN: Cleanup
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Unbind interface
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Reset
17:28:50: AAA/ACCT/NET/STOP User jsmith@hp.com, Port Virtual-Access1:
task_id=14 start_time=900759731 timezone=UTC service=ppp protocol=ip addr=1.1.1.1 
disc-cause=2 disc-cause-ext=1011 pre-bytes-in=0 pre-bytes-out=42
pre-paks-in=0 pre-paks-out=2 bytes_in=882 bytes_out=356 paks_in=17 paks_out=11 
pre-session-time=0 elapsed_time=27 data-rate=0 xmit-rate=0 
17:28:50: RADIUS: Computed extended port value 0:60100:
17:28:50: RADIUS: Initial Transmit id 56 171.68.118.101:1646, Accounting-Request,
 len 129
17:28:50: Attribute 4 6 0A1F0132
17:28:50: Attribute 5 6 0000EAC4
17:28:50: Attribute 1 15 6A736D69
17:28:50: Attribute 40 6 00000002
17:28:50: Attribute 45 6 00000001
17:28:50: Attribute 6 6 00000002
17:28:50: Attribute 44 10 30303030
17:28:50: Attribute 7 6 00000001
17:28:50: Attribute 8 6 01010101
17:28:50: Attribute 49 6 00000002
17:28:50: Attribute 42 6 00000372
17:28:50: Attribute 43 6 00000164
17:28:50: Attribute 47 6 00000011
17:28:50: Attribute 48 6 0000000B
17:28:50: Attribute 46 6 0000001B
17:28:50: Attribute 41 6 00000000
17:28:50: RADIUS: Received from id 56 171.68.118.101:1646, Accounting-response,
 len 20
17:28:50: AAA/AUTHEN: free_user (0x143368) user='jsmith@hp.com' ruser=''
 port='Virtual-Access1' rem_addr='async' authen_type=CHAP service=PPP
priv=1
%LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1,
  changed state to down
Sneetches#

Debugs for failed connection on ISP Router 

koala#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
koala#

!--- Problem 1: !--- User hp.com is not in the ISP server: !--- There is no output on HGW router because the call has not gone that far.

RADIUS: Received from id 83 171.68.120.194:1645, Access-Reject, len 20 18:43:18: 
AAA/AUTHEN (4063976505): status = FAIL

!--- Problem 2: !--- User hp.com is not in the ISP server. !--- There is no output on HGW router because !--- the call has not gone that far.

RADIUS: Received from id 83 171.68.120.194:1645, Access-Reject, len 20 18:43:18: 
AAA/AUTHEN (4063976505): status = FAIL

!--- Problem 3: !--- Problem in tunnel definition on HGW router; in HGW configuration !--- vpdn incoming hp-gw isp virtual-template 1 is inserted !--- instead of vpdn incoming isp hp-gw virtual-template 1.

%VPDN-5-UNREACH: L2F HGW 10.31.1.50 is unreachable
VPDN: Timeout opening tunnel to 10.31.1.50
VPDN: Free busy address 10.31.1.50

!--- Problem 4: !--- User "isp" or "hp-gw" is removed from HGW router.

%VPDN-6-AUTHENFAIL: L2F NAS koala, authentication failure for tunnel hp-gw; 
 Invalid key

!--- Problem 5: !--- User "isp" is not in the HGW server.

%VPDN-6-AUTHENFAIL: L2F HGW , AAA authentication failure for tunnel hp-gw

!--- Problem 6: !--- User jsmith@hp.com is not in the HGW server.

%VPDN-6-AUTHENFAIL: L2F HGW hp-gw, AAA authentication failure for As1 
user jsmith@hp.com; Authentication failure

Debugs for Failed connections on HGW Router 

Sneetches#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
Sneetches#

!--- Problem 1: !--- Problem in tunnel definition on the HGW router; in HGW configuration !--- vpdn incoming hp-gw isp virtual-template 1 is inserted !--- instead of vpdn incoming isp hp-gw virtual-template 1 !--- debug vpdn l2f-errors display.

19:25:27: L2F: Couldn't find tunnel named isp
19:25:30: L2F: Couldn't find tunnel named isp

!--- Problem 2: !--- User "isp" is removed from the HGW router.

AAA/AUTHEN (3372073334): SENDAUTH no password for isp
AAA/AUTHEN (3372073334): status = ERROR
AAA/AUTHEN/START (3372073334): no methods left to try
AAA/AUTHEN (3372073334): status = ERROR
AAA/AUTHEN/START (3372073334): failed to authenticate

!--- Problem 3: !--- User "hp-gw" is removed from the HGW router.

AAA/AUTHEN (3999868118): SENDAUTH no password for hp-gw
AAA/AUTHEN (3999868118): status = ERROR
AAA/AUTHEN/START (3999868118): no methods left to try
AAA/AUTHEN (3999868118): status = ERROR
AAA/AUTHEN/START (3999868118): failed to authenticate

!--- Problem 4: !--- User "isp" is removed from HGW RADIUS server.

RADIUS: Received from id 107 171.68.118.101:1645, Access-Reject, len 46
Attribute 18 26 41757468
AAA/AUTHEN (2759462034): status = FAIL
VPDN: Chap authentication failed for isp
%VPDN-6-AUTHENFAIL: L2F HGW , AAA authentication failure for tunnel isp

!--- Problem 5: !--- User "jsmith@hp.com" is not in the HGW server.

RADIUS: Received from id 109 171.68.118.101:1645, Access-Reject, len 46
Attribute 18 26 41757468
AAA/AUTHEN (2765235576): status = FAIL
%VPDN-6-AUTHENFAIL: L2F HGW hp-gw, AAA authentication failure for Vi1
 user jsmith@hp.com; Authentication failure

Related Information

Revision History

Revision Publish Date Comments
1.0
26-Feb-2008
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products