VPDN Tunnel Management
Available Languages
Table Of Contents
Prerequisites for VPDN Tunnel Management
Information About VPDN Tunnel Management
Control Packet Parameters for VPDN Tunnels
Manually Terminating VPDN Tunnels
Enabling Soft Shutdown of VPDN Tunnels
Verifying the Soft Shutdown of VPDN Tunnels
Limiting the Number of Allowed Simultaneous VPDN Sessions
Configuring Global VPDN Session Limits
Configuring VPDN Session Limits in a VPDN Template
Configuring Session Limits for a VPDN Group
Configuring L2TP Control Packet Parameters for VPDN Tunnels
Configuring L2F Control Packet Parameters for VPDN Tunnels
Configuring L2TP Congestion Avoidance
How L2TP Congestion Avoidance Works
Prerequisites for L2TP Congestion Avoidance
Restrictions for L2TP Congestion Avoidance
Enabling L2TP Congestion Avoidance on the Sending Device
Verifying L2TP Congestion Avoidance
Configuring VPDN Failure Event Logging
Enabling Generic VPDN Event Logging
Configuration Examples for VPDN Tunnel Management
Manually Terminating VPDN Tunnels: Examples
Enabling Soft Shutdown of VPDN Tunnels: Example
Configuring VPDN Session Limits: Examples
Verifying Session Limits for a VPDN Group: Example
Configuring L2F Control Packet Timers and Retry Counters for VPDN Tunnels: Example
Configuring L2TP Control Packet Timers and Retry Counters for VPDN Tunnels: Example
Configuring L2TP Congestion Avoidance: Example
Configuring VPDN Failure Event Logging: Example
Configuring Generic VPDN Event Logging: Examples
Feature Information for VPDN Tunnel Management
VPDN Tunnel Management
This module contains information about managing virtual private dialup network (VPDN) tunnels and monitoring VPDN events. The tasks documented in this module should be performed only after configuring and deploying a VPDN.
Module History
This module was first published on October 31, 2005, and last updated on February 28, 2006.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all features. To find information about feature support and configuration, use the "Feature Information for VPDN Tunnel Management" section.
Contents
•
Prerequisites for VPDN Tunnel Management
•
•
•
Prerequisites for VPDN Tunnel Management
Before you can perform the tasks in this module, you must configure a VPDN deployment. For an overview of VPDN deployments, refer to the "VPDN Technology Overview" module.
Information About VPDN Tunnel Management
Before you perform the tasks in this module, you should understand the following concepts:
•
Termination of VPDN Tunnels
VPDN tunnels can be terminated manually or through a soft shutdown. Manual termination of a VPDN tunnel results in the immediate shut down of the specified VPDN tunnel and all sessions within that tunnel, resulting in a sudden disruption of VPDN services. Enabling soft shutdown on a router prevents the establishment of new VPDN sessions in all VPDN tunnels that terminate on that router, but does not affect existing sessions. Opting to terminate a VPDN tunnel by enabling soft shutdown prevents the disruption of established sessions that occurs when a VPDN tunnel is manually terminated.
VPDN Session Limits
The number of simultaneous VPDN sessions that can be established on a router can be manually configured, providing network administrators more control over the network. VPDN session limits can increase performance and reduce latency for routers that are otherwise forced to operate at high capacity.
The maximum number of VPDN sessions can be configured globally, at the level of a VPDN group, or for all VPDN groups associated with a particular VPDN template.
The hierarchy for the application of VPDN session limits is as follows:
•
•
•
Control Packet Parameters for VPDN Tunnels
Certain control packet timers, retry counters, and the advertised control packet receive window size can be configured for Layer 2 Transport Protocol (L2TP) or Layer 2 Forwarding (L2F) VPDN tunnels. Adjustments to these parameters allow fine-tuning of router performance to suit the particular needs of the VPDN deployment.
L2TP Congestion Avoidance
L2TP congestion avoidance provides packet flow control and congestion avoidance by throttling L2TP control messages as described in RFC 2661. Throttling L2TP control message packets prevents input buffer overflows on the peer tunnel endpoint, which can result in dropped sessions.
Before the introduction of L2TP congestion avoidance, the window size used to send packets between the network access server (NAS) and the tunnel server was set to the value advertised by the peer endpoint and was never changed. Configuring L2TP congestion avoidance allows the L2TP packet window to be dynamically resized using a sliding window mechanism. The window size grows larger when packets are delivered successfully, and is reduced when dropped packets must be retransmitted.
L2TP congestion avoidance is useful in networks with a relatively high rate of calls being placed by either tunnel endpoint. L2TP congestion avoidance is also useful on highly scalable platforms such as the Cisco 10000 router, which supports a large number of simultaneous sessions.
VPDN Event Logging
There are two types of VPDN event logging available, VPDN failure event logging and generic VPDN event logging. The logging of VPDN failure events is enabled by default. Generic VPDN event logging is disabled by default, and must be explicitly enabled before generic event messages can be viewed.
How to Manage VPDN Tunnels
Perform any of the following tasks to manage your VPDN tunnels:
•
•
•
•
•
•
•
•
•
•
Manually Terminating VPDN Tunnels
Manual termination of a VPDN tunnel results in the immediate shutdown of the specified VPDN tunnel and all sessions within that tunnel, resulting in a sudden disruption of VPDN services. Before manually terminating a VPDN tunnel, you may want to consider performing the task in the "Enabling Soft Shutdown of VPDN Tunnels" section instead.
A manually terminated VPDN tunnel can be restarted immediately when a user logs in. Manually terminating and restarting a VPDN tunnel while VPDN event logging is enabled can provide useful troubleshooting information about VPDN session establishment.
Perform this task to manually shut down a specific VPDN tunnel, resulting in the termination of the tunnel and all sessions in that tunnel. You may perform this task on the following devices:
•
•
Restrictions
For Point-to-Point Tunneling Protocol (PPTP) tunnels and client-initiated L2TP tunnels, you may perform this task only on the tunnel server.
SUMMARY STEPS
1.
2.
3.
4.
or
clear vpdn tunnel l2f {all | hostname nas-name hgw-name | id local-id | ip local-ip-address | ip remote-ip-address}DETAILED STEPS
What to Do Next
If you would like to observe VPDN tunnel event messages during the reestablishment of the cleared tunnel, you may perform the task in the "Enabling Generic VPDN Event Logging" section.
Enabling Soft Shutdown of VPDN Tunnels
Enabling soft shutdown of VPDN tunnels on a router prevents the establishment of new VPDN sessions in all VPDN tunnels that terminate on that router, but does not affect existing sessions. Opting to terminate a VPDN tunnel by enabling soft shutdown prevents the disruption of established sessions that occurs when a VPDN tunnel is manually terminated. Enabling soft shutdown on a router or access server will affect all of the tunnels terminating on that device. There is no way to enable soft shutdown for a specific tunnel. If you want to shut down a specific tunnel on a device without affecting any other tunnels, you may perform the task in the "Manually Terminating VPDN Tunnels" section instead.
When soft shutdown is performed on a NAS, the potential session will be authorized before it is refused. This authorization ensures that accurate accounting records can be kept.
When soft shutdown is performed on a tunnel server, the reason for the session refusal will be returned to the NAS. This information is recorded in the VPDN history failure table.
Note
Perform this task to prevent new sessions from being established in any VPDN tunnel terminating on the router without disturbing service for existing sessions. You may perform this task on the following devices:
•
•
Restrictions
•
•
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
What to Do Next
You may proceed to the optional task in the "Verifying the Soft Shutdown of VPDN Tunnels" section.
Verifying the Soft Shutdown of VPDN Tunnels
Perform this task to ensure that soft shutdown is working properly.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Step 1
Step 2
Enter this command to enable privileged EXEC mode. Enter your password if prompted:
Router> enableStep 3
Enters global configuration mode.
Router# configure terminal
Step 4
Prevents new sessions from being established on a VPN tunnel without disturbing existing sessions. You may issue this command on either the NAS or the tunnel server.
Router(config)# vpdn softshut
Step 5
Exits to privileged EXEC mode.
Router(config)# exitStep 6
Displays information about active L2TP or L2F tunnels and message identifiers in a VPDN. Issue this command to verify that the original session is active:
Router# show vpdn% No active L2TP tunnelsL2F Tunnel and SessionNAS CLID HGW CLID NAS Name HGW Name State36 1 NAS1 tunnelserver1 open172.25.52.8 172.25.52.7CLID MID Username Intf State36 1 user1@cisco.com Vi1 openStep 7
If soft shutdown has been enabled, a system logging (syslog) message similar to the following should appear on the console of the soft shutdown router:
00:11:17:%VPDN-6-SOFTSHUT:L2F HGW tunnelserver1 has turned on softshut and rejected user user2@cisco.comStep 8
Shows the content of the history failure table.
Router# show vpdn history failureUser:user2@ cisco.comNAS:NAS1, IP address = 172.25.52.8, CLID = 2Gateway:tunnelserver1, IP address = 172.25.52.7, CLID = 13Log time:00:04:21, Error repeat count:1!!This output demonstrates that soft shutdown has been successful.Failure type:VPDN softshut has been activated.!Failure reason:
Limiting the Number of Allowed Simultaneous VPDN Sessions
The number of simultaneous VPDN sessions that can be established on a router can be manually configured, providing network administrators more control over the network. VPDN session limits can increase performance and reduce latency for routers that are otherwise forced to operate at high capacity.
The maximum number of VPDN sessions can be configured globally, at the level of a VPDN group, or for all VPDN groups associated with a particular VPDN template.
The hierarchy for the application of VPDN session limits is as follows:
•
•
•
For an example of the interactions of global, template-level, and group-level VPDN session limits, see the "Configuring VPDN Session Limits: Examples" section.
Perform any or all of the following optional tasks to configure VPDN session limits:
•
•
•
You may perform these tasks on the NAS or the tunnel server.
Restrictions
For PPTP tunnels and client-initiated L2TP tunnels, you may perform these tasks only on the tunnel server.
Configuring Global VPDN Session Limits
Perform this task to limit the total number of VPDN sessions allowed on the router.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
What to Do Next
•
•
•
Configuring VPDN Session Limits in a VPDN Template
Perform this task to configure a session limit in a VPDN template. The session limit will be applied across all VPDN groups associated with the VPDN template.
Prerequisites
•
•
•
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
What to Do Next
•
•
Configuring Session Limits for a VPDN Group
Perform this task to limit the number of VPDN sessions at the VPDN group level.
Prerequisites
You must be running Cisco IOS Release 12.2(4)T, Cisco IOS Release 12.2(28)SB, or a later release.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
What to Do Next
You may perform the optional task in the "Verifying VPDN Session Limits" section.
Verifying VPDN Session Limits
Perform this task to ensure that VPDN sessions are being limited properly.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Step 1
Enter this command to enable privileged EXEC mode. Enter your password if prompted:
Router> enableStep 2
Enters global configuration mode.
Router# configure terminal
Step 3
Limits the number of simultaneous VPDN sessions on the router to the number specified with the sessions argument.
Issue this command on either the NAS or the tunnel server.
Router(config)# vpdn session-limit 1
Step 4
Step 5
If VPDN session limits have been configured properly, this session will be refused and a syslog message similar to the following should appear on the console of the router:
00:11:17:%VPDN-6-MAX_SESS_EXCD:L2F HGW tunnelserver1 has exceeded configured local session-limit and rejected user user2@cisco.comStep 6
Exits to privileged EXEC mode.
Step 7
Shows the content of the history failure table.
Router# show vpdn history failureUser:user2@scisco.comNAS:NAS1, IP address = 172.25.52.8, CLID = 2Gateway:tunnelserver1, IP address = 172.25.52.7, CLID = 13Log time:00:04:21, Error repeat count:1Failure type:Exceeded configured VPDN maximum session limit.!This output shows that the configured session limit is being properly applied.Failure reason:
Configuring L2TP Control Packet Parameters for VPDN Tunnels
Control packet timers, retry counters, and the advertised control packet receive window size can be configured for L2TP VPDN tunnels. Adjustments to these parameters allow fine-tuning of router performance to suit the particular needs of the VPDN deployment.
Perform this task to configure control packet parameters if your VPDN configuration uses L2TP tunnels. The configuration of each parameter is optional. If a parameter is not manually configured, the default value will be used.
You may perform this task on the following devices:
•
•
Prerequisites
•
•
Restrictions
For client-initiated L2TP tunnels, you may perform this task only on the tunnel server.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
DETAILED STEPS
2
Configuring L2F Control Packet Parameters for VPDN Tunnels
Beginning in Cisco IOS Release 12.2(4)T and Cisco IOS Release 12.2(28)SB, certain control packet timers and retry counters can be configured for L2F VPDN tunnels. Adjustments to these parameters allow fine-tuning of router performance to suit the particular needs of the VPDN deployment.
Perform this task to configure control packet timers and retry counters if your VPDN configuration uses L2F tunnels. The configuration of each parameter is optional. If a parameter is not manually configured, the default values will be used.
You may perform this task on the NAS or the tunnel server.
Prerequisites
You must be running Cisco IOS Release 12.2(4)T, Cisco IOS Release 12.2(28)SB, or a later release.
Restrictions
Load balancing must be enabled for the configuration of the l2f tunnel retransmit initial retries command to have any effect.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Configuring L2TP Congestion Avoidance
L2TP congestion avoidance provides packet flow control and congestion avoidance by throttling L2TP control messages as described in RFC 2661. Throttling L2TP control message packets prevents input buffer overflows on the peer tunnel endpoint, which can result in dropped sessions.
Before the introduction of L2TP congestion avoidance, the window size used to send packets between the NAS and the tunnel server was set to the value advertised by the peer endpoint and was never changed. Configuring L2TP congestion avoidance allows the L2TP packet window to be dynamically resized using a sliding window mechanism. The window size grows larger when packets are delivered successfully, and is reduced when dropped packets must be retransmitted.
L2TP congestion avoidance is useful in networks with a relatively high rate of calls being placed by either tunnel endpoint. L2TP congestion avoidance is also useful on highly scalable platforms such as the Cisco 10000 router, which supports a large number of simultaneous sessions.
The following sections contain additional information about L2TP congestion avoidance:
•
•
•
Perform the following tasks to configure L2TP congestion avoidance:
•
•
How L2TP Congestion Avoidance Works
TCP/IP and RFC 2661 define two algorithms—slow start and congestion avoidance—used to throttle control message traffic between a NAS and a tunnel server. Slow start and congestion avoidance are two independent algorithms that work together to control congestion. Slow start and congestion avoidance require that two variables, a slow start threshold (SSTHRESH) size and a congestion window (CWND) size, be maintained by the sending device for each connection.
The congestion window defines the number of packets that can be transmitted before the sender must wait for an acknowledgment from its peer. The size of the congestion window expands and contracts, but may never exceed the size of the peer device's advertised receive window.
The slow start threshold defines the point at which the sending device switches operation from slow start mode to congestion avoidance mode. When the congestion window size is smaller than the slow start threshold, the device operates in slow start mode. When the congestion window size equals the slow start threshold, the device switches to congestion avoidance mode.
When a new connection is established, the sending device initially operates in slow start mode. The congestion window size is initialized to one packet, and the slow start threshold is set to the receive window size advertised by the peer tunnel endpoint (the receiving side).
The sending device begins by transmitting one packet and waiting for it to be acknowledged. When the acknowledgment is received, the congestion window size is incremented from one to two, and two packets can be sent. When those two packets are each acknowledged, the congestion window is increased to four. The congestion window doubles for each complete round trip, resulting in an exponential increase in size.
When the congestion window size reaches the slow start threshold value, the sending device switches over to operate in congestion avoidance mode. Congestion avoidance mode slows down the rate at which the congestion window size grows. In congestion avoidance mode, for every acknowledgment received the congestion window increases at the rate of 1 divided by the congestion window size. This results in linear, rather than exponential, growth of the congestion window size.
At some point, the capacity of the peer device will be exceeded and packets will be dropped. This indicates to the sending device that the congestion window has grown too large. When a retransmission event is detected, the slow start threshold value is reset to half of the current congestion window size, the congestion window size is reset to one, and the device switches operation to slow start mode (if it was not already operating in that mode).
Prerequisites for L2TP Congestion Avoidance
You must be running Cisco IOS Release 12.2(28)SB or a later release.
Restrictions for L2TP Congestion Avoidance
•
•
•
•
Enabling L2TP Congestion Avoidance on the Sending Device
Perform this task to enable L2TP congestion avoidance on a tunnel endpoint, allowing dynamic throttling of the L2TP control packet window size.
You may perform this task on the following devices:
•
•
This task need only be performed on the sending device.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
What to Do Next
You may perform the optional task in the "Verifying L2TP Congestion Avoidance" section.
Verifying L2TP Congestion Avoidance
Perform this task to verify that L2TP congestion avoidance is enabled, to determine the current congestion window size and slow start threshold, and to detect congestion control events.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Step 1
Enter this command to enable privileged EXEC mode. Enter your password if prompted:
Router> enableStep 2
Displays information about all active L2TP VPDN tunnels.
The following example shows L2TP tunnel activity, including the information that L2TP congestion control is enabled. Note that the slow start threshold is set to the same size as the remote receive window size. The bold text highlights the relevant output.
Router# show vpdn tunnel l2tp allL2TP Tunnel Information Total tunnels 1 sessions 1Tunnel id 30597 is up, remote id is 45078, 1 active sessionsTunnel state is established, time since change 00:08:27Tunnel transport is UDP (17)Remote tunnel name is LAC1Internet Address 172.18.184.230, port 1701Local tunnel name is LNS1Internet Address 172.18.184.231, port 1701Tunnel domain unknownVPDN group for tunnel is 1L2TP class for tunnel is4 packets sent, 3 received194 bytes sent, 42 receivedLast clearing of "show vpdn" counters neverControl Ns 2, Nr 4Local RWS 500, Remote RWS 500Control channel Congestion Control is enabledCongestion Window size, Cwnd 3Slow Start threshold, Ssthresh 500Mode of operation is Slow StartTunnel PMTU checking disabledRetransmission time 1, max 2 secondsUnsent queuesize 0, max 0Resend queuesize 0, max 1Total resends 0, ZLB ACKs sent 2Current nosession queue check 0 of 5Retransmit time distribution: 0 0 0 0 0 0 0 0 0Sessions disconnected due to lack of resources 0Control message authentication is disabledStep 3
Displays troubleshooting information for protocol-specific VPDN tunneling events.
The following partial output from the debug vpdn l2x-events command shows that congestion occurred. The congestion window size and the slow start threshold have been reset due to a packet retransmission event. The bold text highlights the relevant output.
Router# debug vpdn l2x-events!*Jul 15 19:02:57.963: Tnl 47100 L2TP: Congestion Control event received is retransmission*Jul 15 19:02:57.963: Tnl 47100 L2TP: Congestion Window size, Cwnd 1*Jul 15 19:02:57.963: Tnl 47100 L2TP: Slow Start threshold, Ssthresh 2*Jul 15 19:02:57.963: Tnl 47100 L2TP: Remote Window size, 500*Jul 15 19:02:57.963: Tnl 47100 L2TP: Control channel retransmit delay set to 4 seconds*Jul 15 19:03:01.607: Tnl 47100 L2TP: Update ns/nr, peer ns/nr 2/5, our ns/nr 5/2!The following partial output from the debug vpdn l2x-events command shows that traffic has been restarted with L2TP congestion avoidance operating in slow start mode. The bold text highlights the relevant output.
Router# debug vpdn l2x-events!*Jul 15 14:45:16.123: Tnl 30597 L2TP: Control channel retransmit delay set to 2 seconds*Jul 15 14:45:16.123: Tnl 30597 L2TP: Tunnel state change from idle to wait-ctl-reply*Jul 15 14:45:16.131: Tnl 30597 L2TP: Congestion Control event received is positive acknowledgement*Jul 15 14:45:16.131: Tnl 30597 L2TP: Congestion Window size, Cwnd 2*Jul 15 14:45:16.131: Tnl 30597 L2TP: Slow Start threshold, Ssthresh 500*Jul 15 14:45:16.131: Tnl 30597 L2TP: Remote Window size, 500*Jul 15 14:45:16.131: Tnl 30597 L2TP: Congestion Ctrl Mode is Slow Start!
Configuring VPDN Failure Event Logging
Logging of a failure event to the history table is triggered by event logging by the syslog facility. The syslog facility creates a history failure table, which keeps records of failure events. The table defaults to a maximum of 20 entries, but the size of the table can be configured to retain up to 50 entries.
Failure entries are kept chronologically in the history table. Each entry records the relevant information of a failure event. Only the most recent failure event per user, unique to its name and tunnel client ID (CLID), is kept. When the total number of entries in the table reaches the configured maximum table size, the oldest record is deleted and a new entry is added.
The logging of VPDN failure events to the VPDN history failure table is enabled by default. You need enable VPDN failure event logging only if it has been previously disabled. Perform this task to enable VPDN failure event logging, to configure the maximum number of entries the history failure table can hold, and to display and clear the contents of the VPDN history failure table.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Enabling Generic VPDN Event Logging
Generic VPDN events are a mixture of error, warning, notification, and information reports logged by the syslog facility. When VPDN event logging is enabled locally or at a remote tunnel endpoint, VPDN event messages are printed to the console as the events occur. VPDN event messages can also be reported to a remote authentication, authorization, and accounting (AAA) server in a AAA vendor-specific attribute (VSA), allowing the correlation of VPDN call success rates with accounting records.
Perform this task to enable generic VPDN event logging.
SUMMARY STEPS
1.
2.
3.
DETAILED STEPS
Configuration Examples for VPDN Tunnel Management
This section contains the following configuration examples:
•
•
•
•
•
•
•
•
•
Manually Terminating VPDN Tunnels: Examples
The following example manually terminates all L2TP tunnels that terminate on the router:
Router# clear vpdn tunnel l2tp all
The following example manually terminates the L2F tunnel with the tunnel ID 32:
Router# clear vpdn tunnel l2f id 32Enabling Soft Shutdown of VPDN Tunnels: Example
The following example enables soft shutdown of all VPDN tunnels that terminate on the device that the command is issue on:
Router# configure terminalRouter(config)# vpdn softshutRouter(config)#
!The following syslog message will appear on the device whenever an attempt is made to !establish a new VPDN session after soft shutdown is enabled.!00:11:17:%VPDN-6-SOFTSHUT:L2F HGW tunnelserver1 has turned on softshut and rejected user user2@cisco.comConfiguring VPDN Session Limits: Examples
The following example configures a VPDN group named customer7 with a group-level session limit of 25. No more than 25 sessions may be associated with this VPDN group.
Router(config)# vpdn-group customer7Router(config-vpdn)# session-limit 25A VPDN template named customer4 is then created, and a session limit of 8 is configured at the VPDN template-level. Two VPDN groups are associated with the VPDN template, each with a VPDN group-level session limit of 5.
Router(config)# vpdn-template customer4Router(config-vpdn-templ)# group session-limit 8!Router(config)# vpdn-group customer4_l2tpRouter(config-vpdn)# source vpdn-template customer4Router(config-vpdn)# session-limit 5!Router(config)# vpdn-group customer4_l2fRouter(config-vpdn)# source vpdn-template customer4Router(config-vpdn)# session-limit 5With this configuration, if the VPDN group named customer4_l2tp has 5 active sessions, the VPDN group named customer4_l2f may establish only 3 sessions. The VPDN group named customer7 may still have up to 25 active sessions.
If a global limit of 16 VPDN sessions is also configured, the global limit takes precedence over the configured VPDN group and VPDN template session limits.
Router# configure terminalRouter(config)# vpdn session-limit 16The three VPDN groups will be able to establish a total of 16 sessions between them. For example, if the VPDN group named customer4_l2tp has the maximum allowable number of active sessions (5 sessions), and the VPDN group named customer4_l2f has 2 active sessions, the VPDN group named customer7 may establish only up to 9 sessions.
Verifying Session Limits for a VPDN Group: Example
The following example creates the VPDN group named l2tp and restricts it to three sessions. The configured session limit is displayed when the show vpdn group command is issued.
Router# configure terminalRouter(config)# vpdn-group l2tpRouter(config-vpdn)# accept dialinRouter(config-vpdn-acc-in)# protocol l2tpRouter(config-vpdn-acc-in)# virtual-template 5Router(config-vpdn-acc-in)# exitRouter(config-vpdn)# terminate-from hostname host1Router(config-vpdn)# session-limit 3Router(config-vpdn)# endRouter# show vpdn group l2tpTunnel (L2TP)------dnis:cg1dnis:cg2dnis:jancisco.comEndpoint Session Limit Priority Active Sessions Status Reserved Sessions-------- ------------- -------- --------------- ------ -----------------172.21.9.67 3 1 0 OK ---------------- ------------- --------------- -----------------Total * 0 0Configuring L2F Control Packet Timers and Retry Counters for VPDN Tunnels: Example
The following example configures all of the available L2F control packet timers and retry counters for the VPDN group named l2f:
Router# configure terminalRouter(config)# vpdn-group l2f
Router(config-vpdn)# l2f tunnel timeout setup 25Router(config-vpdn)# l2f tunnel retransmit initial retries 5Router(config-vpdn)# l2f tunnel busy timeout 90Router(config-vpdn)# l2f tunnel retransmit retries 10Configuring L2TP Control Packet Timers and Retry Counters for VPDN Tunnels: Example
The following example configures custom values for all of the available L2TP control packet parameters for the VPDN group named l2tp:
Router# configure terminalRouter(config)# vpdn-group l2tp
Router(config-vpdn)# l2tp tunnel hello 90Router(config-vpdn)# l2tp tunnel receive window 500Router(config-vpdn)# l2tp tunnel retransmit retries 8Router(config-vpdn)# l2tp tunnel retransmit timeout min 2Router(config-vpdn)# l2tp tunnel timeout no-session 500Router(config-vpdn)# l2tp tunnel timeout setup 25Router(config-vpdn)# l2tp tunnel zlb delay 4Router(config-vpdn)# l2tp tunnel retransmit initial timeout min 2Router(config-vpdn)# l2tp tunnel retransmit initial retries 5Router(config-vpdn)# l2tp tunnel busy timeout 90Configuring L2TP Congestion Avoidance: Example
The following example configures a basic dial-in L2TP VPDN tunnel, sets the receive window size to 500 on the tunnel server (the receiving device), and enables L2TP congestion avoidance on the NAS (the sending device):
Tunnel Server Configuration
Router(config)# vpdn enable!Router(config)# vpdn-group 1Router(config-vpdn)# accept-dialinRouter(config-vpdn-acc-in)# protocol l2tpRouter(config-vpdn-acc-in)# virtual-template 1!Router(config-vpdn)# terminate from hostname NAS1Router(config-vpdn)# l2tp tunnel receive-window 500NAS Configuration
Router(config)# vpdn enable!Router(config)# vpdn-group 1Router(config-vpdn)# request-dialinRouter(config-vpdn-req-in)# protocol l2tpRouter(config-vpdn-req-in)# domain cisco.com!Router(config-vpdn)# initiate-to ip 172.22.66.25Router(config-vpdn)# local name NAS1!Router(config)# l2tp congestion-controlConfiguring VPDN Failure Event Logging: Example
The following example first disables and then reenables VPDN failure event logging, and sets the maximum number of entries in the VPDN history failure table to 50. The contents of the history failure table are displayed and then cleared.
Router# configure terminalRouter(config)# no vpdn history failureRouter(config)# vpdn history failureRouter(config)# vpdn history failure table-size 50Router(config)# endRouter# show vpdn history failure!Table size: 50Number of entries in table: 1User: user@cisco.com, MID = 1NAS: isp, IP address = 172.21.9.25, CLID = 1Gateway: hp-gw, IP address = 172.21.9.15, CLID = 1Log time: 13:08:02, Error repeat count: 1Failure type: The remote server closed this sessionFailure reason: Administrative intervention!Router# clear vpdn history failureConfiguring Generic VPDN Event Logging: Examples
The following example enables VPDN logging locally:
Router# configure terminalRouter(config)# vpdn logging localThe following example disables VPDN event logging locally, enables VPDN event logging at the remote tunnel endpoint, and enables the logging of both VPDN user and VPDN tunnel-drop events to the remote router:
Router# configure terminalRouter(config)# no vpdn logging localRouter(config)# vpdn logging remoteRouter(config)# vpdn logging userRouter(config)# vpdn logging tunnel-dropThe following example disables the logging of VPDN events at the remote tunnel endpoint, and enables the logging of VPDN event log messages to the AAA server:
Router# configure terminalRouter(config)# no vpdn logging localRouter(config)# no vpdn logging remoteRouter(config)# vpdn logging accountingAdditional References
The following sections provide references related to VPDN tunnel management.
Related Documents
VPDN technology overview
VPDN commands: complete command syntax, command mode, defaults, usage guidelines, and examples
Cisco IOS VPDN Command Reference, Release 12.4T
Technical support documentation for VPDNs
Dial Technologies commands: complete command syntax, command mode, defaults, usage guidelines, and examples
Cisco IOS Dial Technologies Command Reference, Release 12.4T
Standards
TCP/IP; slow start and congestion avoidance algorithms
TCP/IP Illustrated, Volume 1, by W Richard Stevens
MIBs
RFCs
RFC 2341
Cisco Layer Two Forwarding (Protocol) "L2F"
RFC 2637
Point-to-Point Tunneling Protocol (PPTP)
RFC 2661
Layer Two Tunneling Protocol "L2TP"
Technical Assistance
Feature Information for VPDN Tunnel Management
Table 11 lists the features in this module and provides links to specific configuration information. Only features that were introduced or modified in Cisco IOS Releases 12.2(1) or a later release appear in the table.
Not all commands may be available in your Cisco IOS software release. For details on when support for specific commands was introduced, see the command reference documents.
If you are looking for information on a feature in this technology that is not documented here, see the "VPDN Features Roadmap."
Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Table 11 Feature Information for VPDN Tunnel Management
L2TP Congestion Avoidance
12.2(28)SB
This feature provides packet flow control and congestion avoidance by throttling Layer 2 Transport Protocol (L2TP) control messages as described in RFC 2661.
The following sections provide information about this feature:
•
The following commands were introduced or modified by this feature: debug vpdn, l2tp congestion-control.
Session Limit per VRF
12.2(13)T
This feature allows you to apply session limits on all VPDN groups associated with a common VPDN template. You can limit the number of VPDN sessions that terminate in a single VPN Routing and Forwarding (VRF) instance.
The following sections provide information about this feature:
•
The following commands were introduced or modified by this feature: group session-limit, source vpdn-template, vpdn-template.
Timer and Retry Enhancements for L2TP and L2F
12.2(4)T
12.2(28)SBThis feature allows the user to configure certain adjustable timers and counters for L2TP and L2F.
The following sections provide information about this feature:
•
•
•
The following commands were introduced by this feature: l2f tunnel busy timeout, l2f tunnel retransmit initial retries, l2f tunnel retransmit retries, l2f tunnel timeout setup, l2tp tunnel busy timeout, l2tp tunnel retransmit initial retries, l2tp tunnel retransmit initial timeout.
VPDN Group Session Limiting
12.2(4)T
12.2(28)SBThis feature allows the user to configure a limit on the number of L2F or L2TP VPDN sessions allowed for each VPDN group.
The following sections provide information about this feature:
•
•
The following command was introduced by this feature: session-limit (VPDN).
© 2006 Cisco Systems, Inc. All rights reserved.
This module first published October 31, 2005. Last updated February 28, 2006.
Feedback