The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The RADIUS Logical Line ID feature, also known as the Logical Line Identification (LLID) Blocking feature enables administrators to track their customers on the basis of the physical lines on which customer calls originate. Administrators use a virtual port that does not change as customers move from one physical line to another. This virtual port facilitates the maintenance of the administrator's customer profile database and allows the administrator to do additional security checks on customers.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for RADIUS Logical Line ID" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
•Prerequisites for RADIUS Logical Line ID
•Restrictions for RADIUS Logical Line ID
•Information About RADIUS Logical Line ID
•How to Configure RADIUS Logical Line ID
•Configuration Examples for RADIUS Logical Line ID
•Feature Information for RADIUS Logical Line ID
Although this feature can be used with any RADIUS server, some RADIUS servers may require modifications to their dictionary files to allow the Calling-Station-ID attribute to be returned in Access-Accept messages. For example, the Merit RADIUS server does not support LLID downloading unless you modify its dictionary as follows: "ATTRIBUTE Calling-Station-Id 31 string (*, *)"
The RADIUS Logical Line ID feature supports RADIUS only. TACACS+ is not supported.
This feature can be applied only toward PPP over Ethernet over ATM (PPPoEoATM) and PPP over Ethernet over VLAN (PPPoEoVLAN) (Dot1Q) calls; no other calls, such as ISDN, can be used.
LLID is an alphanumeric string (which must be a minimum of one character and a maximum of 253 characters) that is a logical identification of a subscriber line. LLID is maintained in a customer profile database on a RADIUS server. When the customer profile database receives a preauthorization request from the access router, the RADIUS server sends the LLID to the router as the Calling-Station-ID attribute (attribute 31).
The Layer 2 Tunneling Protocol (L2TP) access concentrator (LAC) sends a preauthorization request to the customer profile database when the LAC is configured for preauthorization. Configure the LAC for preauthorization using the subscriber access command.
Note Downloading the LLID is referred to as "preauthorization" because it occurs before either service (domain) authorization or user authentication and authorization occur.
The customer profile database on the RADIUS server consists of user profiles for each physical network access server (NAS) port that is connected to the router. Each user profile contains a profile matched to a username (attribute 1) representing the physical port on the router. When the router is configured for preauthorization, it queries the customer profile database using a username representative of the physical NAS port making the connection to the router. When a match is found in the customer profile database, the customer profile database returns an Access-Accept message containing the LLID in the user profile. The LLID is defined in the Access-Accept record as the Calling-Station-ID attribute.
The preauthorization process can also provide the real username being used for authentication to the RADIUS server. Because the physical NAS port information is being used as the username (attribute 1), RADIUS attribute 77 (Connect-Info) can be configured to contain the authentication username. This configuration allows the RADIUS server to provide additional validation on the authorization request if it chooses, such as analyzing the username for privacy rules, before returning an LLID back to the router.
•Configuring Preauthorization (Required)
•Configuring the LLID in a RADIUS User Profile (Required)
•Verifying Logical Line ID (Optional)
To download the LLID and configure the LAC for preauthorization, perform the following steps.
1. enable
2. configure terminal
3. ip radius source-interface interface-name
4. subscriber access {pppoe | pppoa} pre-authorize nas-port-id [default | list-name] [send username]
To configure the user profile for preauthorization, add a NAS port user to the customer profile database and add RADIUS Internet Engineering Task Force (IETF) attribute 31 (Calling-Station-ID) to the user profile.
1. UserName=nas_port: ip-address:slot/module/port/vpi.vci
2. UserName=nas-port: ip-address:slot/module/port/vlan-id
3. Calling-Station-Id = "string (*,*)"
To verify feature functionality, perform the following steps.
1. enable
2. debug radius
•LAC for Preauthorization Configuration: Example
•RADIUS User Profile for LLID: Example
The following example shows how to configure your LAC for preauthorization by downloading the LLID:
aaa new-model
aaa group server radius sg_llid
server 172.31.164.106 auth-port 1645 acct-port 1646
aaa group server radius sg_water
server 172.31.164.106 auth-port 1645 acct-port 1646
aaa authentication ppp default group radius
aaa authorization confg-commands
aaa authorization network default group sg_water
aaa authorization network mlist_llid group sg_llid
aaa session-id common
!
username s7200_2 password 0 lab
username s5300 password 0 lab
username sg_water password 0 lab
vpdn enable
!
vpdn-group 2
request-dialin
protocol l2tp
domain example.com
domain example.com#184
initiate-to ip 10.1.1.1
local name s7200_2
l2tp attribute clid mask-method right * 255 match #184
!
vpdn-group 3
accept dialin
protocol pppoe
virtual-template 1
!
! Enable the LLID to be downloaded.
subscriber access pppoe pre-authorize nas-port-id mlist_llid send username
!
interface Loopback0
ip address 10.1.1.2 255.255.255.0
!
interface Loopback1
ip address 10.1.1.1 255.255.255.0
!
interface FastEthernet1/0/0
ip address 10.1.1.8 255.255.255.0 secondary
ip address 10.0.58.111 255.255.255.0
no cdp enable
!
interface ATM4/0/0
no ip address
no atm ilmi-keepalive
!
interface ATM4/0/0.1 point-to-point
pvc 1/100
encapsulation aa15snap
protocol pppoe
!
interface virtual-template1
no ip unnumbered Loopback0
no peer default ip address
ppp authentication chap
!
radius-server host 172.31.164.120 auth-port 1645 acct-port 1646 key rad123
radius-server host 172.31.164.106 auth-port 1645 acct-port 1646 key rad123
ip radius source-interface Loopback1
The following example shows how to configure the user profile for LLID querying for PPPoEoVLAN and PPPoEoATM and how to add attribute 31:
pppoeovlan
----------
nas-port:10.1.0.3:6/0/0/0 Password = "password1",
Service-Type = Outbound,
Calling-Station-ID = "cat-example"
pppoeoa
--------
nas-port:10.1.0.3:6/0/0/1.100 Password = "password1",
Service-Type = Outbound,
Calling-Station-ID = "cat-example"
|
|
---|---|
Cisco IOS commands |
|
Security commands: complete command syntax, command modes, command history, defaults, usage guidelines, and examples |
|
AAA authentication |
Configuring Authentication feature module. |
Attribute screening for access requests |
RADIUS Attribute Value Screening feature module. |
|
|
---|---|
None. |
— |
|
|
---|---|
None. |
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
|
|
---|---|
None. |
— |
Table 1 lists the features in this module and provides links to specific configuration information.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
|
|
|
---|---|---|
RADIUS Logical Line ID |
Cisco IOS XE Release 2.1 |
The RADIUS Logical Line ID feature, also known as the Logical Line Identification (LLID) Blocking feature enables administrators to track their customers on the basis of the physical lines on which customer calls originate. In Cisco IOS XE Release 2.1, this feature was introduced on Cisco ASR 1000 Series Aggregation Services Routers. The following sections provide information about this feature: •Information About RADIUS Logical Line ID •How to Configure RADIUS Logical Line ID The following command was introduced or modified by this feature: subscriber access. |
Calling Station ID Attribute 31 |
Cisco IOS XE Release 2.1 |
This feature was introduced on Cisco ASR 1000 Series Routers. |
LLID Blocking |
Cisco IOS XE Release 2.1 |
This feature was introduced on Cisco ASR 1000 Series Routers. |
LLID Blocking—A feature that enables administrators to track their customers on the basis of the physical lines on which the calls of the customers originate. Also known as RADIUS Logical Line ID.
RADIUS Logical Line ID—A feature that enables administrators to track their customers on the basis of the physical lines on which the calls of the customers originate. Also known as LLID Blocking.