Comment configurer l'authentification RADIUS pour les réseaux VPDN

Options de téléchargement

  • PDF     (103.9 KB)
    Consulter à l'aide d'Adobe Reader sur un grand nombre d'appareils
  • ePub     (83.6 KB)
    Consulter à l’aide de différentes applications sur iPhone, iPad, Android ou Windows Phone
  • Mobi (Kindle)     (86.0 KB)
    Consulter sur un appareil Kindle ou à l’aide d’une application Kindle sur plusieurs appareils
Mis à jour:26 février 2008
ID du document:4675

Langage exempt de préjugés

Dans le cadre de la documentation associée à ce produit, nous nous efforçons d’utiliser un langage exempt de préjugés. Dans cet ensemble de documents, le langage exempt de discrimination renvoie à une langue qui exclut la discrimination en fonction de l’âge, des handicaps, du genre, de l’appartenance raciale de l’identité ethnique, de l’orientation sexuelle, de la situation socio-économique et de l’intersectionnalité. Des exceptions peuvent s’appliquer dans les documents si le langage est codé en dur dans les interfaces utilisateurs du produit logiciel, si le langage utilisé est basé sur la documentation RFP ou si le langage utilisé provient d’un produit tiers référencé. Découvrez comment Cisco utilise le langage inclusif.

À propos de cette traduction

Cisco a traduit ce document en traduction automatisée vérifiée par une personne dans le cadre d’un service mondial permettant à nos utilisateurs d’obtenir le contenu d’assistance dans leur propre langue. Il convient cependant de noter que même la meilleure traduction automatisée ne sera pas aussi précise que celle fournie par un traducteur professionnel.

Introduction

Un réseau privé virtuel à accès commuté (VPDN) permet à un réseau privé en service de se répartir sur des serveurs à accès distant (définis comme concentrateur L2TP Access [LAC]). Quand un client de Protocole point à point (PPP) introduit dans un LAC, le LAC détermine qu'il devrait expédier cette session PPP en fonction à un serveur de réseau L2TP (LNS) pour ce client, qui alors authentifie l'utilisateur et commence la négociation PPP. Une fois que l'installation de PPP s'est terminée, toutes les trames sont envoyées par le LAC au client et au LNS.

Cette configuration d'échantillon te permet pour utiliser l'authentification de RAYON avec VPDNs. Le LAC questionne le serveur de RAYON, détermine quel LNS pour expédier l'utilisateur, et établit le tunnel approprié.

Pour plus d'informations sur VPDNs référez-vous compréhension derrière VPDN.

Conditions préalables

Conditions requises

Aucune spécification déterminée n'est requise pour ce document.

Composants utilisés

Les informations contenues dans ce document sont basées sur les versions de matériel et de logiciel suivantes :

  • Version 2.x.x et ultérieures ou Merit RADIUS d'UNIX de Cisco Secure ACS

  • Version de logiciel 11.2 et ultérieures de Cisco IOS®

Les informations contenues dans ce document ont été créées à partir des périphériques d'un environnement de laboratoire spécifique. Tous les périphériques utilisés dans ce document ont démarré avec une configuration effacée (par défaut). Si votre réseau est opérationnel, assurez-vous que vous comprenez l'effet potentiel de toute commande.

Conventions

Pour plus d'informations sur les conventions utilisées dans ce document, reportez-vous aux Conventions relatives aux conseils techniques Cisco.

Informations générales

Dans cet exemple, l'utilisateur est « jsmith@hp.com » avec le mot de passe « test ». Quand « jsmith@hp.com » introduit dans le routeur de l'ISP, le routeur de l'ISP envoie l'ID utilisateur « hp.com » au serveur de RAYON ISP. Le serveur ISP trouve l'ID utilisateur « hp.com » et envoie son tunnel-id (« fournisseur d'accès internet »), l'adresse IP du routeur de la passerelle domestique (HGW) (10.31.1.50), le mot de passe de serveur d'accès à distance (NAS) (« bonjour »), et le mot de passe de la passerelle (« là ») de nouveau au routeur de l'ISP.

Le routeur de l'ISP initie un tunnel et connecte à 10.31.1.50 HGW le routeur, qui authentifie l'utilisateur « HP-gw » localement et en avant le mot de passe pour l'ID utilisateur « fournisseur d'accès internet » (« bonjour ») au serveur de RAYON HGW. Une fois que les tunnels est établis, le routeur de l'ISP en avant au routeur HGW, et l'ID utilisateur ("jsmith@hp.com ") et le mot de passe (« test ») de l'utilisateur se connectant cet utilisateur est authentifié sur le serveur HGW. Dans cet exemple, le routeur de l'ISP s'appelle le « koala » et le routeur HGW s'appelle les « sneetches ».

Configurez

Cette section vous fournit des informations pour configurer les fonctionnalités décrites dans ce document.

Diagramme du réseau

Ce document utilise la configuration réseau indiquée dans le diagramme suivant.

vpdn_rad.gif

Configurations du serveur

Configuration de Merit RADIUS 


!--- The RADIUS Server must support Cisco av-pairs. !--- This user is on the ISP RADIUS server.

hp.com Password = "cisco"
Service-Type = Outbound-User,
cisco-avpair = "vpdn:tunnel-id=isp",
cisco-avpair = "vpdn:ip-addresses=10.31.1.50",
cisco-avpair = "vpdn:nas-password=hello",
cisco-avpair = "vpdn:gw-password=there"

!--- The next two users are on the HGW Server.

isp Password = "hello",
Service-Type = Framed,
Framed-Protocol = PPP

jsmith@hp.com Password = "test",
Service-Type = Framed,
Framed-Protocol = PPP

Configuration du Cisco Secure ACS UNIX 2.x.x 


!--- This user is on the ISP server.

# ./ViewProfile -p 9900 -u hp.com
User Profile Information
user = hp.com{
profile_id = 86
profile_cycle = 1
RADIUS=Cisco {
check_items= {
2="cisco"
}
reply_attributes= {
9,1="vpdn:tunnel-id=isp"
9,1="vpdn:ip-addresses=10.31.1.50"
9,1="vpdn:NAS-password=hello"
9,1="vpdn:gw-password=there"
}
}

}

!--- The next two users are on the HGW Server.


# ./ViewProfile -p 9900 -u isp
User Profile Information
user = isp{
profile_id = 70
profile_cycle = 1
RADIUS=Cisco {
check_items= {
2="hello"
}
reply_attributes= {
6=2
7=1
}
}

}

# ./ViewProfile -p 9900 -u jsmith@hp.com
User Profile Information
user = jsmith@hp.com{
profile_id = 84
profile_cycle = 1
RADIUS=Cisco {
check_items= {
2="test"
}
reply_attributes= {
6=2
7=1
}
}

}

Configurations de routeur

Configuration de routeur de l'ISP 
koala#show running config

Building configuration...


Current configuration:
!
version 11.3
no service password-encryption
service udp-small-servers
service tcp-small-servers
!
hostname koala
!
aaa new-model
aaa authentication ppp default if-needed RADIUS
aaa authorization network default RADIUS
aaa accounting network default start-stop RADIUS
enable password ww
!
vpdn enable

!--- VPDN is enabled.

!
interface Ethernet0
ip address 10.31.1.5 255.255.255.0
!
interface Serial0
shutdown
!
interface Serial1
shutdown
!
interface Async1
ip unnumbered Ethernet0
encapsulation ppp
async mode dedicated
no peer default ip address
no cdp enable
ppp authentication chap
!
ip default-gateway 10.31.1.1
no ip classless
ip route 0.0.0.0 0.0.0.0 10.31.1.1
logging trap debugging
logging 171.68.118.101
snmp-server community public RW
snmp-server enable traps config
snmp-server host 171.68.118.105 traps public
RADIUS-server host 171.68.120.194 auth-port 1645 acct-port 1646
RADIUS-server key cisco

!--- Specify RADIUS server information on the NAS.

!
line con 0
password WW
line 1
password WW
autoselect ppp
modem InOut
transport input all
stopbits 1
speed 115200
flowcontrol hardware
line 2 16
autoselect during-login
line aux 0
line vty 0 4
exec-timeout 0 0
password WW
!
end

Configuration de routeur HGW 
Sneetches#show running config
Building configuration...

Current configuration:
!
version 11.3
no service password-encryption
service udp-small-servers
service tcp-small-servers
!
hostname Sneetches
!
aaa new-model
aaa authentication ppp default RADIUS local
aaa authorization network default RADIUS local
aaa accounting network default start-stop RADIUS
!
username hp-gw password 0 there
username isp password 0 hello
vpdn enable

!--- Enable VPDN.

vpdn incoming isp hp-gw virtual-template 1

!--- Specify the remote host (the network access server) !--- the local name (the home gateway) to use for authenticating !--- and the virtual template to use.

!
interface Ethernet0
ip address 10.31.1.50 255.255.255.0
!
interface Ethernet1
no ip address
shutdown
!


interface Virtual-Template1

!--- Create a virtual template interface.

ip unnumbered Ethernet0

!--- Un-number the Virtual interface to an available LAN interface.

peer default ip address pool async

!--- Use the pool "async" to assign the IP address for incoming connections.

ppp authentication chap

!--- Use CHAP authentication for the incoming connection.

!
interface Serial0
shutdown
!
interface Serial1
shutdown
!
ip local pool async 1.1.1.1 1.1.1.6
ip default-gateway 10.31.1.1
no ip classless
ip route 0.0.0.0 0.0.0.0 10.31.1.1
RADIUS-server host 171.68.118.101 auth-port 1645 acct-port 1646
RADIUS-server timeout 20
RADIUS-server key cisco

!--- Specify RADIUS server information on the NAS.

!
line con 0
exec-timeout 3600 0
line aux 0
line vty 0 4
password WW
!
end

Vérifiez

Aucune procédure de vérification n'est disponible pour cette configuration.

Dépannez

Cette section fournit des informations que vous pouvez utiliser pour dépanner votre configuration.

Dépannage des commandes

certaines commandes show sont prises en charge par l'outil Interpréteur de sortie, qui vous permet d'afficher une analyse de la sortie de la commande show.

Remarque: Avant d'exécuter les commandes debug, référez-vous à la section Informations importantes sur les commandes Debug.

  • debug aaa authentication — Affiche des informations sur l'authentification du Terminal Access Controller Access Control System Plus D.C.A. (TACACS+).

  • autorisation de debug aaa — Affiche des informations sur l'autorisation AAA/TACACS+.

  • debug ppp negotiation — Paquets PPP d'affichages transmis pendant le startup de PPP, où des options PPP sont négociées.

  • debug radius — Affiche les informations de débogage détaillées associées avec le RAYON.

  • erreurs de debug vpdn — Affiche les erreurs qui empêchent un tunnel de PPP d'être établi ou les erreurs qui causent un tunnel établi d'être fermé.

  • événements de debug vpdn — Affiche des messages au sujet des événements qui font partie d'établissement normal de tunnel de PPP ou arrêt.

  • debug vpdn l2f-errors — Les affichages posent 2 erreurs de protocole qui empêchent l'établissement de la couche 2 ou empêchent son fonctionnement normal.

  • debug vpdn l2f-events — Affiche des messages au sujet des événements qui font partie d'établissement normal de tunnel de PPP ou arrêt pour la couche 2.

  • debug vpdn l2f-packets — Messages d'affichages au sujet des en-têtes et d'état de protocole de transfert de couche 2.

  • paquets de debug vpdn — Les affichages posent 2 erreurs de protocole et événements de tunnel qui sont une partie de l'établissement normal d'un tunnel ou un arrêt pour VPDNs.

  • debug vtemplate — Les informations de clonage d'affichages pour une interface d'accès virtuelle du temps où elle est copiée d'un modèle virtuel au temps l'interface d'accès virtuelle descend quand l'appel finit.

Sortie de débogage

Bon debug de routeur de l'ISP 

koala#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
koala#
%LINK-3-UPDOWN: Interface Async1, changed state to up
17:28:19: VPDN: Looking for tunnel -- hp.com --
17:28:19: AAA/AUTHEN: create_user (0x15D28C) user='hp.com' ruser='' port='Async1' 
 rem_addr='' authen_type=NONE service=LOGIN priv=0
17:28:19: AAA/AUTHOR/VPDN (982041598): Port='Async1' list='default' service=NET
17:28:19: AAA/AUTHOR/VPDN: (982041598) user='hp.com'
17:28:19: AAA/AUTHOR/VPDN: (982041598) send AV service=ppp
17:28:19: AAA/AUTHOR/VPDN: (982041598) send AV protocol=vpdn
17:28:19: AAA/AUTHOR/VPDN (982041598) found list "default"
17:28:19: AAA/AUTHOR/VPDN: (982041598) Method=RADIUS
17:28:19: RADIUS: authenticating to get author data
17:28:19: RADIUS: Computed extended port value 0:1:
17:28:19: RADIUS: Initial Transmit id 62 171.68.120.194:1645, Access-Request, len 70
17:28:19: Attribute 4 6 0A1F0105
17:28:19: Attribute 5 6 00000001
17:28:19: Attribute 61 6 00000000
17:28:19: Attribute 1 8 68702E63
17:28:19: Attribute 2 18 8070079C
17:28:19: Attribute 6 6 00000005
17:28:19: RADIUS: Received from id 62 171.68.120.194:1645, Access-Accept, len 143
17:28:19: Attribute 26 26 0000000901147670
17:28:19: Attribute 26 36 00000009011E7670
17:28:19: Attribute 26 31 0000000901197670
17:28:19: Attribute 26 30 0000000901187670

!--- These messages can be decrypted using the OI tool. !--- As of Cisco IOS Software Release 12.2(11)T, !--- the output was changed to be readable.

17:28:19: RADIUS: saved authorization data for user 15D28C at 10EE74
17:28:19: RADIUS: cisco AVPair "vpdn:tunnel-id=isp"
17:28:19: RADIUS: cisco AVPair "vpdn:ip-addresses=10.31.1.50"
17:28:19: RADIUS: cisco AVPair "vpdn:nas-password=hello"
17:28:19: RADIUS: cisco AVPair "vpdn:gw-password=there"
17:28:19: AAA/AUTHOR (982041598): Post authorization status = PASS_ADD
17:28:19: AAA/AUTHOR/VPDN: Processing AV service=ppp
17:28:19: AAA/AUTHOR/VPDN: Processing AV protocol=vpdn
17:28:19: AAA/AUTHOR/VPDN: Processing AV tunnel-id=isp
17:28:19: AAA/AUTHOR/VPDN: Processing AV ip-addresses=10.31.1.50
17:28:19: AAA/AUTHOR/VPDN: Processing AV nas-password=hello
17:28:19: AAA/AUTHOR/VPDN: Processing AV gw-password=there
17:28:19: VPDN: Get tunnel info with NAS isp GW hp.com, IP 10.31.1.50

!--- The RADIUS server returns the attributes the !--- NAS should use for the tunnel. !--- Tunnel-id is "ISP" and the IP address of HGW is 10.31.1.50.

17:28:19: AAA/AUTHEN: free_user (0x15D28C) user='hp.com' ruser='' port='Async1' 
 rem_addr='' authen_type=NONE service=LOGIN priv=0
17:28:19: VPDN: Forward to address 10.31.1.50
17:28:19: As1 VPDN: Forwarding...
17:28:19: AAA/AUTHEN: create_user (0x15D334) user='jsmith@hp.com' ruser=''
 port='Async1' rem_addr='async' authen_type=CHAP service=PPP priv=1
17:28:19: As1 VPDN: Bind interface direction=1
17:28:19: As1 VPDN: jsmith@hp.com is forwarded
17:28:19: AAA/ACCT/NET/START User jsmith@hp.com, Port Async1, List ""
17:28:19: AAA/ACCT/NET: Found list "default"
17:28:19: RADIUS: Computed extended port value 0:1:
17:28:19: RADIUS: Initial Transmit id 63 171.68.120.194:1646, Accounting-Request,
 len 93
17:28:19: Attribute 4 6 0A1F0105
17:28:19: Attribute 5 6 00000001
17:28:19: Attribute 61 6 00000000
17:28:19: Attribute 1 15 6A736D69
17:28:19: Attribute 40 6 00000001
17:28:19: Attribute 45 6 00000002
17:28:19: Attribute 6 6 00000002
17:28:19: Attribute 44 10 30303030
17:28:19: Attribute 7 6 7670646E
17:28:19: Attribute 41 6 00000000
17:28:19: RADIUS: Received from id 63 171.68.120.194:1646, Accounting-response,
 len 20
%LINEPROTO-5-UPDOWN: Line protocol on Interface Async1, changed state to up
koala#

!--- The user finishes and disconnects.

%LINEPROTO-5-UPDOWN: Line protocol on Interface Async1, changed state to down
%LINK-5-CHANGED: Interface Async1, changed state to reset
17:28:48: As1 VPDN: Cleanup
17:28:48: As1 VPDN: Reset
17:28:48: As1 VPDN: Reset
17:28:48: As1 VPDN: Unbind interface
17:28:48: AAA/ACCT/NET/STOP User jsmith@hp.com, Port Async1:
task_id=20 start_time=900759730 timezone=UTC service=vpdn disc-cause=2 
disc-cause-ext=1011 pre-bytes-in=-226131998 pre-bytes-out=-1034130241
pre-paks-in=-63570 pre-paks-out=-64410 bytes_in=1999 bytes_out=364 paks_in=29 
paks_out=12 pre-session-time=5 elapsed_time=29 data-rate=0
xmit-rate=0 
17:28:48: RADIUS: Computed extended port value 0:1:
17:28:48: RADIUS: Initial Transmit id 64 171.68.120.194:1646, Accounting-Request,
 len 129
17:28:48: Attribute 4 6 0A1F0105
17:28:48: Attribute 5 6 00000001
17:28:48: Attribute 61 6 00000000
17:28:48: Attribute 1 15 6A736D69
17:28:48: Attribute 40 6 00000002
17:28:48: Attribute 45 6 00000002
17:28:48: Attribute 6 6 00000002
17:28:48: Attribute 44 10 30303030
17:28:48: Attribute 7 6 7670646E
17:28:48: Attribute 49 6 00000002
17:28:48: Attribute 42 6 000007CF
17:28:48: Attribute 43 6 0000016C
17:28:48: Attribute 47 6 0000001D
17:28:48: Attribute 48 6 0000000C
17:28:48: Attribute 46 6 0000001D
17:28:48: Attribute 41 6 00000000
17:28:48: RADIUS: Received from id 64 171.68.120.194:1646, Accounting-response,
 len 20
%LINK-3-UPDOWN: Interface Async1, changed state to down
17:28:51: AAA/AUTHEN: free_user (0x15D334) user='jsmith@hp.com' ruser=''
 port='Async1' rem_addr='async' authen_type=CHAP service=PPP priv=1
koala#

Debug de routeur HGW bon 

Sneetches#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
Sneetches#
17:28:21: AAA/AUTHEN: create_user (0x14A914) user='hp-gw' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN/START (496523999): port='' list='default' 
action=SENDAUTH service=PPP
17:28:21: AAA/AUTHEN/START (496523999): found list default
17:28:21: AAA/AUTHEN/START (496523999): Method=RADIUS
17:28:21: RADIUS: SENDPASS not supported (action=4)
17:28:21: AAA/AUTHEN (496523999): status = ERROR
17:28:21: AAA/AUTHEN/START (496523999): Method=LOCAL
17:28:21: AAA/AUTHEN (496523999): status = PASS
17:28:21: AAA/AUTHEN: free_user (0x14A914) user='hp-gw' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN: create_user (0x14A914) user='isp' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN/START (3095573082): port='' list='default' 
action=SENDAUTH service=PPP
17:28:21: AAA/AUTHEN/START (3095573082): found list default
17:28:21: AAA/AUTHEN/START (3095573082): Method=RADIUS
17:28:21: RADIUS: SENDPASS not supported (action=4)
17:28:21: AAA/AUTHEN (3095573082): status = ERROR
17:28:21: AAA/AUTHEN/START (3095573082): Method=LOCAL
17:28:21: AAA/AUTHEN (3095573082): status = PASS
17:28:21: AAA/AUTHEN: free_user (0x14A914) user='isp' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN: create_user (0x14ADB4) user='isp' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
17:28:21: AAA/AUTHEN/START (3506257139): port='' list='default'
action=LOGIN service=PPP
17:28:21: AAA/AUTHEN/START (3506257139): found list default
17:28:21: AAA/AUTHEN/START (3506257139): Method=RADIUS
17:28:21: RADIUS: Initial Transmit id 53 171.68.118.101:1645, Access-Request, len 68
17:28:21: Attribute 4 6 0A1F0132
17:28:21: Attribute 61 6 00000000
17:28:21: Attribute 1 5 69737003
17:28:21: Attribute 3 19 10C82B7A
17:28:21: Attribute 6 6 00000002
17:28:21: Attribute 7 6 00000001
17:28:21: RADIUS: Received from id 53 171.68.118.101:1645, Access-Accept, len 32
17:28:21: Attribute 6 6 00000002
17:28:21: Attribute 7 6 00000001
17:28:21: AAA/AUTHEN (3506257139): status = PASS
17:28:21: VPDN: Chap authentication succeeded for isp
17:28:21: AAA/AUTHEN: free_user (0x14ADB4) user='isp' ruser='' port='' rem_addr='' 
authen_type=CHAP service=PPP priv=1
17:28:21: Vi1 VPDN: Virtual interface created for jsmith@hp.com
17:28:21: Vi1 VPDN: Set to Async interface
17:28:21: Vi1 VPDN: Clone from Vtemplate 1 filterPPP=0 blocking
%LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
17:28:23: Vi1 VPDN: Bind interface direction=2
17:28:23: Vi1 VPDN: PPP LCP accepted sent & rcv CONFACK
17:28:23: AAA/AUTHEN: create_user (0x143368) user='jsmith@hp.com' ruser=''
 port='Virtual-Access1' rem_addr='async' authen_type=CHAP service=PPP priv=1
17:28:23: AAA/AUTHEN/START (637397616): port='Virtual-Access1' list=''
 action=LOGIN service=PPP
17:28:23: AAA/AUTHEN/START (637397616): using "default" list
17:28:23: AAA/AUTHEN/START (637397616): Method=RADIUS
17:28:23: RADIUS: Computed extended port value 0:60100:
17:28:23: RADIUS: Initial Transmit id 54 171.68.118.101:1645, Access-Request, len 78
17:28:23: Attribute 4 6 0A1F0132
17:28:23: Attribute 5 6 0000EAC4
17:28:23: Attribute 1 15 6A736D69
17:28:23: Attribute 3 19 186C2AC9
17:28:23: Attribute 6 6 00000002
17:28:23: Attribute 7 6 00000001
17:28:23: RADIUS: Received from id 54 171.68.118.101:1645, Access-Accept, len 32
17:28:23: Attribute 6 6 00000002
17:28:23: Attribute 7 6 00000001
17:28:23: AAA/AUTHEN (637397616): status = PASS
17:28:23: AAA/AUTHOR/LCP Vi1: Authorize LCP
17:28:23: AAA/AUTHOR/LCP Vi1 (1528831370): Port='Virtual-Access1' list=''
 service=NET
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) user='jsmith@hp.com'
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) send AV service=ppp
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) send AV protocol=lcp
17:28:23: AAA/AUTHOR/LCP (1528831370) found list "default"
17:28:23: AAA/AUTHOR/LCP: Vi1 (1528831370) Method=RADIUS
17:28:23: AAA/AUTHOR (1528831370): Post authorization status = PASS_REPL
17:28:23: AAA/AUTHOR/LCP Vi1: Processing AV service=ppp
17:28:23: AAA/ACCT/NET/START User jsmith@hp.com, Port Virtual-Access1, List ""
17:28:23: AAA/ACCT/NET: Found list "default"
17:28:23: AAA/AUTHOR/FSM Vi1: (0): Can we start IPCP?
17:28:23: AAA/AUTHOR/FSM Vi1 (4249637449): Port='Virtual-Access1' list=''
 service=NET
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) user='jsmith@hp.com'
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) send AV service=ppp
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) send AV protocol=ip
17:28:23: AAA/AUTHOR/FSM (4249637449) found list "default"
17:28:23: AAA/AUTHOR/FSM: Vi1 (4249637449) Method=RADIUS
17:28:23: AAA/AUTHOR (4249637449): Post authorization status = PASS_REPL
17:28:23: AAA/AUTHOR/FSM Vi1: We can start IPCP
17:28:23: RADIUS: Computed extended port value 0:60100:
17:28:23: RADIUS: Initial Transmit id 55 171.68.118.101:1646, Accounting-Request,
 len 87
17:28:23: Attribute 4 6 0A1F0132
17:28:23: Attribute 5 6 0000EAC4
17:28:23: Attribute 1 15 6A736D69
17:28:23: Attribute 40 6 00000001
17:28:23: Attribute 45 6 00000001
17:28:23: Attribute 6 6 00000002
17:28:23: Attribute 44 10 30303030
17:28:23: Attribute 7 6 00000001
17:28:23: Attribute 41 6 00000000
17:28:23: RADIUS: Received from id 55 171.68.118.101:1646, Accounting-response,
 len 20
17:28:23: AAA/AUTHOR/IPCP Vi1: Start. Her address 0.0.0.0, we want 0.0.0.0
17:28:23: AAA/AUTHOR/IPCP Vi1: Processing AV service=ppp
17:28:23: AAA/AUTHOR/IPCP Vi1: Authorization succeeded
17:28:23: AAA/AUTHOR/IPCP Vi1: Done. Her address 0.0.0.0, we want 0.0.0.0
17:28:23: AAA/AUTHOR/IPCP Vi1: Start. Her address 0.0.0.0, we want 1.1.1.1
17:28:23: AAA/AUTHOR/IPCP Vi1: Processing AV service=ppp
17:28:23: AAA/AUTHOR/IPCP Vi1: Authorization succeeded
17:28:23: AAA/AUTHOR/IPCP Vi1: Done. Her address 0.0.0.0, we want 1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1: Start. Her address 1.1.1.1, we want 1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1 (923857566): Port='Virtual-Access1' list=''
 service=NET
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) user='jsmith@hp.com'
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) send AV service=ppp
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) send AV protocol=ip
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) send AV addr*1.1.1.1
17:28:24: AAA/AUTHOR/IPCP (923857566) found list "default"
17:28:24: AAA/AUTHOR/IPCP: Vi1 (923857566) Method=RADIUS
17:28:24: AAA/AUTHOR (923857566): Post authorization status = PASS_REPL
17:28:24: AAA/AUTHOR/IPCP Vi1: Reject 1.1.1.1, using 1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1: Processing AV service=ppp
17:28:24: AAA/AUTHOR/IPCP Vi1: Processing AV addr*1.1.1.1
17:28:24: AAA/AUTHOR/IPCP Vi1: Authorization succeeded
17:28:24: AAA/AUTHOR/IPCP Vi1: Done. Her address 1.1.1.1, we want 1.1.1.1
%LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, changed state to up
Sneetches#

!--- The user finishes and disconnects.

Sneetches#
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Reset
%LINK-3-UPDOWN: Interface Virtual-Access1, changed state to down
17:28:50: Vi1 VPDN: Cleanup
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Unbind interface
17:28:50: Vi1 VPDN: Reset
17:28:50: Vi1 VPDN: Reset
17:28:50: AAA/ACCT/NET/STOP User jsmith@hp.com, Port Virtual-Access1:
task_id=14 start_time=900759731 timezone=UTC service=ppp protocol=ip addr=1.1.1.1 
disc-cause=2 disc-cause-ext=1011 pre-bytes-in=0 pre-bytes-out=42
pre-paks-in=0 pre-paks-out=2 bytes_in=882 bytes_out=356 paks_in=17 paks_out=11 
pre-session-time=0 elapsed_time=27 data-rate=0 xmit-rate=0 
17:28:50: RADIUS: Computed extended port value 0:60100:
17:28:50: RADIUS: Initial Transmit id 56 171.68.118.101:1646, Accounting-Request,
 len 129
17:28:50: Attribute 4 6 0A1F0132
17:28:50: Attribute 5 6 0000EAC4
17:28:50: Attribute 1 15 6A736D69
17:28:50: Attribute 40 6 00000002
17:28:50: Attribute 45 6 00000001
17:28:50: Attribute 6 6 00000002
17:28:50: Attribute 44 10 30303030
17:28:50: Attribute 7 6 00000001
17:28:50: Attribute 8 6 01010101
17:28:50: Attribute 49 6 00000002
17:28:50: Attribute 42 6 00000372
17:28:50: Attribute 43 6 00000164
17:28:50: Attribute 47 6 00000011
17:28:50: Attribute 48 6 0000000B
17:28:50: Attribute 46 6 0000001B
17:28:50: Attribute 41 6 00000000
17:28:50: RADIUS: Received from id 56 171.68.118.101:1646, Accounting-response,
 len 20
17:28:50: AAA/AUTHEN: free_user (0x143368) user='jsmith@hp.com' ruser=''
 port='Virtual-Access1' rem_addr='async' authen_type=CHAP service=PPP
priv=1
%LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1,
  changed state to down
Sneetches#

Debugs pour la connexion défectueuse sur le routeur de l'ISP 

koala#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
koala#

!--- Problem 1: !--- User hp.com is not in the ISP server: !--- There is no output on HGW router because the call has not gone that far.

RADIUS: Received from id 83 171.68.120.194:1645, Access-Reject, len 20 18:43:18: 
AAA/AUTHEN (4063976505): status = FAIL

!--- Problem 2: !--- User hp.com is not in the ISP server. !--- There is no output on HGW router because !--- the call has not gone that far.

RADIUS: Received from id 83 171.68.120.194:1645, Access-Reject, len 20 18:43:18: 
AAA/AUTHEN (4063976505): status = FAIL

!--- Problem 3: !--- Problem in tunnel definition on HGW router; in HGW configuration !--- vpdn incoming hp-gw isp virtual-template 1 is inserted !--- instead of vpdn incoming isp hp-gw virtual-template 1.

%VPDN-5-UNREACH: L2F HGW 10.31.1.50 is unreachable
VPDN: Timeout opening tunnel to 10.31.1.50
VPDN: Free busy address 10.31.1.50

!--- Problem 4: !--- User "isp" or "hp-gw" is removed from HGW router.

%VPDN-6-AUTHENFAIL: L2F NAS koala, authentication failure for tunnel hp-gw; 
 Invalid key

!--- Problem 5: !--- User "isp" is not in the HGW server.

%VPDN-6-AUTHENFAIL: L2F HGW , AAA authentication failure for tunnel hp-gw

!--- Problem 6: !--- User jsmith@hp.com is not in the HGW server.

%VPDN-6-AUTHENFAIL: L2F HGW hp-gw, AAA authentication failure for As1 
user jsmith@hp.com; Authentication failure

Debugs pour des connexions Failed sur le routeur HGW 

Sneetches#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
VPN events debugging is on
VPN errors debugging is on
RADIUS protocol debugging is on
Sneetches#

!--- Problem 1: !--- Problem in tunnel definition on the HGW router; in HGW configuration !--- vpdn incoming hp-gw isp virtual-template 1 is inserted !--- instead of vpdn incoming isp hp-gw virtual-template 1 !--- debug vpdn l2f-errors display.

19:25:27: L2F: Couldn't find tunnel named isp
19:25:30: L2F: Couldn't find tunnel named isp

!--- Problem 2: !--- User "isp" is removed from the HGW router.

AAA/AUTHEN (3372073334): SENDAUTH no password for isp
AAA/AUTHEN (3372073334): status = ERROR
AAA/AUTHEN/START (3372073334): no methods left to try
AAA/AUTHEN (3372073334): status = ERROR
AAA/AUTHEN/START (3372073334): failed to authenticate

!--- Problem 3: !--- User "hp-gw" is removed from the HGW router.

AAA/AUTHEN (3999868118): SENDAUTH no password for hp-gw
AAA/AUTHEN (3999868118): status = ERROR
AAA/AUTHEN/START (3999868118): no methods left to try
AAA/AUTHEN (3999868118): status = ERROR
AAA/AUTHEN/START (3999868118): failed to authenticate

!--- Problem 4: !--- User "isp" is removed from HGW RADIUS server.

RADIUS: Received from id 107 171.68.118.101:1645, Access-Reject, len 46
Attribute 18 26 41757468
AAA/AUTHEN (2759462034): status = FAIL
VPDN: Chap authentication failed for isp
%VPDN-6-AUTHENFAIL: L2F HGW , AAA authentication failure for tunnel isp

!--- Problem 5: !--- User "jsmith@hp.com" is not in the HGW server.

RADIUS: Received from id 109 171.68.118.101:1645, Access-Reject, len 46
Attribute 18 26 41757468
AAA/AUTHEN (2765235576): status = FAIL
%VPDN-6-AUTHENFAIL: L2F HGW hp-gw, AAA authentication failure for Vi1
 user jsmith@hp.com; Authentication failure

Informations connexes

Ce document vous est-il utile?

FeedbackCommentaires

Contacter Cisco

Ce document s’applique à ces produits