TACACS+를 사용하여 레이어 2 터널 프로토콜 인증을 구성하는 방법

다운로드 옵션

  • PDF     (258.2 KB)
    다양한 디바이스에서 Adobe Reader로 보기
  • ePub     (94.3 KB)
    iPhone, iPad, Android, Sony Reader 또는 Windows Phone의 다양한 앱에서 보기
  • Mobi (Kindle)     (122.2 KB)
    Kindle 디바이스에서 보기 또는 다양한 디바이스의 Kindle 앱에서 보기
업데이트:2009년 5월 14일
문서 ID:13858

편견 없는 언어

본 제품에 대한 문서 세트는 편견 없는 언어를 사용하기 위해 노력합니다. 본 설명서 세트의 목적상, 편견 없는 언어는 나이, 장애, 성별, 인종 정체성, 민족 정체성, 성적 지향성, 사회 경제적 지위 및 교차성에 기초한 차별을 의미하지 않는 언어로 정의됩니다. 제품 소프트웨어의 사용자 인터페이스에서 하드코딩된 언어, RFP 설명서에 기초한 언어 또는 참조된 서드파티 제품에서 사용하는 언어로 인해 설명서에 예외가 있을 수 있습니다. 시스코에서 어떤 방식으로 포용적인 언어를 사용하고 있는지 자세히 알아보세요.

이 번역에 관하여

Cisco는 전 세계 사용자에게 다양한 언어로 지원 콘텐츠를 제공하기 위해 기계 번역 기술과 수작업 번역을 병행하여 이 문서를 번역했습니다. 아무리 품질이 높은 기계 번역이라도 전문 번역가의 번역 결과물만큼 정확하지는 않습니다. Cisco Systems, Inc.는 이 같은 번역에 대해 어떠한 책임도 지지 않으며 항상 원본 영문 문서(링크 제공됨)를 참조할 것을 권장합니다.

소개

이 문서에서는 TACACS+를 사용하여 L2TP(Layer 2 Tunnel Protocol)를 구성하는 방법에 대해 설명합니다. 여기에는 L2TP LAC(Access Concentrator) TACACS+ 서버, L2TP Network Server(LNS) TACACS+ 서버 및 라우터의 샘플 컨피그레이션이 포함됩니다.

사전 요구 사항

요구 사항

이 문서에 대한 특정 요건이 없습니다.

사용되는 구성 요소

이 문서의 정보는 다음 소프트웨어 및 하드웨어 버전을 기반으로 합니다.

  • Cisco 2511 라우터 2개

  • Cisco IOS® 소프트웨어 릴리스 12.0(2).T

  • Cisco Secure UNIX, Cisco Secure Windows 또는 TACACS+ 프리웨어

이 문서의 정보는 특정 랩 환경의 디바이스를 토대로 작성되었습니다. 이 문서에 사용된 모든 디바이스는 초기화된(기본) 컨피그레이션으로 시작되었습니다. 현재 네트워크가 작동 중인 경우, 모든 명령어의 잠재적인 영향을 미리 숙지하시기 바랍니다.

표기 규칙

문서 표기 규칙에 대한 자세한 내용은 Cisco 기술 팁 표기 규칙을 참조하십시오.

구성

이 섹션에는 이 문서에서 설명하는 기능을 구성하기 위한 정보가 표시됩니다.

참고: 이 문서에 사용된 명령에 대한 추가 정보를 찾으려면 명령 조회 도구(등록된 고객만 해당)를 사용합니다.

네트워크 다이어그램

이 문서에서는 이 다이어그램에 표시된 네트워크 설정을 사용합니다.

l2tptac.gif

TACACS+ 서버 구성

LAC 구성 - Cisco Secure UNIX 

# ./ViewProfile -p 9900 -u rtp.cisco.com user = rtp.cisco.com{ 
service=ppp { 
protocol=vpdn { 
set tunnel-type=l2tp 
set tunnel-id=rtp_tunnel 
set ip-addresses="10.31.1.56" 
} 
} 

} 

# ./ViewProfile -p 9900 -u rtp_tunnel
user = rtp_tunnel{
password = chap "FGHIJ" 
service=ppp {
protocol=lcp {
} 
protocol=ip {
} 
} 

}

LNS 구성 - Cisco Secure UNIX 

# ./ViewProfile -p 9900 -u janedoe@rtp.cisco.com
user = janedoe@rtp.cisco.com{
password = chap "rtprules" 
service=ppp {
protocol=lcp {
} 
protocol=ip {
} 
} 

}
# ./ViewProfile -p 9900 -u ABCDE
user = ABCDE{
password = chap "FGHIJ" 
service=ppp {
protocol=lcp {
} 
protocol=ip {
}
}

}

LAC 컨피그레이션 - Cisco Secure Windows

Cisco Secure Windows에서 LAC를 구성하려면 다음 단계를 완료합니다.

  1. 사용자 rtp_tunnel을 일반 PPP 사용자(사용자 설정의 비밀번호 및/또는 CHAP 비밀번호)로 설정합니다.

  2. 사용자를 group_1에 넣고 서비스 PPP/IP를 확인합니다. PPP/LCP가 표시되면 선택합니다.

  3. 사용자 rtp.cisco.com을 설정합니다. 비밀번호는 "관심 없음"입니다.

  4. 일부 옵션이 Group Settings(그룹 설정)에 표시되지 않으면 Interface Configuration(인터페이스 컨피그레이션)으로 이동하여 상자를 선택하여 표시할 수 있습니다.

  5. 사용자를 group_2에 넣고 서비스 PPP/VPDN을 확인합니다. tunnel-id는 rtp_tunnel, IP 주소 목록은 10.31.1.56이고, 아래의 사각형 사용자 지정 특성 상자에 tunnel-type=l2tp를 입력합니다.

LNS 구성 - Cisco Secure Windows

Cisco Secure Windows용 LNS를 구성하려면 다음 단계를 완료하십시오.

  1. 'ABCDE' 및 'janedoe@rtp.cisco.com' 사용자를 일반 PPP 사용자로 설정합니다(사용자 설정의 비밀번호 및/또는 CHAP 비밀번호).

  2. 사용자를 group_3에 넣고 서비스 PPP/IP를 확인합니다. PPP/LCP가 표시되면 선택합니다.

LAC TACACS+ 프리웨어 컨피그레이션 

user = rtp.cisco.com {
service = ppp protocol = vpdn {
tunnel-type = l2tp
tunnel-id = rtp_tunnel
ip-addresses = "10.31.1.56"
}
}

user = rtp_tunnel {
chap = cleartext "FGHIJ"
service = ppp protocol = ip {
default attribute = permit
}
}

LNS TACACS+ 프리웨어 컨피그레이션 

key = "cisco"

user = janedoe@rtp.cisco.com {
chap = cleartext "rtprules"
service = ppp protocol = ip {
default attribute = permit
}
}

user = ABCDE {
chap = cleartext "FGHIJ"
service = ppp protocol = ip {
default attribute = permit
}
}

라우터 컨피그레이션

LAC 라우터 컨피그레이션 
version 12.0
service timestamps debug datetime
service timestamps log uptime
no service password-encryption
!
hostname LAC
!
aaa new-model
aaa authentication ppp default if-needed tacacs+
aaa authorization network default tacacs+
aaa accounting network default start-stop tacacs+
enable secret level 7 5 $1$Dj3K$9jkyuJR6fJV2JO./Qt0lC1
enable password ww
!
username john password 0 doe
ip subnet-zero
no ip domain-lookup
! 
vpdn enable
!
vpdn search-order domain 
!
interface Loopback0
no ip address
no ip directed-broadcast
!
interface Ethernet0
ip address 10.31.1.144 255.255.255.0
no ip directed-broadcast
!
interface Serial0
no ip address
no ip directed-broadcast
no ip mroute-cache
shutdown
!
interface Serial1
no ip address
no ip directed-broadcast
shutdown
!
interface Async1
ip unnumbered Ethernet0
no ip directed-broadcast
ip tcp header-compression passive
encapsulation ppp
async mode dedicated
peer default ip address pool default
ppp authentication chap
!
ip local pool default 10.5.5.5 10.5.5.50
ip classless
ip route 0.0.0.0 0.0.0.0 10.31.1.1
!
tacacs-server host 171.68.118.106
tacacs-server key cisco
! 
line con 0
transport input none
line 1
exec-timeout 0 0
autoselect during-login
autoselect ppp
modem Dialin
transport preferred none
transport output none
speed 38400
flowcontrol hardware
line 2 16
modem InOut
transport input all
speed 38400
flowcontrol hardware
line aux 0
line vty 0 4
password WW
!
end

LNS 라우터 컨피그레이션 
version 12.0
service timestamps debug datetime
service timestamps log uptime
no service password-encryption
!
hostname LNS
!
aaa new-model
aaa authentication ppp default if-needed tacacs+
aaa authorization network default tacacs+
aaa accounting network default start-stop tacacs+
enable secret 5 $1$wfMI$ixUG9hw7yhmsv.87.krpZ1
enable password WW
!
username john password 0 doe
ip subnet-zero
no ip domain-lookup

! 
vpdn enable
!
vpdn-group 1
accept dialin l2tp virtual-template 1 remote rtp_tunnel
local name ABCDE
!
interface Ethernet0
ip address 10.31.1.56 255.255.255.0
no ip directed-broadcast
!
interface Virtual-Template1
ip unnumbered Ethernet0
no ip directed-broadcast
peer default ip address pool default
ppp authentication chap
!
interface Serial0
no ip address
no ip directed-broadcast
no ip mroute-cache
shutdown
!
interface Serial1
no ip address
no ip directed-broadcast
shutdown
!
interface Async1
ip unnumbered Ethernet0
no ip directed-broadcast
ip tcp header-compression passive
encapsulation ppp
async mode dedicated
peer default ip address pool setup_pool
ppp authentication chap pap
!
!
!
!
ip local pool default 10.6.1.1 10.6.1.2
ip classless
ip route 0.0.0.0 0.0.0.0 10.31.1.1
!
tacacs-server host 171.68.118.101
tacacs-server key cisco
!
line con 0
transport input none
line 1 8 
autoselect during-login
autoselect ppp
modem Dialin
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
password WW
!
end

다음을 확인합니다.

두 라우터의 명령 출력 표시

이 섹션에서는 컨피그레이션이 제대로 작동하는지 확인하는 데 사용할 수 있는 정보를 제공합니다.

일부 show 명령은 출력 인터프리터 툴 에서 지원되는데(등록된 고객만), 이 툴을 사용하면 show 명령 출력의 분석 결과를 볼 수 있습니다.

LAC 라우터 

LAC#show vpdn session
L2TP Session Information (Total tunnels=1 sessions=1)

LocID RemID TunID Intf Username State Last Chg
1 1 76 As1 janedoe@rtp.c est 00:00:32

% No active L2F tunnels

LAC#show vpdn tunnel

L2TP Tunnel Information (Total tunnels=1 sessions=1)

LocID RemID Remote Name State Remote Address Port Sessions
76 58 ABCDE est 10.31.1.56 1701 1 

% No active L2F tunnels

LNS 라우터 

LNS#show vpdn session

L2TP Session Information (Total tunnels=1 sessions=1)

LocID RemID TunID Intf Username State Last Chg
1 1 58 Vi1 janedoe@rtp.c est 00:01:55

% No active L2F tunnels

LNS#show vpdn tunnel 

L2TP Tunnel Information (Total tunnels=1 sessions=1)

LocID RemID Remote Name State Remote Address Port Sessions
58 76 rtp_tunnel est 10.31.1.144 1701 1 

% No active L2F tunnels

두 라우터의 버전 출력 표시 

LAC#show version
Cisco Internetwork Operating System Software 
IOS (tm) 2500 Software (C2500-IS-L), Version 12.0(2)T, RELEASE SOFTWARE (fc1) 
Copyright (c) 1986-1998 by cisco Systems, Inc.
Compiled Wed 09-Dec-98 02:31 by dschwart
Image text-base: 0x030403B0, data-base: 0x00001000

ROM: System Bootstrap, Version 11.0(10c), SOFTWARE
BOOTFLASH: 3000 Bootstrap Software (IGS-BOOT-R), Version 11.0(10c), RELEASE SOFTWARE (fc1)

LAC uptime is 20 hours, 22 minutes
System restarted by reload at 16:13:55 UTC Fri Jan 29 1999
System image file is "flash:c2500-is-l.120-2.T"

cisco 2511 (68030) processor (revision M) with 14336K/2048K bytes of memory.
Processor board ID 07041186, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
1 Ethernet/IEEE 802.3 interface(s)
2 Serial network interface(s)
16 terminal line(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
Configuration register is 0x2102

잘못된 작업 - LAC의 잘못된 디버그

이 디버그 출력에는 라우터가 잘못 구성된 경우 시퀀스가 중지되는 위치에 대한 주석이 포함됩니다. 

LAC#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
L2X protocol events debugging is on
L2X protocol errors debugging is on
VPDN events debugging is on
VPDN errors debugging is on
VTEMPLATE:
Virtual Template debugging is on
LAC#
Jan 30 12:17:09: As1 AAA/AUTHOR/FSM: (0): LCP succeeds trivially
20:03:18: %LINK-3-UPDOWN: Interface Async1, changed state to up
Jan 30 12:17:09: As1 VPDN: Looking for tunnel -- rtp.cisco.com --
Jan 30 12:17:09: AAA: parse name=Async1 idb type=10 tty=1
Jan 30 12:17:09: AAA: name=Async1 flags=0x11 type=4 shelf=0 slot=0 adapter=0 
                port=1 channel=0
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x278B90) user='rtp.cisco.com' 
                 ruser='' port='Async1' 
rem_addr='' authen_type=NONE service=LOGIN priv=0
Jan 30 12:17:09: AAA/AUTHOR/VPDN (898425447): Port='Async1' 
                 list='default' service=NET
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) user='rtp.cisco.com'
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) send AV service=ppp
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) send AV protocol=vpdn
Jan 30 12:17:09: AAA/AUTHOR/VPDN (898425447) found list "default"
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) Method=TACACS+
Jan 30 12:17:09: AAA/AUTHOR/TAC+: (898425447): user=rtp.cisco.com
Jan 30 12:17:09: AAA/AUTHOR/TAC+: (898425447): send AV service=ppp
Jan 30 12:17:09: AAA/AUTHOR/TAC+: (898425447): send AV protocol=vpdn
Jan 30 12:17:09: TAC+: (898425447): received author response status = PASS_ADD
Jan 30 12:17:09: AAA/AUTHOR (898425447): Post authorization status = PASS_ADD
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV service=ppp
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV protocol=vpdn
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV tunnel-type=l2tp
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV tunnel-id=rtp_tunnel

!--- If the wrong tunnel termination IP address !--- is in the profile:

Jan 30 12:56:30: AAA/AUTHOR/VPDN: Processing AV ip-addresses=1.1.1.1
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV ip-addresses=10.31.1.56
Jan 30 12:17:09: As1 VPDN: Get tunnel info for rtp.cisco.com with LAC 
                 rtp_tunnel, IP 10.31.1.56
Jan 30 12:17:09: AAA/AUTHEN: free_user (0x278B90) user='rtp.cisco.com' 
                 ruser='' port='Async1' 
rem_addr='' authen_type=NONE service=LOGIN priv=0

!--- If the wrong tunnel termination IP !--- address is in the profile:

Jan 30 12:56:30: As1 VPDN: Forward to address 1.1.1.1

!--- The connection eventually drops on this end and no !--- debug is seen on the other end.

Jan 30 12:17:09: As1 VPDN: Forward to address 10.31.1.56
Jan 30 12:17:09: As1 VPDN: Forwarding...
Jan 30 12:17:09: AAA: parse name=Async1 idb type=10 tty=1
Jan 30 12:17:09: AAA: name=Async1 flags=0x11 type=4 shelf=0 slot=0 
                  adapter=0 port=1 channel=0
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x22CDEC) 
                 user='janedoe@rtp.cisco.com' ruser='' 
port='Async1' rem_addr='async' authen_type=CHAP  service=PPP priv=1
Jan 30 12:17:09: As1 VPDN: Bind interface direction=1
Jan 30 12:17:09: Tnl/Cl 74/1 L2TP: Session FS enabled
Jan 30 12:17:09: Tnl/Cl 74/1 L2TP: Session state change from idle to 
                  wait-for-tunnel
Jan 30 12:17:09: As1 74/1 L2TP: Create session
Jan 30 12:17:09: Tnl 74 L2TP: SM State idle
Jan 30 12:17:09: Tnl 74 L2TP: O SCCRQ 
Jan 30 12:17:09: Tnl 74 L2TP: Tunnel state change from idle to wait-ctl-reply
Jan 30 12:17:09: Tnl 74 L2TP: SM State wait-ctl-reply
Jan 30 12:17:09: As1 VPDN: janedoe@rtp.cisco.com is forwarded
Jan 30 12:17:10: Tnl 74 L2TP: I SCCRP from ABCDE
Jan 30 12:17:10: Tnl 74 L2TP: Got a challenge from remote peer, ABCDE
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x23232C) user='rtp_tunnel' 
                 ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN/START (1598999635): port='' list='default' 
                  action=SENDAUTH service=PPP
Jan 30 12:17:10: AAA/AUTHEN/START (1598999635): found list default
Jan 30 12:17:10: AAA/AUTHEN (1598999635): status = UNKNOWN
Jan 30 12:17:10: AAA/AUTHEN/START (1598999635): Method=TACACS+
Jan 30 12:17:10: TAC+: send AUTHEN/START packet ver=193 id=1598999635
Jan 30 12:17:10: TAC+: ver=192 id=1598999635 received AUTHEN status = ERROR
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x232470) user='rtp_tunnel' 
                 ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: TAC+: ver=192 id=3400389836 received AUTHEN status = PASS
Jan 30 12:17:10: AAA/AUTHEN: free_user (0x232470) user='rtp_tunnel' ruser='' 
                 port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN (1598999635): status = PASS
Jan 30 12:17:10: AAA/AUTHEN: free_user (0x23232C) user='rtp_tunnel' 
                 ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1


!--- Change the CHAP passwords. The password rtp_tunnel !--- in the LAC TACACS+ users' file does not match the !--- password for "local name ABCDE" from the router !--- in the LNS TACACS+ users' file:

Jan 30 13:24:23: Tnl 88 L2TP: Tunnel Authentication fails for ABCDE
Jan 30 13:24:23: Tnl 88 L2TP: Expected 7C959CA96C1E4AAA68BB3D481249488B
Jan 30 13:24:23: Tnl 88 L2TP: Got E4118FB4C8C4467EA4BF8872276C20B2

Jan 30 12:17:10: Tnl 74 L2TP: Got a response from remote peer, ABCDE
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x22FBA4) user='rtp_tunnel' 
                 ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN/START (2964849625): port='' list='default' 
                 action=SENDAUTH service=PPP
Jan 30 12:17:10: AAA/AUTHEN/START (2964849625): found list default
Jan 30 12:17:10: AAA/AUTHEN (2964849625): status = UNKNOWN
Jan 30 12:17:10: AAA/AUTHEN/START (2964849625): Method=TACACS+
Jan 30 12:17:10: TAC+: send AUTHEN/START packet ver=193 id=2964849625
20:03:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface Async1, 
           changed state to up
Jan 30 12:17:11: TAC+: ver=192 id=2964849625 received AUTHEN status = ERROR
Jan 30 12:17:11: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:11: AAA/AUTHEN: create_user (0x22FC8C) user='rtp_tunnel' 
                  ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: As1 74/1 L2TP: Discarding data packet because tunnel is not open
Jan 30 12:17:11: As1 74/1 L2TP: Discarding data packet because tunnel is not open
Jan 30 12:17:11: TAC+: ver=192 id=1474818051 received AUTHEN status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x22FC8C) user='rtp_tunnel' ruser=''
                 port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: AAA/AUTHEN (2964849625): status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x22FBA4) user='rtp_tunnel' ruser='' 
                  port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: Tnl 74 L2TP: Tunnel Authentication success
Jan 30 12:17:11: Tnl 74 L2TP: Tunnel state change from wait-ctl-reply to 
                 established
Jan 30 12:17:11: Tnl 74 L2TP: O SCCCN to ABCDE tnlid 56
Jan 30 12:17:11: Tnl 74 L2TP: SM State established
Jan 30 12:17:11: As1 74/1 L2TP: O ICRQ to ABCDE 56/0
Jan 30 12:17:11: As1 74/1 L2TP: Session state change from wait-for-tunnel 
                 to wait-reply
Jan 30 12:17:11: Tnl 74 L2TP: Dropping old CM, Ns 0, expected 1
Jan 30 12:17:11: As1 74/1 L2TP: O ICCN to ABCDE 56/1
Jan 30 12:17:11: As1 74/1 L2TP: Session state change from wait-reply to 
                 established
LAC#

잘못된 작업 - LNS의 잘못된 디버그

이 디버그 출력에는 라우터가 잘못 구성된 경우 시퀀스가 중지되는 위치에 대한 주석이 포함됩니다. 

LNS#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
L2X protocol events debugging is on
L2X protocol errors debugging is on
VPDN events debugging is on
VPDN errors debugging is on
VTEMPLATE:
Virtual Template debugging is on
LNS#
Jan 30 12:17:09: L2TP: I SCCRQ from rtp_tunnel tnl 74
Jan 30 12:17:09: Tnl 56 L2TP: New tunnel created for remote rtp_tunnel, 
address 10.31.1.144


!--- Instead of the LAC sending the "rtp_tunnel" !--- (see the user profile on the TACACS+ server), it sends "junk". !--- We are expecting "rtp_tunnel" as in "accept dialin l2tp !--- virtual-template 1 remote rtp_tunnel" in this configuration:

Jan 30 13:05:16: L2TP: I SCCRQ from junk tnl 81
Jan 30 13:05:16: L2X: Never heard of junk
Jan 30 13:05:16: L2TP: Could not find info block for junk
Jan 30 12:17:09: Tnl 56 L2TP: Got a challenge in SCCRQ, rtp_tunnel
Jan 30 12:17:09: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x21F6D0) user='ABCDE' 
                 ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: AAA/AUTHEN/START (3194595626): port='' list='default' 
                 action=SENDAUTH service=PPP
Jan 30 12:17:09: AAA/AUTHEN/START (3194595626): found list default
Jan 30 12:17:09: AAA/AUTHEN (3194595626): status = UNKNOWN
Jan 30 12:17:09: AAA/AUTHEN/START (3194595626): Method=TACACS+
Jan 30 12:17:09: TAC+: send AUTHEN/START packet ver=193 id=3194595626
Jan 30 12:17:09: TAC+: ver=192 id=3194595626 received AUTHEN status = ERROR
Jan 30 12:17:09: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x2281AC) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: TAC+: ver=192 id=3639011179 received AUTHEN status = PASS
Jan 30 12:17:09: AAA/AUTHEN: free_user (0x2281AC) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: AAA/AUTHEN (3194595626): status = PASS
Jan 30 12:17:09: AAA/AUTHEN: free_user (0x21F6D0) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: Tnl 56 L2TP: O SCCRP to rtp_tunnel tnlid 74
Jan 30 12:17:09: Tnl 56 L2TP: Tunnel state change from idle to wait-ctl-reply
Jan 30 12:17:10: Tnl 56 L2TP: O Resend SCCRP, flg TLF, ver 2, len 152, 
                 tnl 74, cl 0, ns 0, nr 1
Jan 30 12:17:10: Tnl 56 L2TP: I SCCCN from rtp_tunnel tnl 74
Jan 30 12:17:10: Tnl 56 L2TP: Got a Challenge Response in SCCCN from rtp_tunnel
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x227F3C) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN/STARTTranslating "rtp.cisco.com"
(4117701992): port='' list='default' action=SENDAUTH service=PPP
Jan 30 12:17:10: AAA/AUTHEN/START (4117701992): found list default
Jan 30 12:17:10: AAA/AUTHEN (4117701992): status = UNKNOWN
Jan 30 12:17:10: AAA/AUTHEN/START (4117701992): Method=TACACS+
Jan 30 12:17:10: TAC+: send AUTHEN/START packet ver=193 id=4117701992
Jan 30 12:17:11: TAC+: ver=192 id=4117701992 received AUTHEN status = ERROR
Jan 30 12:17:11: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:11: AAA/AUTHEN: create_user (0x228E68) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: TAC+: ver=192 id=2827432721 received AUTHEN status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x228E68) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: AAA/AUTHEN (4117701992): status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x227F3C) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: Tnl 56 L2TP: Tunnel Authentication success
Jan 30 12:17:11: Tnl 56 L2TP: Tunnel state change from wait-ctl-reply 
                 to established
Jan 30 12:17:11: Tnl 56 L2TP: SM State established
Jan 30 12:17:11: Tnl 56 L2TP: I ICRQ from rtp_tunnel tnl 74
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session FS enabled
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session state change from idle to 
                 wait-for-tunnel
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: New session created
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: O ICRP to rtp_tunnel 74/1
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session state change from wait-for-tunnel 
                 to wait-connect
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: I ICCN from rtp_tunnel tnl 74, cl 1
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session state change from wait-connect 
                  to established
Jan 30 12:17:11: Vi1 VTEMPLATE: Reuse Vi1, recycle queue size 0
Jan 30 12:17:11: Vi1 VTEMPLATE: Hardware address 00e0.1e68.942c
Jan 30 12:17:11: Vi1 VPDN: Virtual interface created for janedoe@rtp.cisco.com
Jan 30 12:17:11: Vi1 VPDN: Set to Async interface
Jan 30 12:17:11: Vi1 VPDN: Clone from Vtemplate 1 filterPPP=0 blocking
Jan 30 12:17:11: Vi1 VTEMPLATE: Has a new cloneblk vtemplate, now it has 
                 vtemplate
Jan 30 12:17:11: Vi1 VTEMPLATE: ************* CLONE VACCESS1 *****************
Jan 30 12:17:11: Vi1 VTEMPLATE: Clone from Virtual-Template1
interface Virtual-Access1
default ip address
no ip address
encap ppp
ip unnumbered Ethernet0
peer default ip address pool default
ppp authentication chap
ip unnum ethernet0
peer def ip address pool default
ppp authen chap
end

Jan 30 12:17:12: janedoe@rtp.cisco.com 56/1 L2TP: Session with no hwidb
20:12:14: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
Jan 30 12:17:13: Vi1 AAA/AUTHOR/FSM: (0): LCP succeeds trivially
Jan 30 12:17:13: Vi1 VPDN: Bind interface direction=2
Jan 30 12:17:13: Vi1 VPDN: PPP LCP accepted rcv CONFACK
Jan 30 12:17:13: Vi1 VPDN: PPP LCP accepted sent CONFACK
Jan 30 12:17:13: Vi1 L2X: Discarding packet because of no mid/session
Jan 30 12:17:13: AAA: parse name=Virtual-Access1 idb type=21 tty=-1
Jan 30 12:17:13: AAA: name=Virtual-Access1 flags=0x11 type=5 shelf=0 slot=0 
adapter=0 port=1 channel=0
Jan 30 12:17:13: AAA/AUTHEN: create_user (0x1F5100) user='janedoe@rtp.cisco.com' 
ruser='' port='Virtual-Access1' rem_addr='' authen_type=CHAP
service=PPP priv=1
Jan 30 12:17:13: AAA/AUTHEN/START (562517969): port='Virtual-Access1' list='' 
action=LOGIN service=PPP
Jan 30 12:17:13: AAA/AUTHEN/START (562517969): using "default" list
Jan 30 12:17:13: AAA/AUTHEN (562517969): status = UNKNOWN
Jan 30 12:17:13: AAA/AUTHEN/START (562517969): Method=TACACS+
Jan 30 12:17:13: TAC+: send AUTHEN/START packet ver=193 id=562517969
Jan 30 12:17:14: TAC+: ver=192 id=562517969 received AUTHEN status = GETPASS
Jan 30 12:17:14: AAA: parse name=Virtual-Access1 idb type=-1 tty=-1
Jan 30 12:17:14: AAA: name=Virtual-Access1 flags=0x11 type=6 shelf=0 slot=0 
adapter=0 port=1 channel=0
Jan 30 12:17:14: AAA/AUTHEN: create_user (0x1F5270) user='janedoe@rtp.cisco.com' 
ruser='' port='Virtual-Access1' rem_addr='' authen_type=CHAP
service=PPP priv=1
Jan 30 12:17:14: TAC+: ver=192 id=2384902384 received AUTHEN status = PASS
Jan 30 12:17:14: AAA/AUTHEN: free_user (0x1F5270) user='janedoe@rtp.cisco.com' 
ruser='' port='Virtual-Access1' rem_addr='' authen_type=CHAP
service=PPP priv=1


!--- Here, the tunnel is ok, but the user !--- enters a bad password in dialing:

Jan 30 13:39:44: AAA/AUTHEN (1958732267): status = FAIL
21:34:45: %VPDN-6-AUTHENFAIL: L2F HGW 10.31.1.144, AAA authentication
            failure for Vi1 user 
janedoe@rtp.cisco.com; Authentication failure
Jan 30 12:17:14: AAA/AUTHEN (562517969): status = PASS
Jan 30 12:17:14: Vi1 AAA/AUTHOR/LCP: Authorize LCP
Jan 30 12:17:14: AAA/AUTHOR/LCP Vi1 (413543389): Port='Virtual-Access1' 
                list='' service=NET
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) user='janedoe@rtp.cisco.com'
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) send AV protocol=lcp
Jan 30 12:17:14: AAA/AUTHOR/LCP (413543389) found list "default"
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) Method=TACACS+
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (413543389): user=janedoe@rtp.cisco.com
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (413543389): send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (413543389): send AV protocol=lcp
Jan 30 12:17:14: TAC+: (413543389): received author response status = PASS_ADD
Jan 30 12:17:14: AAA/AUTHOR (413543389): Post authorization status = PASS_ADD
Jan 30 12:17:14: AAA/ACCT/NET/START User janedoe@rtp.cisco.com, Port 
                 Virtual-Access1, List ""
Jan 30 12:17:14: AAA/ACCT/NET: Found list "default"
Jan 30 12:17:14: Vi1 AAA/AUTHOR/FSM: (0): Can we start IPCP?
Jan 30 12:17:14: AAA/AUTHOR/FSM Vi1 (1358526470): Port='Virtual-Access1' 
                 list='' service=NET
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) user='janedoe@rtp.cisco.com'
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) send AV protocol=ip
Jan 30 12:17:14: AAA/AUTHOR/FSM (1358526470) found list "default"
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) Method=TACACS+
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (1358526470): user=janedoe@rtp.cisco.com
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (1358526470): send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (1358526470): send AV protocol=ip
Jan 30 12:17:14: TAC+: (1358526470): received author response status = PASS_ADD
Jan 30 12:17:14: AAA/AUTHOR (1358526470): Post authorization status = PASS_ADD
Jan 30 12:17:14: Vi1 AAA/AUTHOR/FSM: We can start IPCP
Jan 30 12:17:14: TAC+: (1442592025): received acct response status = UNKNOWN
20:12:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, 
            changed state to up
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, we want 0.0.0.0
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV service=ppp
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV protocol=ip
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Authorization succeeded
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, 
                 we want 0.0.0.0
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, 
                 we want 10.6.1.1
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV service=ppp
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV protocol=ip
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Authorization succeeded
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, 
                 we want 10.6.1.1
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Start. Her address 10.6.1.1, 
                  we want 10.6.1.1
Jan 30 12:17:16: AAA/AUTHOR/IPCP Vi1 (3572380713): Port='Virtual-Access1' 
                 list='' service=NET
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) user='janedoe@rtp.cisco.com'
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) send AV service=ppp
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) send AV protocol=ip
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) send AV addr*10.6.1.1
Jan 30 12:17:16: AAA/AUTHOR/IPCP (3572380713) found list "default"
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) Method=TACACS+
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): user=janedoe@rtp.cisco.com
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): send AV service=ppp
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): send AV protocol=ip
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): send AV addr*10.6.1.1
Jan 30 12:17:17: TAC+: (3572380713): received author response status = PASS_ADD
Jan 30 12:17:17: AAA/AUTHOR (3572380713): Post authorization status = PASS_ADD
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Processing AV service=ppp
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Processing AV protocol=ip
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Processing AV addr*10.6.1.1
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Authorization succeeded
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Done. Her address 10.6.1.1, 
                 we want 10.6.1.1
LNS#

LNS 회계 레코드

이는 LNS TACACS+ 서버에 있습니다. 

Sat Jan 30 05:27:01 1999 10.31.1.56 janedoe@rtp.cisco.com 
Virtual-Access1 unknown 
start task_id=4 start_time=917700054 timezone=UTC service=ppp

Sat Jan 30 05:27:27 1999 10.31.1.56 janedoe@rtp.cisco.com 
Virtual-Access1 unknown 
stop task_id=4 start_time=917700054 timezone=UTC service=ppp
protocol=ip addr=10.6.1.1 disc-cause=2 disc-cause-ext=1011 
pre-bytes-in=0 pre-bytes-out=8 
pre-paks-in=0 pre-paks-out=2 bytes_in=862 bytes_out=142
paks_in=19 paks_out=8 pre-session-time=1

문제 해결

이 섹션에서는 컨피그레이션 문제를 해결하는 데 사용할 수 있는 정보를 제공합니다.

문제 해결 명령

참고: debug 명령을 실행하기 전에 디버그 명령에 대한 중요 정보를 참조하십시오.

  • debug aaa authentication—AAA/TACACS+ 인증에 대한 정보를 표시합니다.

  • debug aaa authorization - AAA/TACACS+ 권한 부여에 대한 정보를 표시합니다.

  • debug aaa accounting - 발생 시 책임 이벤트에 대한 정보를 표시합니다. 이 명령으로 표시되는 정보는 계정 정보를 서버로 전송하는 데 사용되는 어카운팅 프로토콜과 독립적입니다.

  • debug tacacs+—TACACS+와 관련된 자세한 디버깅 정보를 표시합니다.

  • debug vtemplate - 가상 액세스 인터페이스가 가상 템플릿에서 복제될 때부터 통화가 종료될 때 가상 액세스 인터페이스가 중단될 때까지 가상 액세스 인터페이스에 대한 복제 정보를 표시합니다.

  • debug vpdn error - PPP 터널이 설정되지 않도록 하는 오류 또는 설정된 터널을 닫도록 하는 오류를 표시합니다.

  • debug vpdn events - 일반 PPP 터널 설정 또는 종료의 일부인 이벤트에 대한 메시지를 표시합니다.

  • debug vpdn l2x-errors - 레이어 2 설정을 방지하거나 정상적인 작동을 방지하는 레이어 2 프로토콜 오류를 표시합니다.

  • debug vpdn l2x-events - Layer 2에 대한 일반 PPP 터널 설정 또는 종료의 일부인 이벤트에 대한 메시지를 표시합니다.

디버그 출력

LAC 라우터의 정상 디버그 

LAC#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
L2X protocol events debugging is on
L2X protocol errors debugging is on
VPDN events debugging is on
VPDN errors debugging is on
VTEMPLATE:
Virtual Template debugging is on
LAC#
Jan 30 12:17:09: As1 AAA/AUTHOR/FSM: (0): LCP succeeds trivially
20:03:18: %LINK-3-UPDOWN: Interface Async1, changed state to up
Jan 30 12:17:09: As1 VPDN: Looking for tunnel -- rtp.cisco.com --
Jan 30 12:17:09: AAA: parse name=Async1 idb type=10 tty=1
Jan 30 12:17:09: AAA: name=Async1 flags=0x11 type=4 shelf=0 slot=0 adapter=0 
port=1 channel=0
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x278B90) user='rtp.cisco.com' 
ruser='' 
port='Async1' rem_addr='' authen_type=NONE service=LOGIN priv=0
Jan 30 12:17:09: AAA/AUTHOR/VPDN (898425447): Port='Async1' list='default' 
service=NET
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) user='rtp.cisco.com'
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) send AV service=ppp
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) send AV protocol=vpdn
Jan 30 12:17:09: AAA/AUTHOR/VPDN (898425447) found list "default"
Jan 30 12:17:09: AAA/AUTHOR/VPDN: (898425447) Method=TACACS+
Jan 30 12:17:09: AAA/AUTHOR/TAC+: (898425447): user=rtp.cisco.com
Jan 30 12:17:09: AAA/AUTHOR/TAC+: (898425447): send AV service=ppp
Jan 30 12:17:09: AAA/AUTHOR/TAC+: (898425447): send AV protocol=vpdn
Jan 30 12:17:09: TAC+: (898425447): received author response status = PASS_ADD
Jan 30 12:17:09: AAA/AUTHOR (898425447): Post authorization status = PASS_ADD
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV service=ppp
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV protocol=vpdn
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV tunnel-type=l2tp
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV tunnel-id=rtp_tunnel
Jan 30 12:17:09: AAA/AUTHOR/VPDN: Processing AV ip-addresses=10.31.1.56
Jan 30 12:17:09: As1 VPDN: Get tunnel info for rtp.cisco.com with LAC 
rtp_tunnel, IP 10.31.1.56
Jan 30 12:17:09: AAA/AUTHEN: free_user (0x278B90) user='rtp.cisco.com' ruser='' 
port='Async1' rem_addr='' authen_type=NONE service=LOGIN priv=0
Jan 30 12:17:09: As1 VPDN: Forward to address 10.31.1.56
Jan 30 12:17:09: As1 VPDN: Forwarding...
Jan 30 12:17:09: AAA: parse name=Async1 idb type=10 tty=1
Jan 30 12:17:09: AAA: name=Async1 flags=0x11 type=4 shelf=0 slot=0 adapter=0 
port=1 channel=0
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x22CDEC) user='janedoe@rtp.cisco.com' 
ruser='' port='Async1' rem_addr='async' authen_type=CHAP
service=PPP priv=1
Jan 30 12:17:09: As1 VPDN: Bind interface direction=1
Jan 30 12:17:09: Tnl/Cl 74/1 L2TP: Session FS enabled
Jan 30 12:17:09: Tnl/Cl 74/1 L2TP: Session state change from idle to 
wait-for-tunnel
Jan 30 12:17:09: As1 74/1 L2TP: Create session
Jan 30 12:17:09: Tnl 74 L2TP: SM State idle
Jan 30 12:17:09: Tnl 74 L2TP: O SCCRQ 
Jan 30 12:17:09: Tnl 74 L2TP: Tunnel state change from idle to wait-ctl-reply
Jan 30 12:17:09: Tnl 74 L2TP: SM State wait-ctl-reply
Jan 30 12:17:09: As1 VPDN: janedoe@rtp.cisco.com is forwarded
Jan 30 12:17:10: Tnl 74 L2TP: I SCCRP from ABCDE
Jan 30 12:17:10: Tnl 74 L2TP: Got a challenge from remote peer, ABCDE
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x23232C) user='rtp_tunnel' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN/START (1598999635): port='' list='default' 
action=SENDAUTH service=PPP
Jan 30 12:17:10: AAA/AUTHEN/START (1598999635): found list default
Jan 30 12:17:10: AAA/AUTHEN (1598999635): status = UNKNOWN
Jan 30 12:17:10: AAA/AUTHEN/START (1598999635): Method=TACACS+
Jan 30 12:17:10: TAC+: send AUTHEN/START packet ver=193 id=1598999635
Jan 30 12:17:10: TAC+: ver=192 id=1598999635 received AUTHEN status = ERROR
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x232470) user='rtp_tunnel' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: TAC+: ver=192 id=3400389836 received AUTHEN status = PASS
Jan 30 12:17:10: AAA/AUTHEN: free_user (0x232470) user='rtp_tunnel' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN (1598999635): status = PASS
Jan 30 12:17:10: AAA/AUTHEN: free_user (0x23232C) user='rtp_tunnel'
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: Tnl 74 L2TP: Got a response from remote peer, ABCDE
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x22FBA4) user='rtp_tunnel' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN/START (2964849625): port='' list='default' 
action=SENDAUTH service=PPP
Jan 30 12:17:10: AAA/AUTHEN/START (2964849625): found list default
Jan 30 12:17:10: AAA/AUTHEN (2964849625): status = UNKNOWN
Jan 30 12:17:10: AAA/AUTHEN/START (2964849625): Method=TACACS+
Jan 30 12:17:10: TAC+: send AUTHEN/START packet ver=193 id=2964849625
20:03:20: %LINEPROTO-5-UPDOWN: Line protocol on Interface Async1, 
changed state to up
Jan 30 12:17:11: TAC+: ver=192 id=2964849625 received AUTHEN status = ERROR
Jan 30 12:17:11: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:11: AAA/AUTHEN: create_user (0x22FC8C) user='rtp_tunnel' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: As1 74/1 L2TP: Discarding data packet because tunnel 
is not open
Jan 30 12:17:11: As1 74/1 L2TP: Discarding data packet because tunnel 
is not open
Jan 30 12:17:11: TAC+: ver=192 id=1474818051 received AUTHEN status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x22FC8C) user='rtp_tunnel' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: AAA/AUTHEN (2964849625): status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x22FBA4) user='rtp_tunnel' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: Tnl 74 L2TP: Tunnel Authentication success
Jan 30 12:17:11: Tnl 74 L2TP: Tunnel state change from wait-ctl-reply to 
established
Jan 30 12:17:11: Tnl 74 L2TP: O SCCCN to ABCDE tnlid 56
Jan 30 12:17:11: Tnl 74 L2TP: SM State established
Jan 30 12:17:11: As1 74/1 L2TP: O ICRQ to ABCDE 56/0
Jan 30 12:17:11: As1 74/1 L2TP: Session state change from wait-for-tunnel 
to wait-reply
Jan 30 12:17:11: Tnl 74 L2TP: Dropping old CM, Ns 0, expected 1
Jan 30 12:17:11: As1 74/1 L2TP: O ICCN to ABCDE 56/1
Jan 30 12:17:11: As1 74/1 L2TP: Session state change from wait-reply to 
established
LAC#

LNS 라우터의 정상 디버그 

LNS#show debug
General OS:
AAA Authentication debugging is on
AAA Authorization debugging is on
AAA Accounting debugging is on
VPN:
L2X protocol events debugging is on
L2X protocol errors debugging is on
VPDN events debugging is on
VPDN errors debugging is on
VTEMPLATE:
Virtual Template debugging is on
LNS#
Jan 30 12:17:09: L2TP: I SCCRQ from rtp_tunnel tnl 74
Jan 30 12:17:09: Tnl 56 L2TP: New tunnel created for remote 
rtp_tunnel, address 10.31.1.144
Jan 30 12:17:09: Tnl 56 L2TP: Got a challenge in SCCRQ, rtp_tunnel
Jan 30 12:17:09: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x21F6D0) user='ABCDE' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: AAA/AUTHEN/START (3194595626): port='' list='default' 
action=SENDAUTH service=PPP
Jan 30 12:17:09: AAA/AUTHEN/START (3194595626): found list default
Jan 30 12:17:09: AAA/AUTHEN (3194595626): status = UNKNOWN
Jan 30 12:17:09: AAA/AUTHEN/START (3194595626): Method=TACACS+
Jan 30 12:17:09: TAC+: send AUTHEN/START packet ver=193 id=3194595626
Jan 30 12:17:09: TAC+: ver=192 id=3194595626 received AUTHEN status = ERROR
Jan 30 12:17:09: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:09: AAA/AUTHEN: create_user (0x2281AC) user='ABCDE' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: TAC+: ver=192 id=3639011179 received AUTHEN status = PASS
Jan 30 12:17:09: AAA/AUTHEN: free_user (0x2281AC) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: AAA/AUTHEN (3194595626): status = PASS
Jan 30 12:17:09: AAA/AUTHEN: free_user (0x21F6D0) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:09: Tnl 56 L2TP: O SCCRP to rtp_tunnel tnlid 74
Jan 30 12:17:09: Tnl 56 L2TP: Tunnel state change from idle to 
wait-ctl-reply
Jan 30 12:17:10: Tnl 56 L2TP: O Resend SCCRP, flg TLF, ver 2, len 152, 
tnl 74, cl 0, ns 0, nr 1
Jan 30 12:17:10: Tnl 56 L2TP: I SCCCN from rtp_tunnel tnl 74
Jan 30 12:17:10: Tnl 56 L2TP: Got a Challenge Response in SCCCN from rtp_tunnel
Jan 30 12:17:10: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:10: AAA/AUTHEN: create_user (0x227F3C) user='ABCDE' 
ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:10: AAA/AUTHEN/STARTTranslating "rtp.cisco.com"
(4117701992): port='' list='default' action=SENDAUTH service=PPP
Jan 30 12:17:10: AAA/AUTHEN/START (4117701992): found list default
Jan 30 12:17:10: AAA/AUTHEN (4117701992): status = UNKNOWN
Jan 30 12:17:10: AAA/AUTHEN/START (4117701992): Method=TACACS+
Jan 30 12:17:10: TAC+: send AUTHEN/START packet ver=193 id=4117701992
Jan 30 12:17:11: TAC+: ver=192 id=4117701992 received AUTHEN status = ERROR
Jan 30 12:17:11: AAA: parse name= idb type=-1 tty=-1
Jan 30 12:17:11: AAA/AUTHEN: create_user (0x228E68) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: TAC+: ver=192 id=2827432721 received AUTHEN status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x228E68) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: AAA/AUTHEN (4117701992): status = PASS
Jan 30 12:17:11: AAA/AUTHEN: free_user (0x227F3C) user='ABCDE' ruser='' port='' 
rem_addr='' authen_type=CHAP service=PPP priv=1
Jan 30 12:17:11: Tnl 56 L2TP: Tunnel Authentication success
Jan 30 12:17:11: Tnl 56 L2TP: Tunnel state change from wait-ctl-reply 
to established
Jan 30 12:17:11: Tnl 56 L2TP: SM State established
Jan 30 12:17:11: Tnl 56 L2TP: I ICRQ from rtp_tunnel tnl 74
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session FS enabled
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session state change from idle to 
wait-for-tunnel
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: New session created
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: O ICRP to rtp_tunnel 74/1
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session state change from wait-for-tunnel 
to wait-connect
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: I ICCN from rtp_tunnel tnl 74, cl 1
Jan 30 12:17:11: Tnl/Cl 56/1 L2TP: Session state change from wait-connect 
to established
Jan 30 12:17:11: Vi1 VTEMPLATE: Reuse Vi1, recycle queue size 0
Jan 30 12:17:11: Vi1 VTEMPLATE: Hardware address 00e0.1e68.942c
Jan 30 12:17:11: Vi1 VPDN: Virtual interface created for janedoe@rtp.cisco.com
Jan 30 12:17:11: Vi1 VPDN: Set to Async interface
Jan 30 12:17:11: Vi1 VPDN: Clone from Vtemplate 1 filterPPP=0 blocking
Jan 30 12:17:11: Vi1 VTEMPLATE: Has a new cloneblk vtemplate, now it has vtemplate
Jan 30 12:17:11: Vi1 VTEMPLATE: ************* CLONE VACCESS1 *****************
Jan 30 12:17:11: Vi1 VTEMPLATE: Clone from Virtual-Template1
interface Virtual-Access1
default ip address
no ip address
encap ppp
ip unnumbered Ethernet0
peer default ip address pool default
ppp authentication chap
ip unnum ethernet0
peer def ip address pool default
ppp authen chap
end

Jan 30 12:17:12: janedoe@rtp.cisco.com 56/1 L2TP: Session with no hwidb
20:12:14: %LINK-3-UPDOWN: Interface Virtual-Access1, changed state to up
Jan 30 12:17:13: Vi1 AAA/AUTHOR/FSM: (0): LCP succeeds trivially
Jan 30 12:17:13: Vi1 VPDN: Bind interface direction=2
Jan 30 12:17:13: Vi1 VPDN: PPP LCP accepted rcv CONFACK
Jan 30 12:17:13: Vi1 VPDN: PPP LCP accepted sent CONFACK
Jan 30 12:17:13: Vi1 L2X: Discarding packet because of no mid/session
Jan 30 12:17:13: AAA: parse name=Virtual-Access1 idb type=21 tty=-1
Jan 30 12:17:13: AAA: name=Virtual-Access1 flags=0x11 type=5 shelf=0 slot=0 
adapter=0 port=1 channel=0
Jan 30 12:17:13: AAA/AUTHEN: create_user (0x1F5100) user='janedoe@rtp.cisco.com' 
ruser='' port='Virtual-Access1' rem_addr='' authen_type=CHAP
service=PPP priv=1
Jan 30 12:17:13: AAA/AUTHEN/START (562517969): port='Virtual-Access1' list='' 
action=LOGIN service=PPP
Jan 30 12:17:13: AAA/AUTHEN/START (562517969): using "default" list
Jan 30 12:17:13: AAA/AUTHEN (562517969): status = UNKNOWN
Jan 30 12:17:13: AAA/AUTHEN/START (562517969): Method=TACACS+
Jan 30 12:17:13: TAC+: send AUTHEN/START packet ver=193 id=562517969
Jan 30 12:17:14: TAC+: ver=192 id=562517969 received AUTHEN status = GETPASS
Jan 30 12:17:14: AAA: parse name=Virtual-Access1 idb type=-1 tty=-1
Jan 30 12:17:14: AAA: name=Virtual-Access1 flags=0x11 type=6 shelf=0 slot=0 
adapter=0 port=1 channel=0
Jan 30 12:17:14: AAA/AUTHEN: create_user (0x1F5270) user='janedoe@rtp.cisco.com' 
ruser='' port='Virtual-Access1' rem_addr='' authen_type=CHAP
service=PPP priv=1
Jan 30 12:17:14: TAC+: ver=192 id=2384902384 received AUTHEN status = PASS
Jan 30 12:17:14: AAA/AUTHEN: free_user (0x1F5270) user='janedoe@rtp.cisco.com' 
ruser='' port='Virtual-Access1' rem_addr='' authen_type=CHAP
service=PPP priv=1
Jan 30 12:17:14: AAA/AUTHEN (562517969): status = PASS
Jan 30 12:17:14: Vi1 AAA/AUTHOR/LCP: Authorize LCP
Jan 30 12:17:14: AAA/AUTHOR/LCP Vi1 (413543389): Port='Virtual-Access1' 
list='' service=NET
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) user='janedoe@rtp.cisco.com'
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) send AV protocol=lcp
Jan 30 12:17:14: AAA/AUTHOR/LCP (413543389) found list "default"
Jan 30 12:17:14: AAA/AUTHOR/LCP: Vi1 (413543389) Method=TACACS+
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (413543389): user=janedoe@rtp.cisco.com
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (413543389): send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (413543389): send AV protocol=lcp
Jan 30 12:17:14: TAC+: (413543389): received author response status = PASS_ADD
Jan 30 12:17:14: AAA/AUTHOR (413543389): Post authorization status = PASS_ADD
Jan 30 12:17:14: AAA/ACCT/NET/START User janedoe@rtp.cisco.com, 
Port Virtual-Access1, List ""
Jan 30 12:17:14: AAA/ACCT/NET: Found list "default"
Jan 30 12:17:14: Vi1 AAA/AUTHOR/FSM: (0): Can we start IPCP?
Jan 30 12:17:14: AAA/AUTHOR/FSM Vi1 (1358526470): Port='Virtual-Access1' 
list='' service=NET
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) user='janedoe@rtp.cisco.com'
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) send AV protocol=ip
Jan 30 12:17:14: AAA/AUTHOR/FSM (1358526470) found list "default"
Jan 30 12:17:14: AAA/AUTHOR/FSM: Vi1 (1358526470) Method=TACACS+
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (1358526470): user=janedoe@rtp.cisco.com
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (1358526470): send AV service=ppp
Jan 30 12:17:14: AAA/AUTHOR/TAC+: (1358526470): send AV protocol=ip
Jan 30 12:17:14: TAC+: (1358526470): received author response status = PASS_ADD
Jan 30 12:17:14: AAA/AUTHOR (1358526470): Post authorization status = PASS_ADD
Jan 30 12:17:14: Vi1 AAA/AUTHOR/FSM: We can start IPCP
Jan 30 12:17:14: TAC+: (1442592025): received acct response status = UNKNOWN
20:12:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access1, 
changed state to up
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, we want 0.0.0.0
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV service=ppp
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV protocol=ip
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Authorization succeeded
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, we want 0.0.0.0
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, we want 10.6.1.1
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV service=ppp
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Processing AV protocol=ip
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Authorization succeeded
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, we want 10.6.1.1
Jan 30 12:17:16: Vi1 AAA/AUTHOR/IPCP: Start. Her address 10.6.1.1, we want 10.6.1.1
Jan 30 12:17:16: AAA/AUTHOR/IPCP Vi1 (3572380713): Port='Virtual-Access1' 
list='' service=NET
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) user='janedoe@rtp.cisco.com'
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) send AV service=ppp
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) send AV protocol=ip
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) send AV addr*10.6.1.1
Jan 30 12:17:16: AAA/AUTHOR/IPCP (3572380713) found list "default"
Jan 30 12:17:16: AAA/AUTHOR/IPCP: Vi1 (3572380713) Method=TACACS+
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): user=janedoe@rtp.cisco.com
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): send AV service=ppp
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): send AV protocol=ip
Jan 30 12:17:16: AAA/AUTHOR/TAC+: (3572380713): send AV addr*10.6.1.1
Jan 30 12:17:17: TAC+: (3572380713): received author response status = PASS_ADD
Jan 30 12:17:17: AAA/AUTHOR (3572380713): Post authorization status = PASS_ADD
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Processing AV service=ppp
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Processing AV protocol=ip
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Processing AV addr*10.6.1.1
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Authorization succeeded
Jan 30 12:17:17: Vi1 AAA/AUTHOR/IPCP: Done. Her address 10.6.1.1, we want 10.6.1.1
LNS#

관련 정보

개정 이력

개정 게시 날짜 의견
1.0
14-May-2009
최초 릴리스

이 문서가 도움이 되셨습니까?

Feedback피드백

지원 문의