Cisco VPDN Command reference
Anúncio
Anúncio
VPDN Commands
B2006.tif
January 2011
Cisco IOS VPDN Command Reference
VPD-3
VPDN Commands aaa accounting nested
aaa accounting nested
To specify that NETWORK records be generated, or nested, within EXEC “start” and “stop” records for PPP users who start EXEC terminal sessions, use the aaa accounting nested command in global configuration mode. To allow the sending of records for users with a NULL username, use the no form of this command.
aaa accounting nested [suppress stop]
no aaa accounting nested [suppress stop]
Syntax Description suppress stop
(Optional) Prevents sending a multiple set of records (one from EXEC and one from PPP) for the same client.
Defaults
Command Modes
Global configuration (config)
Command History
Disabled
Release
12.0(5)T
12.2(33)SRA
12.4(11)T
12.2SX
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRA.
The suppress and stop keywords were added.
This command is supported in the Cisco IOS Release 12.2SX train. Support in a specific 12.2SX release of this train depends on your feature set, platform, and platform hardware.
Usage Guidelines
Use the aaa accounting nested command when you want to specify that NETWORK records be nested within EXEC “start” and “stop” records, such as for PPP users who start EXEC terminal sessions. In some cases, such as billing customers for specific services, it can be desirable to keep NETWORK
“start” and “stop” records together, essentially nesting them within the framework of the EXEC “start” and “stop” messages. For example, if you dial in using PPP, you can create the following records:
EXEC-start, NETWORK-start, EXEC-stop, and NETWORK-stop. By using the aaa accounting nested command to generate accounting records, NETWORK-stop records follow NETWORK-start messages:
EXEC-start, NETWORK-start, NETWORK-stop, EXEC-stop.
Use the aaa accounting nested suppress stop command to suppress the sending of EXEC-stop accounting records and to send only PPP accounting records.
Examples
The following example enables nesting of NETWORK accounting records for user sessions:
Router(config)# aaa accounting nested
VPD-4
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands aaa accounting nested
The following example disables nesting of EXEC accounting records for user sessions:
Router(config)# aaa accounting nested suppress stop
January 2011
Cisco IOS VPDN Command Reference
VPD-5
VPDN Commands accept-dialin
accept-dialin
To create an accept dial-in virtual private dialup network (VPDN) subgroup that configures a tunnel server to accept requests from a network access server (NAS) to tunnel dial-in calls, and to enter accept dial-in VPDN subgroup configuration mode, use the accept-dialin command in VPDN group configuration mode. To remove the accept dial-in VPDN subgroup configuration from a VPDN group, use the no form of this command.
accept-dialin no accept-dialin
Syntax Description
This command has no arguments or keywords.
Defaults
Command Modes
VPDN group configuration
Command History
No accept dial-in VPDN subgroups are configured.
Release
11.3(5)AA
12.0(1)T
12.0(5)T
12.1(1)T
Modification
This command was introduced and replaced the vpdn incoming command used in Cisco IOS Release 11.3.
This command was integrated into Cisco IOS Release 12.0(1)T and implemented on additional router and access server platforms.
The original keywords and arguments were removed and made into separate
accept-dialin subgroup commands.
This command was enhanced to support dial-in Point-to-Point Protocol over
Ethernet (PPPoE) calls.
Usage Guidelines
Use the accept-dialin command on a tunnel server to configure a VPDN group to accept requests to establish dial-in VPDN tunnels from a NAS. Once the tunnel server accepts the request from a NAS, it uses the specified virtual template to clone new virtual access interfaces.
To configure a VPDN group to accept dial-in calls, you must also configure the following commands:
•
The protocol command from accept dial-in VPDN subgroup configuration mode
•
•
The virtual-template command from accept dial-in VPDN subgroup configuration mode
(configuring this command is not required if the virtual access interface is not going to be cloned when a user connects)
The terminate-from command in VPDN group configuration mode
VPD-6
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands accept-dialin
Note
If you create a VPDN group without configuring a terminate-from command, a default VPDN group is automatically enabled. Incoming tunnel requests from any hostname will use the attributes specified in the default VPDN group, unless a specific VPDN group is configured with a terminate-from command using that hostname.
Typically, you need one VPDN group for each NAS that will be tunneling to the tunnel server. For a tunnel server that services many NASs, the configuration can become cumbersome. If all the NASs will share the same tunnel attributes, you can simplify the configuration by using the default VPDN group configuration, or by creating a VPDN default group template using the vpdn-template command.
The tunnel server can also be configured to request the establishment of Layer 2 Tunnel Protocol (L2TP) dial-out VPDN tunnels to a NAS using the request-dialout command. Dial-in and dial-out calls can use the same L2TP tunnel.
Examples
Related Commands
The following example enables the tunnel server to accept Layer 2 Forwarding (L2F) tunnels from a
NAS named router23. A virtual-access interface will be cloned from virtual-template 1.
Router(config)# vpdn-group 1
Router(config-vpdn)# accept-dialin
Router(config-vpdn-acc-in)# protocol l2f
Router(config-vpdn-acc-in)# virtual-template 1
!
Router(config-vpdn)# terminate-from hostname router23
The following example configures the router so that tunnels requested by the NAS named router16 are created with the tunnel attributes specified by VPDN group 1, while any other incoming L2TP tunnel request will use the settings configured in the default VPDN group, VPDN group 2:
Router(config)# vpdn-group 1
Router(config-vpdn)# accept-dialin
Router(config-vpdn-acc-in)# protocol l2tp
Router(config-vpdn-acc-in)# virtual-template 2
!
Router(config-vpdn)# terminate-from hostname router16
Router(config)# vpdn-group 2
! Default L2TP VPDN group
Router(config-vpdn)# accept-dialin
Router(config-vpdn-acc-in)# protocol l2tp
Router(config-vpdn-acc-in)# virtual-template 3
Command protocol (VPDN) request-dialin request-dialout terminate-from
Description
Specifies the tunneling protocol that a VPDN subgroup will use.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a
NAS, and enters request dial-out VPDN subgroup configuration mode.
Specifies the hostname of the remote LAC or LNS that will be required when accepting a VPDN tunnel.
January 2011
Cisco IOS VPDN Command Reference
VPD-7
accept-dialin
Command virtual-template vpdn-group vpdn-template
VPDN Commands
Description
Specifies which virtual template will be used to clone virtual-access interfaces.
Associates a VPDN group to a customer or VPDN profile.
Enters VPDN template configuration mode to configure a VPDN template.
VPD-8
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands accept-dialout
accept-dialout
To create an accept dial-out virtual private dialup network (VPDN) subgroup that configures a network access server (NAS) to accept requests from a tunnel server to tunnel Layer 2 Tunneling Protocol (L2TP) dial-out calls, and to enter accept dial-out VPDN subgroup configuration mode, use the accept-dialout command in VPDN group configuration mode. To remove the accept dial-out VPDN subgroup configuration from the VPDN group, use the no form of this command.
accept-dialout no accept-dialout
Syntax Description
This command has no arguments or keywords.
Defaults
Command Modes
VPDN group configuration
Command History
No accept dial-out VPDN subgroups are configured.
Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Use the accept-dialout command on a NAS to configure a VPDN group to accept requests for dial-out
VPDN tunnels from a tunnel server. L2TP is the only tunneling protocol that can be used for dial-out
VPDN tunnels.
For a VPDN group to accept dial-out calls, you must also configure the following commands:
•
•
•
•
The terminate-from command in VPDN group configuration mode
The protocol l2tp command in accept dial-out VPDN subgroup configuration mode
The dialer command in accept dial-out VPDN subgroup configuration mode
The dialer aaa command in dialer interface configuration mode
The NAS can also be configured to request the establishment of dial-in VPDN tunnels to a tunnel server using the request-dialin command. Dial-in and dial-out calls can use the same L2TP tunnel.
Examples
The following example configures a VPDN group on the NAS to accept L2TP tunnels for dial-out calls from the tunnel server TS23 using dialer 2 as its dialing resource:
Router(config)# vpdn-group 1
Router(config-vpdn)# accept-dialout
Router(config-vpdn-acc-ou)# protocol l2tp
Router(config-vpdn-acc-ou)# dialer 2
!
Router(config-vpdn)# terminate-from hostname TS23
!
January 2011
Cisco IOS VPDN Command Reference
VPD-9
VPDN Commands accept-dialout
Router(config)# interface Dialer2
Router(config-if)# ip unnumbered Ethernet0
Router(config-if)# encapsulation ppp
Router(config-if)# dialer in-band
Router(config-if)# dialer aaa
Router(config-if)# dialer-group 1
Router(config-if)# ppp authentication chap
Related Commands Command dialer dialer aaa dialer vpdn protocol (VPDN) request-dialin request-dialout terminate-from
Description
Specifies the dialer interface that an accept-dialout VPDN subgroup will use to dial out calls.
Allows a dialer to access the AAA server for dialing information.
Enables a Dialer Profile or DDR dialer to use L2TP dial-out.
Specifies the tunneling protocol that a VPDN subgroup will use.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode.
Specifies the hostname of the remote router that will be required when accepting a VPDN tunnel.
VPD-10
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands authen-before-forward
authen-before-forward
To configure a network access server (NAS) to request authentication of a complete username before making a forwarding decision for dial-in Layer 2 Tunnel Protocol (L2TP) or Layer 2 Forwarding (L2F) tunnels belonging to a virtual private dialup network (VPDN) group, use the authen-before-forward command in VPDN group configuration mode. To disable this configuration, use the no form of this command.
authen-before-forward no authen-before-forward
Syntax Description
This command has no arguments or keywords.
Command Default
L2TP or L2F tunnels are forwarded to the tunnel server without first requesting authentication of the complete username.
Command Modes
VPDN group configuration
Command History Release
11.3(9) AA
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(5)T and was modified to be available only when the request-dialin VPDN subgroup is enabled.
Usage Guidelines
To configure the NAS to perform authentication of dial-in L2TP or L2F sessions belonging to a specific
VPDN group before the sessions are forwarded to the tunnel server, use the authen-before-forward command in VPDN group configuration mode.
To configure the NAS to perform authentication of all dial-in L2TP or L2F sessions before the sessions are forwarded to the tunnel server, configure the vpdn authen-before-forward command in global configuration mode.
You must configure a request dial-in VPDN subgroup by issuing the request-dialin command before you can configure the authen-before-forward command. Removing the request-dialin configuration will remove the authen-before-forward command configuration from the VPDN group.
Enabling the authen-before-forward command instructs the NAS to authenticate the complete username before making a forwarding decision based on the domain portion of the username. A user may be forwarded or terminated locally depending on the information contained in the users RADIUS profile.
Users with forwarding information in their RADIUS profile are forwarded based on that information.
Users without forwarding information in their RADIUS profile are either forwarded or terminated locally based on the Service-Type in their RADIUS profile. The relationship between forwarding decisions and the information contained in the users RADIUS profile is summarized in
January 2011
Cisco IOS VPDN Command Reference
VPD-11
VPDN Commands authen-before-forward
Table 1 Forwarding Decisions Based on RADIUS Profile Attributes
Forwarding Information Is
Present in RADIUS profile
Absent from RADIUS profile
Service-Type Is Outbound
Forward User
Check Domain
Service-Type Is Not Outbound
Forward User
Terminate Locally
Examples
The following example configures an L2F request dial-in VPDN subgroup that sends the entire username to the authentication, authorization, and accounting (AAA) server when a user dials in with a username that includes the domain cisco.com: vpdn-group 1 request-dialin protocol l2f domain cisco.com
initiate-to ip 10.0.0.1
local name router32 authen-before-forward
Related Commands Command ppp multilink request-dialin vpdn authen-before-forward
Description
Enables MLP on an interface and, optionally, enables dynamic bandwidth allocation.
Configures a LAC to request L2F or L2TP tunnels to an LNS and create a request-dialin VPDN subgroup, and specifies a dial-in L2F or L2TP tunnel to a remote peer if a dial-in request is received for a specified domain or
DNIS.
Configures a NAS to request authentication of a complete username before making a forwarding decision for all dial-in L2TP or L2F tunnels.
VPD-12
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands authenticate (control policy-map class)
authenticate (control policy-map class)
To initiate an authentication request for an Intelligent Services Gateway (ISG) subscriber session, use the authenticate command in control policy-map class configuration mode. To remove an authentication request for an ISG subscriber session, use the no form of this command.
action-number authenticate [variable varname] [aaa list {list-name | default}]
no action-number authenticate [variable varname] [aaa list {list-name | default}]
Syntax Description
action-number
variable
varname
aaa list
list-name default
Number of the action. Actions are executed sequentially within the policy rule.
(Optional) Authenticates using the contents of the varname value instead of the unauthenticated username. If you do not specify an aaa list, the default
AAA authentication list is used.
Specifies that user authentication will be performed on the contents of the
varname value, if present.
(Optional) Specifies that authentication will be performed using an authentication, authorization, and accounting (AAA) method list.
Specifies the AAA method list to which the authentication request will be sent.
Specifies the default AAA method list to which the authentication request will be sent.
Command Default
The control policy will not initiate authentication.
Command Modes
Control policy-map class configuration
Command History Release
12.2(28)SB
12.2(31)SB2
Modification
This command was introduced.
The variable keyword and varname argument were added.
Usage Guidelines
The authenticate command configures an action in a control policy map.
Control policies define the actions the system will take in response to specified events and conditions.
A control policy map is used to configure an ISG control policy. A control policy is made of one or more control policy rules. A control policy rule is an association of a control class and one or more actions.
The control class defines the conditions that must be met before the actions will be executed. The actions are numbered and executed sequentially within the policy rule.
Note that if you specify the default method list, the default list will not appear in the output of the show
running-config command. For example, if you configure the following command:
Router(config-control-policymap-class-control)# 1 authenticate aaa list default
January 2011
Cisco IOS VPDN Command Reference
VPD-13
VPDN Commands authenticate (control policy-map class)
Examples
the following will display in the output for the show running-config command:
1 authenticate
Named method lists will display in the show running-config command output.
The following example shows an ISG configured to initiate an authentication request upon account logon. The authentication request will be sent to the AAA method list called AUTH-LIST.
policy-map type control LOGIN class type control always event account-logon
1 authenticate aaa list AUTH-LIST
2 service-policy type service unapply BLIND-RDT
The following example shows the policy map configured to initiate an authentication request using a name stored in the variable NEWNAME, instead of unauthenticated-username, using the AAA list
EXAMPLE. The authenticate statement is shown in bold: policy-map type control REPLACE_WITH_example.com
class type control always event session-start
1 collect identifier unauthenticated-username
2 set NEWNAME identifier unauthenticated-username
3 substitute NEWNAME “(.*@).*” “\1example.com”
4 authenticate variable NEWNAME aaa list EXAMPLE
5 service-policy type service name example policy-map type service abc service vpdn group 1 bba-group pppoe global virtual-template 1
!
interface Virtual-Template1 service-policy type control REPLACE_WITH_example.com
Related Commands Command class type control policy-map type control set variable substitute
Description
Specifies a control class for which actions may be configured in an ISG control policy map.
Creates or modifies a control policy map, which defines an ISG control policy.
Creates a temporary memory to hold the value of identifier types received by the policy manager.
Matches the contents, stored in temporary memory of identifier types received by the policy manager, against a specified matching pattern and performs the substitution defined in a rewrite pattern.
VPD-14
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands backup
backup
To configure an IP backup endpoint address, enter the backup command in VPDN group configuration mode. To remove this function, use the no form of this command.
backup ip ip-address [limit number [priority number]]
no backup ip ip-address [limit number [priority number]]
Syntax Description
ip ip-address
limit number
IP address of the HGW/LNS at the other end of the tunnel. This is the IP endpoint at the end of the tunnel, which is an HGW/LNS router.
(Optional) Limits sessions per backup. The limit can range from 0 to 32767. The default is no limit set.
priority number (Optional) Priority level. Loadsharing is priority 1. Backup priority is between 2 and 32,767. The highest priority is 2, which is the first home gateway router to receive backup traffic. The lowest priority is 32,767. The priority group is used to support multiple levels of loadsharing and backup. The default is the lowest priority.
Defaults
Command Modes
VPDN group configuration
Command History
No default behavior or values. This function is used only if it is configured.
Release
12.0(4)XI
Modification
This command was introduced on the following platforms only: Cisco AS5200 and Cisco AS5300.
Usage Guidelines
Use the backup VPDN group configuration command to configure an IP backup endpoint address.
Examples
The following examples show that the backup command is not available in the command-line interface until you enter the request-dialin command:
Router(config)# vpdn-group customer1-vpdngroup
Router(config-vpdn)# ?
VPDN group configuration commands:
accept-dialin VPDN accept-dialin group configuration
accept-dialout VPDN accept-dialout group configuration
default Set a command to its defaults
description Description for this VPDN group
exit Exit from VPDN group configuration mode
ip IP settings for tunnel
no Negate a command or set its defaults
request-dialin VPDN request-dialin group configuration
January 2011
Cisco IOS VPDN Command Reference
VPD-15
VPDN Commands backup
request-dialout VPDN request-dialout group configuration
source-ip Set source IP address for this vpdn-group
Router(config-vpdn)# request-dialin l2tp ip 10.2.2.2 domain customerx
Router(config-vpdn)#?
VPDN group configuration commands:
backup Add backup address
default Set a command to its defaults
dnis Accept a DNIS tunnel
domain Accept a domain tunnel
exit Exit from VPDN group configuration mode
force-local-chap Force a CHAP challenge to be instigated locally
l2tp L2TP specific commands
lcp LCP specific commands
loadsharing Add loadsharing address
local local information, like name
multilink Configure limits for Multilink
no Negate a command or set its defaults
request Request to open a tunnel
The following example shows an IP backup endpoint address of 10.1.1.1 configured with a backup session limit of 5:
Router(config-vpdn)# backup ip 10.1.1.1 limit 5
Related Commands Command request-dialin
Description
Configures a LAC to request L2F or L2TP tunnels to an LNS and create a request-dialin VPDN subgroup, and specifies a dial-in L2F or L2TP tunnel to a remote peer if a dial-in request is received for a specified domain or DNIS.
VPD-16
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear l2tp
clear l2tp
To clear Layer 2 Tunnel Protocol (L2TP) entities, use the clear l2tp command in privileged EXEC mode.
clear l2tp {all | counters | l2tp-class class-name | local ip ip-address | remote ip ip-address | tunnel
id tunnel-id}
Syntax Description all counters
Clears all tunnels.
Clears L2TP counters.
l2tp-class class-name Clears all L2TP tunnels by L2TP class name.
local ip ip-address Clears all respective tunnels associated with the local IP address.
remote ip ip-address
tunnel id tunnel-id
Clears all respective tunnels associated with the remote IP address.
Clears the specified L2TP tunnel. The tunnel-id range is 1 to 4294967295.
Command Modes
Privileged EXEC (#)
Command History Release
12.4(11)T
12.2(33)SRC
Cisco IOS XE
Release 2.1
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRC.
This command was integrated into Cisco IOS XE Release 2.1.
Examples
The following example shows how to clear all tunnels:
Router# clear l2tp counters all
The following example shows how to clear all tunnels associated with the IP address 10.1.1.1:
Router# clear l2tp counters local ip 10.1.1.1
This example shows the syslog messages that are displayed at both ends of the tunnel when the clear
l2tp all command is entered at the LAC:
Router-LAC# clear l2tp all
00:01:28: %VPDN-6-CLOSED: L2TP LAC LAC closed user [email protected]; Result 3, Error 6,
Admin Action
00:01:28: %VPDN-6-CLOSED: L2TP LAC closed tunnel ; Result 1, Error 6, Admin Action
Router-LAC#
Router-LNS#
00:01:27: %VPDN-6-CLOSED: L2TP LAC closed tunnel ; Result 1, Error 6, Admin Action
00:01:27: %VPDN-6-CLOSED: L2TP LAC LAC closed Vi2.1 user [email protected]; Result 3, Error
6, Admin Action
Router-LNS#
January 2011
Cisco IOS VPDN Command Reference
VPD-17
VPDN Commands clear l2tp
This example shows the syslog messages that are displayed at both ends of the tunnel when the clear
l2tp all command is entered at the LNS:
Router-LNS# clear l2tp all
00:02:02: %VPDN-6-CLOSED: L2TP LNS LNS closed Vi2.1 user [email protected]; Result 3, Error
6, Admin Action
00:02:02: %VPDN-6-CLOSED: L2TP LNS closed tunnel ; Result 1, Error 6, Admin Action
Router-LNS#
Router-LAC#
00:02:04: %VPDN-6-CLOSED: L2TP LNS closed tunnel ; Result 1, Error 6, Admin Action
00:02:04: %VPDN-6-CLOSED: L2TP LNS LNS closed user [email protected]; Result 3, Error 6,
Admin Action
Router-LAC#
Related Commands Command show l2tp counters show l2tp session show l2tp tunnel
Description
Displays information about L2TP counters and tunnel statistics.
Displays information about L2TP sessions.
Displays details about L2TP tunnels.
VPD-18
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear l2tp counters session
clear l2tp counters session
To clear Layer 2 Tunnel Protocol (L2TP) session counters associated with a particular subset of sessions, use the clear l2tp counters session command in privileged EXEC mode.
clear l2tp counters session [fsm {event [icrq | manual | ocrq] | ip-addr ip-address | state
transition [icrq | manual | ocrq] | tunnel {id local-id [local-session-id] | remote-name
remote-name local-name} | username username | vcid vcid}]
Syntax Description fsm
event [icrq | manual |
ocrq]
ip-addr ip-address
state transition [icrq |
manual | ocrq]
tunnel
id local-id
[local-session-id]
remote-name
remote-name local-name
username username
vcid vcid
(Optional) Clears finite state machine counters.
(Optional) Clears the specified state machine event counter:
•
•
icrq—Incoming Call Request (ICRQ), Incoming Call Reply (ICRP), and Incoming Call Connected (ICCN) dial-in state-machine-related counters.
manual—Manual session state-machine-related counters.
•
ocrq—Outgoing Call Request (OCRQ), Outgoing Call Reply
(OCRP), and Outgoing Call Connected (OCCN) dial-out state-machine-related counters.
(Optional) Clears L2TP session counters for sessions associated with a particular peer IP address.
(Optional) Clears the specified state machine transition counter:
•
icrq—Incoming Call Request (ICRQ), Incoming Call Reply (ICRP), and Incoming Call Connected (ICCN) dial-in state-machine-related counters.
•
manual—Manual session state-machine-related counters.
•
ocrq—Outgoing Call Request (OCRQ), Outgoing Call Reply
(OCRP), and Outgoing Call Connected (OCCN) dial-out state-machine-related counters.
(Optional) Clears L2TP session counters for sessions associated with a particular tunnel.
(Optional) Clears the tunnel L2TP session counters associated with the specified local tunnel ID, and optionally the local session ID. The range for the local tunnel and the local session IDs is 1 to 4294967295.
(Optional) Clears the tunnel L2TP session counters associated with the specified remote tunnel name and local tunnel name.
(Optional) Clears the L2TP session counters for the sessions associated with a particular username.
(Optional) Clears that L2TP session counters for the sessions associated with a particular virtual circuit ID (VCID). The vcid range is 1 to
4294967295.
Command Modes
Privileged EXEC (#)
January 2011
Cisco IOS VPDN Command Reference
VPD-19
VPDN Commands clear l2tp counters session
Command History Release
12.4(11)T
12.2(33)SRC
Cisco IOS XE
Release 2.1
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRC.
This command was integrated into Cisco IOS XE Release 2.1.
Examples
The following example shows how to clear the session counters for only those sessions associated with the peer at IP address 10.1.1.1:
Router# clear l2tp counters session ip-addr 10.1.1.1
Related Commands Command show l2tp counters show l2tp session show l2tp tunnel
Description
Displays information about L2TP counters and tunnel statistics.
Displays information about L2TP sessions.
Displays details about L2TP tunnels.
VPD-20
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear l2tp counters tunnel
clear l2tp counters tunnel
To clear Layer 2 Tunnel Protocol (L2TP) tunnel counters, use the clear l2tp counters tunnel command in privileged EXEC mode.
clear l2tp counters tunnel [authentication | id local-id]
Syntax Description authentication
id local-id
(Optional) Clears the L2TP control channel authentication attribute-value
(AV) pair counters.
(Optional) Clears the per-tunnel control message counters for the L2TP tunnel with the specified local ID. The local-id range is 1 to 4294967295.
Command Modes
Privileged EXEC (#)
Command History Release
12.4(11)T
12.2(33)SRC
Cisco IOS XE
Release 2.1
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(33)SRC.
This command was integrated into Cisco IOS XE Release 2.1.
Usage Guidelines
Use the clear l2tp counters tunnel authentication command to globally clear only the authentication counters.
Examples
The following example shows how to clear all L2TP tunnel counters:
Router# clear l2tp counters tunnel
The following example shows how to clear all L2TP tunnel authentication counters:
Router# clear l2tp counters tunnel authentication
Related Commands Command show l2tp counters show l2tp session show l2tp tunnel
Description
Displays information about L2TP counters and tunnel statistics.
Displays information about L2TP sessions.
Displays details about L2TP tunnels.
January 2011
Cisco IOS VPDN Command Reference
VPD-21
VPDN Commands clear vpdn counters
clear vpdn counters
To clear the counters of a specified virtual private dial-up network (VPDN) session or tunnel or to clear all of the VPDN counters, as displayed by the show vpdn command, use the clear vpdn counters command in privileged EXEC mode.
clear vpdn counters [session {interface interface-type interface-number | id tunnel-id session-id |
username username} | tunnel {l2f | l2tp | pptp} {all | hostname hostname | ip {remote | local}
ip-address | id tunnel-id}]
Syntax Description session interface
interface-type interface-number
(Optional) Specifies that session counters will be cleared.
Clears VPDN session counters for the interface specified by the interface-type
interface-number arguments. Valid values for the interface-type argument are:
•
•
serial—Specifies that VPDN session counters will be cleared on a serial interface.
HSSI—Specifies that VPDN session counters will be cleared on a
High-Speed Serial Interface (HSSI).
•
•
BRI—Specifies that VPDN session counters will be cleared on a BRI interface.
SUBIF—Specifies that VPDN session counters will be cleared on an ATM or Frame Relay subinterface.
id tunnel-id
session-id
username
username
tunnel {l2f | l2tp |
pptp}
all
hostname
hostname
•
Virtual-Access—Specifies that VPDN session counters will be cleared on a virtual access interface.
Clears VPDN session counters by tunnel and session ID. Valid values for the
tunnel-id argument and the session-id argument range from 1 to 65535.
Clears VPDN session counters for the username specified by the username argument.
(Optional) Clears both session and tunnel counters for the tunnel type specified by the l2f, l2tp, or pptp keyword.
Clears VPDN counters for all sessions and tunnels of the selected tunnel type.
Clears VPDN counters for all sessions and tunnels of the selected tunnel type associated with the particular host specified by the hostname argument.
For the l2tp and pptp tunnel type options, the hostname argument has the following value:
remote-name [local-name]
For the l2f tunnel type option, the hostname argument has the following value:
nas-name gateway-name
The nas-name argument is the name of the network access server and
gateway-name argument is the name of the home gateway.
VPD-22
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear vpdn counters
ip {remote | local}
ip-address
id tunnel-id
Clears VPDN counters for all sessions and tunnels of the selected tunnel type associated with the remote or local IP address specified by the ip-address argument.
Clears VPDN counters for all sessions and tunnels of the selected tunnel type associated with the tunnel id specified with the tunnel-id argument. Valid values for the tunnel-id argument range from 1 to 65,535.
Command Modes
Privileged EXEC
Command History Release
12.2(13)T
12.4(11)T
Modification
This command was introduced.
The l2f keyword was removed.
Usage Guidelines
Use this command to clear counters for VPDN sessions and tunnels. If no keywords are used when the
clear vpdn counters command is used, all VPDN session and tunnel counters are cleared. If the session keyword is used, the specified session counters are cleared. If the tunnel keyword is used, the specified session and tunnel counters are cleared. You cannot clear the VPDN tunnel counters without also clearing the VPDN session counters.
Examples
The following example shows output from the show vpdn command before and after the clear vpdn
counters command is issued:
Router# show vpdn session packets interface virtual-access 8
L2TP Session Information Total tunnels 1 sessions 1
PPTP session removal calls 0
LocID RemID TunID Pkts-In Pkts-Out Bytes-In Bytes-Out
7 2 28240 10282 10287 431844 298235
Router# clear vpdn counters session interface virtual-access 8
Clear "show vpdn" counters on this session [confirm]
Router# show vpdn session packets interface virtual-access 8
L2TP Session Information Total tunnels 1 sessions 1
PPTP session removal calls 0
LocID RemID TunID Pkts-In Pkts-Out Bytes-In Bytes-Out
7 2 28240 0 0 0 0
%No active PPTP tunnels
%No active PPPoE tunnels
Related Commands Command show vpdn
Description
Displays information about active L2TP tunnels or sessions in a VPDN.
January 2011
Cisco IOS VPDN Command Reference
VPD-23
VPDN Commands clear vpdn dead-cache
clear vpdn dead-cache
To clear and restart a nonresponding (dead-cache state) Local Network Server (LNS), use the clear vpdn
dead-cache command in user or privileged EXEC mode.
clear vpdn dead-cache {group <group-name> | ip-address <ip-address> | all}
Syntax Description
group <group-name>
ip-address <ip-address>
all
Clears all entries in the dead-cache for the specified VPDN group.
Clears a specified entry in the dead-cache specified by its IP address.
Clears all entries in the dead-cache for all VPDN groups.
Command Modes
User EXEC
Privileged EXEC
Command History Release
12.2(31)ZV
Modification
This command was introduced.
Usage Guidelines
Use the clear vpdn dead-cache command to clear one or more LNS entries in the dead-cache. Once an
LNS clears from the dead-cache, the LNS is active and available for new VPDN tunnels. Enter the clear
vpdn dead-cache on the Local Access Client (LAC) gateway.
The clear vpdn dead-cache group command clears all dead-cache entries in the specified VPDN group
To create a VPDN group and to enter VPDN group configuration mode, use the vpdn-group command in global configuration mode.
The clear vpdn dead-cache ip address command clears the specified IP address from all VPDN groups associated with that IP address.
Use the show vpdn dead-cache command in global configuration mode on the LNS gateway to display a list of LNS entries in a dead-cache state, including the IP address of the LNS and how long, in seconds, the entry has been in a dead-cache state.
To display an SNMP or system message log (syslog) event when an LNS enters or exits a dead-cache state, you must configure the vpdn logging dead-cache command.
Examples
The following example shows how to clear a specified entry in the dead-cache:
Router> enable
Router# clear vpdn dead-cache ip-address 10.10.10.1
The following example shows how to clear all entries in the dead-cache for a particular VPDN group:
Router> enable
Router# clear vpdn dead-cache group example
VPD-24
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear vpdn dead-cache
The following example shows how to clear all entries in the dead-cache for all VPDN groups:
Router> enable
Router# clear vpdn dead-cache all
Related Commands Command Description
show vpdn dead-cache Displays a list of LNS entries in a dead-cache state, including the IP address of the LNS and how long, in seconds, the entry has been in a dead-cache state.
vpdn-group vpdn logging dead-cache
Creates a VPDN group and enters VPDN group configuration mode.
Enables the logging of VPDN events.
January 2011
Cisco IOS VPDN Command Reference
VPD-25
VPDN Commands clear vpdn history failure
clear vpdn history failure
To clear the content of the failure history table, use the clear vpdn history failure command in EXEC mode.
clear vpdn history failure
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History Release
11.3T
Modification
This command was introduced.
Examples
The following example clears the content of the failure history table:
Router# clear vpdn history failure
Command show vpdn history-failure
Description
Displays the content of the failure history table.
VPD-26
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear vpdn redirect
clear vpdn redirect
To clear the Layer 2 Tunnel Protocol (L2TP) redirect counters shown in the show vpdn redirect command output, use the clear vpdn redirect command in privileged EXEC mode.
clear vpdn redirect
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History Release
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use the clear vpdn redirect command to clear the statistics regarding redirects and forwards displayed using the show vpdn redirect command.
Examples
The following example clears the redirect counters:
Router# clear vpdn redirect
Related Commands Command Description show vpdn redirect vpdn redirect
Displays statistics for L2TP redirects and forwards.
Enables L2TP redirect functionality.
vpdn redirect attempts Restricts the number of redirect attempts possible for an L2TP call on the
NAS.
vpdn redirect identifier
Configures a VPDN redirect identifier to use for L2TP call redirection on a stack group tunnel server.
vpdn redirect source
Configures the public redirect IP address of an L2TP stack group tunnel server.
January 2011
Cisco IOS VPDN Command Reference
VPD-27
VPDN Commands clear vpdn tunnel
clear vpdn tunnel
To shut down a specified virtual private dial-up network (VPDN) tunnel and all sessions within the tunnel, use the clear vpdn tunnel command in privileged EXEC mode.
L2TP or PPTP Tunnels
clear vpdn tunnel {pptp | l2tp} {all | hostname remote-name [local-name] | id local-id | ip
local-ip-address | ip remote-ip-address}
L2F Tunnels
clear vpdn tunnel l2f {all | hostname nas-name hgw-name | id local-id | ip local-ip-address | ip
remote-ip-address}
Syntax Description pptp l2tp all hostname
remote-name
[local-name]
id local-id
ip local-ip-address
Clears the specified Point-to-Point Tunneling Protocol (PPTP) tunnel.
Clears the specified Layer 2 Tunneling Protocol (L2TP) tunnel.
Clears all VPDN tunnels terminating on the device.
Clears all L2TP or PPTP VPDN tunnels established between the devices with the specified local and remote hostnames.
Clears the VPDN tunnel with the specified local ID.
Clears all VPDN tunnels terminating on the device with the specified local
IP address.
ip remote-ip-address Clears all VPDN tunnels terminating on the device with the specified remote
IP address.
l2f
Clears the specified Layer 2 Forwarding (L2F) tunnel.
hostname nas-name
hgw-name
Clears all L2F VPDN tunnels established between the network access server
(NAS) and home gateway with the specified hostnames.
Command Modes
Privileged EXEC
Command History Release
11.2
11.3(5)AA
12.0(1)T
12.0(5)XE5
12.1(5)T
Modification
This command was introduced.
The l2tp keyword was added.
The l2f keyword was added.
The pptp keyword was added.
The pptp keyword was updated for additional Cisco access servers or routers.
VPD-28
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear vpdn tunnel
Release
12.2(2)T
12.4(11)T
Modification
The following keywords and arguments were added:
•
•
•
• all
hostname remote-name local-name
hostname nas-name hgw-name
id local-id
•
ip local-ip-address
•
ip remote-ip-address
The l2f keyword was removed.
Usage Guidelines
Manual termination of a VPDN tunnel results in the immediate shutdown of the specified VPDN tunnel and all sessions within that tunnel, resulting in a sudden disruption of VPDN services.
You can shut down VPDN tunnels more gradually by issuing the vpdn softshut command, which prevents the establishment of new VPDN sessions in all VPDN tunnels that terminate on the device.
Existing VPDN sessions are not affected.
A manually terminated VPDN tunnel can be restarted immediately when a user logs in. Manually terminating and restarting a VPDN tunnel while VPDN event logging is enabled can provide useful troubleshooting information about VPDN session establishment. VPDN event logging is enabled by issuing the vpdn logging command.
Examples
The following example clears all L2TP tunnels connecting to a remote peer named NAS1:
Router# clear vpdn tunnel l2tp hostname NAS1
The following example clears all PPTP tunnels connecting the devices with the hostnames NAS3 and tun1:
Router# clear vpdn tunnel pptp NAS3 hostname tun1
This example shows the syslog messages that are displayed at both ends of the tunnel when the clear
vpdn tunnel l2tp all command is entered at the LAC:
Router-LAC# clear vpdn tunnel l2tp all
00:01:29: %VPDN-6-CLOSED: L2TP LAC LAC closed user [email protected]; Result 3, Error 6,
Admin Action
00:01:29: %VPDN-6-CLOSED: L2TP LAC closed tunnel ; Result 1, Error 6, Admin Action
Router-LAC#
Router-LNS#
00:01:28: %VPDN-6-CLOSED: L2TP LAC closed tunnel ; Result 1, Error 6, Admin Action
00:01:28: %VPDN-6-CLOSED: L2TP LAC LAC closed Vi2.1 user [email protected]; Result 3, Error
6, Admin Action
Router-LNS#
January 2011
Cisco IOS VPDN Command Reference
VPD-29
VPDN Commands clear vpdn tunnel
This example shows the syslog messages that are displayed at both ends of the tunnel when the clear
vpdn tunnel l2tp all command is entered at the LNS:
Router-LNS# clear vpdn tunnel l2tp all
00:02:15: %VPDN-6-CLOSED: L2TP LNS LNS closed Vi2.1 user [email protected]; Result 3, Error
6, Admin Action
00:02:15: %VPDN-6-CLOSED: L2TP LNS closed tunnel ; Result 1, Error 6, Admin Action
Router-LNS#
Router-LAC#
00:02:16: %VPDN-6-CLOSED: L2TP LNS closed tunnel ; Result 1, Error 6, Admin Action
00:02:16: %VPDN-6-CLOSED: L2TP LNS LNS closed user [email protected]; Result 3, Error 6,
Admin Action
Router-LAC#
Related Commands Command vpdn logging vpdn softshut
Description
Enables the logging of generic VPDN events.
Prevents new sessions from being established on a VPDN tunnel without disturbing existing sessions.
VPD-30
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands clear vtemplate redundancy counters
clear vtemplate redundancy counters
To clear the virtual template redundancy counters in redundant systems that support broadband remote access server (BRAS) High Availability (HA), that are operating in Stateful Switchover (SSO) mode, use the clear vtemplate redundancy counters command in privileged EXEC mode.
clear vtemplate redundancy counters
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History Release
12.2(32)SR
Modification
This command was introduced.
Usage Guidelines
Use the clear vtemplate redundancy counters command on either the Active or Standby route processor (RP). The clear vtemplate redundancy counters command clears all the counters, that display using the show vtemplate redundancy command.
Use the show vtemplate redundancy command to ensure the virtual templates information is successfully synchronizing from the Active to the Standby RP.
Examples
January 2011
The following is sample output from the show vtemplate redundancy command on the Active RP:
Router# show vtemplate redundancy
Global state
ISSU state
Vaccess dynamic sync send
: Active - Dynamic Sync
: Compatible
: 0
Vaccess dynamic sync send failed : 0
Vaccess bulk sync send
Vaccess bulk sync send failed
: 24
: 0
Vaccess sync rcvd on standby : 24
Vaccess recreate error on standby : 0
The following is sample output from the show vtemplate redundancy command on the Standby RP:
Router-stdby# show vtemplate redundancy
Global state : Active - Collecting
ISSU state
Vaccess dynamic sync send
: Compatible
: 0
Vaccess dynamic sync send failed : 0
Vaccess bulk sync send : 0
Vaccess bulk sync send failed
Vaccess sync rcvd on standby
: 0
: 24
Vaccess recreate error on standby : 0
On the Standby RP, the first four counters do not increment. The value for Vaccess sync rcvd on the
Standby RP should match the sum of the Vaccess bulk sync send and Vaccess dynamic sync send on the
Active RP. Any synchronization errors between the Active and Standby RPs will increment the “failed” or “error” counters.
Cisco IOS VPDN Command Reference
VPD-31
VPDN Commands clear vtemplate redundancy counters
The following is sample output from the clear vtemplate redundancy counters command:
Router# clear vtemplate redundancy counters
Global state : Active - Collecting
ISSU state
Vaccess dynamic sync send
: Compatible
: 0
Vaccess dynamic sync send failed : 0
Vaccess bulk sync send : 0
Vaccess bulk sync send failed
Vaccess sync rcvd on standby
: 0
: 0
Vaccess recreate error on standby : 0
Related Commands Command show vtemplate redundancy
Description
Displays synchronization information between the Active and Standby RPs.
VPD-32
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands default (VPDN)
default (VPDN)
To remove or reset a virtual private dialup network (VPDN) group or a VPDN subgroup configuration to its default value, use the default command in VPDN group, VPDN subgroup, or VPDN template configuration mode.
default command
Syntax Description
command
The command to be removed or reset from the VPDN group or VPDN subgroup configuration.
lists some of the commands that can be issued with the default command.
Command Default
No default behavior or values.
Command Modes
VPDN group configuration
VPDN subgroup configuration
VPDN template configuration
Command History Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Use the default command to remove or reset a specific command configuration in a VPDN group, VPDN subgroup, or VPDN template configuration. Issuing default command is the same as issuing the no form of the command specified with the command argument.
lists some of the commands that can be removed or reset using the default command, and the configuration modes that the default command must be issued in. Some commands may not be available unless a particular configuration is present on the router.
For a complete list of the commands available for use with the default command, use the default ? command in the desired configuration mode.
Some commands have required keywords or arguments that must be included in the default command statement. You may issue default command ? to determine what keywords and arguments are required.
For complete command syntax, see the command documentation in the Cisco IOS Dial Technologies
Command Reference.
Table 2 Command Options for the default (VPDN) Command
Command Name accept-dialin accept-dialout authen before-forward dialer
Configuration Mode
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Accept-dialout VPDN subgroup configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-33
VPDN Commands default (VPDN)
Table 2 Command Options for the default (VPDN) Command (continued)
Command Name dnis domain force-local-chap initiate-to lcp renegotiation local name multilink pool-member protocol multihop request-dialin request-dialout rotary-group session-limit source-ip terminate-from virtual-template
Configuration Mode
Request-dialin VPDN subgroup configuration mode.
Request-dialin VPDN subgroup configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Request-dialout VPDN subgroup configuration mode.
Any VPDN subgroup configuration mode.
Request-dialin VPDN subgroup configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Request-dialout VPDN subgroup configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Accept-dialin VPDN subgroup configuration mode.
Examples
The following example shows the running configuration of a tunnel server VPDN group configured to accept Layer 2 Forwarding (L2F) dial-in calls and to place Layer 2 Tunnel Protocol (L2TP) dial-out calls:
Router# show running-config
!
vpdn-group group1 accept-dialin protocol l2f virtual-template 1 request-dialout protocol l2tp pool-member 1 terminate-from hostname myhost initiate-to ip 10.3.2.1 local name router32 l2f ignore-mid-sequence l2tp ip udp checksum
!
If you issue the default virtual-template command in accept-dialin VPDN subgroup configuration mode, the virtual-template command configuration is removed from the VPDN subgroup:
Router(config-vpdn-req-out)# default virtual-template
!
Router# show running-config
!
vpdn-group group1 accept-dialin protocol l2f
VPD-34
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands default (VPDN)
request-dialout protocol l2tp pool-member 1 terminate-from hostname myhost
!
initiate-to ip 10.3.2.1 local name router32 l2f ignore-mid-sequence l2tp ip udp checksum
If you issue the default accept-dialin command in VPDN group configuration mode, the accept-dialin
VPDN subgroup configuration is removed from the VPDN group along with all configurations that require an accept-dialin VPDN subgroup:
Router(config-vpdn)# default accept-dialin
!
Router# show running-config
!
vpdn-group group1 request dialout protocol l2tp pool-member 1 local name router32 initiate-to ip 10.3.2.1
l2tp ip udp checksum
The following example enters VPDN template configuration mode and uses the command line help system to find the commands available to use with the default command:
Router(config)# vpdn-template 1
Router(config-vpdn-templ)# default ? description Description for this VPDN group
group Items grouped for all attached vpdn-groups
ip IP settings for tunnel
l2f L2F specific commands
l2tp L2TP specific commands
local Local information
pptp PPTP specific commands
redirect Call redirection options
relay Relay options configuration
vpn VPN ID/VRF name
The following example uses the command line help system to show that a value must be entered for the
number argument when the default session-limit command is issued in VPDN group configuration mode:
Router(config-vpdn)# default session-limit ?
<0-32767> Max number of sessions
Related Commands Command accept-dialin
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept-dialin VPDN subgroup configuration mode.
accept-dialout
Creates an accept dial-out VPDN subgroup that configures a NAS to accept requests from a tunnel server to tunnel L2TP dial-out calls, and enters accept-dialout VPDN subgroup configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-35
default (VPDN)
VPDN Commands
Command request-dialin
Description
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request-dialin VPDN subgroup configuration mode.
request-dialout
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request-dialout VPDN subgroup configuration mode.
vpdn-group
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Enters VPDN template configuration mode, where a template for VPDN groups can be configured.
VPD-36
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands description (VPDN group)
description (VPDN group)
To add a description to a virtual private dialup network (VPDN) group, use the description command in
VPDN group or VPDN template configuration mode. To remove the description, use the no form of this command.
description string
no description
Syntax Description
string
Comment or a description about the VPDN group.
Command Default
No description is associated with the VPDN group.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2
Modification
This command was introduced.
Examples
The following example shows how to enter a description for a VPDN group: vpdn-group 333
description This is a VPDN group at location 333
request-dialin exit
initiate-to ip 10.0.0.63
local name cisco.com
Related Commands Command vpdn-group
Description
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-37
VPDN Commands dialer vpdn
dialer vpdn
To enable a dialer profile or dial-on-demand routing (DDR) dialer to use Layer 2 Tunnel Protocol (L2TP) dialout, use the dialer vpdn command in interface configuration mode. To disable L2TP dialout on a dialer profile or DDR dialer, use the no form of this command.
dialer vpdn no dialer vpdn
Syntax Description
This command has no arguments or keywords.
Defaults
Command Modes
Interface configuration
Command History
Disabled
Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
The dialer vpdn command must be configured on the LNSs dialer interface to enable L2TP dialout. This command enables the dialer to place a VPDN call.
Examples
The following example shows how to configure the dialer interface and VPDN group on an LNS for
L2TP dialout: interface Dialer2
ip address 172.16.2.3 255.255.255.128
encapsulation ppp
dialer remote-name myname
dialer string 5550134
dialer vpdn
dialer pool 1
dialer-group 1
ppp authentication chap vpdn-group 1
request-dialout
protocol l2tp
pool-member 1
initiate-to ip 172.21.9.4
VPD-38
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands
Related Commands Command dialer aaa request-dialout
Description
Allows a dialer to access the AAA server for dialing information.
Enables an LNS to request VPDN dial-out calls by using L2TP.
dialer vpdn
January 2011
Cisco IOS VPDN Command Reference
VPD-39
VPDN Commands dnis (VPDN)
dnis (VPDN)
To specify the Dialed Number Identification Service (DNIS) group name or DNIS number of users that are to be forwarded to a tunnel server using a virtual private dialup network (VPDN), use the dnis command in request dial-in VPDN subgroup configuration mode. To remove a DNIS group or number from a VPDN group, use the no form of this command.
dnis {dnis-group-name | dnis-number}
no dnis {dnis-group-name | dnis-number}
Syntax Description
dnis-group-name
DNIS group name used when resource pool management (RPM) is enabled and the VPDN group is configured under the incoming customer profile.
dnis-number
DNIS group number used when RPM is disabled, or when a call is associated with a customer profile without any VPDN group configured for the customer profile.
Command Default
Disabled
Command Modes
Request dial-in VPDN subgroup configuration
Command History Release
12.0(4)XI
Modification
This command was introduced.
Usage Guidelines
You must specify a tunneling protocol using the protocol command in request dial-in VPDN subgroup configuration mode before issuing the dnis command. Removing or changing the protocol command configuration removes any existing dnis command configuration from the request dial-in VPDN subgroup.
You can configure a VPDN group to tunnel multiple DNIS group names and DNIS numbers by issuing multiple instances of the dnis command.
VPDN groups can also be configured to tunnel users based on domain name using the domain command.
Examples
The following example configures a VPDN group to tunnel calls from multiple DNIS numbers and from the domain cisco.com to the tunnel server at 10.1.1.1 using the Layer 2 Forwarding (L2F) protocol:
Note
Effective with Cisco Release 12.4(11)T, the L2F protocol is not supported in Cisco IOS software.
Router(config)# vpdn-group users
Router(config-vpdn)# request dialin
Router(config-vpdn-req-in)# protocol l2f
Router(config-vpdn-req-in)# dnis 1234
Router(config-vpdn-req-in)# dnis 5678
Router(config-vpdn-req-in)# domain cisco.com
VPD-40
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands dnis (VPDN)
!
Router(config-vpdn)# initiate-to 10.1.1.1
Related Commands Command dialer dnis group domain
Description
Creates a DNIS group.
dnis group protocol
(VPDN)
Specifies the domain name of users that are to be forwarded to a tunnel server using
VPDN.
Includes a group of DNIS numbers in a customer profile.
Specifies the tunneling protocol that the VPDN subgroup will use.
request-dialin
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-41
VPDN Commands domain
domain
To specify the domain name of users that are to be forwarded to a tunnel server using a virtual private dialup network (VPDN), use the domain command in request dial-in VPDN subgroup configuration mode. To remove a domain from a VPDN group or subgroup, use the no form of this command.
domain domain-name
no domain [domain-name]
Syntax Description
domain-name
Case-sensitive name of the domain that will be tunneled.
Defaults
Command Modes
Request dial-in VPDN subgroup configuration
Command History
Disabled
Release
12.0(4)XI
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(5)T.
Usage Guidelines
You must specify a tunneling protocol using the protocol command in request dial-in VPDN subgroup configuration mode before issuing the domain command. Removing or changing the protocol command configuration removes any existing domain command configuration from the request dial-in VPDN subgroup.
You can configure a request dial-in VPDN subgroup to tunnel calls from multiple domain names by issuing multiple instances of the domain command.
VPDN groups can also be configured to tunnel users based on Dialed Number Identification Service
(DNIS) group names or DNIS numbers using the dnis command.
Examples
The following example configures VPDN group 1 to request a dial-in Layer 2 Tunnel Protocol (L2TP) tunnel to IP address 10.99.67.76 when it receives a PPP call from a username with the domain name cisco1.com, the domain name cisco2.com, or the DNIS number 4321:
Router(config)# vpdn-group 1
Router(config-vpdn)# request-dialin
Router(config-vpdn-req-in)# protocol l2tp
Router(config-vpdn-req-in)# domain cisco1.com
Router(config-vpdn-req-in)# domain cisco2.com
Router(config-vpdn-req-in)# dnis 4321
!
Router(config-vpdn)# initiate-to ip 10.99.67.76
VPD-42
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands domain
Related Commands Command dnis protocol (VPDN) request-dialin
Description
Specifies the DNIS group name or DNIS number of users that are to be forwarded to a tunnel server using VPDN.
Specifies the tunneling protocol that the VPDN subgroup will use.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-43
VPDN Commands dsl-line-info-forwarding
dsl-line-info-forwarding
To enable processing of the attribute-value (AV) pairs containing Digital Subscriber Line (DSL) information in a PPPoE Active Discovery Request (PADR) packet, and send the AV pair from the Line
Access Client (LAC) to the Line Network Server (LNS) where a matching Vendor Specific Attribute
(VSA) is sent to an authentication, authorization, and accounting (AAA) server for authentication, authorization, and accounting, use the dsl-line-info-forwarding command in VPDN group or VPDN template-configuration mode. To disable the command function (default), use the no form of this command.
dsl-line-info-forwarding no dsl-line-info-forwarding
Syntax Description
This command has no arguments or keywords.
Command Default
The command function is disabled.
Command Modes
VPDN group
VPDN template-configuration
Command History Release
12.4(15)T
Modification
This command was introduced.
Usage Guidelines
Configure the dsl-line-info-forwarding command on the LAC.
Examples
The following example shows the configuration on the LAC:
LAC(config)# vpdn-group example
LAC(config)# dsl-line-info-forwarding
The following example shows the ICRQ message containing the circuit-id, shown in bold, when you configure the dsl-line-info-forwarding command on the LAC:
03:11:49:L2TPtnl 61454:42513: | ICRQ, flg TLS, ver 2, len 90
03:11:49:L2TPtnl 61454:42513: tnl 42513, ns 2, nr 1
03:11:49:L2TPtnl 61454:42513: IETF v2:
03:11:49:L2TPtnl 61454:42513: Assigned Call ID 24
03:11:49:L2TPtnl 61454:42513: Serial Number 12345
03:11:49:L2TPtnl 61454:42513: Bearer Type none (0)
03:11:49:L2TPtnl 61454:42513: Cisco v2:
03:11:49:L2TPtnl 61454:42513: Client NAS Port [9]
03:11:49:L2TPtnl 61454:42513:
“<0F><10><09><02><02><Qg<00><00>”
03:11:49:L2TPtnl 61454:42513: ADSL Forum v2:
03:11:49:L2TPtnl 61454:42513: Circuit ID [21]
03:11:49:L2TPtnl 61454:42513: “Ethernet1/1:PPOE-TAG”
VPD-44
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands dsl-line-info-forwarding
The following example shows the ICRQ message containing no circuit-id, when you configure the no
dsl-line-info-forwarding command on the LAC:
03:11:49:L2TPtnl 61454:42513: | ICRQ, flg TLS, ver 2, len 90
03:11:49:L2TPtnl 61454:42513: tnl 42513, ns 2, nr 1
03:11:49:L2TPtnl 61454:42513: IETF v2:
03:11:49:L2TPtnl 61454:42513: Assigned Call ID 24
03:11:49:L2TPtnl 61454:42513: Serial Number 12345
03:11:49:L2TPtnl 61454:42513: Bearer Type none (0)
03:11:49:L2TPtnl 61454:42513: Cisco v2:
03:11:49:L2TPtnl 61454:42513: Client NAS Port [9]
03:11:49:L2TPtnl 61454:42513:
“<0F><10><09><02><02><Qg<00><00>”
Related Commands Command debug vpdn radius server attribute 87 circuit-id vpdn-group
Description
Displays information associated with the RADIUS server.
Overrides the nas-port-id attribute with circuit-id in RADIUS AAA messages.
Creates a VPDN group and enters VPDN group configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-45
VPDN Commands encryption mppe
encryption mppe
To enable Microsoft Point-to-Point Encryption (MPPE) on an Industry-Standard Architecture (ISA) card, use the encryption mppe command in controller configuration mode. To disable MPPE, use the
no form of this command.
encryption mppe no encryption mppe
Syntax Description
This command has no arguments or keywords.
Command Default
IPSec is the default encryption type.
Command Modes
Controller configuration
Command History Release
12.0(5)XE5
12.1(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
Using the ISA card offloads MPPE from the Route Processor and will improve performance in large-scale environments.
The router must be rebooted for the change to the encryption mppe command configuration to take effect.
Examples
The following example enables MPPE encryption on the ISA card in slot 5, port 0:
Router(config)# controller isa 5/0
Router(config-controller)# encryption mppe
Related Commands Command Description debug ppp mppe
Displays debug messages for MPPE events.
encryption mppe show ppp mppe
Enables MPPE encryption on the virtual template.
Displays MPPE information for an interface.
VPD-46
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands force-local-chap
force-local-chap
To force the L2TP network server (LNS) to reauthenticate the client, use the force-local-chap command in VPDN group configuration mode. To disable reauthentication, use the no form of this command.
force-local-chap no force-local-chap
Syntax Description
This command has no arguments or keywords.
Defaults
Proxy authentication. The Challenge Handshake Authentication Protocol (CHAP) response to the Layer
2 Transport Protocol access concentrator (LAC) authentication challenge is passed to the LNS.
Command Modes
VPDN group configuration
Command History Release
11.3(5)AA
12.0(1)T
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
This command was modified to be available only if the accept-dialin VPDN group configuration mode is enabled.
Usage Guidelines
You must enable the accept-dialin command on the VPDN group before you can use the
force-local-chap command. Removing the accept-dialin command will remove the force-local-chap command from the VPDN group.
This command is used only if CHAP authentication is enabled for PPP (using the ppp authentication
chap command). This command forces the LNS to reauthenticate the client in addition to the proxy authentication that occurs at the LAC. If the force-local-chap command is used, then the authentication challenge occurs twice. The first challenge comes from the LAC and the second challenge comes from the LNS. Some PPP clients may experience problems with double authentication. If this problem occurs, authentication challenge failures may be seen if the debug ppp authentication command is enabled.
Examples
The following example enables CHAP authentication at the LNS: vpdn-group 1
accept dialin
protocol l2tp
virtual-template 1 terminate-from hostname router32
force-local-chap
January 2011
Cisco IOS VPDN Command Reference
VPD-47
VPDN Commands force-local-chap
Related Commands Command accept-dialin
Description
Configures an LNS to accept tunneled PPP connections from a LAC and create an accept dial-in VPDN subgroup.
lcp renegotiation
Allows the LNS to renegotiate the LCP on dial-in calls, using L2TP or L2F.
VPD-48
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands group session-limit
group session-limit
To limit the number of simultaneous virtual private dialup network (VPDN) sessions allowed across all
VPDN groups associated with a particular VPDN template, use the group session-limit command in
VPDN template configuration mode. To remove a configured session limit restriction, use the no form of this command.
group session-limit number
no group session-limit
Syntax Description
number
Maximum number of concurrent sessions allowed across all VPDN groups associated with a particular VPDN template. Valid values range from 1 to
32767.
Command Default
No session limit exists for the VPDN template.
Command Modes
VPDN template configuration
Command History Release
12.2(4)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use the group session-limit command to specify the maximum number of simultaneous sessions allowed across all VPDN groups associated with a VPDN template.
If you configure a session limit that is lower than the number of current active sessions, existing sessions will not be terminated. However, new sessions will not be established until the number of existing sessions falls below the configured session limit.
VPDN session limits can be configured globally using the vpdn session-limit command, at the level of a VPDN group using the session-limit (VPDN) command, or for all VPDN groups associated with a particular VPDN template using the group session-limit command.
The hierarchy for the application of VPDN session limits is as follows:
•
Globally configured session limits take precedence over session limits configured for a VPDN group or in a VPDN template. The total number of sessions on a router may not exceed a configured global session limit.
•
•
Session limits configured for a VPDN template are enforced for all VPDN groups associated with that VPDN template. The total number of sessions for all of the associated VPDN groups may not exceed the configured VPDN template session limit.
Session limits configured for a VPDN group are enforced for that VPDN group.
January 2011
Cisco IOS VPDN Command Reference
VPD-49
VPDN Commands group session-limit
Examples
The following example associates two VPDN groups with the VPDN template named cisco, and configures a session limit of 100 for all VPDN groups associated with the template: vpdn-group group1 source vpdn-template cisco
!
vpdn-group group2 source vpdn-template cisco
!
vpdn-template cisco group session-limit 100
Related Commands Command Description session-limit (VPDN)
Limits the number of simultaneous VPDN sessions allowed for a specified
VPDN group.
show vpdn session
Displays session information about active Layer 2 sessions for a VPDN.
source vpdn-template
Associates a VPDN group with a VPDN template.
vpdn session-limit vpdn-template
Limits the number of simultaneous VPDN sessions allowed on a router.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-50
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands initiate-to
initiate-to
To specify an IP address that will be used for Layer 2 tunneling, use the initiate-to command in VPDN group configuration mode. To remove an IP address from the virtual private dialup network (VPDN) group, use the no form of this command.
initiate-to ip ip-address [limit limit-number] [priority priority-number]
no initiate-to [ip ip-address]
Syntax Description
ip ip-address
limit limit-number
priority
priority-number
Specifies the IP address of the router that will be tunneled to.
(Optional) Specifies a limit to the number of connections that can be made to this IP address in the range from 0 to 32767.
(Optional) Specifies a priority for this IP address in the range from 1 to
32767. 1 is the highest priority.
Command Default
No IP address is specified.
Command Modes
VPDN group configuration
Command History Release
12.0(5)T
12.2(15)T
12.2(28)SB
Modification
This command was introduced.
This command was enhanced with the capability to configure multiple Layer 2
Tunneling Protocol (L2TP) network access servers (NASs) on an L2TP tunnel server within the same VPDN group.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Before you can use this command, you must enable one of the two request VPDN subgroups by using either the request-dialin or request-dialout command.
A NAS configured to request dial-in can be configured with multiple initiate-to commands to enable tunneling to more than one IP address.
A tunnel server configured to request dial-out can be configured with multiple initiate-to commands to enable tunneling to more than one IP address.
Examples
January 2011
The following example configures a VPDN group for L2TP dial-out. This group can tunnel a maximum of five simultaneous users and has the second highest priority for requesting dial-out calls.
vpdn-group 1 request-dialout protocol l2tp pool-member 1
!
initiate-to ip 10.3.2.1 limit 5 priority
Cisco IOS VPDN Command Reference
VPD-51
VPDN Commands initiate-to
The following example configures VPDN group 1 to request L2TP tunnels to the peers (NASs) at IP addresses 10.0.58.201 and 10.0.58.205. The two NASs configured by the initiate-to commands have differing priority values to provide failover redundancy.
vpdn-group 1 accept-dialin protocol l2tp virtual-template 1
!
request-dialout protocol l2tp pool-member 1
!
initiate-to ip 10.0.58.201 priority 1 initiate-to ip 10.0.58.205 priority 100 source-ip 10.0.58.211
In the previous example, you would configure load balancing among the NASs by setting the priority values in the initiate-to commands to the same values.
The following partial example shows how to set parameters to control how many times a tunnel server will retry connecting to a NAS, and the amount of time after which the NAS will declare itself down or busy so that the tunnel server will try connecting to the next NAS. (Note that the l2tp tunnel commands are optional and should be used only if it becomes necessary to change the default settings for these commands.)
!
vpdn enable vpdn search-order domain
!
vpdn-group 1
.
.
.
request-dialout protocol l2tp
!
pool-member 1 initiate-to ip 10.0.58.201 priority 1 initiate-to ip 10.0.58.207 priority 50 initiate-to ip 10.0.58.205 priority 100 l2tp tunnel retransmit initial retries 5
.
l2tp tunnel retransmit initial timeout min 4 l2tp tunnel busy timeout 420
.
.
Related Commands Command l2tp tunnel busy timeout
Description
Configures the amount of time that the router will wait before attempting to recontact a router that was previously busy.
l2tp tunnel retransmit initial retries Sets the number of times that the router will attempt to send out the initial control packet for tunnel establishment before considering a router busy.
VPD-52
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands initiate-to
Command l2tp tunnel retransmit initial timeout request-dialin request-dialout source-ip
Description
Sets the minimum or maximum amount of time that the router will wait before resending an initial packet out to establish a tunnel.
Creates a request dial-in VPDN subgroup that configures a
NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode.
Specifies an alternate IP address for a VPDN tunnel that is different from the physical IP address used to open the tunnel.
January 2011
Cisco IOS VPDN Command Reference
VPD-53
VPDN Commands interface virtual-template
interface virtual-template
To create a virtual template interface that can be configured and applied dynamically in creating virtual access interfaces, use the interface virtual-template command in global configuration mode. To remove a virtual template interface, use the no form of this command.
interface virtual-template number [type virtual-template-type]
no interface virtual-template number
Syntax Description
number
type
virtual-template
-type
Number used to identify the virtual template interface. Up to 200 virtual template interfaces can be configured. On the Cisco 10000 series router, up to 4095 virtual template interfaces can be configured.
(Optional) Specifies the type of virtual template.
Command Default
No virtual template interface is defined.
Command Modes
Global configuration (config)
Command History Release Modification
11.2F
12.2(4)T
12.2(28)SB
This command was introduced.
This command was enhanced to increase the maximum number of virtual template interfaces from 25 to 200.
This command was integrated into Cisco IOS Release 12.2(28)SB.
12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.2(31)SB2 This command was integrated into Cisco IOS Release 12.2(31)SB2.
12.2(33)SXH This command was integrated into Cisco IOS Release 12.2(33)SXH.
12.2(33)SB
Cisco IOS XE
Release 2.5
This command’s default configuration was modified for SNMP and implemented on the Cisco 10000 series router for the PRE3 and PRE4.
This command was implemented on Cisco ASR 1000 series routers.
Usage Guidelines
A virtual template interface is used to provide the configuration for dynamically created virtual access interfaces. It is created by users and can be saved in NVRAM.
After the virtual template interface is created, it can be configured in the same way as a serial interface.
Virtual template interfaces can be created and applied by various applications such as virtual profiles, virtual private dialup networks (VPDNs), PPP over ATM, protocol translation, and Multichassis
Multilink PPP (MMP).
VPD-54
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands
Examples
January 2011 interface virtual-template
Cisco 10000 Series Router
You can configure up to 4095 total virtual template interfaces on the Cisco 10000 series router.
To ensure proper scaling and to minimize CPU utilization, we recommend the following virtual template interface settings:
•
•
•
•
A keepalive timer of 30 seconds or greater using the keepalive command. The default is 10 seconds.
Do not enable the Cisco Discovery Protocol (CDP). CDP is disabled by default. Use the no cdp
enable command to disable CDP, if necessary.
Disable link-status event messaging using the no logging event link-status command.
To prevent the virtual-access subinterfaces from being registered with the SNMP functionality of the router and using memory, do not use the router’s SNMP management tools to monitor PPP sessions. Use the no virtual-template snmp command to disable the SNMP management tools.
When a virtual template interface is applied dynamically to an incoming user session, a virtual access interface (VAI) is created.
If you configure a virtual template interface with interface-specific commands, the
Cisco 10000 series router does not achieve the highest possible scaling. To verify that the router does not have interface-specific commands within the virtual template interface configuration, use the test
virtual-template number subinterface command.
In Cisco IOS Release 12.2(33)SB, the default configuration for the virtual-template snmp command was changed to no virtual-template snmp. This prevents large numbers of entries into the MIB ifTable, thereby avoiding CPU Hog messages as SNMP uses the interfaces MIB and other related MIBs. If you configure the no virtual-template snmp command, the router no longer accepts the snmp trap
link-status command under a virtual-template interface. Instead, the router displays a configuration error message such as the following:
Router(config)# interface virtual-template 1
Router(config-if)# snmp trap link-status
%Unable set link-status enable/disable for interface
If your configuration already has the snmp trap link-status command configured under a virtual-template interface and you upgrade to Cisco IOS Release 12.2(33)SB, the configuration error occurs when the router reloads even though the virtual template interface is already registered in the interfaces MIB.
Cisco 10000 Series Router
The following example creates a virtual template interface called Virtual-Template1:
Router(config)# interface Virtual-Template1
Router(config-if)# ip unnumbered Loopback1
Router(config-if)# keepalive 60
Router(config-if)# no peer default ip address
Router(config-if)# ppp authentication pap
Router(config-if)# ppp authorization vpn1
Router(config-if)# ppp accounting vpn1
Router(config-if)# no logging event link-status
Router(config-if)# no virtual-template snmp
Virtual Template with PPP Authentication Example
The following example creates and configures virtual template interface 1: interface virtual-template 1 type ethernet
ip unnumbered ethernet 0
ppp multilink
Cisco IOS VPDN Command Reference
VPD-55
VPDN Commands interface virtual-template
ppp authentication chap
IPsec Virtual Template Example
The following example shows how to configure a virtual template for an IPsec virtual tunnel interface.
interface virtual-template1 type tunnel ip unnumbered Loopback1 tunnel mode ipsec ipv4 tunnel protection ipsec profile virtualtunnelinterface
Related Commands Command cdp enable clear interface virtual-access keepalive show interface virtual-access tunnel protection virtual interface virtual-profile virtual template
Description
Enables Cisco Discovery Protocol (CDP) on an interface.
Tears down the live sessions and frees the memory for other client uses.
Enables keepalive packets and to specify the number of times that the Cisco
IOS software tries to send keepalive packets without a response before bringing down the interface.
Displays the configuration of the active VAI that was created using a virtual template interface.
Associates a tunnel interface with an IPsec profile.
Sets the zone name for the connected AppleTalk network.
Enables virtual profiles.
Specifies the destination for a tunnel interface.
VPD-56
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands ip mtu adjust
ip mtu adjust
To enable automatic adjustment of the IP maximum transmission unit (MTU) on a virtual access interface, use the ip mtu adjust command in VPDN group or VPDN template configuration mode. To disable automatic adjustment of the IP MTU, use the no form of this command.
ip mtu adjust no ip mtu adjust
Syntax Description
This command has no arguments or keywords.
Command Default
Cisco IOS Release 12.2(3) and 12.2(4)T
Automatic adjustment of the IP MTU is enabled.
Cisco IOS Release 12.2(6) and 12.2(8)T and Later Releases
Automatic adjustment of the IP MTU is disabled.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(3)
12.2(4)T
12.2(6)
12.2(8)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(4)T.
The default setting for this command was changed from enabled to disabled.
The default setting for this command was changed from enabled to disabled.
Usage Guidelines
Enabling the ip mtu adjust command allows the router to automatically adjust the IP MTU on the virtual access interface associated with the specified virtual private dialup network (VPDN) group. The IP MTU is automatically adjusted to compensate for the size of the Layer 2 header and the MTU of the egress interface.
The IP MTU is adjusted automatically only if there is no IP MTU manually configured on the virtual template interface from which the virtual access interface is cloned. To manually configure an IP MTU on the virtual template interface, use the ip mtu command in interface configuration mode.
Examples
The following example enables automatic adjustment of the IP MTU for sessions associated with the
VPDN group named cisco1: vpdn-group cisco1 ip mtu adjust
January 2011
Cisco IOS VPDN Command Reference
VPD-57
VPDN Commands ip mtu adjust
Related Commands Command ip mtu ip pmtu vpdn-group vpdn-template
Description
Sets the MTU size of IP packets sent on an interface.
Allows VPDN tunnels to participate in path MTU discovery.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-58
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands ip pmtu
ip pmtu
To enable the discovery of the path maximum transmission unit (MTU) for Layer 2 traffic, use the ip
pmtu command in VPDN group, VPDN template, or pseudowire class configuration mode. To disable path MTU discovery, use the no form of this command.
ip pmtu no ip pmtu
Syntax Description
This command has no arguments or keywords.
Command Default
Path MTU discovery is disabled.
Command Modes
VPDN group configuration
VPDN template configuration
Pseudowire class configuration
Command History Release
12.2(4)T
12.2(11)T
12.0(23)S
12.3(2)T
12.2(25)S
12.2(28)SB
Cisco IOS XE Release
2.6.2
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.0(23)S and support was added for using this command in pseudowire class configuration mode.
Support was added for using this command in pseudowire class configuration mode.
This command was integrated into Cisco IOS Release 12.2(25)S.
This command was integrated into Cisco IOS Release 12.2(28)SB.
This command was integrated into Cisco IOS XE Release 2.6.2.
Usage Guidelines
When the ip pmtu command is enabled, the Don’t Fragment (DF) bit is copied from the inner IP header to the Layer 2 encapsulation header.
Enabling the ip pmtu command triggers Internet Control Message Protocol (ICMP) unreachable messages that indicate fragmentation errors in the IP backbone network carrying the tunneled traffic. If an IP packet is larger than the MTU of any interface it must pass through and the DF bit is set, the packet is dropped and an ICMP unreachable message is returned. The ICMP unreachable message indicates the
MTU of the interface that was unable to forward the packet without fragmentation. This information allows the source host to reduce the size of the packet before retransmission, allowing it to fit through that interface.
January 2011
Cisco IOS VPDN Command Reference
VPD-59
VPDN Commands ip pmtu
Examples
Note
When path MTU discovery (PMTUD) is enabled, VPDN deployments are vulnerable to Denial of
Service (DoS) attacks that use crafted Internet Control Message Protocol (ICMP) “fragmentation needed and Don't Fragment (DF) bit set” (code 4) messages, also known as PMTUD attacks.
Crafted code 4 ICMP messages can be used to set the path MTU to an impractically low value. This will cause higher layer protocols to time out because of a very low throughput, even though the connection is still in the established state. This type of attack is classified as a throughput-reduction attack. When
PMTUD is enabled, it is highly recommended that you use the vpdn pmtu command to configure a range of acceptable values for the path MTU to block PMTUD attacks.
Enabling PMTUD will decrease switching performance.
When issued in VPDN group configuration mode, the ip pmtu command enables any tunnel associated with the specified virtual private dialup network (VPDN) group to participate in path MTU discovery.
When issued in VPDN template configuration mode, the ip pmtu command enables any tunnel associated with the specified VPDN template to participate in path MTU discovery.
When issued in pseudowire class configuration mode, the ip pmtu command enables any Layer 2 Tunnel
Protocol Version 3 (L2TPv3) session derived from the specified pseudowire class configuration to participate in path MTU discovery.
The following example configures a VPDN group named dial-in on a Layer 2 Tunnel Protocol (L2TP) tunnel server and uses the ip pmtu command to specify that tunnels associated with this VPDN group will participate in path MTU discovery. The vpdn pmtu command is used to configure the device to accept only path MTU values ranging from 576 to 1460 bytes. The device will ignore code 4 ICMP messages that specify a path MTU outside of this range.
Router(config)# vpdn-group dial-in
Router(config-vpdn)# request-dialin
Router(config-vpdn-acc-in)# protocol l2tp
Router(config-vpdn-acc-in)# virtual-template 1
!
Router(config-vpdn)# l2tp security crypto-profile l2tp
Router(config-vpdn)# no l2tp tunnel authentication
Router(config-vpdn)# lcp renegotiation on-mismatch
Router(config-vpdn)# ip pmtu
!
Router(config)# vpdn pmtu maximum 1460
Router(config)# vpdn pmtu minimum 576
The following example shows how to enable the discovery of the path MTU for pseudowires that are created from the pseudowire class named ether-pw. The vpdn pmtu command is used to configure the device to accept only path MTU values ranging from 576 to 1460 bytes. The device will ignore code 4
ICMP messages that specify a path MTU outside of this range.
Router(config)# pseudowire-class ether-pw
Router(config-pw)# ip pmtu
!
Router(config)# vpdn pmtu maximum 1460
Router(config)# vpdn pmtu minimum 576
Related Commands
VPD-60
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands ip pmtu
Command ip dfbit set ip mtu ip mtu adjust pseudowire-class vpdn pmtu vpdn-group vpdn-template
Description
Enables the DF bit in the outer L2TPv3 tunnel header.
Sets the MTU size of IP packets sent on an interface.
Enables automatic adjustment of the IP MTU on a virtual access interface.
Specifies the name of an L2TP pseudowire class and enters pseudowire class configuration mode.
Manually configures a range of allowed path MTU sizes for an L2TP
VPDN.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-61
VPDN Commands ip precedence (VPDN)
ip precedence (VPDN)
To set the precedence value in the virtual private dialup network (VPDN) Layer 2 encapsulation header, use the ip precedence command in VPDN group or VPDN template configuration mode. To remove a precedence value setting, use the no form of this command.
ip precedence {number | name}
no ip precedence {number | name}
Syntax Description
number | name A number or name that defines the setting for the precedence bits in the IP header. The values for the number argument and the corresponding name argument are listed in
, from least to most important.
Command Default
The IP precedence value of the Layer 2 encapsulation header is set to zero.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.1(1.1)
12.1(1.1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.1(1.1)T.
Usage Guidelines
Table 3 lists the values for the number argument and the corresponding name argument for precedence
values in the IP header. They are listed from least to most important.
Table 3 Number and Name Values for IP Precedence
2
3
4
5
6
7
Number
0
1
Name routine priority immediate flash flash-override critical internet network
You can set the precedence using either a number or the corresponding name. Once the IP Precedence bits are set, other quality of service (QoS) services such as weighted fair queueing (WFQ) and Weighted
Random Early Detection (WRED) then operate on the bit settings.
VPD-62
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands ip precedence (VPDN)
Examples
For further information on QoS services, refer to the
Cisco IOS Quality of Service Solutions
Configuration Guide
.
The following example sets the IP precedence to 5 (critical) for packets that traverse the VPDN tunnel associated with VPDN group 1: vpdn-group 1 ip precedence 5
Related Commands Command ip tos vpdn-group vpdn-template
Description
Sets the ToS bits in the VPDN Layer 2 encapsulation header.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-63
VPDN Commands ip tos (VPDN)
ip tos (VPDN)
To set the type of service (ToS) bits in the virtual private dialup network (VPDN) Layer 2 encapsulation header, use the ip tos command in VPDN group or VPDN template configuration mode. To restore the default setting, use the no form of this command.
ip tos {tos-bit-value | max-reliability | max-throughput | min-delay | min-monetary-cost |
normal | reflect}
no set ip tos {tos-bit-value | max-reliability | max-throughput | min-delay | min-monetary-cost
| normal | reflect}
Syntax Description
tos-bit-value
max-reliability max-throughput min-delay min-monetary-cost normal reflect
A value (number) from 0 to 15 that sets the ToS bits in the IP header. See
Sets the maximum reliability ToS bits to 2.
Sets the maximum throughput ToS bits to 4.
Sets the minimum delay ToS bits to 8.
Sets the minimum monetary cost ToS bits to 1.
Sets the normal ToS bits to 0. This is the default setting.
Copies the ToS value from the inner IP packet to the Layer 2 encapsulation header.
Command Default
The ToS bits are set to 0, which is equivalent to the normal keyword.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(5)T
12.1(1.1)
12.1(1.1)T
Modification
This command was introduced as l2tp ip tos reflect.
The l2tp ip tos reflect command was replaced by the ip tos command, configuration options were added, and support was added for other protocols.
This command was integrated into Cisco IOS Release 12.1(1.1)T
Usage Guidelines
The ip tos command allows you to set four bits in the ToS portion of the Layer 2 encapsulation header.
The ToS bits can be set manually, or copied from the header of the inner IP packet by issuing the reflect keyword.
The ToS bits of the inner IP header can be set manually using the set ip tos (route-map) command. If you then configure the ip tos reflect command, the manually configured ToS setting of the inner IP header will be copied to the encapsulation header.
The reflect keyword functions only when the inner payload is IP. The encapsulated payload of Multilink
PPP (MLP) connections is not IP, therefore the reflect keyword has no effect when MLP is tunneled.
VPD-64
Cisco IOS VPDN Command Reference
January 2011
VPDN Commands ip tos (VPDN)
Examples
shows the format of the four ToS bits in binary form.
Table 4 ToS Bits and Description
0
0
0
1
T3
0
0
0
1
0
T2
0
0
1
0
0
T1
0
1
0
0
0
T0
0
Description
0 normal forwarding
1 minimum monetary cost
2 maximum reliability
4 maximum throughput
8 minimum delay
The T3 bit sets the delay. Setting T3 to 0 equals normal delay, and setting it to 1 equals low delay.
The T2 bit sets the throughput. Setting this bit to 0 equals normal throughput, and setting it to 1 equals maximum throughput. Similarly, the T1 and T0 bits set reliability and monetary cost, respectively.
Therefore, as an example, if you want to set a packet with the following requirements: minimum delay T3 = 1 normal throughput T2 = 0 normal reliability T1 = 0 minimum monetary cost T0 = 1
You would set the ToS to 9, which is 1001 in binary format.
The following example configures a tunnel server to preserve the IP ToS settings of the encapsulated IP payload for a Layer 2 Tunnel Protocol (L2TP) dial-in sessions: vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname router12 local name router32 ip tos reflect
The following example sets the IP ToS bits to 8 (minimum delay as shown in
) for packets that traverse the VPDN tunnel associated with VPDN group 1: vpdn-group 1 ip tos 8
Related Commands Command ip precedence set ip tos (route-map) vpdn-group vpdn-template
Description
Sets the precedence value (and an optional IP number or IP name) in the
VPDN Layer 2 encapsulation header.
Sets the ToS bits in the header of an IP packet.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
January 2011
Cisco IOS VPDN Command Reference
VPD-65
Download
Link público atualizado
O link público para seu chat foi atualizado. Você pode visualizar e gerenciar seus links de chat após o registro aqui.
Link público do documento
Anúncio