Cisco Systems IOS VPDN Virtual Private Dialup Network Command Reference
Below you will find brief information for Virtual Private Dialup Network IOS VPDN. This document provides a complete list of all the commands for configuring and maintaining virtual private dialup networks, including configuration examples and detailed descriptions. This document provides the information necessary to configure, troubleshoot, and manage the Virtual Private Dialup Network (VPDN).
Advertisement
Advertisement
Cisco IOS VPDN Command Reference
Release 12.4T
Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA http://www.cisco.com
800 553-NETS (6387)
Text Part Number: OL-7919-01
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco
Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel,
EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard,
LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect,
RateMUX, ScriptShare, SlideCast, SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0601R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco IOS VPDN Command Reference
© 2006, Cisco Systems, Inc. All rights reserved.
Introduction
1
VPDN Commands
3
accept-dialin
4
accept-dialout
6
authen-before-forward
8
backup
10
clear vpdn counters
12
clear vpdn history failure
14
clear vpdn redirect
15
clear vpdn tunnel
16
default (VPDN)
18
description (VPDN group)
22
dialer vpdn
23
dnis (VPDN)
24
domain
26
encryption mppe
28
force-local-chap
29
group session-limit
31
initiate-to
33
interface virtual-template
36
ip mtu adjust
38
ip pmtu
40
ip precedence (VPDN)
43
ip tos (VPDN)
45
l2f ignore-mid-sequence
47
l2f tunnel busy timeout
48
l2f tunnel retransmit initial retries
50
l2f tunnel retransmit retries
52
l2f tunnel timeout setup
54
l2tp attribute clid mask-method
56
l2tp drop out-of-order
58
C O N T E N T S
Cisco IOS VPDN Command Reference iii
Contents
l2tp hidden
59
l2tp ip udp checksum
61
l2tp security crypto-profile
62
l2tp sequencing
64
l2tp tunnel authentication
66
l2tp tunnel bearer capabilities
67
l2tp tunnel busy timeout
69
l2tp tunnel framing capabilities
70
l2tp tunnel hello
72
l2tp tunnel password
73
l2tp tunnel receive-window
75
l2tp tunnel retransmit initial retries
76
l2tp tunnel retransmit initial timeout
78
l2tp tunnel retransmit retries
80
l2tp tunnel retransmit timeout
82
l2tp tunnel timeout no-session
84
l2tp tunnel timeout setup
86
l2tp tunnel zlb delay
87
lcp renegotiation
88
loadsharing
90
local name
91
multihop-hostname
93
pool-member
95
pptp flow-control receive-window
96
pptp flow-control static-rtt
98
pptp tunnel echo
100
protocol (VPDN)
102
redirect identifier
104
request-dialin
106
request-dialout
108
resource-pool profile vpdn
110
service vpdn group
112
session-limit (VPDN)
114
show interfaces virtual-access
116
show ppp mppe
122
Cisco IOS VPDN Command Reference iv
Contents
show resource-pool vpdn
124
show vpdn
127
show vpdn domain
130
show vpdn group
131
show vpdn history failure
135
show vpdn multilink
137
show vpdn redirect
139
show vpdn session
141
show vpdn tunnel
147
show vtemplate
151
source vpdn-template
154
source-ip
156
terminate-from
158
virtual-template
159
vpdn aaa attribute
162
vpdn aaa override-server
164
vpdn aaa untagged
166
vpdn authen-before-forward
167
vpdn authorize directed-request
169
vpdn authorize domain
171
vpdn domain-delimiter
173
vpdn enable
175
vpdn group
176
vpdn history failure
178
vpdn ip udp ignore checksum
180
vpdn l2tp attribute clid mask-method
181
vpdn logging
183
vpdn multihop
185
vpdn pmtu
188
vpdn profile
190
vpdn redirect
192
vpdn redirect attempts
194
vpdn redirect identifier
195
vpdn redirect source
197
vpdn search-order
198
Cisco IOS VPDN Command Reference v
Contents
vpdn session accounting network
200
vpdn session-limit
202
vpdn softshut
204
vpdn source-ip
205
vpdn tunnel accounting network
206
vpdn tunnel authorization network
208
vpdn tunnel authorization password
210
vpdn tunnel authorization virtual-template
211
vpdn-group
213
vpdn-template
215
vpn
219 vi
Cisco IOS VPDN Command Reference
Introduction
This book contains the commands used to configure and maintain a Cisco IOS virtual private dialup network (VPDN). The commands are listed alphabetically.
Prior to Cisco IOS Release 12.4, the commands for configuring VPDNs were presented in the Cisco IOS
Dial Technologies Command Reference.
For configuration tasks and examples, refer to the Cisco IOS VPDN Configuration Guide.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-1
Introduction
VPD-2
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
This chapter presents the commands to configure and maintain Cisco IOS VPDNs, in alphabetical order.
Some commands required for configuring VPDNs may be found in other Cisco IOS command references. Use the Cisco IOS Master Command List or the Command Lookup Tool to find these commands.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-3
VPDN Commands accept-dialin
accept-dialin
To create an accept dial-in virtual private dialup network (VPDN) subgroup that configures a tunnel server to accept requests from a network access server (NAS) to tunnel dial-in calls, and to enter accept dial-in VPDN subgroup configuration mode, use the accept-dialin command in VPDN group configuration mode. To remove the accept dial-in VPDN subgroup configuration from a VPDN group, use the no form of this command.
accept-dialin no accept-dialin
Syntax Description
This command has no arguments or keywords.
Defaults
No accept dial-in VPDN subgroups are configured.
Command Modes
VPDN group configuration
Command History Release
11.3(5)AA
12.0(1)T
12.0(5)T
12.1(1)T
Modification
This command was introduced and replaced the vpdn incoming command used in Cisco IOS Release 11.3.
This command was integrated into Cisco IOS Release 12.0(1)T and implemented on additional router and access server platforms.
The original keywords and arguments were removed and made into separate
accept-dialin subgroup commands.
This command was enhanced to support dial-in Point-to-Point Protocol over
Ethernet (PPPoE) calls.
Usage Guidelines
Use the accept-dialin command on a tunnel server to configure a VPDN group to accept requests to establish dial-in VPDN tunnels from a NAS. Once the tunnel server accepts the request from a NAS, it uses the specified virtual template to clone new virtual access interfaces.
To configure a VPDN group to accept dial-in calls, you must also configure the following commands:
•
The protocol command from accept dial-in VPDN subgroup configuration mode
•
•
The virtual-template command from accept dial-in VPDN subgroup configuration mode
The terminate-from command in VPDN group configuration mode
Note
If you create a VPDN group without configuring a terminate-from command, a default VPDN group is automatically enabled. Incoming tunnel requests from any hostname will use the attributes specified in the default VPDN group, unless a specific VPDN group is configured with a terminate-from command using that hostname.
VPD-4
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands accept-dialin
Typically, you need one VPDN group for each NAS that will be tunneling to the tunnel server. For a tunnel server that services many NASs, the configuration can become cumbersome. If all the NASs will share the same tunnel attributes, you can simplify the configuration by using the default VPDN group configuration, or by creating a VPDN default group template using the vpdn-template command.
The tunnel server can also be configured to request the establishment of Layer 2 Tunnel Protocol (L2TP) dial-out VPDN tunnels to a NAS using the request-dialout command. Dial-in and dial-out calls can use the same L2TP tunnel.
Examples
The following example enables the tunnel server to accept Layer 2 Forwarding (L2F) tunnels from a
NAS named router23. A virtual-access interface will be cloned from virtual-template 1.
Router(config)# vpdn-group 1
Router(config-vpdn)# accept-dialin
Router(config-vpdn-acc-in)# protocol l2f
Router(config-vpdn-acc-in)# virtual-template 1
!
Router(config-vpdn)# terminate-from hostname router23
The following example configures the router so that tunnels requested by the NAS named router16 are created with the tunnel attributes specified by VPDN group 1, while any other incoming L2TP tunnel request will use the settings configured in the default VPDN group, VPDN group 2:
Router(config)# vpdn-group 1
Router(config-vpdn)# accept-dialin
Router(config-vpdn-acc-in)# protocol l2tp
Router(config-vpdn-acc-in)# virtual-template 2
!
Router(config-vpdn)# terminate-from hostname router16
Router(config)# vpdn-group 2
! Default L2TP VPDN group
Router(config-vpdn)# accept-dialin
Router(config-vpdn-acc-in)# protocol l2tp
Router(config-vpdn-acc-in)# virtual-template 3
Related Commands Command protocol (VPDN) request-dialin request-dialout terminate-from virtual-template vpdn-group vpdn-template
Description
Specifies the tunneling protocol that a VPDN subgroup will use.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a
NAS, and enters request dial-out VPDN subgroup configuration mode.
Specifies the hostname of the remote LAC or LNS that will be required when accepting a VPDN tunnel.
Specifies which virtual template will be used to clone virtual-access interfaces.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-5
VPDN Commands accept-dialout
accept-dialout
To create an accept dial-out virtual private dialup network (VPDN) subgroup that configures a network access server (NAS) to accept requests from a tunnel server to tunnel Layer 2 Tunneling Protocol (L2TP) dial-out calls, and to enter accept dial-out VPDN subgroup configuration mode, use the accept-dialout command in VPDN group configuration mode. To remove the accept dial-out VPDN subgroup configuration from the VPDN group, use the no form of this command.
accept-dialout no accept-dialout
Syntax Description
This command has no arguments or keywords.
Defaults
No accept dial-out VPDN subgroups are configured.
Command Modes
VPDN group configuration
Command History Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Use the accept-dialout command on a NAS to configure a VPDN group to accept requests for dial-out
VPDN tunnels from a tunnel server. L2TP is the only tunneling protocol that can be used for dial-out
VPDN tunnels.
For a VPDN group to accept dial-out calls, you must also configure the following commands:
•
•
•
•
The terminate-from command in VPDN group configuration mode
The protocol l2tp command in accept dial-out VPDN subgroup configuration mode
The dialer command in accept dial-out VPDN subgroup configuration mode
The dialer aaa command in dialer interface configuration mode
The NAS can also be configured to request the establishment of dial-in VPDN tunnels to a tunnel server using the request-dialin command. Dial-in and dial-out calls can use the same L2TP tunnel.
Examples
The following example configures a VPDN group on the NAS to accept L2TP tunnels for dial-out calls from the tunnel server TS23 using dialer 2 as its dialing resource:
Router(config)# vpdn-group 1
Router(config-vpdn)# accept-dialout
Router(config-vpdn-acc-ou)# protocol l2tp
Router(config-vpdn-acc-ou)# dialer 2
!
Router(config-vpdn)# terminate-from hostname TS23
!
Router(config)# interface Dialer2
VPD-6
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands accept-dialout
Router(config-if)# ip unnumbered Ethernet0
Router(config-if)# encapsulation ppp
Router(config-if)# dialer in-band
Router(config-if)# dialer aaa
Router(config-if)# dialer-group 1
Router(config-if)# ppp authentication chap
Related Commands Command dialer dialer aaa dialer vpdn protocol (VPDN) request-dialin request-dialout terminate-from
Description
Specifies the dialer interface that an accept-dialout VPDN subgroup will use to dial out calls.
Allows a dialer to access the AAA server for dialing information.
Enables a Dialer Profile or DDR dialer to use L2TP dial-out.
Specifies the tunneling protocol that a VPDN subgroup will use.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode.
Specifies the hostname of the remote router that will be required when accepting a VPDN tunnel.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-7
VPDN Commands authen-before-forward
authen-before-forward
To configure a network access server (NAS) to request authentication of a complete username before making a forwarding decision for dial-in Layer 2 Tunnel Protocol (L2TP) or Layer 2 Forwarding (L2F) tunnels belonging to a virtual private dialup network (VPDN) group, use the authen-before-forward command in VPDN group configuration mode. To disable this configuration, use the no form of this command.
authen-before-forward no authen-before-forward
Syntax Description
This command has no arguments or keywords.
Command Default
L2TP or L2F tunnels are forwarded to the tunnel server without first requesting authentication of the complete username.
Command Modes
VPDN group configuration
Command History Release
11.3(9)AA
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(5)T and was modified to be available only when the request-dialin VPDN subgroup is enabled.
Usage Guidelines
To configure the NAS to perform authentication of dial-in L2TP or L2F sessions belonging to a specific
VPDN group before the sessions are forwarded to the tunnel server, use the authen-before-forward command in VPDN group configuration mode.
To configure the NAS to perform authentication of all dial-in L2TP or L2F sessions before the sessions are forwarded to the tunnel server, configure the vpdn authen-before-forward command in global configuration mode.
You must configure a request dial-in VPDN subgroup by issuing the request-dialin command before you can configure the authen-before-forward command. Removing the request-dialin configuration will remove the authen-before-forward command configuration from the VPDN group.
VPD-8
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands authen-before-forward
Enabling the authen-before-forward command instructs the NAS to authenticate the complete username before making a forwarding decision based on the domain portion of the username. A user may be forwarded or terminated locally depending on the information contained in the users RADIUS profile.
Users with forwarding information in their RADIUS profile are forwarded based on that information.
Users without forwarding information in their RADIUS profile are either forwarded or terminated locally based on the Service-Type in their RADIUS profile. The relationship between forwarding decisions and the information contained in the users RADIUS profile is summarized in
Table 1 Forwarding Decisions Based on RADIUS Profile Attributes
Forwarding Information Is
Present in RADIUS profile
Absent from RADIUS profile
Service-Type Is Outbound
Forward User
Check Domain
Service-Type Is Not Outbound
Forward User
Terminate Locally
Examples
The following example configures an L2F request dial-in VPDN subgroup that sends the entire username to the authentication, authorization, and accounting (AAA) server when a user dials in with a username that includes the domain cisco.com: vpdn-group 1 request-dialin protocol l2f domain cisco.com
initiate-to ip 10.0.0.1
local name router32 authen-before-forward
Related Commands Command ppp multilink request-dialin vpdn authen-before-forward
Description
Enables MLP on an interface and, optionally, enables dynamic bandwidth allocation.
Configures a LAC to request L2F or L2TP tunnels to an LNS and create a request-dialin VPDN subgroup, and specifies a dial-in L2F or L2TP tunnel to a remote peer if a dial-in request is received for a specified domain or
DNIS.
Configures a NAS to request authentication of a complete username before making a forwarding decision for all dial-in L2TP or L2F tunnels.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-9
VPDN Commands backup
backup
To configure an IP backup endpoint address, enter the backup command in VPDN group configuration mode. To remove this function, use the no form of this command.
backup ip ip-address [limit number [priority number]]
no backup ip ip-address [limit number [priority number]]
Syntax Description
ip ip-address
limit number
IP address of the HGW/LNS at the other end of the tunnel. This is the IP endpoint at the end of the tunnel, which is an HGW/LNS router.
(Optional) Limits sessions per backup. The limit can range from 0 to 32767. The default is no limit set.
priority number (Optional) Priority level. Loadsharing is priority 1. Backup priority is between 2 and 32,767. The highest priority is 2, which is the first home gateway router to receive backup traffic. The lowest priority is 32,767. The priority group is used to support multiple levels of loadsharing and backup. The default is the lowest priority.
Defaults
Command Modes
VPDN group configuration
Command History
No default behavior or values. This function is used only if it is configured.
Release
12.0(4)XI
Modification
This command was introduced on the following platforms only: Cisco AS5200 and Cisco AS5300.
Usage Guidelines
Use the backup VPDN group configuration command to configure an IP backup endpoint address.
Examples
The following examples show that the backup command is not available in the command-line interface until you enter the request-dialin command:
Router(config)# vpdn-group customer1-vpdngroup
Router(config-vpdn)# ?
VPDN group configuration commands:
accept-dialin VPDN accept-dialin group configuration
accept-dialout VPDN accept-dialout group configuration
default Set a command to its defaults
description Description for this VPDN group
exit Exit from VPDN group configuration mode
ip IP settings for tunnel
no Negate a command or set its defaults
request-dialin VPDN request-dialin group configuration
VPD-10
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands backup
request-dialout VPDN request-dialout group configuration
source-ip Set source IP address for this vpdn-group
Router(config-vpdn)# request-dialin l2tp ip 10.2.2.2 domain customerx
Router(config-vpdn)#?
VPDN group configuration commands:
backup Add backup address
default Set a command to its defaults
dnis Accept a DNIS tunnel
domain Accept a domain tunnel
exit Exit from VPDN group configuration mode
force-local-chap Force a CHAP challenge to be instigated locally
l2tp L2TP specific commands
lcp LCP specific commands
loadsharing Add loadsharing address
local local information, like name
multilink Configure limits for Multilink
no Negate a command or set its defaults
request Request to open a tunnel
The following example shows an IP backup endpoint address of 10.1.1.1 configured with a backup session limit of 5:
Router(config-vpdn)# backup ip 10.1.1.1 limit 5
Related Commands Command request-dialin
Description
Configures a LAC to request L2F or L2TP tunnels to an LNS and create a request-dialin VPDN subgroup, and specifies a dial-in L2F or L2TP tunnel to a remote peer if a dial-in request is received for a specified domain or DNIS.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-11
VPDN Commands clear vpdn counters
clear vpdn counters
To clear the counters of a specified virtual private dial-up network (VPDN) session or tunnel or to clear all of the VPDN counters, as displayed by the show vpdn command, use the clear vpdn counters command in privileged EXEC mode.
clear vpdn counters [session {interface interface-type interface-number | id tunnel-id session-id |
username username} | tunnel {l2f | l2tp | pptp} {all | hostname hostname | ip {remote | local}
ip-address | id tunnel-id}]
Syntax Description session interface
interface-type interface-number
(Optional) Specifies that session counters will be cleared.
Clears VPDN session counters for the interface specified by the interface-type
interface-number arguments. Valid values for the interface-type argument are:
•
•
serial—Specifies that VPDN session counters will be cleared on a serial interface.
HSSI—Specifies that VPDN session counters will be cleared on a
High-Speed Serial Interface (HSSI).
•
•
BRI—Specifies that VPDN session counters will be cleared on a BRI interface.
SUBIF—Specifies that VPDN session counters will be cleared on an ATM or Frame Relay subinterface.
id tunnel-id
session-id
username
username
tunnel {l2f | l2tp |
pptp}
all
hostname
hostname
•
Virtual-Access—Specifies that VPDN session counters will be cleared on a virtual access interface.
Clears VPDN session counters by tunnel and session ID. Valid values for the
tunnel-id argument and the session-id argument range from 1 to 65535.
Clears VPDN session counters for the username specified by the username argument.
(Optional) Clears both session and tunnel counters for the tunnel type specified by the l2f, l2tp, or pptp keyword.
Clears VPDN counters for all sessions and tunnels of the selected tunnel type.
Clears VPDN counters for all sessions and tunnels of the selected tunnel type associated with the particular host specified by the hostname argument.
For the l2tp and pptp tunnel type options, the hostname argument has the following value:
remote-name [local-name]
For the l2f tunnel type option, the hostname argument has the following value:
nas-name gateway-name
The nas-name argument is the name of the network access server and
gateway-name argument is the name of the home gateway.
VPD-12
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands clear vpdn counters
ip {remote | local}
ip-address
id tunnel-id
Clears VPDN counters for all sessions and tunnels of the selected tunnel type associated with the remote or local IP address specified by the ip-address argument.
Clears VPDN counters for all sessions and tunnels of the selected tunnel type associated with the tunnel id specified with the tunnel-id argument. Valid values for the tunnel-id argument range from 1 to 65,535.
Command Modes
Privileged EXEC
Command History Release
12.2(13)T
Modification
This command was introduced.
Usage Guidelines
Use this command to clear counters for VPDN sessions and tunnels. If no keywords are used when the
clear vpdn counters command is used, all VPDN session and tunnel counters are cleared. If the session keyword is used, the specified session counters are cleared. If the tunnel keyword is used, the specified session and tunnel counters are cleared. You cannot clear the VPDN tunnel counters without also clearing the VPDN session counters.
Examples
Related Commands
The following example shows output from the show vpdn command before and after the clear vpdn
counters command is issued:
Router# show vpdn session packets interface virtual-access 8
L2TP Session Information Total tunnels 1 sessions 1
PPTP session removal calls 0
LocID RemID TunID Pkts-In Pkts-Out Bytes-In Bytes-Out
7 2 28240 10282 10287 431844 298235
Router# clear vpdn counters session interface virtual-access 8
Clear "show vpdn" counters on this session [confirm]
Router# show vpdn session packets interface virtual-access 8
L2TP Session Information Total tunnels 1 sessions 1
PPTP session removal calls 0
LocID RemID TunID Pkts-In Pkts-Out Bytes-In Bytes-Out
7 2 28240 0 0 0 0
%No active L2F tunnels
%No active PPTP tunnels
%No active PPPoE tunnels
Command show vpdn
Description
Displays information about active L2TP or L2F tunnels or sessions in a
VPDN.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-13
VPDN Commands clear vpdn history failure
clear vpdn history failure
To clear the content of the failure history table, use the clear vpdn history failure command in EXEC mode.
clear vpdn history failure
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History Release
11.3T
Modification
This command was introduced.
Examples
Related Commands
The following example clears the content of the failure history table:
Router# clear vpdn history failure
Command show vpdn history-failure
Description
Displays the content of the failure history table.
VPD-14
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands clear vpdn redirect
clear vpdn redirect
To clear the Layer 2 Tunnel Protocol (L2TP) redirect counters shown in the show vpdn redirect command output, use the clear vpdn redirect command in privileged EXEC mode.
clear vpdn redirect
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History Release
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use the clear vpdn redirect command to clear the statistics regarding redirects and forwards displayed using the show vpdn redirect command.
Examples
The following example clears the redirect counters:
Router# clear vpdn redirect
Related Commands Command show vpdn redirect
Description
Displays statistics for L2TP redirects and forwards.
vpdn redirect
Enables L2TP redirect functionality.
vpdn redirect attempts Restricts the number of redirect attempts possible for an L2TP call on the
NAS.
vpdn redirect identifier
Configures a VPDN redirect identifier to use for L2TP call redirection on a stack group tunnel server.
vpdn redirect source
Configures the public redirect IP address of an L2TP stack group tunnel server.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-15
VPDN Commands clear vpdn tunnel
clear vpdn tunnel
To shut down a specified virtual private dial-up network (VPDN) tunnel and all sessions within the tunnel, use the clear vpdn tunnel command in privileged EXEC mode.
L2TP or PPTP Tunnels
clear vpdn tunnel {pptp | l2tp} {all | hostname remote-name [local-name] | id local-id | ip
local-ip-address | ip remote-ip-address}
L2F Tunnels
clear vpdn tunnel l2f {all | hostname nas-name hgw-name | id local-id | ip local-ip-address | ip
remote-ip-address}
Syntax Description pptp l2tp all hostname
remote-name
[local-name]
Clears the specified Point-to-Point Tunneling Protocol (PPTP) tunnel.
Clears the specified Layer 2 Tunneling Protocol (L2TP) tunnel.
Clears all VPDN tunnels terminating on the device.
Clears all L2TP or PPTP VPDN tunnels established between the devices with the specified local and remote hostnames.
id local-id
ip local-ip-address
Clears the VPDN tunnel with the specified local ID.
Clears all VPDN tunnels terminating on the device with the specified local
IP address.
ip remote-ip-address Clears all VPDN tunnels terminating on the device with the specified remote
IP address.
l2f
Clears the specified Layer 2 Forwarding (L2F) tunnel.
hostname nas-name
hgw-name
Clears all L2F VPDN tunnels established between the network access server
(NAS) and home gateway with the specified hostnames.
Command Modes
Privileged EXEC
Command History Release
11.2
11.3(5)AA
12.0(1)T
12.0(5)XE5
Modification
This command was introduced.
The l2tp keyword was added.
The l2f keyword was added.
The pptp keyword was added.
VPD-16
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Release
12.1(5)T
12.2(2)T
clear vpdn tunnel
Modification
The pptp keyword was updated for additional Cisco access servers or routers.
The syntax for this command was modified to include the following keywords and arguments:
• all
•
•
hostname remote-name local-name
•
•
hostname nas-name hgw-name
id local-id
ip local-ip-address
•
ip remote-ip-address
Usage Guidelines
Manual termination of a VPDN tunnel results in the immediate shutdown of the specified VPDN tunnel and all sessions within that tunnel, resulting in a sudden disruption of VPDN services.
You can shut down VPDN tunnels more gradually by issuing the vpdn softshut command, which prevents the establishment of new VPDN sessions in all VPDN tunnels that terminate on the device.
Existing VPDN sessions are not affected.
A manually terminated VPDN tunnel can be restarted immediately when a user logs in. Manually terminating and restarting a VPDN tunnel while VPDN event logging is enabled can provide useful troubleshooting information about VPDN session establishment. VPDN event logging is enabled by issuing the vpdn logging command.
Examples
The following example clears all L2TP tunnels connecting to a remote peer named NAS1:
Router# clear vpdn tunnel l2tp hostname NAS1
The following example clears all PPTP tunnels connecting the devices with the hostnames NAS3 and tun1:
Router# clear vpdn tunnel pptp NAS3 hostname tun1
The following example clears all L2F tunnels originating from the specified IP address:
Router# clear vpdn tunnel l2f ip 10.1.1.1
Related Commands Command vpdn logging vpdn softshut
Description
Enables the logging of generic VPDN events.
Prevents new sessions from being established on a VPDN tunnel without disturbing existing sessions.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-17
VPDN Commands default (VPDN)
default (VPDN)
To remove or reset a virtual private dialup network (VPDN) group or a VPDN subgroup configuration to its default value, use the default command in VPDN group, VPDN subgroup, or VPDN template configuration mode.
default command
Syntax Description
command
The command to be removed or reset from the VPDN group or VPDN subgroup configuration.
lists some of the commands that can be issued with the default command.
Command Default
No default behavior or values.
Command Modes
VPDN group configuration
VPDN subgroup configuration
VPDN template configuration
Command History Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Use the default command to remove or reset a specific command configuration in a VPDN group, VPDN subgroup, or VPDN template configuration. Issuing default command is the same as issuing the no form of the command specified with the command argument.
Table 2 lists some of the commands that can be removed or reset using the default command, and the
configuration modes that the default command must be issued in. Some commands may not be available unless a particular configuration is present on the router.
For a complete list of the commands available for use with the default command, use the default ? command in the desired configuration mode.
Some commands have required keywords or arguments that must be included in the default command statement. You may issue default command ? to determine what keywords and arguments are required.
For complete command syntax, see the command documentation in the Cisco IOS Dial Technologies
Command Reference.
Table 2 Command Options for the default (VPDN) Command
Command Name accept-dialin accept-dialout authen before-forward dialer
Configuration Mode
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Accept-dialout VPDN subgroup configuration mode.
VPD-18
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Table 2 Command Options for the default (VPDN) Command (continued)
Command Name dnis domain force-local-chap initiate-to lcp renegotiation local name multilink pool-member protocol multihop request-dialin request-dialout rotary-group session-limit source-ip terminate-from virtual-template
Configuration Mode
Request-dialin VPDN subgroup configuration mode.
Request-dialin VPDN subgroup configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Request-dialout VPDN subgroup configuration mode.
Any VPDN subgroup configuration mode.
Request-dialin VPDN subgroup configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Request-dialout VPDN subgroup configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
VPDN group configuration mode.
Accept-dialin VPDN subgroup configuration mode.
default (VPDN)
Examples
Release 12.4T
The following example shows the running configuration of a tunnel server VPDN group configured to accept Layer 2 Forwarding (L2F) dial-in calls and to place Layer 2 Tunnel Protocol (L2TP) dial-out calls:
Router# show running-config
!
vpdn-group group1 accept-dialin protocol l2f virtual-template 1 request-dialout protocol l2tp pool-member 1 terminate-from hostname myhost initiate-to ip 10.3.2.1 local name router32 l2f ignore-mid-sequence l2tp ip udp checksum
!
If you issue the default virtual-template command in accept-dialin VPDN subgroup configuration mode, the virtual-template command configuration is removed from the VPDN subgroup:
Router(config-vpdn-req-out)# default virtual-template
!
Router# show running-config
!
vpdn-group group1 accept-dialin protocol l2f
Cisco IOS VPDN Command Reference
VPD-19
default (VPDN)
VPDN Commands
!
request-dialout protocol l2tp pool-member 1 terminate-from hostname myhost initiate-to ip 10.3.2.1 local name router32 l2f ignore-mid-sequence l2tp ip udp checksum
If you issue the default accept-dialin command in VPDN group configuration mode, the accept-dialin
VPDN subgroup configuration is removed from the VPDN group along with all configurations that require an accept-dialin VPDN subgroup:
Router(config-vpdn)# default accept-dialin
!
Router# show running-config
!
vpdn-group group1 request dialout protocol l2tp pool-member 1 local name router32 initiate-to ip 10.3.2.1
l2tp ip udp checksum
The following example enters VPDN template configuration mode and uses the command line help system to find the commands available to use with the default command:
Router(config)# vpdn-template 1
Router(config-vpdn-templ)# default ? description Description for this VPDN group
group Items grouped for all attached vpdn-groups
ip IP settings for tunnel
l2f L2F specific commands
l2tp L2TP specific commands
local Local information
pptp PPTP specific commands
redirect Call redirection options
relay Relay options configuration
vpn VPN ID/VRF name
The following example uses the command line help system to show that a value must be entered for the
number argument when the default session-limit command is issued in VPDN group configuration mode:
Router(config-vpdn)# default session-limit ?
<0-32767> Max number of sessions
Related Commands Command accept-dialin accept-dialout
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept-dialin VPDN subgroup configuration mode.
Creates an accept dial-out VPDN subgroup that configures a NAS to accept requests from a tunnel server to tunnel L2TP dial-out calls, and enters accept-dialout VPDN subgroup configuration mode.
VPD-20
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands default (VPDN)
Command request-dialin
Description
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request-dialin VPDN subgroup configuration mode.
request-dialout
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request-dialout VPDN subgroup configuration mode.
vpdn-group
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-21
VPDN Commands description (VPDN group)
description (VPDN group)
To add a description to a virtual private dialup network (VPDN) group, use the description command in
VPDN group or VPDN template configuration mode. To remove the description, use the no form of this command.
description string
no description
Syntax Description
string
Comment or a description about the VPDN group.
Command Default
No description is associated with the VPDN group.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2
Modification
This command was introduced.
Examples
The following example shows how to enter a description for a VPDN group: vpdn-group 333
description This is a VPDN group at location 333
request-dialin exit
initiate-to ip 10.0.0.63
local name cisco.com
Related Commands Command Description vpdn-group
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
VPD-22
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands dialer vpdn
dialer vpdn
To enable a dialer profile or dial-on-demand routing (DDR) dialer to use Layer 2 Tunnel Protocol (L2TP) dialout, use the dialer vpdn command in interface configuration mode. To disable L2TP dialout on a dialer profile or DDR dialer, use the no form of this command.
dialer vpdn no dialer vpdn
Syntax Description
This command has no arguments or keywords.
Defaults
Disabled
Command Modes
Interface configuration
Command History Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
The dialer vpdn command must be configured on the LNSs dialer interface to enable L2TP dialout. This command enables the dialer to place a VPDN call.
Examples
The following example shows how to configure the dialer interface and VPDN group on an LNS for
L2TP dialout: interface Dialer2
ip address 172.16.2.3 255.255.255.128
encapsulation ppp
dialer remote-name myname
dialer string 5550134
dialer vpdn
dialer pool 1
dialer-group 1
ppp authentication chap vpdn-group 1
request-dialout
protocol l2tp
pool-member 1
initiate-to ip 172.21.9.4
Related Commands Command dialer aaa request-dialout
Description
Allows a dialer to access the AAA server for dialing information.
Enables an LNS to request VPDN dial-out calls by using L2TP.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-23
VPDN Commands dnis (VPDN)
dnis (VPDN)
To specify the Dialed Number Identification Service (DNIS) group name or DNIS number of users that are to be forwarded to a tunnel server using a virtual private dialup network (VPDN), use the dnis command in request dial-in VPDN subgroup configuration mode. To remove a DNIS group or number from a VPDN group, use the no form of this command.
dnis {dnis-group-name | dnis-number}
no dnis {dnis-group-name | dnis-number}
Syntax Description
dnis-group-name
DNIS group name used when resource pool management (RPM) is enabled and the VPDN group is configured under the incoming customer profile.
dnis-number
DNIS group number used when RPM is disabled, or when a call is associated with a customer profile without any VPDN group configured for the customer profile.
Defaults
Disabled
Command Modes
Request dial-in VPDN subgroup configuration
Command History Release
12.0(4)XI
Modification
This command was introduced.
Usage Guidelines
You must specify a tunneling protocol using the protocol command in request dial-in VPDN subgroup configuration mode before issuing the dnis command. Removing or changing the protocol command configuration removes any existing dnis command configuration from the request dial-in VPDN subgroup.
You can configure a VPDN group to tunnel multiple DNIS group names and DNIS numbers by issuing multiple instances of the dnis command.
VPDN groups can also be configured to tunnel users based on domain name using the domain command.
Examples
The following example configures a VPDN group to tunnel calls from multiple DNIS numbers and from the domain cisco.com to the tunnel server at 10.1.1.1 using the Layer 2 Forwarding (L2F) protocol:
Router(config)# vpdn-group users
Router(config-vpdn)# request dialin
Router(config-vpdn-req-in)# protocol l2f
Router(config-vpdn-req-in)# dnis 1234
Router(config-vpdn-req-in)# dnis 5678
Router(config-vpdn-req-in)# domain cisco.com
!
Router(config-vpdn)# initiate-to 10.1.1.1
VPD-24
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands dnis (VPDN)
Related Commands Command dialer dnis group domain
Description
Creates a DNIS group.
Specifies the domain name of users that are to be forwarded to a tunnel server using
VPDN.
Includes a group of DNIS numbers in a customer profile.
dnis group protocol
(VPDN)
Specifies the tunneling protocol that the VPDN subgroup will use.
request-dialin
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-25
VPDN Commands domain
domain
To specify the domain name of users that are to be forwarded to a tunnel server using a virtual private dialup network (VPDN), use the domain command in request dial-in VPDN subgroup configuration mode. To remove a domain from a VPDN group or subgroup, use the no form of this command.
domain domain-name
no domain [domain-name]
Syntax Description
domain-name
Case-sensitive name of the domain that will be tunneled.
Defaults
Command Modes
Request dial-in VPDN subgroup configuration
Command History
Disabled
Release
12.0(4)XI
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(5)T.
Usage Guidelines
You must specify a tunneling protocol using the protocol command in request dial-in VPDN subgroup configuration mode before issuing the domain command. Removing or changing the protocol command configuration removes any existing domain command configuration from the request dial-in VPDN subgroup.
You can configure a request dial-in VPDN subgroup to tunnel calls from multiple domain names by issuing multiple instances of the domain command.
VPDN groups can also be configured to tunnel users based on Dialed Number Identification Service
(DNIS) group names or DNIS numbers using the dnis command.
Examples
The following example configures VPDN group 1 to request a dial-in Layer 2 Tunnel Protocol (L2TP) tunnel to IP address 10.99.67.76 when it receives a PPP call from a username with the domain name cisco1.com, the domain name cisco2.com, or the DNIS number 4321:
Router(config)# vpdn-group 1
Router(config-vpdn)# request-dialin
Router(config-vpdn-req-in)# protocol l2tp
Router(config-vpdn-req-in)# domain cisco1.com
Router(config-vpdn-req-in)# domain cisco2.com
Router(config-vpdn-req-in)# dnis 4321
!
Router(config-vpdn)# initiate-to ip 10.99.67.76
VPD-26
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Related Commands Command dnis protocol (VPDN) request-dialin domain
Description
Specifies the DNIS group name or DNIS number of users that are to be forwarded to a tunnel server using VPDN.
Specifies the tunneling protocol that the VPDN subgroup will use.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-27
VPDN Commands encryption mppe
encryption mppe
To enable Microsoft Point-to-Point Encryption (MPPE) on an Industry-Standard Architecture (ISA) card, use the encryption mppe command in controller configuration mode. To disable MPPE, use the
no form of this command.
encryption mppe no encryption mppe
Syntax Description
This command has no arguments or keywords.
Command Default
IPSec is the default encryption type.
Command Modes
Controller configuration
Command History Release
12.0(5)XE5
12.1(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
Using the ISA card offloads MPPE from the Route Processor and will improve performance in large-scale environments.
The router must be rebooted for the change to the encryption mppe command configuration to take effect.
Examples
The following example enables MPPE encryption on the ISA card in slot 5, port 0:
Router(config)# controller isa 5/0
Router(config-controller)# encryption mppe
Related Commands Command Description debug ppp mppe
Displays debug messages for MPPE events.
encryption mppe show ppp mppe
Enables MPPE encryption on the virtual template.
Displays MPPE information for an interface.
VPD-28
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands force-local-chap
force-local-chap
To force the L2TP network server (LNS) to reauthenticate the client, use the force-local-chap command in VPDN group configuration mode. To disable reauthentication, use the no form of this command.
force-local-chap no force-local-chap
Syntax Description
This command has no arguments or keywords.
Defaults
Proxy authentication. The Challenge Handshake Authentication Protocol (CHAP) response to the Layer
2 Transport Protocol access concentrator (LAC) authentication challenge is passed to the LNS.
Command Modes
VPDN group configuration
Command History Release
11.3(5)AA
12.0(1)T
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
This command was modified to be available only if the accept-dialin VPDN group configuration mode is enabled.
Usage Guidelines
You must enable the accept-dialin command on the VPDN group before you can use the
force-local-chap command. Removing the accept-dialin command will remove the force-local-chap command from the VPDN group.
This command is used only if CHAP authentication is enabled for PPP (using the ppp authentication
chap command). This command forces the LNS to reauthenticate the client in addition to the proxy authentication that occurs at the LAC. If the force-local-chap command is used, then the authentication challenge occurs twice. The first challenge comes from the LAC and the second challenge comes from the LNS. Some PPP clients may experience problems with double authentication. If this problem occurs, authentication challenge failures may be seen if the debug ppp authentication command is enabled.
Examples
The following example enables CHAP authentication at the LNS: vpdn-group 1
accept dialin
protocol l2tp
virtual-template 1 terminate-from hostname router32
force-local-chap
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-29
VPDN Commands force-local-chap
Related Commands Command accept-dialin
Description
Configures an LNS to accept tunneled PPP connections from a LAC and create an accept dial-in VPDN subgroup.
lcp renegotiation
Allows the LNS to renegotiate the LCP on dial-in calls, using L2TP or L2F.
VPD-30
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands group session-limit
group session-limit
To limit the number of simultaneous virtual private dialup network (VPDN) sessions allowed across all
VPDN groups associated with a particular VPDN template, use the group session-limit command in
VPDN template configuration mode. To remove a configured session limit restriction, use the no form of this command.
group session-limit number
no group session-limit
Syntax Description
number
Maximum number of concurrent sessions allowed across all VPDN groups associated with a particular VPDN template. Valid values range from 1 to
32767.
Command Default
No session limit exists for the VPDN template.
Command Modes
VPDN template configuration
Command History Release
12.2(4)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use the group session-limit command to specify the maximum number of simultaneous sessions allowed across all VPDN groups associated with a VPDN template.
If you configure a session limit that is lower than the number of current active sessions, existing sessions will not be terminated. However, new sessions will not be established until the number of existing sessions falls below the configured session limit.
VPDN session limits can be configured globally using the vpdn session-limit command, at the level of a VPDN group using the session-limit (VPDN) command, or for all VPDN groups associated with a particular VPDN template using the group session-limit command.
The hierarchy for the application of VPDN session limits is as follows:
•
Globally configured session limits take precedence over session limits configured for a VPDN group or in a VPDN template. The total number of sessions on a router may not exceed a configured global session limit.
•
•
Session limits configured for a VPDN template are enforced for all VPDN groups associated with that VPDN template. The total number of sessions for all of the associated VPDN groups may not exceed the configured VPDN template session limit.
Session limits configured for a VPDN group are enforced for that VPDN group.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-31
group session-limit
Examples
VPDN Commands
The following example associates two VPDN groups with the VPDN template named cisco, and configures a session limit of 100 for all VPDN groups associated with the template: vpdn-group group1 source vpdn-template cisco
!
vpdn-group group2 source vpdn-template cisco
!
vpdn-template cisco group session-limit 100
Related Commands Command Description session-limit (VPDN)
Limits the number of simultaneous VPDN sessions allowed for a specified
VPDN group.
show vpdn session
Displays session information about active Layer 2 sessions for a VPDN.
source vpdn-template
Associates a VPDN group with a VPDN template.
vpdn session-limit vpdn-template
Limits the number of simultaneous VPDN sessions allowed on a router.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-32
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands initiate-to
initiate-to
To specify an IP address that will be used for Layer 2 tunneling, use the initiate-to command in VPDN group configuration mode. To remove an IP address from the virtual private dialup network (VPDN) group, use the no form of this command.
initiate-to ip ip-address [limit limit-number] [priority priority-number]
no initiate-to [ip ip-address]
Syntax Description
ip ip-address
limit limit-number
priority
priority-number
Specifies the IP address of the router that will be tunneled to.
(Optional) Specifies a limit to the number of connections that can be made to this IP address in the range from 0 to 32767.
(Optional) Specifies a priority for this IP address in the range from 1 to 32767.
1 is the highest priority.
Command Default
No IP address is specified.
Command Modes
VPDN group configuration
Command History Release
12.0(5)T
12.2(15)T
12.2(28)SB
Modification
This command was introduced.
This command was enhanced with the capability to configure multiple Layer 2
Tunneling Protocol (L2TP) network access servers (NASs) on an L2TP tunnel server within the same VPDN group.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Before you can use this command, you must enable one of the two request VPDN subgroups by using either the request-dialin or request-dialout command.
A NAS configured to request dial-in can be configured with multiple initiate-to commands to enable tunneling to more than one IP address.
A tunnel server configured to request dial-out can be configured with multiple initiate-to commands to enable tunneling to more than one IP address.
Examples
Release 12.4T
The following example configures a VPDN group for L2TP dial-out. This group can tunnel a maximum of five simultaneous users and has the second highest priority for requesting dial-out calls.
vpdn-group 1 request-dialout protocol l2tp pool-member 1
!
initiate-to ip 10.3.2.1 limit 5 priority
Cisco IOS VPDN Command Reference
VPD-33
initiate-to
VPDN Commands
The following example configures VPDN group 1 to request L2TP tunnels to the peers (NASs) at IP addresses 10.0.58.201 and 10.0.58.205. The two NASs configured by the initiate-to commands have differing priority values to provide failover redundancy.
vpdn-group 1 accept-dialin protocol l2tp virtual-template 1
!
request-dialout protocol l2tp pool-member 1
!
initiate-to ip 10.0.58.201 priority 1 initiate-to ip 10.0.58.205 priority 100 source-ip 10.0.58.211
In the previous example, you would configure load balancing among the NASs by setting the priority values in the initiate-to commands to the same values.
The following partial example shows how to set parameters to control how many times a tunnel server will retry connecting to a NAS, and the amount of time after which the NAS will declare itself down or busy so that the tunnel server will try connecting to the next NAS. (Note that the l2tp tunnel commands are optional and should be used only if it becomes necessary to change the default settings for these commands.)
.
.
.
!
vpdn enable vpdn search-order domain
!
.
.
vpdn-group 1
.
request-dialout protocol l2tp pool-member 1
!
initiate-to ip 10.0.58.201 priority 1 initiate-to ip 10.0.58.207 priority 50 initiate-to ip 10.0.58.205 priority 100 l2tp tunnel retransmit initial retries 5 l2tp tunnel retransmit initial timeout min 4 l2tp tunnel busy timeout 420
Related Commands Command l2tp tunnel busy timeout
Description
Configures the amount of time that the router will wait before attempting to recontact a router that was previously busy.
l2tp tunnel retransmit initial retries Sets the number of times that the router will attempt to send out the initial control packet for tunnel establishment before considering a router busy.
VPD-34
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Command l2tp tunnel retransmit initial timeout request-dialin request-dialout source-ip initiate-to
Description
Sets the minimum or maximum amount of time that the router will wait before resending an initial packet out to establish a tunnel.
Creates a request dial-in VPDN subgroup that configures a
NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode.
Specifies an alternate IP address for a VPDN tunnel that is different from the physical IP address used to open the tunnel.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-35
VPDN Commands interface virtual-template
interface virtual-template
To create a virtual template interface that can be configured and applied dynamically in creating virtual access interfaces, use the interface virtual-template command in global configuration mode.
interface virtual-template number
Syntax Description
number
Number used to identify the virtual template interface. Up to 200 virtual template interfaces can be configured.
Command Defaults
No virtual template interface is defined.
Command Modes
Global configuration
Command History Release
11.2F
12.2(4)T
12.2(28)SB
12.2(33)SR
Modification
This command was introduced.
This command was enhanced to increase the maximum number of virtual template interfaces from 25 to 200.
This command was integrated into Cisco IOS Release 12.2(28)SB.
This command was incorporated into Cisco IOS 12.2SR Release.
Usage Guidelines
A virtual template interface is used to provide the configuration for dynamically created virtual access interfaces. It is created by users and can be saved in NVRAM.
Once the virtual template interface is created, it can be configured in the same way as a serial interface.
Virtual template interfaces can be created and applied by various applications such as virtual profiles, virtual private dialup networks (VPDNs), PPP over ATM, protocol translation, and Multichassis
Multilink PPP (MMP).
Examples Virtual Template with PPP Authentication Example
The following example creates and configures virtual template interface 1: interface virtual-template 1 type ethernet
ip unnumbered ethernet 0
ppp multilink
ppp authentication chap
IPSec Virtual Template Example
The following example shows how to configure a virtual template for an IPsec virtual tunnel interface.
interface virtual-template1 type tunnel ip unnumbered Loopback1 tunnel mode ipsec ipv4 tunnel protection ipsec profile virtualtunnelinterface
VPD-36
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Related Commands Command tunnel protection virtual interface virtual template interface virtual-template
Description
Associates a tunnel interface with an IPsec profile.
Sets the zone name for the connected AppleTalk network.
Specifies the destination for a tunnel interface.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-37
VPDN Commands ip mtu adjust
ip mtu adjust
To enable automatic adjustment of the IP maximum transmission unit (MTU) on a virtual access interface, use the ip mtu adjust command in VPDN group or VPDN template configuration mode. To disable automatic adjustment of the IP MTU, use the no form of this command.
ip mtu adjust no ip mtu adjust
Syntax Description
This command has no arguments or keywords.
Command Default
Cisco IOS Release 12.2(3) and 12.2(4)T
Automatic adjustment of the IP MTU is enabled.
Cisco IOS Release 12.2(6) and 12.2(8)T and Later Releases
Automatic adjustment of the IP MTU is disabled.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(3)
12.2(4)T
12.2(6)
12.2(8)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(4)T.
The default setting for this command was changed from enabled to disabled.
The default setting for this command was changed from enabled to disabled.
Usage Guidelines
Enabling the ip mtu adjust command allows the router to automatically adjust the IP MTU on the virtual access interface associated with the specified virtual private dialup network (VPDN) group. The IP MTU is automatically adjusted to compensate for the size of the Layer 2 header and the MTU of the egress interface.
The IP MTU is adjusted automatically only if there is no IP MTU manually configured on the virtual template interface from which the virtual access interface is cloned. To manually configure an IP MTU on the virtual template interface, use the ip mtu command in interface configuration mode.
Examples
The following example enables automatic adjustment of the IP MTU for sessions associated with the
VPDN group named cisco1: vpdn-group cisco1 ip mtu adjust
VPD-38
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Related Commands Command ip mtu ip pmtu vpdn-group vpdn-template ip mtu adjust
Description
Sets the MTU size of IP packets sent on an interface.
Allows VPDN tunnels to participate in path MTU discovery.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-39
VPDN Commands ip pmtu
ip pmtu
To enable the discovery of the path maximum transmission unit (MTU) for Layer 2 traffic, use the ip
pmtu command in VPDN group, VPDN template, or pseudowire class configuration mode. To disable path MTU discovery, use the no form of this command.
ip pmtu no ip pmtu
Syntax Description
This command has no arguments or keywords.
Command Default
Path MTU discovery is disabled.
Command Modes
VPDN group configuration
VPDN template configuration
Pseudowire class configuration
Command History Release
12.2(4)T
12.2(11)T
12.0(23)S
12.3(2)T
12.2(25)S
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.0(23)S and support was added for using this command in pseudowire class configuration mode.
Support was added for using this command in pseudowire class configuration mode.
This command was integrated into Cisco IOS Release 12.2(25)S.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
When the ip pmtu command is enabled, the Don’t Fragment (DF) bit is copied from the inner IP header to the Layer 2 encapsulation header.
Enabling the ip pmtu command triggers Internet Control Message Protocol (ICMP) unreachable messages that indicate fragmentation errors in the IP backbone network carrying the tunneled traffic. If an IP packet is larger than the MTU of any interface it must pass through and the DF bit is set, the packet is dropped and an ICMP unreachable message is returned. The ICMP unreachable message indicates the
MTU of the interface that was unable to forward the packet without fragmentation. This information allows the source host to reduce the size of the packet before retransmission, allowing it to fit through that interface.
VPD-40
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands ip pmtu
Examples
Note
When path MTU discovery (PMTUD) is enabled, VPDN deployments are vulnerable to Denial of
Service (DoS) attacks that use crafted Internet Control Message Protocol (ICMP) “fragmentation needed and Don't Fragment (DF) bit set” (code 4) messages, also known as PMTUD attacks.
Crafted code 4 ICMP messages can be used to set the path MTU to an impractically low value. This will cause higher layer protocols to time out because of a very low throughput, even though the connection is still in the established state. This type of attack is classified as a throughput-reduction attack. When
PMTUD is enabled, it is highly recommended that you use the vpdn pmtu command to configure a range of acceptable values for the path MTU to block PMTUD attacks.
Enabling PMTUD will decrease switching performance.
When issued in VPDN group configuration mode, the ip pmtu command enables any tunnel associated with the specified virtual private dialup network (VPDN) group to participate in path MTU discovery.
When issued in VPDN template configuration mode, the ip pmtu command enables any tunnel associated with the specified VPDN template to participate in path MTU discovery.
When issued in pseudowire class configuration mode, the ip pmtu command enables any Layer 2 Tunnel
Protocol Version 3 (L2TPv3) session derived from the specified pseudowire class configuration to participate in path MTU discovery.
The following example configures a VPDN group named dial-in on a Layer 2 Tunnel Protocol (L2TP) tunnel server and uses the ip pmtu command to specify that tunnels associated with this VPDN group will participate in path MTU discovery. The vpdn pmtu command is used to configure the device to accept only path MTU values ranging from 576 to 1460 bytes. The device will ignore code 4 ICMP messages that specify a path MTU outside of this range.
Router(config)# vpdn-group dial-in
Router(config-vpdn)# request-dialin
Router(config-vpdn-acc-in)# protocol l2tp
Router(config-vpdn-acc-in)# virtual-template 1
!
Router(config-vpdn)# l2tp security crypto-profile l2tp
Router(config-vpdn)# no l2tp tunnel authentication
Router(config-vpdn)# lcp renegotiation on-mismatch
Router(config-vpdn)# ip pmtu
!
Router(config)# vpdn pmtu maximum 1460
Router(config)# vpdn pmtu minimum 576
The following example shows how to enable the discovery of the path MTU for pseudowires that are created from the pseudowire class named ether-pw. The vpdn pmtu command is used to configure the device to accept only path MTU values ranging from 576 to 1460 bytes. The device will ignore code 4
ICMP messages that specify a path MTU outside of this range.
Router(config)# pseudowire-class ether-pw
Router(config-pw)# ip pmtu
!
Router(config)# vpdn pmtu maximum 1460
Router(config)# vpdn pmtu minimum 576
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-41
ip pmtu
Related Commands Command ip dfbit set ip mtu ip mtu adjust pseudowire-class vpdn pmtu vpdn-group vpdn-template
VPDN Commands
Description
Enables the DF bit in the outer L2TPv3 tunnel header.
Sets the MTU size of IP packets sent on an interface.
Enables automatic adjustment of the IP MTU on a virtual access interface.
Specifies the name of an L2TP pseudowire class and enters pseudowire class configuration mode.
Manually configures a range of allowed path MTU sizes for an L2TP
VPDN.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-42
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands ip precedence (VPDN)
ip precedence (VPDN)
To set the precedence value in the virtual private dialup network (VPDN) Layer 2 encapsulation header, use the ip precedence command in VPDN group or VPDN template configuration mode. To remove a precedence value setting, use the no form of this command.
ip precedence {number | name}
no ip precedence {number | name}
Syntax Description
number | name A number or name that defines the setting for the precedence bits in the IP header. The values for the number argument and the corresponding name argument are listed in
, from least to most important.
Command Default
The IP precedence value of the Layer 2 encapsulation header is set to zero.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.1(1.1)
12.1(1.1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.1(1.1)T.
Usage Guidelines
lists the values for the number argument and the corresponding name argument for precedence values in the IP header. They are listed from least to most important.
Table 3 Number and Name Values for IP Precedence
Number
2
3
0
1
4
5
6
7
Name routine priority immediate flash flash-override critical internet network
You can set the precedence using either a number or the corresponding name. Once the IP Precedence bits are set, other quality of service (QoS) services such as weighted fair queueing (WFQ) and Weighted
Random Early Detection (WRED) then operate on the bit settings.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-43
VPDN Commands ip precedence (VPDN)
For further information on QoS services, refer to the Cisco IOS Quality of Service Solutions
Configuration Guide.
Examples
The following example sets the IP precedence to 5 (critical) for packets that traverse the VPDN tunnel associated with VPDN group 1: vpdn-group 1 ip precedence 5
Related Commands Command ip tos vpdn-group vpdn-template
Description
Sets the ToS bits in the VPDN Layer 2 encapsulation header.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-44
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands ip tos (VPDN)
ip tos (VPDN)
To set the type of service (ToS) bits in the virtual private dialup network (VPDN) Layer 2 encapsulation header, use the ip tos command in VPDN group or VPDN template configuration mode. To restore the default setting, use the no form of this command.
ip tos {tos-bit-value | max-reliability | max-throughput | min-delay | min-monetary-cost |
normal | reflect}
no set ip tos {tos-bit-value | max-reliability | max-throughput | min-delay | min-monetary-cost
| normal | reflect}
Syntax Description
tos-bit-value
max-reliability max-throughput min-delay min-monetary-cost normal reflect
A value (number) from 0 to 15 that sets the ToS bits in the IP header. See
for more information.
Sets the maximum reliability ToS bits to 2.
Sets the maximum throughput ToS bits to 4.
Sets the minimum delay ToS bits to 8.
Sets the minimum monetary cost ToS bits to 1.
Sets the normal ToS bits to 0. This is the default setting.
Copies the ToS value from the inner IP packet to the Layer 2 encapsulation header.
Command Default
The ToS bits are set to 0, which is equivalent to the normal keyword.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(5)T
12.1(1.1)
12.1(1.1)T
Modification
This command was introduced as l2tp ip tos reflect.
The l2tp ip tos reflect command was replaced by the ip tos command, configuration options were added, and support was added for other protocols.
This command was integrated into Cisco IOS Release 12.1(1.1)T.
Usage Guidelines
The ip tos command allows you to set four bits in the ToS portion of the Layer 2 encapsulation header.
The ToS bits can be set manually, or copied from the header of the inner IP packet by issuing the reflect keyword.
The ToS bits of the inner IP header can be set manually using the set ip tos (route-map) command. If you then configure the ip tos reflect command, the manually configured ToS setting of the inner IP header will be copied to the encapsulation header.
The reflect keyword functions only when the inner payload is IP. The encapsulated payload of Multilink
PPP (MLP) connections is not IP, therefore the reflect keyword has no effect when MLP is tunneled.
Cisco IOS VPDN Command Reference
Release 12.4T
VPD-45
ip tos (VPDN)
Examples
VPDN Commands
Table 4 shows the format of the four ToS bits in binary form.
Table 4 ToS Bits and Description
0
0
0
1
T3
0
0
0
1
0
T2
0
0
1
0
0
T1
0
1
0
0
0
T0
0
Description
0 normal forwarding
1 minimum monetary cost
2 maximum reliability
4 maximum throughput
8 minimum delay
The T3 bit sets the delay. Setting T3 to 0 equals normal delay, and setting it to 1 equals low delay.
The T2 bit sets the throughput. Setting this bit to 0 equals normal throughput, and setting it to 1 equals maximum throughput. Similarly, the T1 and T0 bits set reliability and monetary cost, respectively.
Therefore, as an example, if you want to set a packet with the following requirements: minimum delay T3 = 1 normal throughput T2 = 0 normal reliability T1 = 0 minimum monetary cost T0 = 1
You would set the ToS to 9, which is 1001 in binary format.
The following example configures a tunnel server to preserve the IP ToS settings of the encapsulated IP payload for a Layer 2 Tunnel Protocol (L2TP) dial-in sessions: vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname router12 local name router32 ip tos reflect
The following example sets the IP ToS bits to 8 (minimum delay as shown in
traverse the VPDN tunnel associated with VPDN group 1: vpdn-group 1 ip tos 8
Related Commands Command ip precedence set ip tos (route-map) vpdn-group vpdn-template
Description
Sets the precedence value (and an optional IP number or IP name) in the
VPDN Layer 2 encapsulation header.
Sets the ToS bits in the header of an IP packet.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-46
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2f ignore-mid-sequence
l2f ignore-mid-sequence
To configure the router to ignore multiplex ID (MID) sequence numbers for sessions in a Layer 2
Forwarding (L2F) tunnel, use the l2f ignore-mid-sequence command in VPDN group or VPDN template configuration mode. To remove the ability to ignore MID sequencing, use the no form of this command.
l2f ignore-mid-sequence no l2f ignore-mid-sequence
Syntax Description
This command has no arguments or keywords.
Command Default
MID sequence numbers are not ignored.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Usage Guidelines
This command applies only to L2F initiated tunnels and control packets for initial link control protocol
(LCP) tunnel negotiation.
This command is not required when both tunnel endpoints are Cisco equipment, and is required only if
MID sequence numbering is not supported by third-party hardware.
Examples
The following example configures the VPDN group named group1 to ignore MID sequencing for L2F sessions between a Cisco router and a non-Cisco hardware device that does not support MID sequencing: vpdn-group group1 l2f ignore-mid-sequence
Related Commands Command vpdn-group
Description
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-47
VPDN Commands l2f tunnel busy timeout
l2f tunnel busy timeout
To configure the amount of time that the router will wait before attempting to recontact a Layer 2
Forwarding (L2F) peer that was previously busy, use the l2f tunnel busy timeout command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2f tunnel busy timeout seconds
no l2f tunnel busy timeout
Syntax Description
seconds
Time, in seconds, to wait before checking for router availability. This value can range from 60 to 6000. The default value is 300.
Command Default
The router will wait 300 seconds before attempting to recontact a previously busy peer.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Examples
The following example configures the router to leave an L2F peer on the busy list for 90 seconds. This configuration affects only tunnels associated with the virtual private dialup network (VPDN) group named group1.
vpdn-group group1 l2f tunnel busy timeout 90
Related Commands Command Description l2f tunnel retransmit initial retries
Configures the number of times that the router will attempt to send the initial control packet for tunnel establishment before considering an
L2F peer busy.
l2f tunnel retransmit retries Configures the number of times the router will attempt to resend an
L2F tunnel control packet before tearing the tunnel down.
l2f tunnel timeout setup
Configures the amount of time that the router will wait for a confirmation message after sending out the initial L2F control packet before considering a peer busy.
VPD-48
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Command vpdn-group vpdn-template l2f tunnel busy timeout
Description
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-49
VPDN Commands l2f tunnel retransmit initial retries
l2f tunnel retransmit initial retries
To configure the number of times that the router will attempt to send the initial control packet for tunnel establishment before considering a Layer 2 Forwarding (L2F) peer busy, use the l2f tunnel retransmit
initial retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2f tunnel retransmit initial retries number
no l2f tunnel retransmit initial retries
Syntax Description
number
The number of retries that will be attempted, ranging from 1 to 1000. The default value is 2.
Command Default
The router will send the initial control packet twice.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
This command can be used only if load sharing is enabled.
Examples
The following example configures a dial-in VPDN group on a network access server (NAS) to load balance calls between two tunnel servers, and to attempt to send the initial L2F control packet five times: vpdn-group 1 request-dialin protocol l2f domain cisco.com
!
initiate-to ip 172.16.0.1 priority 1 initiate-to ip 172.16.1.1 priority 2 l2f tunnel retransmit initial retries 5
VPD-50
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2f tunnel retransmit initial retries
Related Commands Command Description
l2f tunnel busy timeout Configures the amount of time that the router will wait before attempting to recontact an L2F peer that was previously busy.
l2f tunnel retransmit retries l2f tunnel timeout setup
Configures the number of times the router will attempt to resend an L2F tunnel control packet before tearing the tunnel down.
Configures the amount of time that the router will wait for a confirmation message after sending out the initial L2F control packet before considering a peer busy.
vpdn-group vpdn-template
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-51
VPDN Commands l2f tunnel retransmit retries
l2f tunnel retransmit retries
To configure the number of times the router will attempt to resend a Layer 2 Forwarding (L2F) tunnel control packet before tearing the tunnel down, use the l2f tunnel retransmit retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2f tunnel retransmit retries number
no l2f tunnel retransmit retries
Syntax Description
number
The number of retries that will be attempted, ranging from 5 to 1000. The default value is 6.
Command Default
The router will resend control packets six times.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
This command does not affect the initial tunnel setup message or session control packets.
Examples
The following example configures the router to resend L2F tunnel control packets ten times before tearing the tunnel down. This configuration affects only tunnels associated with the virtual private dialup network (VPDN) group named group1.
vpdn-group group1 l2f tunnel retransmit retries 10
Related Commands Command Description
l2f tunnel busy timeout Configures the amount of time that the router will wait before attempting to recontact an L2F peer that was previously busy.
l2f tunnel retransmit initial retries
Configures the number of times that the router will attempt to send the initial control packet for tunnel establishment before considering an L2F peer busy.
VPD-52
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Command l2f tunnel timeout setup vpdn-group vpdn-template l2f tunnel retransmit retries
Description
Configures the amount of time that the router will wait for a confirmation message after sending out the initial L2F control packet before considering a peer busy.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-53
VPDN Commands l2f tunnel timeout setup
l2f tunnel timeout setup
To configure the amount of time that the router will wait for a confirmation message after sending out the initial Layer 2 Forwarding (L2F) control packet before considering a peer busy, use the l2f tunnel
timeout setup command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2f tunnel timeout setup seconds
no l2f tunnel timeout setup
Syntax Description
seconds
Time, in seconds, that the router will wait for a return message. This value can range from 5 to 6000. The default value is 10.
Command Default
The router will wait 10 seconds for a confirmation message.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
If the router has not received a confirmation message from the peer device before the tunnel timeout setup timer expires, the peer will be placed on the busy list.
Examples
The following example configures a router to wait 25 seconds for confirmation that the initial L2F control packet was received by the peer. This configuration will affect only tunnels associated with the virtual private dialup network (VPDN) group named group1.
vpdn-group group1 l2f tunnel timeout setup 25
Related Commands Command Description
l2f tunnel busy timeout Configures the amount of time that the router will wait before attempting to recontact an L2F peer that was previously busy.
l2f tunnel retransmit initial retries
Configures the number of times that the router will attempt to send the initial control packet for tunnel establishment before considering an L2F peer busy.
VPD-54
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2f tunnel timeout setup
Command l2f tunnel retransmit retries vpdn-group vpdn-template
Description
Configures the number of times the router will attempt to resend an L2F tunnel control packet before tearing the tunnel down.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-55
VPDN Commands l2tp attribute clid mask-method
l2tp attribute clid mask-method
To configure a network access server (NAS) to suppress Layer 2 Tunnel Protocol (L2TP) calling station
IDs for sessions associated with a virtual private dialup network (VPDN) group or VPDN template, use the l2tp attribute clid mask-method command in VPDN group or VPDN template configuration mode.
To disable L2TP calling station ID suppression, use the no form of this command.
l2tp attribute clid mask-method {right mask-character characters | remove} [match
match-string]
no l2tp attribute clid mask-method {right mask-character characters | remove} [match
match-string]
Syntax Description right
mask-character characters
remove
match match-string
Specifies that the calling station ID will be masked by replacing characters, starting from the right end of the string.
Character to be used as a replacement.
Number of characters to be replaced.
Specifies that the entire calling station ID will be removed.
(Optional) Applies the defined masking method only if the string specified by the match-string argument is contained in the username.
Command Default
The calling station ID is not masked or dropped.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.4(2)T
12.3(14)YM2
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(14)YM2 and implemented on the Cisco 7301, Cisco 7204VXR, and Cisco 7206VXR routers.
Usage Guidelines
The l2tp attribute clid mask-method command can be used to mask the calling station ID in L2TP attribute-value (AV) pair 22. This command is compatible with only local authorization. You can either substitute characters for a portion of the calling station ID, or remove the entire calling station ID.
Use the l2tp attribute clid mask-method command in VPDN group configuration mode to mask the calling station ID for calls belonging to that virtual private dialup network (VPDN) group.
Use the l2tp attribute clid mask-method command in VPDN template configuration mode to mask the calling station ID for calls belonging to any VPDN group associated with that VPDN template.
The vpdn l2tp attribute clid mask-method command masks the calling station ID globally for all
VPDN groups configured on the NAS, and is compatibe with both local and remote RADIUS AAA authorization.
VPD-56
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Examples l2tp attribute clid mask-method
The following example shows how to use the l2tp attribute clid mask-method command to remove the calling station ID during local authorization if the username contains the string #184. This configuration will apply only to calls belonging to the VPDN group named l2tp.
vpdn-group l2tp request-dialin protocol l2tp domain cisco.com
domain cisco.com#184
!
initiate-to ip 10.168.1.4
local name router32 l2tp tunnel password 0 cisco l2tp attribute clid mask-method remove match #184
Related Commands Command vpdn l2tp attribute clid mask-method vpdn-group vpdn-template
Description
Configures a NAS to suppress L2TP calling station IDs globally on the router.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-57
VPDN Commands l2tp drop out-of-order
l2tp drop out-of-order
To instruct a network access server (NAS) or tunnel server using Layer 2 Tunneling Protocol (L2TP) to drop packets that are received out of order, use the l2tp drop out-of-order command in VPDN group or
VPDN template configuration mode. To disable dropping of out-of-sequence packets, use the no form of this command.
l2tp drop out-of-order no l2tp drop out-of-order
Syntax Description
This command has no arguments or keywords.
Command Default
Out of order packets are not dropped.
Command Modes
VPDN group configuration
VPDN template configuraton
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Usage Guidelines
This command is valid only for tunnels where sequencing is enabled.
Examples
The following example enables sequencing and configures the router to drop any out-of-order packets that are received on a tunnel associated with the VPDN group named tunnelme: vpdn-group tunnelme l2tp sequencing l2tp drop out-of-order
Related Commands Command Description l2tp sequencing
Enables sequencing for packets sent over an L2TP tunnel.
vpdn-group
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
VPD-58
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp hidden
l2tp hidden
To enable Layer 2 Tunneling Protocol (L2TP) attribute-value (AV) pair hiding, which encrypts the value of sensitive AV pairs, use the l2tp hidden command in VPDN group or VPDN template configuration mode. To disable L2TP AV pair value hiding, use the no form of this command.
l2tp hidden
no l2tp hidden
Syntax Description
This command has no arguments or keywords.
Command Default
L2TP AV pair hiding is disabled.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Usage Guidelines
This command is not required if one-time Password Authentication Protocol (PAP) password authentication is used. This command is useful for additional security if PPP is using PAP or proxy authentication between the L2TP access concentrator (LAC) and Layer 2 Tunneling Protocol Network
Server (LNS). When AV pair hiding is enabled, the L2TP hiding algorithm is executed, and sensitive passwords that are used between the L2TP AV pairs are encrypted during PAP or proxy authentication.
In
in turn exchanges authentication requests with the LNS. Upon successful authentication between the
LAC and LNS, a tunnel is created. Proxy authentication is done by the LAC using either PAP or
Challenge Handshake Authentication Protocol (CHAP). Because PAP username and password information is exchanged between devices in clear-text, it is beneficial to use the l2tp hidden command where L2TP AV pair values are encrypted.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-59
VPDN Commands l2tp hidden
Figure 1
Client
LAC-LNS Proxy Authentication
LNS
Proxy authentication using PAP or CHAP
PAP = uses “clear text”
CHAP = uses MD5 algorithm
Examples
The following example encrypts the AV pair value exchanged between the endpoints of tunnels associated with the VPDN group named group1: vpdn-group group1 l2tp hidden
Related Commands Command vpdn-group
Description
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
VPD-60
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp ip udp checksum
l2tp ip udp checksum
To enable IP User Data Protocol (UDP) checksums on Layer 2 Tunneling Protocol (L2TP) data packets, use the l2tp ip udp checksum command in VPDN group or VPDN template configuration mode. To disable IP UDP checksums, use the no form of this command.
l2tp ip udp checksum
no l2tp ip udp checksum
Syntax Description
This command has no arguments or keywords.
Command Default
UDP checksums are not used on L2TP data packets.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Usage Guidelines
Enabling IP UDP checksums on data packets causes the switching path to revert to process-level switching, which results in slower performance. The drop in performance may be acceptable if the connection between the network access server (NAS) and the tunnel server is poor. Enabling IP UDP checksums will minimize delays that occur when the ultimate error correction is done end-to-end rather than at the tunnel endpoints.
Examples
The following example enables IP UDP checksums on L2TP data packets for tunnels associated with the virtual private dialup network (VPDN) group named group1: vpdn-group group1 l2tp ip udp checksum
Related Commands Command vpdn-group
Description
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-61
VPDN Commands l2tp security crypto-profile
l2tp security crypto-profile
To configure IP Security (IPSec) protection of Layer 2 Tunnel Protocol (L2TP) sessions associated with a virtual private dialup network (VPDN) group, use the l2tp security crypto-profile command in VPDN group or VPDN template configuration mode. To disable IPSec protection for a VPDN group, use the
no form of this command.
l2tp security crypto-profile profile-name [keep-sa]
no l2tp security crypto-profile
Syntax Description
profile-name
keep-sa
The name of the crypto profile to be used for IPSec protection of tunneled
PPP sessions.
(Optional) Controls the destruction of IPSec security associations (SAs) upon tunnel teardown. By default, any IPSec phase 2 SAs and Internet Key
Exchange (IKE) phase 1 SAs are destroyed when the L2TP tunnel is torn down. Issuing the keep-sa keyword prevents the destruction of IKE phase 1
SAs.
Command Default
IPSec security is disabled.
IKE phase 1 SAs are destroyed on tunnel teardown.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Enabling this command for a VPDN group ensures that no L2TP packets will be processed unless they have IPSec protection.
A crypto profile must be configured using the crypto map (global IPSec) command before it can be associated with a VPDN group using the l2tp security crypto-profile command. The profile-name argument must match the name of a profile configured using the crypto map command.
The keep-sa keyword can be used to prevent the destruction of IKE phase 1 SAs when the L2TP tunnel between the network access server (NAS) and tunnel server is considered permanent, and the IP addresses of the peer devices rarely change. This option is not useful with short-lived tunnels, such as those generated by client-initiated L2TP tunneling.
VPD-62
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Examples l2tp security crypto-profile
The following example configures VPDN group 1, associates it with the crypto profile named l2tp, and prevents the destruction of IKE phase 1 SAs on tunnel teardown: vpdn-group 1
request-dialin
protocol l2tp
domain cisco.com
initiate-to ip 10.0.0.13
local name LAC
l2tp security crypto-profile l2tp keep-sa
Related Commands Command crypto map (global
IPSec) vpdn-group vpdn-template
Description
Enters crypto map configuration mode and creates or modifies a crypto map entry, creates a crypto profile that provides a template for configuration of dynamically created crypto maps, or configures a client accounting list.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-63
VPDN Commands l2tp sequencing
l2tp sequencing
To enable sequencing for packets sent over a Layer 2 Tunnel Protocol (L2TP) tunnel, use the l2tp
sequencing command in VPDN group or VPDN template configuration mode. To disable sequencing, use the no form of this command.
l2tp sequencing no l2tp sequencing
Syntax Description
This command has no arguments or keywords.
Command Default
Sequencing is disabled by default. However, if the peer device requests sequencing, it will be enabled.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.1
Modification
This command was introduced.
Usage Guidelines
Use the l2tp sequencing command to control sequencing for packets sent over an L2TP tunnel.
The l2tp sequencing command configuration may be overridden by a request for sequencing from the peer device. The following sections describe the default behavior and sequencing request interactions of the two tunnel endpoints.
Tunnel Initiator
•
By default, sequence numbers are off.
•
By default, the Sequencing Required attribute-value (AV) pair will not be sent from the tunnel initiator to the tunnel terminator.
•
•
If the tunnel initiator receives data packets from the tunnel terminator that include sequencing numbers, the tunnel initiator will include sequence numbers on data packets regardless of the l2tp
sequencing command configuration.
Enabling the l2tp sequencing command will cause the tunnel initiator to send the Sequencing
Required AV pair to the tunnel terminator and to include sequencing numbers on data packets.
Tunnel Terminator
•
By default, sequence numbers are off.
•
•
If the tunnel terminator receives the Sequencing Required AV pair from the tunnel initiator, the tunnel terminator will include sequence numbers on data packets regardless of the l2tp sequencing command configuration.
Enabling the l2tp sequencing command will cause the tunnel terminator to include sequence numbers.
VPD-64
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Examples l2tp sequencing
The following example configures sequencing on a network access server (NAS) for dial-in L2TP tunnels associated with the VPDN group named tunnelme. The NAS will send the Sequencing Required
AV pair to the tunnel server, and sequencing will be enabled on both devices.
vpdn-group tunnelme request-dialin protocol l2tp domain cisco.com
!
local name router32 initiate to 172.16.1.1
l2tp sequencing
Related Commands Command Description l2tp drop out-of-order
Instructs a NAS or tunnel server using L2TP to drop packets that are received out of order.
vpdn-group vpdn-template
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-65
VPDN Commands l2tp tunnel authentication
l2tp tunnel authentication
To enable Layer 2 Tunneling Protocol (L2TP) tunnel authentication, use the l2tp tunnel authentication command in VPDN group or VPDN template configuration mode. To disable L2TP tunnel authentication, use the no form of this command.
l2tp tunnel authentication no l2tp tunnel authentication
Syntax Description
This command has no arguments or keywords.
Command Default
L2TP tunnel authentication is enabled.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Examples
The following example disables L2TP tunnel authentication for tunnels associated with the virtual private dialup network (VPDN) group named group1: vpdn-group group1 no l2tp tunnel authentication
The following example reenables L2TP tunnel authentication for tunnels associated with the VPDN group named group1: vpdn-group group1 l2tp tunnel authentication
Note
L2TP tunnel authentication is enabled by default, so there is no need to enable this command unless it was previously disabled.
Related Commands Command vpdn-group
Description
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
VPD-66
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel bearer capabilities
l2tp tunnel bearer capabilities
To set the Layer 2 Tunnel Protocol (L2TP) bearer-capability value used by the Cisco router, use the l2tp
tunnel bearer capabilities command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel bearer capabilities {none | digital | analog | all}
no l2tp tunnel bearer capabilities
Syntax Description none digital analog all
Specifies that no access types are supported. This is the default value if the
accept-dialout command is not configured.
Specifies that digital access is supported.
Specifies that analog access is supported.
Specifies that all access types are supported. This is the default value if the
accept-dialout command is configured.
Command Default
If the accept-dialout command is not configured, no access types are supported.
If the accept-dialout command is configured, all access types are supported.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(11)T
Modification
This command was introduced.
Usage Guidelines
By default, Cisco routers use a bearer-capability value of none. If the accept-dialout command is configured, Cisco routers use a bearer-capability value of all. To ensure compatibility with some non-Cisco routers, you may be required to override the default bearer-capability value by configuring the l2tp tunnel bearer capabilities command.
Examples
The following example configures the bearer-capability value to support only digital access for tunnels associated with the virtual private dialup network (VPDN) group named group1: vpdn-group group1 l2tp tunnel bearer capabilities digital
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-67
VPDN Commands l2tp tunnel bearer capabilities
Related Commands Command accept-dialout l2tp tunnel framing capabilities vpdn-group vpdn-template
Description
Accepts requests to tunnel L2TP dial-out calls and creates an accept-dialout
VPDN subgroup.
Sets the framing-capability value used by the Cisco router.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-68
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel busy timeout
l2tp tunnel busy timeout
To configure the amount of time that the router will wait before attempting to recontact a Layer 2
Transport Protocol (L2TP) peer that was previously busy, use the l2tp tunnel busy timeout command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel busy timeout seconds
no l2tp tunnel busy timeout
Syntax Description
seconds
Time, in seconds, to wait before checking for router availability. This value can range from 60 to 6000. The default value is 300.
Command Default
The router will wait 300 seconds before attempting to recontact a previously busy peer.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Examples
The following example configures tunnels associated with the virtual private dialup network (VPDN) group named group1 to leave an L2TP destination router on the busy list for 90 seconds: vpdn-group group1 l2tp tunnel busy timeout 90
Related Commands Command l2tp tunnel retransmit initial retries l2tp tunnel retransmit initial timeout vpdn-group vpdn-template
Description
Sets the number of times that the router will attempt to send out the initial control packet for tunnel establishment before considering a router busy.
Sets the amount of time that the router will wait before resending an initial packet out to establish a tunnel.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-69
VPDN Commands l2tp tunnel framing capabilities
l2tp tunnel framing capabilities
To set the Layer 2 Tunnel Protocol (L2TP) framing-capability value used by the Cisco router, use the
l2tp tunnel framing capabilities command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel framing capabilities {none | synchronous | asynchronous | all}
no l2tp tunnel framing capabilities
Syntax Description none synchronous asynchronous all
Specifies that no framing types are supported. This is the default value if the
accept-dialout command is not configured.
Specifies that synchronous framing is supported.
Specifies that asynchronous framing is supported.
Specifies that all framing types are supported. This is the default value if the
accept-dialout command is configured.
Command Default
If the accept-dialout command is not configured, no framing types are supported.
If the accept-dialout command is configured, all framing types are supported.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(11)T
Modification
This command was introduced.
Usage Guidelines
By default, Cisco routers use a framing-capability value of none. If the accept-dialout command is configured, Cisco routers use a framing-capability value of all. To ensure compatibility with some non-Cisco routers, you may be required to override the default framing-capability value by configuring the l2tp tunnel framing capabilities command.
Examples
The following example configures the framing-capability value to support only asynchronous framing for tunnels associated with the virtual private dialup network (VPDN) group named group1: vpnd-group group1 l2tp tunnel framing capabilities asynchronous
VPD-70
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Related Commands Command accept-dialout l2tp tunnel bearer capabilities vpdn-group vpdn-template l2tp tunnel framing capabilities
Description
Accepts requests to tunnel L2TP dial-out calls and creates an accept-dialout
VPDN subgroup.
Sets the bearer-capability value used by the Cisco router.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-71
VPDN Commands l2tp tunnel hello
l2tp tunnel hello
To set the number of seconds between sending hello keepalive packets for a Layer 2 Tunneling Protocol
(L2TP) tunnel, use the l2tp tunnel hello command in VPDN group or VPDN template configuration mode. To disable the sending of hello keepalive packets, use the no form of this command.
l2tp tunnel hello seconds
no l2tp tunnel hello
Syntax Description
seconds
The interval, in seconds, that the network access server (NAS) and tunnel server wait before sending the next L2TP tunnel keepalive packet. Valid values range from 0 to 1000. The default value is 60.
Command Default
Hello keepalive packets are sent every 60 seconds.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Usage Guidelines
To change the tunnel hello value, reenter the command with the new value.
The L2TP tunnel keepalive timers need not use the same value on both sides of the tunnel. For example, a NAS can use a keepalive value of 30 seconds, and a tunnel server can use the default value of
60 seconds.
Examples
The following example sets the L2TP tunnel hello value to 90 seconds for tunnels associated with the virtual private dialup network (VPDN) group named group1: vpdn-group group1 l2tp tunnel hello 90
Related Commands Command vpdn-group
Description
Creates a VPDN group and enters VPDN group configuration mode.
vpdn-template
Creates a VPDN template and enters VPDN template configuration mode.
VPD-72
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel password
l2tp tunnel password
To set the password that the router will use to authenticate Layer 2 Tunnel Protocol (L2TP) tunnels, use the l2tp tunnel password command in VPDN group or VPDN template configuration mode. To remove a previously configured password, use the no form of this command.
l2tp tunnel password password
no l2tp tunnel password
Syntax Description
password
String that the router uses for tunnel authentication.
Command Default
The password associated with the local name of the router is used to authenticate the tunnel.
If no local name password is configured, the password associated with the hostname of the router is used to authenticate the tunnel.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Usage Guidelines
The password defined with the l2tp tunnel password command is also used for attribute-value (AV) pair hiding.
The password hierarchy sequence that is used for tunnel identification, and subsequently tunnel authentication, is as follows:
•
An L2TP tunnel password is used if one is configured.
•
•
If no L2TP tunnel password exists, the password associated with the local name of the router is used.
If a local name password does not exist, the password associated with the hostname of the router is used.
The username command is used to define the passwords associated with the local name and the hostname.
Examples
The following example configures the L2TP tunnel password, secret, which will be used to authenticate tunnels associated with the virtual private dialup network (VPDN) group named group1: vpdn-group group1 l2tp tunnel password secret
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-73
VPDN Commands l2tp tunnel password
Related Commands Command hostname l2tp hidden local name username vpdn-group vpdn-template
Description
Specifies or modifies the hostname for the network server.
Enables L2TP AV pair hiding, which encrypts the value of sensitive AV pairs.
Specifies a local hostname that the tunnel will use to identify itself.
Establishes a username-based authentication system.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-74
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel receive-window
l2tp tunnel receive-window
To configure the number of packets allowed in the local receive window for a Layer 2 Tunnel Protocol
(L2TP) control channel, use the l2tp tunnel receive-window command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel receive-window packets
no l2tp tunnel receive-window packets
Syntax Description
packets
Number of packets allowed in the receive window. Valid values range from
1 to 5000. The default value varies by platform.
Command Default
The default size of the control channel receive window is platform-dependent.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(7)DC
12.1(1)
Modification
This command was introduced on the Cisco 6400 node route processor (NRP).
This command was integrated into Cisco IOS Release 12.1(1).
Usage Guidelines
Use the l2tp tunnel receive-window command to set the size of the advertised control channel receive window. The receive window size controls the number of L2TP control packets that can be queued by the system for processing. Increasing the size of the control channel receive window allows the system to open PPP sessions more quickly; a smaller size is desirable on networks that cannot handle large bursts of traffic.
Examples
Related Commands
The following example configures the receive window to hold up to 500 packets for tunnels associated with the virtual private dialup network (VPDN) group named group1: vpdn-group group1 l2tp tunnel receive-window 500
Command vpdn-group vpdn-template
Description
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-75
VPDN Commands l2tp tunnel retransmit initial retries
l2tp tunnel retransmit initial retries
To configure the number of times that the router will attempt to send out the initial Layer 2 Tunnel
Protocol (L2TP) control packet for tunnel establishment before considering a peer busy, use the l2tp
tunnel retransmit initial retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel retransmit initial retries number
no l2tp tunnel retransmit initial retries
Syntax Description
number
Number of retransmission attempts. Valid values range from 1 to 1000. The default value is 2.
Command Default
The router will resend the initial L2TP control packet twice.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use the l2tp tunnel retransmist initial retries command to configure the number of times a device will attempt to resend the initial control packet used to establish an L2TP tunnel.
Examples
The following example configures the router to attempt to send the initial L2TP control packet five times for tunnels associated with the virtual private dialup network (VPDN) group named group1: vpdn-group group1 l2tp tunnel retransmit initial retries 5
Related Commands Command l2tp tunnel busy timeout l2tp tunnel retransmit initial timeout l2tp tunnel retransmit retries
Description
Configures the amount of time that the router will wait before attempting to recontact a router that was previously busy.
Configures the amount of time that the router will wait before resending an initial L2TP control packet out to establish a tunnel.
Configures the number of retransmission attempts made for a L2TP control packet.
VPD-76
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel retransmit initial retries
Command l2tp tunnel retransmit timeout vpdn-group vpdn-template
Description
Configures the amount of time that the router will wait before resending an
L2TP control packet.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-77
VPDN Commands l2tp tunnel retransmit initial timeout
l2tp tunnel retransmit initial timeout
To configure the amount of time that the router will wait before resending an initial Layer 2 Tunnel
Protocol (L2TP) control packet out to establish a tunnel, use the l2tp tunnel retransmit initial timeout command in VPDN group or VPDN template configuration mode. To restore the default value, use the
no form of this command.
l2tp tunnel retransmit initial timeout {min | max} seconds
no l2tp tunnel retransmit initial timeout {min | max}
Syntax Description min max
seconds
Specifies the minimum time that the router will wait before resending an initial packet.
Specifies the maximum time that the router will wait before resending an initial packet.
Timeout length, in seconds, the router will wait before resending an initial packet.
Valid values range from 1 to 8. The default minimum value is 1. The default maximum value is 8.
Command Default
The minimum timeout is one second.
The maximum timeout is eight seconds.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5400, and Cisco AS5800 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
This command will take effect only when load balancing is enabled.
Control channel retransmissions follow an exponential backoff, starting at the minimum retransmit timeout length specified by the min seconds keyword and argument combination. After each packet that is not acknowledged, the timeout exponentially increases until it reaches the value specified by the max
seconds keyword and argument combination. For example, if the minimum timeout length is set to one second, the next retransmission attempt occurs two seconds later. The following attempt occurs four seconds later, and all additional attempts occur in eight second intervals.
VPD-78
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Examples l2tp tunnel retransmit initial timeout
The following example configures a network access server (NAS) virtual private dialup network (VPDN) group to establish L2TP tunnels that are load balanced across two tunnel servers. The NAS is configured to attempt to recontact a peer with an initial control packet five times before considering it busy. The timers are set so that the first attempt to recontact the peer will occur two seconds after the initial failure, and the final attempt will occur seven seconds after the previous failure.
vpdn-group 1 request-dialin protocol l2tp domain cisco.com
!
initiate-to ip 172.16.0.1 priority 1 initiate-to ip 172.16.1.1 priority 2 l2tp tunnel retransmit initial retries 5 l2tp tunnel retransmit initial timeout min 2 l2tp tunnel retransmit initial timeout max 7
Related Commands Command l2tp tunnel busy timeout l2tp tunnel retransmit initial retries l2tp tunnel retransmit retries l2tp tunnel retransmit timeout vpdn-group vpdn-template
Description
Configures the amount of time that the router will wait before attempting to recontact a router that was previously busy.
Configures the number of times that the router will attempt to send out the initial L2TP control packet for tunnel establishment before considering a peer busy.
Configures the number of retransmission attempts made for an L2TP control packet.
Configures the amount of time that the router will wait before resending an
L2TP control packet.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-79
VPDN Commands l2tp tunnel retransmit retries
l2tp tunnel retransmit retries
To configure the number of retransmission attempts made for a Layer 2 Tunnel Protocol (L2TP) control packet, use the l2tp tunnel retransmit retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel retransmit retries number
no l2tp tunnel retransmit retries number
Syntax Description
number
Number of retransmission attempts. Valid values range from 5 to 1000 retries. The default value is 10.
Command Default
The router will resend control packets ten times.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(7)DC
12.1(1)
Modification
This command was introduced on the Cisco 6400 node route processor (NRP).
This command was integrated into Cisco IOS Release 12.1(1).
Usage Guidelines
Use the l2tp tunnel retransmist retries command to configure the number of times a device will attempt to resend an L2TP control packet.
Examples
The following example tunnels associated with the virtual private dialup network (VPDN) group named group1 to make eight retransmission attempts: vpdn-group group1 l2tp tunnel retransmit retries 8
Related Commands Command l2tp tunnel busy timeout l2tp tunnel retransmit initial retries l2tp tunnel retransmit initial timeout l2tp tunnel retransmit timeout
Description
Configures the amount of time that the router will wait before attempting to recontact a router that was previously busy.
Configures the number of times that the router will attempt to send out the initial L2TP control packet for tunnel establishment before considering a peer busy.
Configures the amount of time that the router will wait before resending an initial L2TP control packet out to establish a tunnel.
Configures the amount of time that the router will wait before resending an
L2TP control packet.
VPD-80
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Command l2tp tunnel timeout no-session vpdn-group vpdn-template l2tp tunnel retransmit retries
Description
Sets the duration a router waits after an L2TP tunnel becomes empty before tearing down the tunnel.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-81
VPDN Commands l2tp tunnel retransmit timeout
l2tp tunnel retransmit timeout
To configure the amount of time that the router will wait before resending a Layer 2 Tunnel Protocol
(L2TP) control packet, use the l2tp tunnel retransmit timeout command in VPDN group or VPDN template configuration mode. To disable a parameter setting, use the no form of this command.
l2tp tunnel retransmit timeout {min | max} seconds
no l2tp tunnel retransmit timeout {min | max} seconds
Syntax Description min max
seconds
Specifies the minimum time that the router will wait before resending a control packet.
Specifies the maximum time that the router will wait before resending a control packet.
Timeout length, in seconds, the router will wait before resending a control packet. Valid values range from 1 to 8. The default minimum value is 1. The default maximum value is 8.
Command Default
The router will use the default timeout values specified in the “Syntax Description” section.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(7)DC
12.1(1)
Modification
This command was introduced on the Cisco 6400 node route processor (NRP).
This command was integrated into Cisco IOS Release 12.1(1).
Usage Guidelines
Control channel retransmissions follow an exponential backoff, starting at the minimum retransmit timeout length specified by the min seconds keyword and argument combination. After each packet that is not acknowledged, the timeout exponentially increases until it reaches the value specified by the max
seconds keyword and argument combination. For example, if the minimum timeout length is set to 1 second, the next retransmission attempt occurs 2 seconds later. The following attempt occurs 4 seconds later, and all additional attempts occur in 8-second intervals.
Examples
The following example configures the VPDN group named group1 to make 8 retransmission attempts, with the minimum timeout length set at 2 seconds, and the maximum timeout length set at 4 seconds: vpdn-group group1 l2tp tunnel retransmit retries 8 l2tp tunnel retransmit timeout min 2 l2tp tunnel retransmit timeout max 4
VPD-82
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel retransmit timeout
Related Commands Command l2tp tunnel busy timeout l2tp tunnel retransmit initial retries l2tp tunnel retransmit initial timeout l2tp tunnel retransmit retries l2tp tunnel timeout no-session vpdn-group vpdn-template
Description
Configures the amount of time that the router will wait before attempting to recontact a router that was previously busy.
Configures the number of times that the router will attempt to send out the initial L2TP control packet for tunnel establishment before considering a peer busy.
Configures the amount of time that the router will wait before resending an initial L2TP control packet out to establish a tunnel.
Configures the number of retransmission attempts made for an L2TP control packet.
Sets the duration a router waits after an L2TP tunnel becomes empty before tearing down the tunnel.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-83
VPDN Commands l2tp tunnel timeout no-session
l2tp tunnel timeout no-session
To configure the time a router waits after a Layer 2 Tunnel Protocol (L2TP) tunnel becomes empty before tearing down the tunnel, use the l2tp tunnel timeout no-session command in VPDN group or VPDN template configuration mode. To restore the default timeout value, use the no form of this command.
l2tp tunnel timeout no-session {seconds | never}
no l2tp tunnel timeout no-session
Syntax Description
seconds
never
Time, in seconds, the router waits before tearing down an empty L2TP tunnel. Valid values range from 0 to 86400. If the router is configured as a network access server
(NAS), the default is 15 seconds. If the router is configured as a tunnel server, the default is 10 seconds.
Specifies that the router will never tear down an empty L2TP tunnel.
Command Default
Empty tunnels will be torn down after the default timeout.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(8)T
12.2(11)T
Modification
This command was introduced.
Support was added for the never keyword.
Usage Guidelines
Use the l2tp tunnel timeout no-session command to configure the amount of time a device will wait before tearing down an empty tunnel. It may be desirable to leave an empty tunnel up beyond the default timeout value if you expect that a new session will be established imminently, or if you want to display statistics for a tunnel after all sessions have been terminated.
A router is considered a NAS if it has either a request-dialin or accept-dialout virtual private dialup network (VPDN) group configured.
A router is considered a tunnel server if it has either an accept-dialin or request-dialout VPDN group configured.
Examples
The following example configures the router to never tear down empty L2TP tunnels associated with the
VPDN group named group1: vpdn-group group1 l2tp tunnel timeout no-session never
VPD-84
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel timeout no-session
The following example returns the router to the default timeout duration for tearing down empty L2TP tunnels. This default value depends on whether the router is configured as a NAS or a tunnel server.
vpdn-group group1 no l2tp tunnel timeout no-session
Related Commands Command accept-dialin accept-dialout request-dialin request-dialout vpdn-group vpdn-template
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept dial-in
VPDN subgroup configuration mode.
Creates an accept dial-out VPDN subgroup that configures a NAS to accept requests from a tunnel server to tunnel L2TP dial-out calls, and enters accept dial-out VPDN subgroup configuration mode.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in
VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-85
VPDN Commands l2tp tunnel timeout setup
l2tp tunnel timeout setup
To configure the amount of time that the router will wait for a confirmation message after sending out the initial Layer 2 Tunnel Protocol (L2TP) control packet before considering a peer busy, use the l2tp
tunnel timeout setup command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel timeout setup seconds
no l2tp tunnel timeout setup seconds
Syntax Description
seconds
Time, in seconds, the router will wait for a return message. Valid values range from 60 to 6000 seconds. The default value is 10 seconds.
Command Default
The router will wait 10 seconds for a confirmation message from the peer device before considering it busy.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.1(1)
Modification
This command was introduced.
Usage Guidelines
If the router has not received a confirmation message from the peer device before the tunnel timeout setup timer expires, the peer will be placed on the busy list.
Examples
The following example configures a router to wait 25 seconds for confirmation that the initial L2TP control packet was received by the peer. This configuration will apply only to tunnels associated with the virtual private dialup network (VPDN) group named group1.
vpdn-group group1 l2tp tunnel timeout setup 25
Related Commands Command vpdn-group vpdn-template
Description
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-86
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands l2tp tunnel zlb delay
l2tp tunnel zlb delay
To configure the delay time before a zero length bit (ZLB) control message must be acknowledged, use the l2tp tunnel zlb delay command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
l2tp tunnel zlb delay seconds
no l2tp tunnel zlb delay seconds
Syntax Description
seconds
Maximum number of seconds the router will delay before acknowledging
ZLB control messages. Valid values for the seconds argument range from 1 to 5. The default value is 3.
Command Default
The router waits up to 3 seconds before acknowledging ZLB control messages.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(10)
12.2(11)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(11)T.
Usage Guidelines
Use the l2tp tunnel zlb delay command to change the maximum allowable delay in responding to ZLB messages in a virtual private dialup network (VPDN) deployment. Changing the delay time may be beneficial when the peer device at the other end of the control channel requires a faster response to ZLB messages. This situation can occur if the remote peer has short keepalive timers configured.
Examples
Related Commands
The following example configures control channels associated with the VPDN group named group1 to delay no more than 2 seconds before responding to a ZLB message: vpdn-group group1 l2tp tunnel zlb delay 2
Command vpdn-group vpdn-template
Description
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-87
VPDN Commands lcp renegotiation
lcp renegotiation
To allow the L2TP network server (LNS) to renegotiate the PPP Link Control Protocol (LCP) on dial-in calls, using Layer 2 Tunneling Protocol (L2TP) or Layer 2 Forwarding (L2F), use the lcp renegotiation command in virtual private dialup network (VPDN) group configuration mode. To remove LCP renegotiation, use the no form of this command.
lcp renegotiation {always | on-mismatch}
no lcp renegotiation
Syntax Description always
Always renegotiate LCP at the LNS.
on-mismatch
Renegotiate LCP at the LNS only in the event of an LCP mismatch between the LAC and LNS.
Defaults
LCP renegotiation is disabled on the LNS.
Command Modes
VPDN group configuration
Command History Release
11.3(5)AA
12.0(1)T
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
This command was modified to be available only if the accept-dialin VPDN subgroup is enabled.
Usage Guidelines
You must enable the accept-dialin command on the VPDN group before you can use the lcp
renegotiation command. Removing the accept-dialin command will remove the lcp renegotiation command from the VPDN group.
This command is valid only at the LNS. This command is useful for an LNS that tunnels to a non-Cisco
L2TP access concentrator (LAC), where the LAC may negotiate a different set of LCP options than what the LNS expects.
When a PPP session is started at the LAC, LCP parameters are negotiated, and a tunnel is initiated, the
LNS can either accept the LAC LCP negotiations or can request LCP renegotiation. Using the lcp
renegotiation always command forces renegotiation to occur at the LNS. If the lcp renegotiation
on-mismatch command is configured, then renegotiation will only occur if there is an LCP mismatch between the LNS and LAC.
Note
Older PC PPP clients may experience a “lock up” during PPP LCP renegotiation.
VPD-88
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands lcp renegotiation
Examples
The following example configures the LNS to renegotiate PPP LCP with a non-Cisco LAC: vpdn-group 1
accept dialin
protocol l2tp
virtual-template 1
terminate-from router32
lcp renegotiation on-mismatch
Related Commands Command accept-dialin
Description
Specifies the LNS to use for authenticating—and the virtual template to use for cloning—new virtual access interfaces when an incoming L2TP tunnel connection is requested from a specific peer.
force-local-chap
Forces the LNS to reauthenticate the client.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-89
VPDN Commands loadsharing
loadsharing
To configure endpoints for load sharing, use the loadsharing command in virtual private dialup network
(VPDN) group configuration mode. To remove this function, use the no form of this command.
loadsharing ip ip-address [limit session-limit]
no loadsharing ip ip-address [limit session-limit]
Syntax Description
ip ip-address IP address of the home gateway/L2TP network server (HGW/LNS) at the other end of the tunnel. This is the IP endpoint at the end of the tunnel, which is a HGW/LNS router.
limit session-limit (Optional) Limits sessions per load share. The limit has a range from 0 to 32,767 sessions. By default, no limit is set.
Defaults
No default is set, and this function is not used when not configured.
Command Modes
VPDN group configuration
Command History Release
12.0(4)XI
Modification
This command was introduced.
Usage Guidelines
Use the loadsharing VPDN group configuration command to configure endpoints for loadsharing.
Examples
In the following example, VPDN group customer1-vpdng is created. L2TP IP traffic load is shared between two HGW/LNS. The IP addresses for the HGW/LNS WAN ports are 172.21.9.67 and
172.21.9.68 (the home gateway is a Cisco IOS router terminating L2TP sessions). The characteristics for link 172.21.9.67 are defined by using the request dialin command. The characteristics for link
172.21.9.68 are defined by using the loadsharing command.
A backup home-gateway router is specified at 172.21.9.69 by using the backup command. This router serves as a backup device for two load-sharing HGW/LNS: vpdn-group customer1-vpdng
request dialin l2tp ip 172.21.9.67 domain cisco.com
loadsharing ip 172.21.9.68 limit 100
backup ip 172.21.9.69 priority 5
domain cisco2.com
Related Commands Command Description
request-dialin Configures an L2TP access concentrator to request L2F or L2TP tunnels to an LNS and create a request-dialin VPDN subgroup, and specifies a dial-in L2F or L2TP tunnel to a remote peer if a dial-in request is received for a specified domain or DNIS.
VPD-90
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands local name
local name
To specify a local hostname that the tunnel will use to identify itself, use the local name command in
VPDN group or VPDN template configuration mode. To remove the configured local hostname, use the
no form of this command.
local name host-name
no local name
Syntax Description
host-name
Local hostname of the tunnel.
Command Default
No local hostname is configured.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
11.3(5)AA
12.0(1)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(1)T.
Usage Guidelines
This command allows each virtual private dialup network (VPDN) group to use a unique local hostname.
The password hierarchy sequence that is used for tunnel identification and, subsequently, tunnel authentication, is as follows:
•
A Layer 2 Tunnel Protocol (L2TP) tunnel password is used first (defined by the l2tp tunnel
password command).
If no L2TP tunnel password exists, the password associated with the local name is used.
•
•
If no local name password exists, the password associated with the hostname is used.
The username command defines the passwords associated with the local name and the hostname.
Examples
The following example configures the local hostname Tunnel1 for the tunnels associated with the VPDN group named tunnelme: vpdn-group tunnelme local name Tunnel1
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-91
VPDN Commands local name
Related Commands Command Description l2tp tunnel password
Sets the password the router uses to authenticate the tunnel.
username vpdn-group vpdn-template
Establishes a username-based authentication system.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-92
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands multihop-hostname
multihop-hostname
To enable a tunnel switch to initiate a tunnel based on the hostname or tunnel ID associated with an ingress tunnel, use the multihop-hostname command in VPDN request-dialin subgroup configuration mode. To disable this option, use the no form of this command.
multihop-hostname ingress-tunnel-name
no multihop-hostname ingress-tunnel-name
Syntax Description
ingress-tunnel-name
Network access server (NAS) hostname or ingress tunnel ID.
Command Default
No multihop hostname is configured.
Command Modes
VPDN request-dialin subgroup configuration
Command History Release
12.1(1)DC1
12.2(13)T
Modification
This command was introduced on the Cisco 6400 node route processor (NRP).
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
Use the multihop-hostname command only on a device configured as a tunnel switch.
The ingress-tunnel-name argument must specify either the hostname of the device initiating the tunnel that is to be to be switched, or the tunnel ID of the ingress tunnel that is to be switched.
Removing the request-dialin subgroup configuration will remove the multihop-hostname configuration.
Examples
The following example configures a Layer 2 Tunnel Protocol (L2TP) virtual private dialup network
(VPDN) group on a tunnel switch to forward ingress sessions from the host named LAC-1 through an outgoing tunnel to IP address 10.3.3.3: vpdn-group 11
request-dialin
protocol l2tp
multihop-hostname LAC-1
initiate-to ip 10.3.3.3
local name tunnel-switch
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-93
VPDN Commands multihop-hostname
Related Commands Command dnis domain request-dialin vpdn multihop vpdn search order
Description
Configures a VPDN group to tunnel calls from the specified DNIS, and supports additional domain names for a specific VPDN group.
Requests that PPP calls from a specific domain name be tunneled, and supports additional domain names for a specific VPDN group.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Enables VPDN multihop.
Specifies how the NAS is to perform VPDN tunnel authorization searches.
VPD-94
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Release 12.4T
pool-member
pool-member
To assign a request-dialout virtual private dialup network (VPDN) subgroup to a dialer pool, use the
pool-member command in VPDN request-dialout configuration mode. To remove the request-dialout
VPDN subgroup from a dialer pool, use the no form of this command.
pool-member pool-number
no pool-member [pool-number]
Syntax Description
pool-number
Dialer pool to which this VPDN group belongs.
Defaults
Command Modes
VPDN request-dialout configuration
Command History
Command is disabled.
Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Before you can enable the pool-member command, you must first enable the protocol l2tp command on the request-dialout VPDN subgroup. Removing the protocol l2tp command will remove the
pool-member command from the request-dialout VPDN subgroup.
You can only configure one dialer profile pool (using the pool-member command) or dialer rotary group
(using the rotary-group command). If you attempt to configure a second dialer resource, you will replace the first dialer resource in the configuration.
Examples
The following example configures VPDN group 1 to request L2TP dial-out to IP address 172.16.4.6 using dialer profile pool 1 and identifying itself using the local name “user1.” vpdn-group 1
request-dialout
protocol l2tp
pool-member 1
initiate-to ip 172.16.4.6
local name user1
Related Commands Command initiate-to
Description
Specifies the IP address that will be tunneled to.
protocol (VPDN)
Specifies the Layer 2 tunneling protocol that the VPDN subgroup will use.
request-dialout
Enables an LNS to request VPDN dial-out calls by using L2TP.
rotary-group
Assigns a request-dialout VPDN subgroup to a dialer rotary group.
Cisco IOS VPDN Command Reference
VPD-95
VPDN Commands pptp flow-control receive-window
pptp flow-control receive-window
To specify how many packets the Point-to-Point Tunnel Protocol (PPTP) client can send before it must wait for acknowledgment from the tunnel server, use the pptp flow-control receive-window command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
pptp flow-control receive-window packets
no pptp flow-control receive-window
Syntax Description
packets
Number of packets the client can send before it has to wait for acknowledgment from the tunnel server. Valid values range from 1 to 64 packets. The default value is 16 packets.
Command Default
The PPTP client may send up to 16 packets before it must wait for acknowledgment.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(5)XE5
12.1(5)T
Modification
This command was introduced
This command was integrated into Cisco IOS Release 12.1(5)T.
Examples
The following example shows how to fine-tune PPTP by specifying that a client associated with the virtual private dialup network (VPDN) group named group1 can send 20 packets before it must wait for acknowledgment from the tunnel server: vpdn-group group1 accept-dialin protocol pptp virtual-template 1
!
pptp flow-control receive-window 20
Related Commands Command Description encryption mppe
Enables MPPE encryption on the virtual template.
pptp flow-control static-rtt Specifies the tunnel server’s timeout interval between sending a packet to the client and receiving a response.
pptp tunnel echo
Specifies the period of idle time on the tunnel that will trigger an echo message from the tunnel server to the client.
VPD-96
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Command vpdn-group vpdn-template pptp flow-control receive-window
Description
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-97
VPDN Commands pptp flow-control static-rtt
pptp flow-control static-rtt
To specify the timeout interval of the Point-to-Point Tunnel Protocol (PPTP) tunnel server between sending a packet to the client and receiving a response, use the pptp flow-control static-rtt command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
pptp flow-control static-rtt seconds
no pptp flow-control static-rtt
Syntax Description
seconds
Timeout interval, in milliseconds (ms), that the tunnel server will wait between sending a packet to the client and receiving a response. Valid values range from 100 to 5000. The default value is 1500.
Command Default
The tunnel server will wait 1500 ms for a response before timing out.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(5)XE5
12.1(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
If the session times out, the tunnel server does not retry or resend the packet. Instead the flow control alarm is set off, and stateful mode is automatically switched to stateless.
Examples
The following example shows how to fine-tune PPTP by increasing the timeout interval for tunnels associated with the virtual private dialup network (VPDN) group named group1 on the tunnel server to
2000 ms: vpdn-group group1 accept-dialin protocol pptp virtual-template 1
!
pptp flow-control static-rtt 2000
VPD-98
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands pptp flow-control static-rtt
Related Commands Command encryption mppe vpdn-template
Description
Enables MPPE encryption on the virtual template.
pptp flow-control receive-window Specifies how many packets the client can send before it must wait for the acknowledgment from the tunnel server.
pptp tunnel echo
Specifies the period of idle time on the tunnel that will trigger an echo message from the tunnel server to the client.
vpdn-group
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-99
VPDN Commands pptp tunnel echo
pptp tunnel echo
To specify the period of idle time on the Point-to-Point Tunnel Protocol (PPTP) tunnel that will trigger an echo message from the tunnel server to the client, use the pptp tunnel echo command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.
pptp tunnel echo seconds
no pptp tunnel echo
Syntax Description
seconds
Echo packet interval, in seconds. Valid values range from 0 to 1000. The default value is 60.
Command Default
The tunnel server will send an echo message after a 60-second idle interval.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.0(5)XE5
12.1(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
Use the pptp tunnel echo command to set the idle time that the tunnel server will wait before sending an echo message to the client.
If the tunnel server does not receive a reply to the echo message within 20 seconds, it will tear down the tunnel. This 20-second interval is hard coded.
Examples
The following example shows how to fine-tune PPTP on the tunnel server by increasing the idle time interval for the tunnels associated with the virtual private dialup network (VPDN) group named group1 to 90 seconds: vpdn-group group1 accept-dialin protocol pptp virtual-template 1
!
pptp tunnel echo 90
VPD-100
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands pptp tunnel echo
Related Commands Command encryption mppe pptp flow-control receive-window pptp flow-control static-rtt vpdn-group vpdn-template
Description
Enables MPPE encryption on the virtual template.
Specifies how many packets the client can send before it must wait for the acknowledgment from the tunnel server.
Specifies the timeout interval of the tunnel server between sending a packet to the client and receiving a response.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-101
VPDN Commands protocol (VPDN)
protocol (VPDN)
To specify the tunneling protocol that a virtual private dialup network (VPDN) subgroup will use, use the protocol command in VPDN subgroup configuration mode. To remove the protocol-specific configurations from a VPDN subgroup, use the no form of this command.
protocol {any | l2f | l2tp | pppoe | pptp}
no protocol
Syntax Description any l2f l2tp pppoe pptp
Specifies either the Layer 2 Forwarding (L2F) protocol or the Layer 2 Tunneling
Protocol (L2TP).
Specifies the L2F protocol.
Specifies L2TP.
Specifies the PPP over Ethernet (PPPoE) protocol.
Specifies the Point-to-Point Tunneling Protocol (PPTP).
Defaults
No protocol is specified.
Command Modes
VPDN subgroup
Command History Release
12.0(5)T
12.1(1)T
Modification
This command was introduced.
The pppoe keyword was added.
Usage Guidelines
This command is required for any VPDN subgroup configuration.
L2TP is the only protocol that can be used for dialout subgroup configurations.
Changing the protocol will remove all the commands from the VPDN subgroup configuration, and any protocol-specific commands from the VPDN group configuration.
Note
Users must first enter the vpdn enable command to set up the PPP over Ethernet discovery daemon.
Examples
The following example configures VPDN group 1 to accept dial-in calls using L2F and to request dial-out calls using L2TP: vpdn-group 1
accept-dialin
protocol l2f
virtual-template 1
request-dialout
protocol l2tp
VPD-102
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands protocol (VPDN)
pool-member 1
local name router1
terminate-from hostname router2
initiate-to ip 10.3.2.1
l2f ignore-mid-sequence
l2tp ip udp checksum
If you then use the no protocol command in request-dialout mode, the configuration will be changed to this: vpdn-group 1
accept-dialin
protocol l2f
virtual-template 1
request-dialout
local name router1
terminate-from hostname router2
l2f ignore-mid-sequence
Related Commands Command accept-dialin accept-dialout request-dialin request-dialout
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept dial-in VPDN subgroup configuration mode.
Creates an accept dial-out VPDN subgroup that configures a NAS to accept requests from a tunnel server to tunnel L2TP dial-out calls, and enters accept dial-out VPDN subgroup configuration mode.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in
VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-103
VPDN Commands redirect identifier
redirect identifier
To configure a virtual private dialup network (VPDN) redirect identifier to use for Layer 2 Tunneling
Protocol (L2TP) call redirection on a network access server (NAS), use the redirect identifier command in VPDN group or VPDN template configuration mode. To remove the name of the redirect identifier from the NAS, use the no form of this command.
redirect identifier identifier-name
no redirect identifier identifier-name
Syntax Description
identifier-name
Name of the redirect identifier to use for call redirection.
Command Default
No redirect identifier is configured.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(8)B
12.2(13)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
The redirect identifier command is used only on the NAS. To configure the name of the redirect identifier on the stack group tunnel server, use the vpdn redirect identifier command in global configuration mode.
The NAS compares the redirect identifier with the one received from the stack group tunnel server to determine authorization information to redirect the call.
Configuring the redirect identifier is not necessary to perform redirects. If the redirect identifier is not configured, the NAS uses the redirect IP address in order to get authorization information to redirect the call. In that case, the IP address of the new redirected tunnel server must be present in the initiate-to command configuration of the VPDN group on the NAS.
The redirect identifier allows new stack group members to be added without the need to update the NAS configuration with their IP addresses. With the redirect identifier configured, a new stack group member can be added and given the same redirect identifier as the rest of the stack group.
If the authorization information for getting to the new redirected tunnel server is different, then you will need to configure the authorization information via RADIUS using tagged attributes:
Cisco:Cisco-Avpair = :0:"vpdn:vpdn-redirect-id= identifier name "
The NAS will choose the correct tagged parameters to get authorization information for the new redirected tunnel server by first trying to match the redirect identifier (if present) or else by matching the
Tunnel-Server-Endpoint IP address.
VPD-104
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands redirect identifier
Examples
The following example configures the redirect identifier named lns1 on the NAS for the VPDN group named group1: vpdn-group group1 redirect identifier lns1
Related Commands Command clear vpdn redirect show vpdn redirect vpdn redirect
Description
Clears the L2TP redirect counters shown in the output from the show vpdn
redirect command.
Displays statistics for L2TP call redirects and forwards.
Enables L2TP redirect functionality.
vpdn redirect attempts Restricts the number of redirect attempts possible for an L2TP call on the
LAC.
vpdn redirect identifier
Configures a VPDN redirect identifier to use for L2TP call redirection on a stack group tunnel server.
vpdn redirect source
Configures the public redirect IP address of an LNS.
vpdn-group vpdn-template
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-105
VPDN Commands request-dialin
request-dialin
To create a request dial-in virtual private dialup network (VPDN) subgroup that configures a network access server (NAS) to request the establishment of a dial-in tunnel to a tunnel server, and to enter request dial-in VPDN subgroup configuration mode, use the request-dialin command in VPDN group configuration mode. To remove the request dial-in VPDN subgroup configuration from a VPDN group, use the no form of this command.
request-dialin
no request-dialin
Syntax Description
This command has no arguments or keywords.
Defaults
No request dial-in VPDN subgroups are configured.
Command Modes
VPDN group configuration
Command History Release
11.3(5)AA
12.0(5)T
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(5)T.
The original keywords and arguments were removed and made into separate
request-dialin subgroup commands.
Usage Guidelines
Use the request-dialin command on a NAS to configure a VPDN group to request the establishment of dial-in VPDN tunnels to a tunnel server.
For a VPDN group to request dial-in calls, you must also configure the following commands:
•
The initiate-to command in VPDN group configuration mode
•
The protocol command in request dial-in VPDN subgroup configuration mode
•
At least one dnis or domain command in request dial-in VPDN subgroup configuration mode
The NAS can also be configured to accept requests for Layer 2 Tunnel Protocol (L2TP) dial-out VPDN tunnels from the tunnel server using the accept-dialout command. Dial-in and dial-out calls can use the same L2TP tunnel.
VPD-106
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands request-dialin
Examples
The following example requests an L2TP dial-in tunnel to a remote peer at IP address 172.17.33.125 for a user in the domain named cisco.com:
Router(config)# vpdn-group 1
Router(config-vpdn)# request-dialin
Router(config-vpdn-req-in)# protocol l2tp
Router(config-vpdn-req-in)# domain cisco.com
!
Router(config-vpdn)# initiate-to ip 172.17.33.125
Related Commands Command accept-dialin
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept dial-in
VPDN subgroup configuration mode.
accept-dialout authen before-forward
Specifies that VPDN send the entire structured username to the AAA server the first time the router contacts the AAA server.
dnis
Specifies the DNIS group name or DNIS number of users that are to be forwarded to a tunnel server using VPDN.
domain
Creates an accept dial-out VPDN subgroup that configures a NAS to accept requests from a tunnel server to tunnel L2TP dial-out calls, and enters accept dial-out VPDN subgroup configuration mode.
initiate-to protocol (VPDN)
Specifies the domain name of users that are to be forwarded to a tunnel server using VPDN.
Specifies the IP address that calls are tunneled to.
Specifies the tunneling protocol that a VPDN subgroup will use.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-107
VPDN Commands request-dialout
request-dialout
To create a request dial-out virtual private dialup network (VPDN) subgroup that configures a tunnel server to request the establishment of dial-out Layer 2 Tunnel Protocol (L2TP) tunnels to a network access server (NAS), and to enter request dial-out VPDN subgroup configuration mode, use the
request-dialout command in VPDN group configuration mode. To remove the request dial-out VPDN subgroup configuration from a VPDN group, use the no form of this command.
request-dialout no request-dialout
Syntax Description
This command has no arguments or keywords.
Defaults
No request dial-out VPDN subgroups are configured.
Command Modes
VPDN group configuration
Command History Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Use the request-dialout command on a tunnel server to configure a VPDN group to request the establishment of dial-out VPDN tunnels to a NAS. L2TP is the only tunneling protocol that can be used for dial-out VPDN tunnels.
For a VPDN group to request dial-out calls, you must also configure the following commands:
•
•
•
The initiate-to command in VPDN group configuration mode
The protocol l2tp command in request dial-out VPDN subgroup configuration mode
Either the pool-member or rotary-group command in request dial-out VPDN subgroup configuration mode, depending on the type of dialer resource to be used by the VPDN subgroup
The dialer vpdn command in dialer interface configuration mode
•
If the dialer pool or dialer rotary group that the VPDN group is in contains physical interfaces, the physical interfaces will be used before the VPDN group configuration.
The tunnel server can also be configured to accept requests to establish dial-in VPDN tunnels from a
NAS using the accept-dialin command. Dial-in and dial-out calls can use the same L2TP tunnel.
Examples
The following example configures VPDN group 1 to request an L2TP tunnel to the peer at IP address
10.3.2.1 for tunneling dial-out calls from dialer pool 1:
Router(config)# vpdn-group 1
Router(config-vpdn)# request-dialout
Router(config-vpdn-req-ou)# protocol l2tp
Router(config-vpdn-req-ou)# pool-member 1
VPD-108
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands request-dialout
!
Router(config-vpdn)# initiate-to ip 10.3.2.1
!
Router(config)# interface Dialer2
Router(config-if)# ip address 172.16.2.3 255.255.128
Router(config-if)# encapsulation ppp
Router(config-if)# dialer remote-name dialer32
Router(config-if)# dialer string 5550100
Router(config-if)# dialer vpdn
Router(config-if)# dialer pool 1
Router(config-if)# dialer-group 1
Router(config-if)# ppp authentication chap
Related Commands Command accept-dialin accept-dialout dialer vpdn initiate-to pool-member protocol (VPDN) rotary-group
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept dial-in
VPDN subgroup configuration mode.
Creates an accept dial-out VPDN subgroup that configures a NAS to accept requests from a tunnel server to tunnel L2TP dial-out calls, and enters accept dial-out VPDN subgroup configuration mode.
Enables a dialer profile or DDR dialer to use L2TP dial-out.
Specifies the IP address that will be tunneled to.
Assigns a request-dialout VPDN subgroup to a dialer pool.
Specifies the tunneling protocol that a VPDN subgroup will use.
Assigns a request-dialout VPDN subgroup to a dialer rotary group.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-109
VPDN Commands resource-pool profile vpdn
resource-pool profile vpdn
To create a virtual private dialup network (VPDN) profile and to enter VPDN profile configuration mode, use the resource-pool profile vpdn command in global configuration mode. To disable this function, use the no form of this command.
resource-pool profile vpdn name
no resource-pool profile vpdn name
Syntax Description
name
VPDN profile name.
Defaults
No VPDN profiles are set up.
Command Modes
Global configuration
Command History Release
12.0(4)XI
12.0(5)T
Modification
This command was introduced.
Support for this command was integerated into Cisco IOS Release 12.0(5)T.
Usage Guidelines
Use the resource-pool profile vpdn command to create a VPDN profile and enter VPDN profile configuration mode, or to enter VPDN profile configuration mode for a VPDN profile that already exists.
VPDN groups can be associated with a VPDN profile using the vpdn group command in VPDN profile configuration mode. A VPDN profile will count VPDN sessions across all associated VPDN groups.
VPDN session limits for the VPDN groups associated with a VPDN profile can be configured in VPDN profile configuration mode using the limit base-size command.
Examples
The following example createss the VPDN groups named l2tp and l2f, and associates both VPDN groups with the VPDN profile named profile32:
Router(config)# vpdn-group l2tp
Router(config-vpdn)#
!
Router(config)# vpdn-group l2f
Router(config-vpdn)#
!
Router(config)# resource-pool profile vpdn profile32
Router(config-vpdn-profile)# vpdn group l2tp
Router(config-vpdn-profile)# vpdn group l2f
VPD-110
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands resource-pool profile vpdn
Related Commands Command limit base-size limit overflow-size vpdn group vpdn-group vpdn profile
Description
Defines the base number of simultaneous connections that can be done in a single customer or VPDN profile.
Defines the number of overflow calls granted to one customer or VPDN profile.
Associates a VPDN group with a customer or VPDN profile.
Creates a VPDN group and enters VPDN group configuration mode.
Associates a VPDN profile with a customer profile.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-111
VPDN Commands service vpdn group
service vpdn group
To provide virtual private dialup network (VPDN) service for the Subscriber Service Switch policy, use the service vpdn group command in subscriber profile configuration mode. To remove VPDN service, use the no form of this command.
service vpdn group vpdn-group-name
no service vpdn group vpdn-group-name
Syntax Description
vpdn-group-name
Provides the VPDN service by obtaining the configuration from a predefined
VPDN group.
Defaults
Command Modes
Subscriber profile configuration
Command History
This command is disabled by default.
Release
12.3(4)T
Modification
This command was introduced.
Usage Guidelines
The service vpdn group command provides VPDN service by obtaining the configuration from a predefined VPDN group for the SSS policy defined with the subscriber profile command.
Examples
The following example provides VPDN service to users in the domain cisco.com, and uses VPDN group 1 to obtain VPDN configuration information:
!
subscriber profile cisco.com
service vpdn group 1
The following example provides VPDN service to dialed number identification service (DNIS) 1234567, and uses VPDN group 1 to obtain VPDN configuration information:
!
subscriber profile dnis:1234567 service vpdn group 1
The following example provides VPDN service using a remote tunnel (used on the multihop node), and uses VPDN group 1 to obtain VPDN configuration information:
!
subscriber profile host:lac service vpdn group 1
VPD-112
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands service vpdn group
Related Commands Command service deny service local service relay
Description
Denies service for the SSS policy.
Enables local termination service for the SSS policy.
Enables relay of PAD messages over an L2TP tunnel.
subscriber profile Defines the SSS policy for searches of a subscriber profile database.
vpdn-group
Associates a VPDN group to a customer or VPDN profile.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-113
VPDN Commands session-limit (VPDN)
session-limit (VPDN)
To limit the number of simultaneous virtual private dialup network (VPDN) sessions allowed for a specified VPDN group, use the session-limit command in VPDN group configuration mode. To remove a configured session limit restriction, use the no form of this command.
session-limit number
no session-limit number
Syntax Description
number
The number of sessions allowed through a specified VPDN group. Valid values range from 0 to 32767.
Command Default
No session limit exists for a VPDN group.
Command Modes
VPDN group configuration
Command History Release
12.2(1)DX
12.2(2)DD
12.2(4)T
12.2(11)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(2)DD.
This command was integrated into Cisco IOS Release 12.2(4)T.
This command was implemented on the Cisco 1760, Cisco AS5300,
Cisco AS5350, Cisco AS5400, Cisco AS5800, and Cisco AS5850 platforms.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use this command to limit the number of allowed sessions for the specified VPDN group. If the
session-limit command is configured to 0, no sessions are allowed on the VPDN group.
You must configure the VPDN group as either an accept dial-in or request dial-out VPDN subgroup before you can issue the session-limit command.
The maximum number of VPDN sessions can be configured globally using the vpdn session-limit command, at the level of a VPDN group using the session-limit command, or for all VPDN groups associated with a particular VPDN template using the group session-limit command.
The hierarchy for the application of VPDN session limits is as follows:
•
Globally configured session limits take precedence over session limits configured for a VPDN group or in a VPDN template. The total number of sessions on a router may not exceed a configured global session limit.
•
Session limits configured for a VPDN template are enforced for all VPDN groups associated with that VPDN template. The total number of sessions for all of the associated VPDN groups may not exceed the configured VPDN template session limit.
•
Session limits configured for a VPDN group are enforced for that VPDN group.
VPD-114
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands session-limit (VPDN)
Examples
The following example configures an accept dial-in VPDN group named group1 and restricts the VPDN group to a maximum of three simulataneous sessions:
Router(config)# vpdn-group group1
Router(config-vpdn)# accept-dialin
Router(config-vpdn-acc-in)# protocol l2tp
Router(config-vpdn-acc-in)# virtual-template 5
Router(config-vpdn-acc-in)# exit
Router(config-vpdn)# terminate-from hostname host1
Router(config-vpdn)# session-limit 3
Related Commands Command accept-dialin group session-limit
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept dial-in
VPDN subgroup configuration mode.
Limits the number of simultaneous VPDN sessions allowed across all VPDN groups associated with a particular VPDN template.
request-dialout
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode.
show vpdn session
Displays session information about active Layer 2 sessions for a VPDN.
source vpdn-template Associates a VPDN group with a VPDN template.
vpdn session-limit vpdn-group vpdn-template
Limits the number of simultaneous VPDN sessions allowed on a router.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-115
VPDN Commands show interfaces virtual-access
show interfaces virtual-access
To display status, traffic data, and configuration information about a specified virtual access interface, use the show interfaces virtual-access command in privileged EXEC mode.
show interfaces virtual-access number [configuration]
Syntax Description
number
Number of the virtual access interface.
configuration
(Optional) Restricts output to configuration information.
Command Modes
Privileged EXEC
Command History Release
11.2F
11.3
12.3(7)T
Modification
This command was introduced.
The configuration keyword was added.
The output for this command was modified to indicate if the interface is a member of a multilink PPP bundle.
Usage Guidelines
To identify the number of the vty on which the virtual access interface was created, enter the show users
EXEC command.
The counts of output packet bytes as reported by the L2TP access server (LAC) to the RADIUS server in the accounting record do not match those of a client. The following paragraphs describe how the accounting is done and how you can determine the correct packet byte counts.
Packet counts for client packets in the input path are as follows:
•
•
•
For packets that are process-switched, virtual access input counters are incremented by the coalescing function by the PPP over Ethernet (PPPoE) payload length.
For packets that are fast-switched, virtual access input counters are incremented by the fast-switching function by the formula:
PPPoE payload length + PPP address&control bytes = = PPPoE payload length + 2
For packets that are Cisco Express Forwarding (CEF)-switched, virtual access input counters are incremented by the CEF switching function by the formula:
IP len + PPP encapbytes (4) = = PPPoE payload length + 2
Packet counts for client packets in the output path are as follows:
•
For packets that are process-switched by protocols other than PPP, virtual access output counters are incremented in the upper layer protocol by the entire datagram, as follows:
Size = PPPoE payload + PPPoE hdr (6) + Eth hdr (14) + SNAP hdr (10) + media hdr (4 for ATM)
•
For packets process-switched by PPP Link Control Protocol (LCP) and Network Control Protocol
(NCP), virtual access output counters are incremented by PPP, as follows:
PPP payload size + 4 bytes of PPP hdr
VPD-116
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show interfaces virtual-access
•
Accounting is done for PPPoE, PPPoA PTA and L2X as follows:
•
For PPPoE PPP Termination Aggregation (PTA), the PPPoE payload length is counted for all input and output packets.
•
For packets that are CEF fast-switched, virtual access counters are incremented by the PPPoE payload size.
•
For PPPoE L2X on a LAC, the PPPoE payload length is counted for all input packets. On an L2TP
Network Server (LNS), the payload plus the PPP header (address + control + type) are counted.
For PPP over ATM (PPPoA) PTA i/p packets, the payload plus the PPP address plus control bytes are counted. For PPPoA PTA o/p packets, the payload plus PPP address plus control plus ATM header are counted.
•
For PPPoA L2X on a LAC for i/p packets, the payload plus PPP addr plus cntl bytes are counted.
For PPPoA L2X on a LNS, the payload plus PPP header (address + control + type) are counted.
Examples
The following is sample output from the show interfaces virtual-access command:
Router# show interfaces virtual-access 3
Virtual-Access3 is up, line protocol is up
Hardware is Virtual Access interface
MTU 1500 bytes, BW 149760 Kbit, DLY 100000 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation PPP, LCP Open, multilink Open
Link is a member of Multilink bundle Virtual-Access4
PPPoATM vaccess, cloned from Virtual-Template1
Vaccess status 0x44
Bound to ATM4/0.10000 VCD:16, VPI:15, VCI:200, loopback not set
DTR is pulsed for 5 seconds on reset
Last input never, output never, output hang never
Last clearing of "show interface" counters 00:57:37
Input queue:0/75/0/0 (size/max/drops/flushes); Total output drops:0
Queueing strategy:fifo
Output queue:0/40 (size/max)
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
676 packets input, 12168 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
676 packets output, 10140 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 output buffer failures, 0 output buffers swapped out
0 carrier transitions
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-117
VPDN Commands show interfaces virtual-access
Table 5 describes the significant fields shown in the display.
Table 5 show interfaces virtual-access Field Descriptions
Field
Virtual-Access ... is {up | down | administratively down} line protocol is {up | down | administratively down}
Hardware is
Internet address | interface is unnumbered
MTU
BW
DLY reliability load
Encapsulation loopback keepalive
DTR
LCP open | closed | req sent
Description
Indicates whether the interface is currently active (whether carrier detect is present), is inactive, or has been taken down by an administrator.
Indicates whether the software processes that handle the line protocol consider the line to be usable (that is, whether keepalives are successful).
Type of interface. In this case, the interface is a dynamically created virtual access interface that exists on a vty line.
IP address or IP unnumbered for the line. If unnumbered, the output lists the interface and IP address to which the line is assigned (Ethernet0 at 10.0.21.14 in this example).
Maximum transmission unit for packets on the virtual access interface.
Bandwidth of the virtual access interface, in kbps.
Delay of the virtual access interface, in microseconds.
Reliability of the virtual access interface as a fraction of
255 (255/255 is 100 percent reliability), calculated as an exponential average over five minutes.
Load on the virtual access interface as a fraction of 255
(255/255 is completely saturated), calculated as an exponential average over five minutes. The calculation uses the value from the bandwidth interface configuration command.
Encapsulation method assigned to the virtual access interface.
Test in which signals are sent and then directed back toward the source at some point along the communication path. Used to test network interface usability.
Interval set for keepalive packets on the interface. If keepalives have not been enabled, the message is
“keepalive not set.”
Data terminal ready. An RS232-C circuit that is activated to let the DCE know when the DTE is ready to send and receive data.
Link Control Protocol (for PPP only; not for SLIP). LCP must come to the open state before any useful traffic can cross the link.
VPD-118
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Release 12.4T
show interfaces virtual-access
Table 5 show interfaces virtual-access Field Descriptions (continued)
Field
Open IPCP | IPXCP | ATCP
Last input output output hang
Last clearing
Input queue, drops
Queueing strategy
Output queue
Conversations
Reserved Conversations
Five minute input rate,
Five minute output rate
Description
IPCP is the IP control protocol for PPP, IPXCP is the IPX control protocol for PPP, and ATCP is the AppleTalk control protocol for PPP. The network control protocol
(NCP) is negotiated after the LCP opens. The NCP must come into the open state before useful traffic can cross the link.
Number of hours, minutes, and seconds since the last packet was successfully received by a virtual access interface. This value indicates when a dead interface failed.
Number of hours, minutes, and seconds since the last packet was successfully transmitted by a virtual access interface.
Number of hours, minutes, and seconds (or never) since the virtual access interface was last reset because of a transmission that took too long. When the number of hours in any of the “last” fields exceeds 24 hours, the number of days and hours is displayed. If that field overflows, asterisks are displayed.
Time at which the counters that measure cumulative statistics (such as number of bytes transmitted and received) were last reset to zero. Note that variables that might affect routing (for example, load and reliability) are not cleared when the counters are cleared.
Asterisks (***) indicate that the elapsed time is too large to be displayed.
Zeros (0:00:00) indicate that the counters were cleared more than 2
31 ms (and less than 2
32 ms) ago.
Number of packets in input queues. Each number is followed by a slash, the maximum size of the queue, and the number of packets dropped on account of a full queue.
Type of queueing selected to prioritize network traffic. The options are first-come-first-served (FCFS) queueing, weighted fair queueing, priority queueing, and custom queueing.
Number of packets in output queues. Each number is followed by a slash, the maximum size of the queue, and the number of packets dropped on account of a full queue.
Number of weighted fair queueing conversations.
Number of reserved weighted fair queueing conversations.
The example shows the number of allocated conversations divided by the number of maximum allocated conversations. In this case, there have been 0 reserved conversations.
Average number of bits and packets transmitted per second in the last five minutes.
Cisco IOS VPDN Command Reference
VPD-119
VPDN Commands show interfaces virtual-access
Table 5
Field
packets input bytes no buffer broadcasts runts giants input errors
CRC frame overrun ignored abort packets output bytes
show interfaces virtual-access Field Descriptions (continued)
Description
Total number of error-free packets received by the system.
Total number of bytes, including data and MAC encapsulation, in the error-free packets received by the system.
Number of received packets discarded because there was no buffer space in the main system. Compare with ignored count. Broadcast storms on Ethernets and bursts of noise on serial lines are often responsible for no-input-buffer events.
Total number of broadcast or multicast packets received by the virtual access interface.
Number of packets that are discarded because they are smaller than the medium’s minimum packet size.
Number of packets that are discarded because they exceed the medium’s maximum packet size.
Total number of no-buffer, runts, giants, cyclic redundancy checks (CRCs), frame, overrun, ignored, and abort counts.
Other input-related errors can also increment the count, so that this sum might not balance with the other counts.
Counter that reflects when the cyclic redundancy checksum generated by the originating LAN station or far-end device does not match the checksum calculated from data received. On a LAN, this often indicates noise or transmission problems on the LAN interface or the LAN bus. A high number of CRCs is usually the result of collisions or a station transmitting bad data. On a serial link, CRCs often indicate noise, gain hits, or other transmission problems on the data link.
Number of packets received incorrectly having a CRC error and a noninteger number of octets. On a serial line, this is usually the result of noise or other transmission problems.
Number of times the serial receiver hardware was unable to hand received data to a hardware buffer because the input rate exceeded the receiver’s ability to handle the data.
Number of received packets ignored by the virtual access interface because the interface hardware ran low on internal buffers. These buffers are different from the system buffers mentioned in the description of the no buffer field. Broadcast storms and bursts of noise can cause the “ignored” count to be incremented.
Illegal sequence of one bits on a virtual access interface.
This usually indicates a clocking problem between the virtual access interface and the data link equipment.
Total number of messages transmitted by the system.
Total number of bytes, including data and MAC encapsulation, transmitted by the system.
VPD-120
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show interfaces virtual-access
Table 5
Field
underruns output errors collisions interface resets
show interfaces virtual-access Field Descriptions (continued)
output buffer failures output buffers swapped out carrier transitions
Description
Number of times that the far-end transmitter has been running faster than the near-end communication server’s receiver can handle. Underruns may never be reported on some virtual access interfaces.
Sum of all errors that prevented the final transmission of datagrams out of the virtual access interface being examined. Note that this might not balance with the sum of the enumerated output errors, because some datagrams might have more than one error, and others might have errors that do not fall into any of the tabulated categories.
Number of packets colliding.
Number of times a virtual access interface has been completely reset. A reset can happen if packets queued for transmission were not sent within several seconds.
Resetting can be caused by a malfunctioning modem that is not supplying the transmit clock signal or by a cable problem. If the system notices that the carrier detect line of a virtual access interface is up, but the line protocol is down, it periodically resets the interface in an effort to restart it. Interface resets can also occur when a virtual access interface is looped back or shut down.
Number of outgoing packets dropped from the output buffer.
Number of times that the output buffer was swapped out.
Number of times that the carrier detect (CD) signal of a virtual access interface has changed state. Indicates modem or line problems if the CD line changes state often. If data carrier detect (DCD) goes down and comes up, the carrier transition counter increments two times.
Related Commands Command interface virtual-template
Description
Creates a virtual template interface that can be configured and applied dynamically in creating virtual access interfaces.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-121
VPDN Commands show ppp mppe
show ppp mppe
To display Microsoft Point-to-Point Encryption (MPPE) information for an interface, use the show ppp
mppe command in privileged EXEC mode.
show ppp mppe {serial | virtual-access} [number]
Syntax Description serial virtual-access
number
Displays MPPE information for all serial interfaces.
Displays MPPE information for all virtual-access interfaces.
(Optional) Specifies an interface number. Issuing the optional
number argument restricts the display to MPPE information for only the specified interface number.
Command Modes
Privileged EXEC
Command History Release
12.0(5)XE5
12.1(5)T
VPD-122
Cisco IOS VPDN Command Reference
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.1(5)T.
Usage Guidelines
None of the fields in the output from the show ppp mppe command are fatal errors. Excessive packet drops, misses, out of orders, or CCP-Resets indicate that packets are getting lost. If you see such activity and have stateful MPPE configured, you may want to consider switching to stateless mode.
Examples
The following example displays MPPE information for virtual-access interface 3:
Router# show ppp mppe virtual-access 3
Interface Virtual-Access3 (current connection)
Hardware (ISA5/1, flow_id=13) encryption, 40 bit encryption, Stateless mode
packets encrypted = 0 packets decrypted = 1
sent CCP resets = 0 receive CCP resets = 0
next tx coherency = 0 next rx coherency = 0
tx key changes = 0 rx key changes = 0
rx pkt dropped = 0 rx out of order pkt= 0
rx missed packets = 0
To update the key change information, reissue the show ppp mppe virtual-access 3 command:
Router# show ppp mppe virtual-access 3
Interface Virtual-Access3 (current connection)
Hardware (ISA5/1, flow_id=13) encryption, 40 bit encryption, Stateless mode
packets encrypted = 0 packets decrypted = 1
sent CCP resets = 0 receive CCP resets = 0
next tx coherency = 0 next rx coherency = 0
tx key changes = 0 rx key changes = 1
rx pkt dropped = 0 rx out of order pkt= 0
rx missed packets = 0
Release 12.4T
VPDN Commands show ppp mppe
describes the significant fields shown in the displays.
Table 6 show ppp mppe Field Descriptions
Field
packets encrypted packets decrypted sent CCP resets next tx coherency next rx coherency key changes rx pkt dropped rx out of order pkt
Description
Number of packets that have been encrypted.
Number of packets that have been decrypted.
Number of CCP-Resets sent. One CCP-Reset is sent for each packet loss that is detected in stateful mode. When using stateless MPPE, this field is always zero.
The coherency count (the sequence number) of the next packet to be encrypted.
The coherency count (the sequence number) of the next packet to be decrypted.
Number of times the session key has been reinitialized. In stateless mode, the key is reinitialized once per packet. In stateful mode, the key is reinitialized every 256 packets or when a CCP-Reset is received.
Number of packets received and dropped. A packet is dropped because it is suspected of being a duplicate or already received packet.
Number of packets received that are out of order.
Related Commands Command encryption mppe pptp flow-control static-rtt
Description
Enables MPPE encryption on the virtual template.
Specifies the timeout interval of the tunnel server between sending a packet to the client and receiving a response.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-123
VPDN Commands show resource-pool vpdn
show resource-pool vpdn
To display information about a specific virtual private dialup network (VPDN) group or specific VPDN profile, use the show resource-pool vpdn command in EXEC mode.
show resource-pool vpdn {group | profile} [name]
Syntax Description group profile
name
All the VPDN groups configured on the router.
All the VPDN profiles configured on the router.
(Optional) Specific VPDN group or profile.
Command Modes
EXEC
Command History Release
12.0(4)XI
Modification
This command was introduced.
Examples
Use the show resource-pool vpdn group command to display information about a specific VPDN group.
Example 1
This example displays specific information about the VPDN group named vpdng2:
Router# show resource-pool vpdn group vpdng2
VPDN Group vpdng2 found under Customer Profiles: customer2
Tunnel (L2TP)
-------- dnis:customer2-calledg cisco.com
Endpoint Session Limit Priority Active Sessions Status Reserved Sessions
-------- ------------- -------- --------------- ------ -----------------
172.21.9.97 * 1 0 OK
------------- --------------- -----------------
Total * 0 0
Example 2
The following example displays information about all the VPDN groups configured on the router:
Router# show resource-pool vpdn group
List of VPDN Groups under Customer Profiles
Customer Profile customer1: vpdng1
Customer Profile customer2: vpdng2
List of VPDN Groups under VPDN Profiles
VPDN Profile profile1: vpdng1
VPDN Profile profile2: vpdng2
VPD-124
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show resource-pool vpdn
describes the significant fields shown in the displays.
Table 7 show resource-pool vpdn group Field Descriptions
Field
Endpoint
Session Limit
Priority
Active Sessions
Status
Reserved Sessions
*
List of VPDN Groups under
Customer Profiles
List of VPDN Groups under
VPDN Profiles
Description
IP address of HGW/LNS router.
Number of sessions permitted for the designated endpoint.
Loadsharing HGW/LNSs are always marked with a priority of 1.
Number of active sessions on the network access server. These are sessions successfully established with endpoints (not reserved sessions).
Only two status types are possible: OK and busy.
Authorized sessions that are waiting to see if they can successfully connect to endpoints. Essentially, these sessions are queued calls. In most cases, reserved sessions become active sessions.
No limit is set.
A list of VPDN groups that are assigned to customer profiles. The customer profile name is listed first, followed by the name of the
VPDN group assigned to it.
A list of VPDN groups that are assigned to VPDN profiles. The
VPDN profile name is listed first, followed by the VPDN group assigned to it.
Example 3
The following example displays a list of all VPDN profiles configured on the router:
Router# show resource-pool vpdn profile
% List of VPDN Profiles: profile1 profile2 profile3
Example 4
The following example displays details about a specific VPDN profile named vpdnp1:
Router# show resource-pool vpdn profile vpdnp1
0 active connections
0 max number of simultaneous connections
0 calls rejected due to profile limits
0 calls rejected due to resource unavailable
0 overflow connections
0 overflow states entered
0 overflow connections rejected
3003 minutes since last clear command
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-125
VPDN Commands show resource-pool vpdn
Table 8 describes the significant fields shown in the displays.
Table 8 show resource-pool vpdn profile Field Descriptions
Field
List of VPDN Profiles
Active connections
Max number of simultaneous connections
Description
A list of the VPDN profiles that have been assigned.
Number of active VPDN connections counted by the VPDN profile.
Maximum number of VPDN simultaneous connections counted by the VPDN profile. This value helps you determine how many VPDN sessions to subscribe to a specific profile.
Calls rejected due to profile limits
Calls rejected due to resource unavailable
Overflow connections
Number of calls rejected since the last clear command because the profile limit has been exceeded.
Number of calls rejected since the last clear command because the assigned resource was unavailable.
Number of overflow connections used since the last clear command.
Number of overflow states entered since the last clear command.
Overflow states entered
Overflow connections rejected Number of overflow connections rejected since the last clear command.
Minutes since last clear command
Number of minutes elapsed since the last clear command was used.
Related Commands Command resource-pool profile customer resource-pool profile vpdn vpdn group vpdn-group
Description
Creates a customer profile and enters customer profile configuration mode.
Creates a VPDN profile and enters VPDN profile configuration mode.
Associates a VPDN group with a customer or VPDN profile.
Creates a VPDN group and enters VPDN group configuration mode.
VPD-126
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn
show vpdn
To display basic information about all active virtual private dialup network (VPDN) tunnels, use the
show vpdn command in user EXEC mode.
show vpdn
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC
Command History Release
11.2
12.1(1)T
12.1(2)T
Modification
This command was introduced.
This command was enhanced to display Point-to-Point Protocol over Ethernet
(PPPoE) information.
This command was enhanced to display PPPoE session information on actual
Ethernet interfaces.
Usage Guidelines
Use the show vpdn command to display information about all active tunnels using Layer 2 Tunnel
Protocol (L2TP), Layer 2 Forwarding (L2F), and Point-to-Point Tunnel Protocol (PPTP).
The output of the show vpdn session command also displays PPPoE session information. PPPoE is supported on ATM permanent virtual connections (PVCs) compliant with RFC 1483 only. PPPoE is not supported on Frame Relay and any other LAN interfaces such as FDDI and Token Ring.
Examples
The following is sample output from the show vpdn command on a device with active L2F and L2TP tunnels:
Router> show vpdn
Active L2F tunnels
NAS Name Gateway Name NAS CLID Gateway CLID State nas gateway 4 2 open
L2F MIDs
Name NAS Name Interface MID State [email protected] nas As7 1 open [email protected] nas As8 2 open
%No active PPTP tunnels
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-127
VPDN Commands show vpdn
The following is sample output from the show vpdn command on a device with an active PPPoE tunnels:
Router> show vpdn
%No active L2TP tunnels
%No active L2F tunnels
PPPoE Tunnel and Session Information Total tunnels 1 sessions 1
PPPoE Tunnel Information
Session count:1
PPPoE Session Information
SID RemMAC LocMAC Intf VASt OIntf VC
1 0010.7b01.2cd9 0090.ab13.bca8 Vi4 UP AT6/0 0/104
The following is sample output from the show vpdn command on a device with an active PPPoE session on an actual Ethernet interface:
Router> show vpdn
%No active L2TP tunnels
%No active L2F tunnels
PPPoE Tunnel and Session Information Total tunnels 1 sessions 1
PPPoE Tunnel Information
Session count:1
PPPoE Session Information
SID RemMAC LocMAC Intf VASt OIntf
1 0090.bf06.c870 00e0.1459.2521 Vi1 UP Eth1
Table 9 describes the significant fields shown in the displays.
Table 9 show vpdn Field Descriptions
Field
Active L2F tunnels
Description
NAS Name Hostname of the network access server (NAS), which is the remote termination point of the tunnel.
Gateway Name Hostname of the home gateway, which is the local termination point of the tunnel.
NAS CLID A number uniquely identifying the VPDN tunnel on the NAS.
Gateway CLID A number uniquely identifying the VPDN tunnel on the gateway.
State
L2F MIDs
Indicates whether the tunnel is open, opening, closing, or closed.
Name Username of the person from whom a protocol message was forwarded over the tunnel.
Hostname of the NAS.
NAS Name
Interface
MID
State
Interface from which the protocol message was sent.
A number uniquely identifying this user in this tunnel.
Indicates status for the individual user in the tunnel. The states are: opening, open, closed, closing, and waiting_for_tunnel.
The waiting_for_tunnel state means that the user connection is waiting until the main tunnel can be brought up before it moves to the opening state.
PPPoE Tunnel Information
VPD-128
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn
Table 9
Field
SID
RemMAC
LocMAC
Intf
VASt
OIntf
VC
show vpdn Field Descriptions (continued)
Description
Session ID for the PPPoE session.
Remote MAC address of the host.
Local MAC address of the router. It is the default MAC address of the router.
Virtual access interface associated with the PPP session.
Line protocol state of the virtual access interface.
Outgoing interface.
VC on which the PPPoE session is established.
Related Commands Command show vpdn domain show vpdn group show vpdn history failure show vpdn multilink show vpdn redirect show vpdn session show vpdn tunnel
Description
Displays all VPDN domains and DNIS groups configured on the NAS.
Displays a summary of the relationships among VPDN groups and customer/VPDN profiles, or summarizes the configuration of a VPDN group including DNIS/domain, load sharing information, and current session information.
Displays the content of the failure history table.
Displays the multilink sessions authorized for all VPDN groups.
Displays statistics for L2TP redirects and forwards.
Displays session information about active Layer 2 sessions for a VPDN.
Displays information about active Layer 2 tunnels for a VPDN.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-129
VPDN Commands show vpdn domain
show vpdn domain
To display all virtual private dialup network (VPDN) domains and DNIS groups configured on the network access server, use the show vpdn domain command in privileged EXEC mode.
show vpdn domain
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History Release
12.0(4)XI
Modification
This command was introduced.
Examples
Related Commands
The following is sample output from the show vpdn domain command:
Router# show vpdn domain
Tunnel VPDN Group
------ ---------dnis:cg2 vgdnis (L2F) domain:twu-ultra test (L2F)
describes the significant fields shown in the display.
Table 10 show vpdn domain Field Descriptions
Field
Tunnel
VPDN Group
Description
The assigned name of the tunnel endpoint.
The assigned name of the VPDN group using the tunnel.
Command dnis (VPDN) domain vpdn-group
Description
Specifies the DNIS group name or DNIS number of users that are to be forwarded to a tunnel server using a VPDN.
Specifies the domain name of users that are to be forwarded to a tunnel server using a VPDN.
Creates a VPDN group and enters VPDN group configuration mode.
VPD-130
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn group
show vpdn group
To display a summary of the relationships among virtual private dialup network (VPDN) groups and customer/VPDN profiles, or to summarize the configuration of a VPDN group including DNIS/domain, load sharing information, and current session information, use the show vpdn group command in EXEC mode.
show vpdn group [name] [domain | endpoint]
Syntax Description
name
domain endpoint
(Optional) VPDN group name summarizes the configuration of the specified group.
(Optional) DNIS/domain information.
(Optional) Endpoint session information.
Command Modes
EXEC
Command History Release
12.0(4)XI
12.2(8)T
Modification
This command was introduced.
The “resource-pool disabled” message was added to the command output.
Usage Guidelines
Use the show vpdn group command in EXEC mode to see a summary of the relationships among VPDN groups and customer/VPDN profiles, or to summarize the configuration of a VPDN group including domain/DNIS, load sharing information, and current session information. To summarize relationships among VPDN groups and customer/VPDN profiles, use the syntax show vpdn group name.
The following usage guidelines apply only to the Cisco AS5300, AS5400, and AS5800 access servers.
If the resource manager has been disabled by the resource-pool disable global configuration command, the show vpdn group command only displays a message stating that the resource-pool is disabled. If you enter the show vpdn group name command when the resource-pool disable command is enabled, the router will display the message stating that the resource-pool is disabled followed by a summary of active VPDN sessions.
Examples
Release 12.4T
The following is sample output from the show vpdn group command summarizing all VPDN group and profile relationships:
Router# show vpdn group
VPDN Group Customer Profile VPDN Profile
---------- ---------------- ------------
1 - -
2 - -
3 - -
lisun cp1 -
outgoing-2 - -
test - -
*vg1 cpdnis -
*vg2 cpdnis -
vgdnis +cp1 vp1
Cisco IOS VPDN Command Reference
VPD-131
VPDN Commands show vpdn group
vgnumber - -
vp1 - -
* VPDN group not configured
+ VPDN profile under Customer profile
Note
VPDN group is marked with “*” if it does not exist, but is used under customer/VPDN profile.
Note
Customer profiles are marked with “+” if the corresponding VPDN group is not directly configured under a customer profile. Instead, the corresponding VPDN profile is configured under the customer profile.
The following is sample output from the show vpdn group command for a VPDN group named vgdnis:
Router # show vpdn group vgdnis
Tunnel (L2TP)
-----dnis:cg1 dnis:cg2 dnis:jan cisco.com
Endpoint Session Limit Priority Active Sessions Status Reserved Sessions
-------- ------------- -------- --------------- ------ -----------------
172.21.9.67 * 1 0 OK -
--------------- ------------- --------------- -----------------
Total * 0 0
Note
Tunnel section lists all domain/DNIS (“dnis” appears before DNIS).
The session limit endpoint is the sum of the session limits of all endpoints and is marked with “*” if there is no limit (indicated by “*”) for any endpoint.
If the endpoint has no session limit, reserved sessions are marked with “-”.
The following is sample output from the show vpdn group command:
Router# show vpdn group
VPDN Group Customer Profile VPDN Profile
---------- ---------------- ------------ customer1-vpdng customer1 customer1-profile customer2-vpdng customer2 -
Router# show vpdn group customer1-vpdng
Tunnel (L2TP)
-------- cisco.com cisco1.com dnis:customer1-calledg
VPD-132
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn group
Endpoint Session Limit Priority Active Sessions Status Reserved Sessions
-------- ------------- -------- --------------- ------ -----------------
172.21.9.67 * 1 0 OK
172.21.9.68 100 1 0 OK
172.21.9.69 * 5 0 OK
------------- --------------- -----------------
Total * 0 0
The following is sample output from the show vpdn group command on a Cisco AS5300 access server when the resource-pool disable command is configured:
Router # show vpdn group
% Resource-pool disabled
The following is sample output from the show vpdn group vpdnis command on a Cisco AS5300 access server when the resource-pool disable command is configured. The summary of tunnel information is only displayed if there is an active VPDN session.
Router # show vpdn group vgdnis
% Resource-pool disabled
Tunnel (L2TP)
-----dnis:cg1 cisco.com
Endpoint Session Limit Priority Active Sessions Status Reserved Sessions
-------- ------------- -------- --------------- ------ -----------------
172.21.9.67 * 1 1 OK -
--------------- ------------- --------------- -----------------
Table 11 describes the significant fields shown in the displays.
Table 11
Field
VPDN Group
Customer Profile
VPDN Profile
Tunnel
Endpoint
Session Limit
Priority
Active Sessions
Status
show vpdn group Field Descriptions
Reserved Sessions
Description
The assigned name of the VPDN group using the tunnel.
The name of the assigned customer profile.
The name of the assigned VPDN profile.
The assigned name of the tunnel endpoint.
IP address of HGW/LNS router.
Number of sessions permitted for the designated endpoint.
Loadsharing HGW/LNSs are always marked with a priority of 1.
Number of active sessions on the network access server. These are sessions successfully established with endpoints (not reserved sessions).
Only two status types are possible: OK and busy.
Authorized sessions that are waiting to see if they can successfully connect to endpoints. Essentially, these sessions are queued calls. In most cases, reserved sessions become active sessions.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-133
VPDN Commands show vpdn group
Related Commands Command dnis (VPDN) domain resource-pool profile customer resource-pool profile vpdn vpdn group vpdn-group
Description
Specifies the DNIS group name or DNIS number of users that are to be forwarded to a tunnel server using a VPDN.
Specifies the domain name of users that are to be forwarded to a tunnel server using a VPDN.
Creates a customer profile and enters customer profile configuration mode.
Creates a VPDN profile and enters VPDN profile configuration mode.
Associates a VPDN group with a customer or VPDN profile.
Creates a VPDN group and enters VPDN group configuration mode.
VPD-134
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn history failure
show vpdn history failure
To display the content of the failure history table, use the show vpdn history failure command in EXEC mode.
show vpdn history failure [user-name]
Syntax Description
user-name (Optional) Username, which displays only the entries mapped to that particular user.
Command Modes
EXEC
Command History Release
11.3T
Modification
This command was introduced.
Usage Guidelines
If a username is specified, only the entries mapped to that username are displayed; when the username is not specified, the whole table is displayed.
Examples
Release 12.4T
The following is sample output from the show vpdn history failure command, which displays the failure history table for a specific user:
Router# show vpdn history failure
Table size: 20
Number of entries in table: 1
User: [email protected], MID = 1
NAS: isp, IP address = 172.21.9.25, CLID = 1
Gateway: hp-gw, IP address = 172.21.9.15, CLID = 1
Log time: 13:08:02, Error repeat count: 1
Failure type: The remote server closed this session
Failure reason: Administrative intervention
Table 12 describes the significant fields shown in the display.
Table 12
NAS
IP address
show vpdn history failure Field Descriptions
Field
Table size
Number of entries in table
User
MID
Description
Configurable VPDN history table size.
Number of entries currently in the history table.
Username for the entry displayed.
VPDN user session ID that correlates to the logged event. The MID is a unique ID per user session.
Network access server identity.
IP address of the network access server or home gateway (HGW).
Cisco IOS VPDN Command Reference
VPD-135
VPDN Commands show vpdn history failure
Related Commands
Table 12
Failure type
Failure reason
show vpdn history failure Field Descriptions (continued)
Field
CLID
Gateway
Log time
Error repeat count
Description
Tunnel endpoint for the network access server and HGW.
HGW end of the VPDN tunnel.
The event logged time.
Number of times a failure entry has been logged under a specific user. Only one log entry is allowed per user and is unique to its MID, with the older one being overwritten.
Description of failure.
Reason for failure.
Command clear vpdn history failure vpdn history failure
Description
Clears the content of the VPDN failure history table.
Enables logging of VPDN failures to the history failure table or to sets the failure history table size.
VPD-136
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn multilink
show vpdn multilink
To display the multilink sessions authorized for all virtual private dialup network (VPDN) groups, use the show vpdn multilink command in EXEC mode.
show vpdn multilink
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History Release
12.0(4)XI
Modification
This command was introduced.
Examples
Following is sample output comparing the show vpdn tunnel command with the show vpdn multilink command:
Router# show vpdn tunnel
L2F Tunnel and Session Information (Total tunnels=1 sessions=1)
NAS CLID HGW CLID NAS Name HGW Name State
24 10 centi3_nas twu253_hg open
172.21.9.46 172.21.9.67
CLID MID Username Intf State
10 1 [email protected] Se0:22 open
Router# show vpdn multilink
Multilink Bundle Name VPDN Group Active links Reserved links Bundle/Link Limit
--------------------- ---------- ------------ -------------- [email protected] vgdnis 1 0 */*
Table 13 describes the significant fields shown in the display.
Table 13 show vpdn multilink Field Descriptions
Field
NAS CLID
HGW CLID
NAS Name
HGW Name
State
CLID
MID
Description
Network access server Caller Line Identification number (CLID).
Home gateway (HGW) Caller Line Identification number (CLID).
Name assigned to the NAS.
Name assigned to the HGW.
Operational state of the designated piece of equipment.
Calling Line Identification number.
Modem Identification.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-137
VPDN Commands show vpdn multilink
Related Commands
Table 13 show vpdn multilink Field Descriptions (continued)
Field
Username
Intf
State
Multilink Bundle Name
VPDN Group
Active Links
Reserved Links
Bundle/Link limit
Description
Assigned user name.
Type of interface.
Operational state of the designated piece of equipment.
Name of the multilink bundle.
Name of the VPDN group.
Number of active links.
Number of reserved links.
Limit of bundles or links available.
Command multilink
Description
Limits the total number MLP sessions for all VPDN multilink users.
VPD-138
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn redirect
show vpdn redirect
To display statistics for Layer 2 Tunneling Protocol (L2TP) redirects and forwards, use the show vpdn
redirect command in privileged EXEC mode.
show vpdn redirect
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History Release
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Statistics about the number of L2TP forwards and redirects that were done by the router as an L2TP network access server (NAS) or L2TP tunnel server are displayed when you enter the show vpdn
redirect command. To clear the redirect counters, use the clear vpdn redirect command.
Examples
The following example displays statistics for redirects and forwards for a router configured as an L2TP
NAS:
Router# show vpdn redirect vpdn redirection enabled sessions redirected as access concentrator: 2 sessions redirected as network server: 0 sessions forwarded: 2
Table 14 describes the significant fields shown in the display.
Table 14 show vpdn redirect Field Descriptions
Field Description
vpdn redirection enabled Verifies that L2TP redirect is enabled.
sessions redirected as access concentrator
Displays the number of sessions that the router has redirected when configured as a NAS.
sessions redirected as network server Displays the number of sessions that the router has redirected when configured as a tunnel server.
sessions forwarded Displays the total number of sessions that have been forwarded.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-139
VPDN Commands show vpdn redirect
Related Commands Command clear vpdn redirect
Description
Clears the L2TP redirect counters shown in the output from the show vpdn
redirect command.
Enables L2TP redirect functionality.
vpdn redirect
vpdn redirect attempts Restricts the number of redirect attempts possible for an L2TP call on the
NAS.
vpdn redirect identifier
Configures a VPDN redirect identifier to use for L2TP call redirection on a stack group tunnel server.
vpdn redirect source
Configures the public redirect IP address of an L2TP stack group tunnel server.
VPD-140
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn session
show vpdn session
To display session information about active Layer 2 sessions for a virtual private dialup network
(VPDN), use the show vpdn session command in privileged EXEC mode.
show vpdn session [l2f | l2tp | pptp] [all [filter] | packets [filter] | sequence [filter] | state [filter]]
Syntax Description l2f l2tp pptp all
filter
packets sequence state
(Optional) Displays information about Layer 2 Forwarding (L2F) calls only.
(Optional) Displays information about Layer 2 Tunnel Protocol (L2TP) calls only.
(Optional) Displays information about Point-to-Point Tunnel Protocol (PPTP) calls only.
(Optional) Displays extensive reports about active sessions.
(Optional) One of the filter parameters defined in
(Optional) Displays information about packet and byte counts for sessions.
(Optional) Displays sequence information for sessions.
(Optional) Displays state information for sessions.
Command Modes
Privileged EXEC
Command History Release
11.2
12.1(1)T
12.1(2)T
12.2(13)T
12.3(2)T
Modification
This command was introduced.
This command was enhanced to display Point-to-Point Protocol over Ethernet (PPPoE) session information. Support was added for the packets and all keywords.
This command was enhanced to display PPPoE session information on actual Ethernet interfaces.
Reports from this command were enhanced with a unique identifier that can be used to correlate a particular session with the session information retrieved from other show commands or debug command traces.
Support was added for the l2f, l2tp, and pptp keywords.
Usage Guidelines
Use the show vpdn session command to display information about all active sessions using L2TP, L2F, and PPTP.
The output of the show vpdn session command displays PPPoE session information as well. PPPoE is supported on ATM permanent virtual connections (PVCs) compliant with RFC 1483 only. PPPoE is not supported on Frame Relay and any other LAN interfaces such as FDDI and Token Ring.
Reports and options for this command depend upon the configuration in which it is used. Use the command-line question mark (?) help function to display options available with the show vpdn session command.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-141
show vpdn session
Examples
VPDN Commands
defines the filter parameters available to refine the output of the show vpdn session command.
You may use any one of the filter parameters in place of the filter argument.
Table 15 Filter Parameters for the show vpdn session Command
Syntax
interface serial number
tunnel remote-name remote-name
local-name
Description
Filters the output to display only information for sessions associated with the specified serial interface.
•
•
number—The serial interface number.
interface virtual-template number Filters the output to display only information for sessions associated with the specified virtual template.
number—The virtual template number.
tunnel id tunnel-id session-id Filters the output to display only information for sessions associated with the specified tunnel ID and session ID.
•
tunnel-id—The local tunnel ID. Valid values range from 1 to 65535.
•
•
session-id—The local session ID. Valid values range from
1 to 65535.
Filters the output to display only information for sessions associated with the tunnel with the specified names.
remote-name—The remote tunnel name.
username username
•
local-name—The local tunnel name.
Filters the output to display only information for sessions associated with the specified username.
•
username—The username.
The show vpdn session command provides reports on call activity for all active sessions. The following output is from a device carrying active L2TP, L2F, and PPPoE sessions:
Router# show vpdn session
L2TP Session Information Total tunnels 1 sessions 4
LocID RemID TunID Intf Username State Last Chg Uniq ID
4 691 13695 Se0/0 [email protected] est 00:06:00 4
5 692 13695 SSS Circuit [email protected] est 00:01:43 8
6 693 13695 SSS Circuit [email protected] est 00:01:43 9
3 690 13695 SSS Circuit [email protected] est 2d21h 3
L2F Session Information Total tunnels 1 sessions 2
CLID MID Username Intf State Uniq ID
1 2 [email protected] SSS Circuit open 10
1 3 [email protected] SSS Circuit open 11
%No active PPTP tunnels
PPPoE Session Information Total tunnels 1 sessions 7
VPD-142
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn session
PPPoE Session Information
UID SID RemMAC OIntf Intf Session
LocMAC VASt state
3 1 0030.949b.b4a0 Fa2/0 N/A CNCT_FWDED
0010.7b90.0840
6 2 0030.949b.b4a0 Fa2/0 Vi1.1 CNCT_PTA
0010.7b90.0840 UP
7 3 0030.949b.b4a0 Fa2/0 Vi1.2 CNCT_PTA
0010.7b90.0840 UP
8 4 0030.949b.b4a0 Fa2/0 N/A CNCT_FWDED
0010.7b90.0840
9 5 0030.949b.b4a0 Fa2/0 N/A CNCT_FWDED
0010.7b90.0840
10 6 0030.949b.b4a0 Fa2/0 N/A CNCT_FWDED
0010.7b90.0840
11 7 0030.949b.b4a0 Fa2/0 N/A CNCT_FWDED
0010.7b90.0840
Table 16 describes the significant fields in the show vpdn session display.
Table 16 show vpdn session Field Descriptions
Field
LocID
RemID
TunID
Intf
Username
State
Last Chg
Uniq ID (Unique ID:)
CLID
MID
UID
SID
RemMAC
Description
Local identifier.
Remote identifier.
Tunnel identifier.
Interface associated with the session.
User domain name.
Status for the individual user in the tunnel; can be one of the following states:
•
•
•
•
•
•
est opening open closing closed waiting_for_tunnel
The waiting_for_tunnel state means that the user connection is waiting until the main tunnel can be brought up before it moves to the opening state.
Time interval (in hh:mm:ss) since last change occurred.
The unique identifier used to correlate this particular session with the sessions retrieved from other show commands or debug command traces.
A number uniquely identifying the session.
A number uniquely identifying this user in this tunnel.
PPPoE user ID.
PPPoE session ID.
Remote Media Access Control (MAC) address of the host.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-143
VPDN Commands show vpdn session
Table 16 show vpdn session Field Descriptions (continued)
Field
LocMAC
OIntf
Intf VASt
Session state
Description
Local MAC address of the router. It is the default MAC address of the router.
Outgoing interface.
Virtual access interface number and state.
PPPoE session state.
The show vpdn session packets command provides reports on call activity for all the currently active sessions. The following output is from a device carrying an active PPPoE session:
Router# show vpdn session packets
%No active L2TP tunnels
%No active L2F tunnels
PPPoE Session Information Total tunnels 1 sessions 1
PPPoE Session Information
SID Pkts-In Pkts-Out Bytes-In Bytes-Out
1 202333 202337 2832652 2832716
describes the significant fields shown in the show vpdn session packets command display.
Table 17
Field
SID
Pkts-In
Pkts-Out
Bytes-In
Bytes-Out
show vpdn session packets Field Descriptions
Description
Session ID for the PPPoE session.
Number of packets coming into this session.
Number of packets going out of this session.
Number of bytes coming into this session.
Number of bytes going out of this session.
The show vpdn session all command provides extensive reports on call activity for all the currently active sessions. The following output is from a device carrying active L2TP, L2F, and PPPoE sessions:
Router# show vpdn session all
L2TP Session Information Total tunnels 1 sessions 4
Session id 5 is up, tunnel id 13695
Call serial number is 3355500002
Remote tunnel name is User03
Internet address is 10.0.0.63
Session state is established, time since change 00:03:53
52 Packets sent, 52 received
2080 Bytes sent, 1316 received
Last clearing of "show vpdn" counters never
Session MTU is 1464 bytes
Session username is [email protected]
Interface
Remote session id is 692, remote tunnel id 58582
UDP checksums are disabled
SSS switching enabled
No FS cached header information available
VPD-144
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Release 12.4T
show vpdn session
Sequencing is off
Unique ID is 8
Session id 6 is up, tunnel id 13695
Call serial number is 3355500003
Remote tunnel name is User03
Internet address is 10.0.0.63
Session state is established, time since change 00:04:22
52 Packets sent, 52 received
2080 Bytes sent, 1316 received
Last clearing of "show vpdn" counters never
Session MTU is 1464 bytes
Session username is [email protected]
Interface
Remote session id is 693, remote tunnel id 58582
UDP checksums are disabled
SSS switching enabled
No FS cached header information available
Sequencing is off
Unique ID is 9
Session id 3 is up, tunnel id 13695
Call serial number is 3355500000
Remote tunnel name is User03
Internet address is 10.0.0.63
Session state is established, time since change 2d21h
48693 Packets sent, 48692 received
1947720 Bytes sent, 1314568 received
Last clearing of "show vpdn" counters never
Session MTU is 1464 bytes
Session username is [email protected]
Interface
Remote session id is 690, remote tunnel id 58582
UDP checksums are disabled
SSS switching enabled
No FS cached header information available
Sequencing is off
Unique ID is 3
Session id 4 is up, tunnel id 13695
Call serial number is 3355500001
Remote tunnel name is User03
Internet address is 10.0.0.63
Session state is established, time since change 00:08:40
109 Packets sent, 3 received
1756 Bytes sent, 54 received
Last clearing of "show vpdn" counters never
Session MTU is 1464 bytes
Session username is [email protected]
Interface Se0/0
Remote session id is 691, remote tunnel id 58582
UDP checksums are disabled
IDB switching enabled
FS cached header information:
encap size = 36 bytes
4500001C BDDC0000 FF11E977 0A00003E
0A00003F 06A506A5 00080000 0202E4D6
02B30000
Sequencing is off
Unique ID is 4
L2F Session Information Total tunnels 1 sessions 2
MID: 2
User: [email protected]
Cisco IOS VPDN Command Reference
VPD-145
VPDN Commands show vpdn session
Interface:
State: open
Packets out: 53
Bytes out: 2264
Packets in: 51
Bytes in: 1274
Unique ID: 10
Last clearing of "show vpdn" counters never
MID: 3
User: [email protected]
Interface:
State: open
Packets out: 53
Bytes out: 2264
Packets in: 51
Bytes in: 1274
Unique ID: 11
Last clearing of "show vpdn" counters never
%No active PPTP tunnels
PPPoE Session Information Total tunnels 1 sessions 7
PPPoE Session Information
SID Pkts-In Pkts-Out Bytes-In Bytes-Out
1 48696 48696 681765 1314657
2 71 73 1019 1043
3 71 73 1019 1043
4 61 62 879 1567
5 61 62 879 1567
6 55 55 791 1363
7 55 55 795 1363
The significant fields shown in the show vpdn session all command display are similar to those defined in
Related Commands Command show sss session show vpdn show vpdn domain show vpdn group show vpdn history failure show vpdn multilink show vpdn redirect show vpdn tunnel
Description
Displays Subscriber Service Switch session status.
Displays basic information about all active VPDN tunnels.
Displays all VPDN domains and DNIS groups configured on the NAS.
Displays a summary of the relationships among VPDN groups and customer/VPDN profiles, or summarizes the configuration of a VPDN group including DNIS/domain, load sharing information, and current session information.
Displays the content of the failure history table.
Displays the multilink sessions authorized for all VPDN groups.
Displays statistics for L2TP redirects and forwards.
Displays information about active Layer 2 tunnels for a VPDN.
VPD-146
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vpdn tunnel
show vpdn tunnel
To display information about active Layer 2 tunnels for a virtual private dialup network (VPDN), use the
show vpdn tunnel command in privileged EXEC mode.
show vpdn tunnel [l2f | l2tp | pptp] [all [filter] | packets [filter] | state [filter] | summary [filter] |
transport [filter]]
Syntax Description l2f l2tp pptp all
filter
packets state summary transport
(Optional) Specifies that only information about Layer 2 Forwarding (L2F) tunnels will be displayed.
(Optional) Specifies that only information about Layer 2 Tunnel Protocol (L2TP) tunnels will be displayed.
(Optional) Specifies that only information about Point-to-Point Tunnel Protocol
(PPTP) tunnels will be displayed.
(Optional) Displays summary information about all active tunnels.
(Optional) One of the filter parameters defined in Table 18
.
(Optional) Displays packet numbers and packet byte information.
(Optional) Displays state information for a tunnel.
(Optional) Displays a summary of tunnel information.
(Optional) Displays tunnel transport information.
Command Modes
Privileged EXEC
Command History Release
11.2
12.1(1)T
12.3(2)T
12.2(28)SB
Modification
This command was introduced.
Support was added for the packets and all keywords.
Support was added for the l2f, l2tp, and pptp keywords.
This command was integrated into Cisco IOS Release 12.2(28)SB and support was added for L2TP congestion avoidance statistics.
Usage Guidelines
Use the show vpdn tunnel command to display detailed information about L2TP, L2F, and PPTP VPDN tunnels.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-147
show vpdn tunnel
Examples
VPDN Commands
defines the filter parameters available to refine the output of the show vpdn tunnel command.
You may use any one of the filter parameters in place of the filter argument.
Table 18 Filter Parameters for the show vpdn tunnel Command
Syntax
id local-id
local-name local-name
remote-name
remote-name remote-name
local-name
Description
Filters the output to display only information for the tunnel with the specified local ID.
•
•
local-id—The local tunnel ID number. Valid values range from 1 to 65535.
Filters the output to display only information for the tunnel associated with the specified names.
local-name—The local tunnel name.
•
remote-name—The remote tunnel name.
Filters the output to display only information for the tunnel associated with the specified names.
•
•
remote-name—The remote tunnel name.
local-name—The local tunnel name.
The following is sample output from the show vpdn tunnel command for L2F and L2TP sessions:
Router# show vpdn tunnel
L2TP Tunnel Information (Total tunnels=1 sessions=1)
LocID RemID Remote Name State Remote Address Port Sessions
2 10 router1 est 172.21.9.13 1701 1
L2F Tunnel
NAS CLID HGW CLID NAS Name HGW Name State
9 1 nas1 HGW1 open
172.21.9.4 172.21.9.232
%No active PPTP tunnels
describes the significant fields shown in the display.
Table 19 show vpdn tunnel Field Descriptions
Field
LocID
RemID
Remote Name
Description
Local tunnel identifier.
Remote tunnel identifier.
Hostname of the remote peer.
VPD-148
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Release 12.4T
show vpdn tunnel
Table 19 show vpdn tunnel Field Descriptions (continued)
Field
State
Remote address
Port
Sessions
NAS CLID
HGW CLID
NAS Name
HGW Name
Description
Status for the individual user in the tunnel; can be one of the following states:
•
•
•
•
est opening open closing
•
•
closed waiting_for_tunnel
The waiting_for_tunnel state means that the user connection is waiting until the main tunnel can be brought up before it moves to the opening state.
IP address of the remote peer.
Port ID.
Number of sessions using the tunnel.
A number uniquely identifying the VPDN tunnel on the network access server
(NAS).
A number uniquely identifying the VPDN tunnel on the gateway.
Hostname and IP address of the NAS.
Hostname and IP address of the home gateway.
The following example shows L2TP tunnel activity, including information about the L2TP congestion avoidance:
Router# show vpdn tunnel l2tp all
L2TP Tunnel Information Total tunnels 1 sessions 1
Tunnel id 30597 is up, remote id is 45078, 1 active sessions
Tunnel state is established, time since change 00:08:27
Tunnel transport is UDP (17)
Remote tunnel name is LAC1
Internet Address 172.18.184.230, port 1701
Local tunnel name is LNS1
Internet Address 172.18.184.231, port 1701
Tunnel domain unknown
VPDN group for tunnel is 1
L2TP class for tunnel is
4 packets sent, 3 received
194 bytes sent, 42 received
Last clearing of "show vpdn" counters never
Control Ns 2, Nr 4
Local RWS 500, Remote RWS 500
Control channel Congestion Control is enabled
Congestion Window size, Cwnd 3
Slow Start threshold, Ssthresh 500
Mode of operation is Slow Start
Tunnel PMTU checking disabled
Retransmission time 1, max 2 seconds
Unsent queuesize 0, max 0
Resend queuesize 0, max 1
Total resends 0, ZLB ACKs sent 2
Cisco IOS VPDN Command Reference
VPD-149
VPDN Commands show vpdn tunnel
Current nosession queue check 0 of 5
Retransmit time distribution: 0 0 0 0 0 0 0 0 0
Sessions disconnected due to lack of resources 0
Control message authentication is disabled
describes the significant fields shown in the display.
Table 20 show vpdn tunnel all Field Descriptions
Field
Local RWS
Description
Size of the locally configured recieve window.
Remote RWS Size of the receive window configured on the remote peer.
Congestion Window size, Cwnd 3 Current size of the congestion window (Cwnd).
Slow Start threshold, Ssthresh 500 Current value of the slow start threshold (Ssthresh).
Mode of operation is...
Indicates if the router is operating in Slow Start or Congestion
Avoidance mode.
Related Commands Command show vpdn show vpdn domain show vpdn group
Description
Displays basic information about all active VPDN tunnels.
Displays all VPDN domains and DNIS groups configured on the NAS.
Displays a summary of the relationships among VPDN groups and customer/VPDN profiles, or summarizes the configuration of a VPDN group including DNIS/domain, load sharing information, and current session information.
show vpdn history failure
Displays the content of the failure history table.
show vpdn multilink
Displays the multilink sessions authorized for all VPDN groups.
show vpdn redirect show vpdn session
Displays statistics for L2TP redirects and forwards.
Displays session information about active Layer 2 sessions for a VPDN.
VPD-150
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vtemplate
show vtemplate
To display information about all configured virtual templates, use the show vtemplate command in privileged EXEC mode.
show vtemplate
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History Release
12.0(7)DC
12.2(13)T
Modification
This command was introduced on the Cisco 6400 NRP.
This command was integrated into Cisco IOS Release 12.2(13)T.
Examples
The following is sample output from the show vtemplate command:
Router# show vtemplate
Virtual access subinterface creation is globally enabled
Vt1
Vt2
Usage Summary
Active Active Subint Pre-clone Pre-clone
Interface Subinterface Capable Available Limit
--------- ------------ ------- --------- ---------
2 0 Yes 48 50
0 1 Yes ---
Current in use
Current free
Total
Interface Subinterface
--------- ------------
52
0
52
1
1
2
3
2
Cumulative created
Cumulative freed
6
0
Base virtual access interfaces:2
Total create or clone requests:3
Current request queue size:0
Current free pending:0
Maximum request duration:32 msec
Average request duration:24 msec
Last request duration:32 msec
Maximum processing duration:0 msec
Average processing duration:0 msec
Last processing duration:0 msec
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-151
show vtemplate
VPDN Commands
describes the significant fields shown in the example.
Table 21 show vtemplate Field Descriptions
Field Description
Virtual access subinterface creation is globally...
Active Interface
The configured setting of the virtual-template command. Virtual access subinterface creation may be enabled or disabled.
The number of virtual access interfaces that are cloned from the specified virtual template.
Active Subinterface
Subint Capable
Pre-clone Available
The number of virtual access subinterfaces that are cloned from the specified virtual template.
Specifies if the configuration of the virtual template is supported on the virtual access subinterface.
The number of precloned virtual access interfaces currently available for use for the particular virtual template.
Pre-clone Limit
Current in use
Current free
Total
The number of precloned virtual access interfaces available for that particular virtual template.
The number of virtual access interfaces and subinterfaces that are currently in use.
The number of virtual access interfaces and subinterfaces that are no longer in use.
The total number of virtual access interfaces and subinterfaces that exist.
Cumulative created
Cumulative freed
Base virtual-access interfaces
Total create or clone requests
Current request queue size
Current free pending
Maximum request duration
Average request duration
The number of requests for a virtual access interface or subinterface that have been satisfied.
The number of times that the application using the virtual access interface or subinterface has been freed.
This field specifies the number of base virtual access interfaces.
The base virtual access interface is used to create virtual access subinterfaces. There is one base virtual access interface per application that supports subinterfaces. A base virtual access interface can be identified from the output of the show interfaces
virtual-access command.
The number of requests that have been made through the virtual template manager’s asynchronous request API.
The number of items in the virtual template manager work queue.
The number of virtual access interfaces whose final freeing is pending. These virtual access interfaces cannot currently be freed because they are still in use.
The maximum time that it took from the time that the asynchronous request was made until the application was notified that the request was done.
The average time that it took from the time that the asynchronous request was made until the application was notified that the request was done.
VPD-152
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands show vtemplate
Related Commands
Table 21 show vtemplate Field Descriptions (continued)
Field Description
Last request duration The time that it took from the time that the asynchronous request was made until the application was notified that the request was done for the most recent request.
Maximum processing duration The maximum time that the virtual template manager spent satisfying the request.
Average processing duration The average time that the virtual template manager spent satisfying the request.
Last processing duration The time that the virtual template manager spent satisfying the request for the most recent request.
Command show interfaces virtual-access virtual-template
Description
Displays status, traffic data, and configuration information about a specified virtual access interface.
Specifies which virtual template will be used to clone virtual access interfaces.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-153
VPDN Commands source vpdn-template
source vpdn-template
To associate a virtual private dialup network (VPDN) group with a VPDN template, use the source
vpdn-template command in VPDN group configuration mode. To disassociate a VPDN group from a
VPDN template, use the no form of this command.
source vpdn-template [name]
no source vpdn-template [name]
Syntax Description
name
(Optional) The name of the VPDN template to be associated with the
VPDN group.
Command Default
Global VPDN template settings are applied to individual VPDN groups if a global VPDN template has been defined. If no global VPDN template has been defined, system default settings are applied to individual VPDN groups.
Command Modes
VPDN group configuration
Command History Release
12.2(4)B
12.2(8)T
12.2(13)T
12.2(28)SB
Modification
This command was introduced on the Cisco 7200 series and Cisco 7401ASR routers.
This command was integrated into Cisco IOS Release 12.2(8)T without support for the name argument.
Support was added for the name argument in Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use the source vpdn-template command to associate a VPDN group with a VPDN template. By default,
VPDN groups are associated with the global VPDN template if one is defined. A VPDN group can be associated with only one VPDN template. Associating a VPDN group with a named VPDN template automatically disassociates it from the global VPDN template.
The hierarchy for the application of VPDN parameters to a VPDN group is as follows:
•
VPDN parameters configured for the individual VPDN group are always applied to that VPDN group.
•
•
VPDN parameters configured in the associated VPDN template are applied for any settings not specified in the individual VPDN group configuration.
System default settings for VPDN parameters are applied for any settings not configured in the individual VPDN group or the associated VPDN template.
VPD-154
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands source vpdn-template
Examples
Disassociating a VPDN group from the global VPDN template using the no source vpdn-template command results in the following hierarchy for the application of VPDN parameters to that VPDN group:
•
•
VPDN parameters configured for the individual VPDN group are always applied to that VPDN group.
System default settings for VPDN parameters are applied for any settings not configured in the individual VPDN group.
If you disassociate a VPDN group from a named VPDN template, the VPDN group will be associated with the global VPDN template if one is defined.
The following example configures the VPDN group named group1 to ignore the global VPDN template settings and use the system default settings for all unspecified VPDN parameters:
Router(config)# vpdn-group group1
Router(config-vpdn)# no source vpdn-template
The following example creates a VPDN template named l2tp, enters VPDN template configuration mode, configures two VPDN parameters in the VPDN template, and associates the VPDN group named l2tptunnels with the VPDN template:
Router(config)# vpdn-template l2tp
Router(config-vpdn-templ)# l2tp tunnel busy timeout 65
Router(config-vpdn-templ)# l2tp tunnel password 7 tunnel4me
!
Router(config)# vpdn-group l2tptunnels
Router(config-vpdn)# source vpdn-template l2tp
The following example disassociates the VPDN group named l2tptunnels from the VPDN template named l2tp. The VPDN group will be associated with the global VPDN template if one has been defined.
Router(config)# vpdn-group l2tptunnels
Router(config-vpdn)# no source vpdn-template l2tp
Related Commands Command vpdn-group vpdn-template
Description
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-155
VPDN Commands source-ip
source-ip
To specify an IP address that is different from the physical IP address used to open a virtual private dialup network (VPDN) tunnel for the tunnels associated with a VPDN group, use the source-ip command in
VPDN group configuration mode. To remove the alternate IP address, use the no form of this command.
source-ip ip-address
no source-ip
Syntax Description
ip-address
Alternate IP address.
Command Default
No alternate IP address is specified.
Command Modes
VPDN group configuration
Command History Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Use the source-ip command in VPDN group configuration mode to configure an alternate IP address to be used for only those tunnels associated with that VPDN group. Each VPDN group on a router can be configured with a unique source-ip command.
Use the vpdn source-ip command to specify a single alternate IP address to be used for all tunnels on the device. A single source IP address can be configured globally per device.
The VPDN group-level configuration will override the global configuration.
Examples
The following example configures a network access server (NAS) to accept Layer 2 Tunnel Protocol
(L2TP) dial-out calls using the alternate IP address 172.23.33.7, which is different from the physical IP address used to open the L2TP tunnel: vpdn-group 3
accept-dialout
protocol l2tp
dialer 2
terminate-from hostname router21
source-ip 172.23.33.7
VPD-156
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands source-ip
Related Commands Command accept-dialin accept-dialout request-dialin request-dialout vpdn source-ip
Description
Creates an accept dial-in VPDN subgroup that configures a tunnel server to accept requests from a NAS to tunnel dial-in calls, and enters accept dial-in
VPDN subgroup configuration mode.
Creates an accept dial-out VPDN subgroup that configures a NAS to accept requests from a tunnel server to tunnel L2TP dial-out calls, and enters accept dial-out VPDN subgroup configuration mode.
Creates a request dial-in VPDN subgroup that configures a NAS to request the establishment of a dial-in tunnel to a tunnel server, and enters request dial-in VPDN subgroup configuration mode.
Creates a request dial-out VPDN subgroup that configures a tunnel server to request the establishment of dial-out L2TP tunnels to a NAS, and enters request dial-out VPDN subgroup configuration mode.
Globally specifies an IP address that is different from the physical IP address used to open a VPDN tunnel.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-157
VPDN Commands terminate-from
terminate-from
To specify the hostname of the remote L2TP access concentrator (LAC) or L2TP network server (LNS) that will be required when accepting a virtual private dialup network (VPDN) tunnel, use the
terminate-from command in VPDN group configuration mode. To remove the hostname from the
VPDN group, use the no form of this command.
terminate-from hostname host-name
no terminate-from [hostname host-name]
Syntax Description
hostname host-name Hostname from which this VPDN group will accept connections.
Defaults
Command Modes
VPDN group configuration
Command History
Disabled
Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
Before you can use this command, you must have already enabled one of the two accept VPDN subgroups by using either the accept-dialin or accept-dialout command.
Each VPDN group can only terminate from a single hostname. If you enter a second terminate-from command on a VPDN group, it will replace the first terminate-from command.
Examples
The following example configures a VPDN group to accept L2TP tunnels for dial-out calls from the LNS cerise by using dialer 2 as its dialing resource: vpdn-group 1
accept-dialout
protocol l2tp
dialer 2 terminate-from hostname host1
Related Commands Command accept-dialin accept-dialout
Description
Specifies the LNS to use for authenticating, and the virtual template to use for cloning, new virtual access interfaces when an incoming L2TP tunnel connection is requested from a specific peer.
Accepts requests to tunnel L2TP dial-out calls and creates an accept-dialout
VPDN subgroup
VPD-158
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands virtual-template
virtual-template
To specify which virtual template will be used to clone virtual access interfaces, use the
virtual-template command in VPDN group configuration mode. To remove the virtual template from a virtual private dial-up network (VPDN) group, use the no form of this command.
virtual-template template-number
no virtual-template
Syntax Description
template-number
Number of the virtual template that will be used to clone virtual access interfaces.
Defaults
Command Modes
VPDN group configuration
Command History
No virtual template is enabled.
Release
12.0(5)T
12.1(1)T
12.2(15)T
Modification
This command was introduced.
This command was enhanced to enable PPPoE on ATM to accept dial-in PPP over
Ethernet (PPPoE) sessions.
This command was enhanced to allow IP per-user attributes to be applied to a
Layer 2 Tunneling Protocol (L2TP) dial-out session.
Usage Guidelines
You must first enable a tunneling protocol on the VPDN group using the protocol (VPDN) command before you can enable the virtual-template command. Removing or modifying the protocol command will remove the virtual-template command from the VPDN group.
Each VPDN group can clone only virtual access interfaces using one virtual template. If you enter a second virtual-template command on a VPDN group, it will replace the first virtual-template command.
lists the VPDN group commands under which the virtual-template command can be entered.
Entering the VPDN group command starts VPDN group configuration mode. The table includes the command-line prompt for the VPDN group configuration mode and the type of service configured.
Table 22 VPDN Subgroups
VPDN Group Command accept-dialin request-dialout
Command Mode Prompt
router(config-vpdn-acc-in)# router(config-vpdn-req-ou)#
Type of Service
Tunnel server
L2TP network server (LNS)
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-159
virtual-template
Examples
VPDN Commands
When the virtual-template command is entered under a request-dialout VPDN subgroup, IP and other per-user attributes can be applied to an L2TP dial-out session from an LNS. Before this command was enhanced, IP per-user configurations from authentication, authorization, and accounting (AAA) servers were not supported; the IP configuration would come from the dialer interface defined on the router.
The enhanced virtual-template command works in a way similar to configuring virtual profiles and
L2TP dial-in. The L2TP virtual access interface is first cloned from the virtual template, which means that configurations from the virtual template interface will be applied to the L2TP virtual access interface. After authentication, the AAA per-user configuration is applied to the virtual access interface.
Because AAA per-user attributes are applied only after the user has been authenticated, the LNS must be configured to authenticate the dial-out user (configuration authentication is needed for this command).
With the enhanced virtual-template command, all software components can now use the configuration present on the virtual access interface rather than what is present on the dialer interface. For example,
IP Control Protocol (IPCP) address negotiation uses the local address of the virtual access interface as the router address while negotiating with the peer.
The following example enables the LNS to accept an L2TP tunnel from an L2TP access concentrator
(LAC) named LAC2. A virtual access interface will be cloned from virtual template 1.
vpdn-group 1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname LAC2
The following example enables PPPoE on ATM to accept dial-in PPPoE sessions. A virtual access interface for the PPP session is cloned from virtual template 1.
vpdn-group 1 accept-dialin protocol pppoe virtual-template 1
The following partial example shows how to configure an LNS to support IP per-user configurations from a AAA server:
!
vpdn enable vpdn search-order domain
!
vpdn-group 1
.
.
.
request-dialout protocol l2tp rotary-group 1 virtual-template 1 initiate-to ip 10.0.1.194.2
local name lns l2tp tunnel password 7094F3$!5^3
!
source-ip 10.0.194.53
VPD-160
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands virtual-template
The previous configuration requires a AAA profile such as the following example to specify the per-user attributes:
5300-Router1-out Password = "cisco"
Service-Type = Outbound cisco-avpair = "outbound:dial-number=5550121"
7200-Router1-1 Password = "cisco"
Service-Type = Outbound cisco-avpair = "ip:route=10.17.17.1 255.255.255.255 Dialer1 100 name 5300-Router1"
5300-Router1 Password = "cisco"
Service-Type = Framed
Framed-Protocol = PPP cisco-avpair = "lcp:interface-config=ip unnumbered loopback 0" cisco-avpair = "ip:outacl#1=deny ip host 10.5.5.5 any log" cisco-avpair = "ip:outacl#2=permit ip any any" cisco-avpair = "ip:inacl#1=deny ip host 10.5.5.5 any log" cisco-avpair = "ip:inacl#2=permit ip any any" cisco-avpair = "multilink:min-links=2"
Framed-Route = "10.5.5.6/32 Ethernet4/0"
Framed-Route = "10.5.5.5/32 Ethernet4/0"
Idle-Timeout = 100
Related Commands Command accept-dialin
Description
Configures an LNS to accept tunneled PPP connections from a LAC and to create an accept-dialin VPDN subgroup.
protocol (VPDN)
Specifies the Layer 2 Tunneling Protocol that the VPDN subgroup will use.
request-dialout
Enables an LNS to request VPDN dial-out calls by using L2TP and to create a request-dialout VPDN subgroup.
vpdn-group
Defines a local, unique group number identifier.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-161
VPDN Commands vpdn aaa attribute
vpdn aaa attribute
To enable reporting of network access server (NAS) authentication, authorization, and accounting
(AAA) attributes related to a virtual private dialup network (VPDN) to the AAA server, use the vpdn
aaa attribute command in global configuration mode. To disable reporting of AAA attributes related to
VPDN, use the no form of this command.
vpdn aaa attribute {nas-ip-address vpdn-nas | nas-port {vpdn-nas | physical-channel-id}}
no vpdn aaa attribute {nas-ip-address vpdn-nas | nas-port}
Syntax Description nas-ip-address vpdn-nas
Enable reporting of the VPDN NAS IP address to the AAA server.
nas-port vpdn-nas
Enable reporting of the VPDN NAS port to the AAA server.
nas-port physical-channel-id
Enable reporting of the VPDN NAS port physical channel identifier to the AAA server.
Command Default
AAA attributes are not reported to the AAA server.
Command Modes
Global configuration
Command History Release
11.3NA
11.3(8.1)T
12.1(5)T
12.2(13)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 11.3(8.1)T.
This command was modified to support the PPP extended NAS-Port format.
Support was added for the physical-channel-id keyword.
Usage Guidelines
This command can be used with RADIUS or TACACS+, and is applicable only on the VPDN tunnel server.
The PPP extended NAS-Port format enables the NAS-Port and NAS-Port-Type attributes to provide port details to a RADIUS server when one of the following protocols is configured:
•
•
PPP over ATM
PPP over Ethernet (PPPoE) over ATM
•
PPPoE over 802.1Q VLANs
Before PPP extended NAS-Port format attributes can be reported to the RADIUS server, the
radius-server attribute nas-port format command with the d keyword must be configured on both the tunnel server and the NAS, and the tunnel server and the NAS must both be Cisco routers.
VPD-162
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn aaa attribute
Examples
The following example configures VPDN on a tunnel server and enables reporting of VPDN AAA attributes to the AAA server: vpdn enable vpdn-group 1 accept-dialin protocol any virtual-template 1
!
!
terminate-from hostname nas1 local name ts1 vpdn aaa attribute nas-ip-address vpdn-nas vpdn aaa attribute nas-port vpdn-nas vpdn aaa attribute nas-port physical-channel-id
The following example configures the tunnel server for VPDN, enables AAA, configures a RADIUS
AAA server, and enables reporting of PPP extended NAS-Port format values to the RADIUS server. PPP extended NAS-Port format must also be configured on the NAS for this configuration to be effective.
vpdn enable vpdn-group L2TP-tunnel accept-dialin protocol l2tp virtual-template 1
!
terminate-from hostname nas1
!
local name ts1 aaa new-model aaa authentication ppp default local group radius aaa authorization network default local group radius aaa accounting network default start-stop group radius
!
radius-server host 171.79.79.76 auth-port 1645 acct-port 1646 radius-server retransmit 3 radius-server attribute nas-port format d radius-server key ts123
!
vpdn aaa attribute nas-port vpdn-nas
Related Commands Command radius-server attribute nas-port format
Description
Selects the NAS-Port format used for RADIUS accounting features.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-163
VPDN Commands vpdn aaa override-server
vpdn aaa override-server
To specify an authentication, authorization, and accounting (AAA) server to be used for virtual private dialup network (VPDN) tunnel authorization other than the default AAA server, use the vpdn aaa
override-server global configuration command. To return to the default setting, use the no form of this command.
vpdn aaa override-server {aaa-server-ip-address | aaa-server-name}
no vpdn aaa override-server {aaa-server-ip-address | aaa-server-nam}
Syntax Description
aaa-server-ip-address The IP address of the AAA server to be used for tunnel authorization.
aaa-server-name
The name of the AAA server to be used for tunnel authorization.
Defaults
If the AAA server is not specified, the default AAA server configured for network authorization is used.
Command Modes
Global configuration
Command History Release
11.2F
Modification
This command was introduced.
Usage Guidelines
This command can be used with RADIUS or TACACS+, and is applicable only on the VPDN network access server (NAS). Configuring this command restricts tunnel authorization to the specified AAA servers only. This command can be used to specify multiple AAA servers.
For TACACS+ configuration, the tacacs-server directed-request command must be configured using the restricted keyword, or authorization will continue with all configured TACACS+ servers.
Examples
The following example enables AAA attributes and specifies the AAA server to be used for VPDN tunnel authorization: aaa new-model aaa authorization network default group radius vpdn aaa override-server 10.1.1.1
vpdn enable radius-server host 10.1.1.2 auth-port 1645 acct-port 1646 radius-server key Secret
VPD-164
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn aaa override-server
Related Commands Command aaa new-model tacacs-server directed-request vpdn enable
Description
Enables the AAA access control model.
Sends only a username to a specified server when a direct request is issued.
Enables VPDN on the router and directs the router to look for tunnel definitions in a local database and on a remote authorization server (home gateway), if one is present.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-165
VPDN Commands vpdn aaa untagged
vpdn aaa untagged
To apply untagged attribute values obtained from the authentication, authorization, and accounting
(AAA) RADIUS server to all attribute sets for virtual private dialup network (VPDN) tunnels, use the
vpdn aaa untagged command in global configuration mode. To disable this function, use the no form of this command.
vpdn aaa untagged no vpdn aaa untagged
Syntax Description
This command has no arguments or keywords.
Defaults
Untagged attribute values are applied to all attribute sets.
Command Modes
Global configuration
Command History Release
12.2(1)T
Modification
This command was introduced.
Usage Guidelines
Untagged attribute values obtained from the AAA RADIUS server will be applied to all attribute sets by default, unless a value for that attribute is already specified in the tagged attribute set. To prevent untagged attribute values from being applied to tagged attribute sets, use the no form of this command.
Examples
The following example disables the application of untagged attribute values to attribute sets: no vpdn aaa untagged
VPD-166
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn authen-before-forward
vpdn authen-before-forward
To configure a network access server (NAS) to request authentication of a complete username before making a forwarding decision for all dial-in Layer 2 Tunnel Protocol (L2TP) or Layer 2 Forwarding
(L2F) tunnels, use the vpdn authen-before-forward command in global configuration mode. To disable this configuration, use the no form of this command.
vpdn authen-before-forward
no vpdn authen-before-forward
Syntax Description
This command has no arguments or keywords.
Command Default
L2TP or L2F tunnels are forwarded to the tunnel server without first requesting authentication of the complete username.
Command Modes
Global configuration
Command History Release
11.3
Modification
This command was introduced.
Usage Guidelines
To configure the NAS to perform authentication of all dial-in L2TP or L2F sessions before the sessions are forwarded to the tunnel server, configure the vpdn authen-before-forward command in global configuration mode.
To configure the NAS to perform authentication of dial-in L2TP or L2F sessions belonging to a specific
VPDN group before the sessions are forwarded to the tunnel server, use the authen-before-forward command in VPDN group configuration mode.
Enabling the vpdn authen-before-forward command instructs the NAS to authenticate the complete username before making a forwarding decision based on the domain portion of the username. A user may be forwarded or terminated locally depending on the information contained in the users RADIUS profile.
Users with forwarding information in their RADIUS profile are forwarded based on that information.
Users without forwarding information in their RADIUS profile are either forwarded or terminated locally based on the Service-Type in their RADIUS profile. The relationship between forwarding decisions and the information contained in the users RADIUS profile is summarized in
.
Table 23 Forwarding Decisions Based on RADIUS Profile Attributes
Forwarding Information Is
Present in RADIUS profile
Absent from RADIUS profile
Service-Type Is Outbound
Forward User
Check Domain
Service-Type Is Not Outbound
Forward User
Terminate Locally
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-167
VPDN Commands vpdn authen-before-forward
Examples
The following example configures the NAS to request authentication of all dial-in L2TP or L2F sessions before the sessions are forwarded to the tunnel server: vpdn authen-before-forward
Related Commands Command Description authen-before-forward
Configures a NAS to request authentication of a complete username before making a forwarding decision for dial-in L2TP or L2F tunnels belonging to a VPDN group.
VPD-168
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn authorize directed-request
vpdn authorize directed-request
To enable virtual private dialup network (VPDN) authorization for directed-request users, use the
vpdn authorize directed-request command in global configuration mode. To disable VPDN authorization for directed request users, use the no form of this command.
vpdn authorize directed-request no vpdn authorize directed-request
Syntax Description
This command has no keywords or arguments.
Defaults
VPDN authorization for directed-request users is disabled.
Command Modes
Global configuration
Command History Release
12.1
Modification
This command was introduced.
Usage Guidelines
When a username incudes both a username and a domain portion, such as [email protected], directed request configuration allows the authorization request to be sent to a specific RADIUS or TACACS+ server based on the domain name portion of the username (site.com). The vpdn authorize
directed-request command must be enabled to allow VPDN authorization of any directed request user.
Directed request for RADIUS users is enabled by issuing the radius-server directed-request command.
Directed request for TACACS+ users is enabled by default, and may be disabled using the no
tacacs-server directed request command. The ip host command must be configured to enable directed requests to RADIUS or TACACS+ servers.
The vpdn authorize directed-request command is usually configured on the L2TP network server
(LNS). When directed-requests are used on an L2TP access concentrator (LAC) in conjuction with per-user VPDN configuration, the authen before-forward command must be enabled.
Examples
The following example enables VPDN authorization and RADIUS directed requests on an LNS: ip host site.com 10.1.1.1
radius-server host 10.1.1.1 auth-port 1645 acct-port 1646 radius-server directed-request vpdn authorize directed-request
The following example enables VPDN authorization and TACACS+ directed requests on an LNS: ip host site.com 10.1.1.1 tacacs-server host 10.1.1.1 tacacs-server directed-request vpdn authorize directed-request
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-169
VPDN Commands vpdn authorize directed-request
The following example enables per-user VPDN and enables VPDN authorization for directed request users on a LAC: vpdn-group 1
request-dialin
protocol l2f
domain cisco.com
!
initiate-to ip 10.1.1.1
local name local1
authen before-forward
!
ip host cisco.com 10.1.1.1
vpdn authorize directed-request
!
radius-server host 10.1.1.1 auth-port 1645 acct-port 1646 radius-server directed-request
Related Commands Command Description authen before-forward
Specifies that the VPDN sends the entire structured username to the AAA server the first time the router contacts the AAA server.
ip host
Defines a static hostname-to-address mapping in the host cache.
radius-server directed-request tacacs-server directed-request
Allows users logging into a Cisco NAS to select a RADIUS server for authentication.
Sends only a username to a specified server when a direct request is issued.
VPD-170
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn authorize domain
vpdn authorize domain
To enable domain preauthorization on a network access server (NAS), use the vpdn authorize domain command in global configuration mode. To disable domain preauthorization, use the no form of this command.
vpdn authorize domain no vpdn authorize domain
Syntax Description
This command has no arguments or keywords.
Defaults
Domain preauthorization is disabled by default.
Command Modes
Global configuration
Command History Release
12.1(1)DC1
12.2(13)T
Modification
This command was introduced on the Cisco 6400 NRP.
This command was integrated into Cisco IOS Release 12.2(13)T.
Usage Guidelines
A RADIUS domain preauthorization user profile must also be created. See the “Examples” section and refer to the Cisco IOS Security Configuration Guide for information on how to create these profiles.
Examples
Domain Preauthorization Configuration on the LAC Example
The following example shows the configuration necessary for a L2TP access concentrator (LAC) to participate in domain preauthorization:
!
aaa new-model aaa authorization network default local group radius
!
vpdn authorize domain
!
radius-server host 10.9.9.9 auth-port 1645 acct-port 1646 radius-server attribute nas-port format d radius-server key MyKey radius-server vsa send authentication
!
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-171
vpdn authorize domain
Domain Preauthorization RADIUS User Profile Example
The following example shows a domain preauthorization RADIUS user profile: user = nas-port:10.9.9.9:0/0/0/30.33{
profile_id = 826
profile_cycle = 1
radius=Cisco {
check_items= {
2=cisco
}
reply_attributes= {
9,1="vpdn:vpn-domain-list=net1.com,net2.com"
6=5
}
}
Related Commands Command aaa new-model
Description
Enables the AAA access control model.
VPDN Commands
VPD-172
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn domain-delimiter
vpdn domain-delimiter
To specify the characters to be used to delimit the domain prefix or domain suffix, use the vpdn
domain-delimiter command in global configuration mode. To disable this function, use the no form of this command.
vpdn domain-delimiter characters [suffix | prefix]
no vpdn domain-delimiter characters [suffix | prefix]
Syntax Description
characters
One or more specific characters to be used as suffix or prefix delimiters. Available characters are %, –, @, \ , #, and /.
If a backslash (\) is the last delimiter in the command line, enter it as a double backslash (\\).
suffix | prefix (Optional) Usage of the specified characters.
Defaults
Disabled
Command Modes
Global configuration
Command History Release
11.3
Modification
This command was introduced.
Usage Guidelines
You can enter one vpdn domain-delimiter command to list the suffix delimiters and another vpdn
domain-delimiter command to list the prefix delimiters. However, no character can be both a suffix delimiter and a prefix delimiter.
This command allows the network access server to parse a list of home gateway DNS domain names and addresses sent by an AAA server. The AAA server can store domain names or IP addresses in the following AV pair: cisco-avpair = "lcp:interface-config=ip address 10.1.1.1 255.255.255.255.0", cisco-avpair = "lcp:interface-config=ip address [email protected],
Examples
The following example lists three suffix delimiters and three prefix delimiters: vpdn domain-delimiter %-@ suffix vpdn domain-delimiter #/\\ prefix
This example allows the following host and domain names: cisco.com#localddr [email protected]
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-173
VPDN Commands vpdn domain-delimiter
Related Commands Command vpdn enable vpdn history failure vpdn profile vpdn-group
Description
Enables VPDN on the router and directs the router to look for tunnel definitions in a local database and on a remote authorization server
(home gateway), if one is present.
Enables logging of VPDN failures to the history failure table or to sets the failure history table size.
Specifies how the network access server for the service provider is to perform VPDN tunnel authorization searches.
Creates a VPDN group and enters VPDN group configuration mode.
VPD-174
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn enable
vpdn enable
To enable virtual private dialup networking (VPDN) on the router and inform the router to look for tunnel definitions in a local database and on a remote authorization server (home gateway), if one is present, use the vpdn enable command in global configuration mode. To disable, use the no form of this command.
vpdn enable no vpdn enable
Syntax Description
This command has no arguments or keywords.
Command Default
VPDN is disabled.
Command Modes
Global configuration
Command History Release
11.2
Modification
This command was introduced.
Usage Guidelines
The no vpdn enable command does not automatically disable a VPDN tunnel.
To shut down a VPDN tunnel, use the clear vpdn tunnel command or the vpdn softshut command.
Examples
Related Commands
The following example enables VPDN on the router: vpdn enable
Command clear vpdn tunnel vpdn history failure vpdn-group vpdn softshut
Description
Shuts down a specified tunnel and all sessions within the tunnel.
Enables logging of VPDN failures to the history failure table or to sets the failure history table size.
Creates a VPDN group and enters VPDN group configuration mode.
Prevents new sessions from being established on a VPDN tunnel without disturbing existing sessions.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-175
VPDN Commands vpdn group
vpdn group
To associate a virtual private dialup network (VPDN) group with a customer or VPDN profile, use the
vpdn group command in customer profile or VPDN profile configuration mode. To disassociate a
VPDN group from a customer or VPDN profile, use the no form of this command.
vpdn group name
no vpdn group name
Syntax Description
name
Name of the VPDN group.
Note
This name should match the name defined for the VPDN group configured with the vpdn-group command.
Defaults
No default behavior or values.
Command Modes
Customer profile configuration
VPDN profile configuration
Command History Release
12.0(4)XI
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(5)T.
Usage Guidelines
Use the vpdn group command in customer profile configuration mode or VPDN profile configuration mode to associate a VPDN group with a customer profile or a VPDN profile, respectively.
VPDN groups are created using the vpdn-group command in global configuration mode.
Examples
The following example creates the VPDN groups named l2tp and l2f, and associates both VPDN groups with the VPDN profile named profile32:
Router(config)# vpdn-group l2tp
Router(config-vpdn)#
!
Router(config)# vpdn-group l2f
Router(config-vpdn)#
!
Router(config)# resource-pool profile vpdn profile32
Router(config-vpdn-profile)# vpdn group l2tp
Router(config-vpdn-profile)# vpdn group l2f
VPD-176
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn group
The following example creates two VPDN groups and configures them under a customer profile named company2:
Router(config)# vpdn-group mygroup
Router(config-vpdn)#
!
Router(config)# vpdn-group yourgroup
Router(config-vpdn)#
!
Router(config)# resource-pool profile vpdn company2
Router(config-vpdn-profile)# vpdn group mygroup
Router(config-vpdn-profile)# vpdn group yourgroup
Related Commands Command resource-pool profile customer resource-pool profile vpdn vpdn profile vpdn-group
Description
Creates a customer profile and enters customer profile configuration mode.
Creates a VPDN profile and enters VPDN profile configuration mode.
Associates a VPDN profile with a customer profile.
Creates a VPDN group and enters VPDN group configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-177
VPDN Commands vpdn history failure
vpdn history failure
To enable logging of virtual private dialup network (VPDN) failures to the history failure table or to set the failure history table size, use the vpdn history failure command in global configuration mode. To disable logging of VPDN history failures or to restore the default table size, use the no form of this command.
vpdn history failure [table-size entries]
no vpdn history failure [table-size]
Syntax Description
table-size entries (Optional) Sets the number of entries in the history failure table. Valid entries range from 20 to 50.
Defaults
VPDN failures are logged by default.
table size: 20 entries
Command Modes
Global configuration
Command History Release
11.3T
Modification
This command was introduced.
Usage Guidelines
Logging of VPDN failure events is enabled by default. You can disable the logging of VPDN failure events by issuing the no vpdn history failure command.
The logging of a failure event to the history table is triggered by event logging by the syslog facility. The syslog facility creates a failure history table entry, which keeps records of failure events. The table starts with 20 entries, and the size of the table can be expanded to a maximum of 50 entries using the vpdn
history failure table-size entries command. You may configure the vpdn history failure table-size
entries command only if VPDN failure event logging is enabled.
All failure entries for the user are kept chronologically in the history table. Each entry records the relevant information of a failure event. Only the most recent failure event per user, unique to its name and tunnel client ID (CLID), is kept.
When the total number of entries in the table reaches the configured table size, the oldest record is deleted and a new entry is added.
Examples
The following example disables logging of VPDN failures to the history failure table: no vpdn history failure
The following example enables logging of VPDN failures to the history table and sets the history failure table size to 40 entries: vpdn history failure vpdn history failure table-size 40
VPD-178
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands
Related Commands Command show vpdn history failure
Description
Displays the content of the failure history table.
vpdn history failure
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-179
VPDN Commands vpdn ip udp ignore checksum
vpdn ip udp ignore checksum
To allow the router to ignore User Datagram Protocol (UDP) checksums for Layer 2 Forwarding (L2F) and Layer 2 Tunnel Protocol (L2TP) virtual private dialup network (VPDN) traffic, use the vpdn ip udp
ignore checksum command in global configuration mode. To disable the ignoring of UDP checksums, use the no form of this command.
vpdn ip udp ignore checksum no vpdn ip udp ignore checksum
Syntax Description
This command has no arguments or keywords.
Defaults
Releases Prior to Cisco IOS Release 12.3(13) and 12.3(14)T
UDP checksums are not ignored by default.
Cisco IOS Release 12.3(13) and 12.3(14)T and Later Releases
UDP checksums are ignored by default.
Command Modes
Global configuration
Command History Release
12.2(15)T
12.3(13)
12.3(14)T
Modification
This command was introduced.
This command was modified to be enabled by default.
This command was modified to be enabled by default.
Usage Guidelines
Ignoring UDP checksums is beneficial when the remote tunnel endpoint uses UDP checksums and you want to use fast switching or Cisco Express Forwarding (CEF). If the remote tunnel endpoint uses UDP checksums and the vpdn ip udp ignore checksum command has been disabled, all tunnel traffic will be process-switched.
In Cisco IOS Release 12.3(13) and Cisco IOS Release 12.3(14)T this command was modified to be enabled by default.
Examples
The following example configures the router to ignore UDP checksums, allowing fast switching or CEF: vpdn ip udp ignore checksum
The following example disables the ignoring of UDP checksums on the router: no vpdn ip udp ignore checksum
VPD-180
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn l2tp attribute clid mask-method
vpdn l2tp attribute clid mask-method
To configure a network access server (NAS) to suppress Layer 2 Tunnel Protocol (L2TP) calling station
IDs globally, use the vpdn l2tp attribute clid mask-method command in global configuration mode.
To disable this function, use the no form of this command.
vpdn l2tp attribute clid mask-method {right mask-character characters | remove} [match
match-string]
no vpdn l2tp attribute clid mask-method {right mask-character characters | remove} [match
match-string]
Syntax Description right
mask-character characters
remove
match match-string
Specifies that the calling station ID will be masked by replacing characters, starting from the right end of the string.
Character to be used as a replacement.
Number of characters to be replaced.
Specifies that the entire calling station ID will be removed.
(Optional) Applies the defined masking method only if the string specified by the match-string argument is contained in the username.
Command Default
The calling station ID is not masked or dropped.
Command Modes
Global configuration
Command History Release
12.4(2)T
12.3(14)YM2
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(14)YM2 and implemented on the Cisco 7301, Cisco 7204VXR, and Cisco 7206VXR routers.
Usage Guidelines
Use the vpdn l2tp attribute clid mask-method command to mask the calling calling station ID in L2TP attribute-value (AV) pair 22 globally for all virtual private dialup network (VPDN) groups configured on the NAS. This command is compatibe with both local and remote RADIUS authorization. You can either substitute characters for a portion of the calling station ID, or remove the entire calling station ID.
The l2tp attribute clid mask-method command can be used to mask the calling station ID for calls associated with a specific VPDN group or VPDN template. This command is compatible with only local authorization.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-181
VPDN Commands vpdn l2tp attribute clid mask-method
Examples
The following example shows how to use the vpdn l2tp attribute clid mask-method command globally to mask the L2TP calling station ID during authorization if the username contains the string #184.
vpdn enable vpdn l2tp attribute clid mask-method right # 255 match #184 vpdn search-order domain
Related Commands Command l2tp attribute clid mask-method
Description
Configures a NAS to suppress L2TP calling station IDs for sessions associated with a VPDN group or VPDN template.
VPD-182
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn logging
vpdn logging
To enable the logging of virtual private dialup network (VPDN) events, use the vpdn logging command in global configuration mode. To disable the logging of VPDN events, use the no form of this command.
vpdn logging [accounting | local | remote | tunnel-drop | user]
no vpdn logging [accounting | local | remote | tunnel-drop | user]
Syntax Description accounting local remote tunnel-drop user
(Optional) Enables the transmission of VPDN event log messages within an authentication, authorization, and accounting (AAA) accounting record.
(Optional) Enables logging of VPDN events to the system message log (syslog) locally.
(Optional) Enables logging of VPDN events to the syslog of the remote tunnel endpoint.
(Optional) Enables logging of VPDN tunnel-drop events to the syslog.
(Optional) Enables logging of VPDN user events to the syslog.
Command Default
All VPDN event logging is disabled.
Command Modes
Global configuration
Command History Release
11.3T
12.1
12.2(11)T
12.2(15)T
12.2(28)SB
Modification
This command was introduced.
The user keyword was introduced in Cisco IOS Release 12.1.
The tunnel-drop keyword was introduced in Cisco IOS Release 12.2(11)T.
The accounting keyword was introduced in Cisco IOS Release 12.2(15)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
This command controls the logging of VPDN events. By default, all VPDN event logging is disabled.
To enable the logging of VPDN events to the syslog of the local or remote tunnel endpoint router, issue the vpdn logging command with the local or remote keyword.
To log VPDN user events or VPDN tunnel-drop events to the syslog, you must configure the vpdn
logging command with the user or tunnel-drop keyword.
Configuring the vpdn logging command with the accounting keyword causes VPDN event log messages to be sent to a remote AAA server in a AAA vendor-specific attribute (VSA). This allows the correlation of VPDN call success rates with accounting records.
Note
VPDN event logging to the syslog need not be enabled to allow the reporting of VPDN event log messages to a AAA server.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-183
VPDN Commands vpdn logging
Examples
You may configure as many types of VPDN event logging as you want.
The following example enables VPDN logging locally: vpdn logging local
The following example disables VPDN event logging locally, enables VPDN event logging at the remote tunnel endpoint, and enables the logging of both VPDN user and VPDN tunnel-drop events to the syslog of the remote router: no vpdn logging local vpdn logging remote vpdn logging user vpdn logging tunnel-drop
The following example disables the logging of VPDN events to the syslog both locally and at the remote tunnel endpoint, and enables the reporting of VPDN event log messages to the AAA server: no vpdn logging local no vpdn logging remote vpdn logging accounting
Related Commands Command vpdn history failure
Description
Enables logging of VPDN failures to the history failure table or sets the failure history table size.
VPD-184
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn multihop
vpdn multihop
To enable virtual private dialup network (VPDN) multihop, use the vpdn multihop command in global configuration mode. To disable VPDN multihop capability, use the no form of this command.
vpdn multihop no vpdn multihop
Syntax Description
This command has no arguments or keywords.
Command Default
Multihop is disabled.
Command Modes
Global configuration
Command History Release
11.3(5)T
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
Support was added for dialed number identification service (DNIS)-based multihop capability.
Support was added for DNIS-based multihop capability.
This command was integrated into Cisco IOS Release 12.2(28)SB, including support for DNIS-based multihop capability.
Usage Guidelines
Use this command to enable multihop VPDN. Multihop VPDN allows packets to pass through multiple
VPDN tunnels. Ordinarily, packets are not allowed to traverse more than one tunnel. With multihop enabled, a packet may traverse as many as four tunnels.
VPDN multihop allows a router configured as a tunnel switch to act as both a network access server
(NAS) and a tunnel server, receiving packets from an incoming VPDN tunnel and sending them out over an outgoing VPDN tunnel.
A tunnel switch may terminate incoming VPDN tunnels from multiple devices, and initiate outgoing tunnels to one or more tunnel servers. The outgoing tunnel is selected using either a domain name, a remote tunnel name, or a DNIS number. The order in which these criteria are searched by the Cisco IOS software is determined by the vpdn search-order command.
VPDN multihop must be enabled for a Multichassis Multilink PPP (MMP) stack group deployment to function when incoming calls traverse a VPDN tunnel. For more information on configuring multihop
VPDN for MMP, refer to the Cisco IOS VPDN Configuration Guide.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-185
VPDN Commands vpdn multihop
Examples
The following example configures the NAS, tunnel switch, and tunnel server to establish a multihop
VPDN tunnel using L2TP:
NAS Configuration
! Configure the NAS to initiate VPDN dial-in sessions to the tunnel switch vpdn-group 1 request-dialin protocol l2tp domain cisco.com
!
initiate-to ip 172.22.66.25 local name ISP-NAS
Tunnel Switch Configuration
!Enable multihop vpdn multihop
!
! Configure the tunnel switch to use the multihop hostname in the authentication search.
vpdn search-order multihop-hostname domain dnis
!
! Configure the tunnel switch to accept dial-in sessions from the NAS vpdn-group tunnelin accept-dialin protocol l2tp virtual-template 1
!
terminate-from hostname ISP-NAS local name ISP-Sw
!
! Configure the tunnel switch to initiate VPDN dial-in sessions to the tunnel server vpdn-group tunnelout request-dialin protocol l2tp multihop-hostname ISP-NAS
!
initiate-to ip 10.2.2.2
local name ISP-Sw
Tunnel Server Configuration
! Configure the tunnel server to accept dial-in sessions from the NAS vpdn-group 1 accept-dialin protocol l2tp virtual-template 1
! terminate-from hostname ISP-Sw local name ENT-TS
The following example configures one member of a stack group and a NAS for dial-in L2F VPDN tunneling. Multihop VPDN must be enabled on each stack group member to allow calls to be forwarded to the bundle owner.
Tunnel Server A Configuration
!Enable multihop VPDN vpdn multihop
!
!Configure the tunnel server to accept L2F tunnels from the NAS vpdn-group group1 accept-dialin
VPD-186
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn multihop
protocol l2f virtual-template 1 exit terminate-from 172.18.32.139
!
!Configure the tunnel server as a stack group member username user1 password mypassword sgbp group mystack sgbp member tunnelserverb 10.1.1.2
sgbp member tunnelserverc 10.1.1.3
NAS Configuration
!Configure the NAS to initiate L2F tunnels vpdn-group group1 request-dialin protocol l2f domain cisco.com
!
!Configure the NAS with the IP address of each tunnel server in the stack group initiate-to ip 10.1.1.1
initiate-to ip 10.1.1.2
initiate-to ip 10.1.1.3
Related Commands Command vpdn enable
Description
Enables VPDN networking on the router and informs the router to look for tunnel definitions in a local database and on a remote authorization server
(home gateway), if one is present.
vpdn search-order
Specifies how a NAS or tunnel switch is to perform VPDN tunnel authorization searches.
vpdn-group
Creates a VPDN group and enters VPDN group configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-187
VPDN Commands vpdn pmtu
vpdn pmtu
To manually configure a range of allowed path maximum transmission unit (MTU) sizes for a Layer 2
Tunnel Protocol (L2TP) virtual private dialup network (VPDN), use the vpdn pmtu command in global configuration mode. To restore the default value, use the no form of this command.
vpdn pmtu {maximum bytes | minimum bytes}
no vpdn pmtu
Syntax Description
maximum bytes
minimum bytes
Sets the maximum allowed size, in bytes, for the path MTU. Valid values for the bytes argument range from 68 to 65535 bytes.
Sets the minimum allowed size, in bytes, for the path MTU. Valid values for the bytes argument range from 68 to 65535 bytes.
Command Default
No maximum or minimum path MTU size is defined.
Command Modes
Global configuration
Command History Release
12.3(25)
12.3(14)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(14)T.
This command was integrated into Cisco IOS Release 12.2(27)SB.
Usage Guidelines
Use the vpdn pmtu command to prevent Denial of Service (DoS) attacks against L2TP VPDN deployments that are performing path MTU discovery (PMTUD). PMTUD for an L2TP VPDN is disabled by default. To enable PMTUD, use the ip pmtu command.
When PMTUD is enabled, VPDN deployments are vulnerable to DoS attacks that use crafted Internet
Control Message Protocol (ICMP) “fragmentation needed and Don't Fragment (DF) bit set” (code 4) messages, also known as PMTUD attacks.
When an Internet host is performing PMTUD, crafted code 4 ICMP messages can be used to set the path
MTU to an impractically low value. This will cause higher layer protocols to time out because of a very low throughput, even though the connection is still in the established state. This type of attack is classified as a throughput-reduction attack.
Use the vpdn pmtu command to configure a range of acceptable values for the path MTU when PMTUD is enabled. If the device receives a code 4 ICMP message that advertises a next-hop path MTU outside the configured size range, the device will ignore the ICMP message and display the following log message:
%VPDN-5-IGNOREICMPMTU Ignoring received ICMP Type 3 Code 4, due to pmtu min or max setting
For information on detecting a PMTUD attack on an L2TP VPDN deployment, see the Cisco Security
Advisory Crafted ICMP Messages Can Cause Denial of Service.
VPD-188
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn pmtu
Examples
Cisco IOS Releases that support the ip pmtu command but do not support the vpdn pmtu command are vulnerable to PMTUD attacks. To protect a device running a vulnerable version of Cisco IOS software, issue the no ip pmtu command to disable PMTUD.
For a complete list of Cisco IOS software rebuild releases that support the vpdn pmtu command, refer to the Cisco Security Advisory Crafted ICMP Messages Can Cause Denial of Service.
The following example enables PMTUD for the VPDN group named mygroup and configures the device to accept path MTU values ranging from 576 to 1460 bytes. The device will ignore code 4 ICMP messages that specify a path MTU outside of this range.
Router(config)# vpdn-group mygroup
Router(config-vpdn)# ip pmtu
!
Router(config)# vpdn pmtu maximum 1460
Router(config)# vpdn pmtu minimum 576
Related Commands Command ip pmtu
Description
Enables the discovery of the path MTU for Layer 2 traffic.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-189
VPDN Commands vpdn profile
vpdn profile
To associate a virtual private dialup network (VPDN) profile with a customer profile, use the vpdn
profile command in customer profile configuration mode. To remove a VPDN profile from a customer profile, use the no form of this command.
vpdn profile name
no vpdn profile name
Syntax Description
name
VPDN profile name.
Defaults
Command Modes
Customer profile configuration
Command History
No default behavior or values.
Release
12.0(4)XI
12.0(5)T
Modification
This command was introduced.
Support for this command was integerated into Cisco IOS Release 12.0(5)T.
Usage Guidelines
Use the vpdn profile command to associate a VPDN profile with a customer profile.
VPDN profiles can be used to combine session counting over multiple VPDN groups. This ability can be applied to customer profiles by configuring multiple VPDN groups under a VPDN profile, then associating the VPDN profile with the customer profile using the vpdn profile command.
Examples
The following example shows how to create two VPDN groups, configure the VPDN groups under a
VPDN profile named profile1, then associates the VPDN profile with a customer profile named customer12:
Router(config)# vpdn-group 1
Router(config-vpdn)#
!
Router(config)# vpdn-group 2
Router(config-vpdn)#
!
Router(config)# resource-pool profile vpdn profile1
Router(config-vpdn-profile)# vpdn group 1
Router(config-vpdn-profile)# vpdn group 2
!
Router(config)# resource-pool profile customer customer12
Router(config-vpdn-customer)# vpdn profile profile1
VPD-190
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn profile
Related Commands Command resource-pool profile customer resource-pool profile vpdn vpdn group vpdn-group
Description
Creates a customer profile.
Creates a VPDN profile and enters VPDN profile configuration mode.
Associates a VPDN group with a customer or VPDN profile.
Creates a VPDN group and enters VPDN group configuration mode.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-191
VPDN Commands vpdn redirect
vpdn redirect
To enable Layer 2 Tunneling Protocol (L2TP) redirect functionality, use the vpdn redirect command in global configuration mode. To disable L2TP redirect functionality, use the no form of this command.
vpdn redirect no vpdn redirect
Syntax Description
This command has no arguments or keywords.
Command Default
L2TP redirect functionality is disabled so that current multihop forwarding behavior is preserved.
Command Modes
Global configuration
Command History Release
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Configuring this command on the L2TP network access server (NAS) enables the NAS to perform L2TP redirection by sending a new vendor-specific attribute-value (AV) pair to the L2TP tunnel server.
Configuring this command on the stack group tunnel server allows the tunnel server to redirect a call by disconnecting it and requesting the NAS to redirect it. The Stack Group Bidding Protocol (SGBP) stack group tunnel servers must have this command enabled in order to receive redirected calls, or else they will receive calls only through the usual multihop forwarding from the tunnel server that first took the call.
Examples
The following example enables the L2TP redirect feature on the NAS:
Router(config)# vpdn redirect
Related Commands Command Description clear vpdn redirect
Clears the L2TP redirect counters shown in the output from the show vpdn
redirect command.
show vpdn redirect
Displays statistics for L2TP redirects and forwards.
vpdn redirect attempts Restricts the number of redirect attempts possible for an L2TP call on the
NAS.
VPD-192
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn redirect
Command vpdn redirect identifier
Description
Configures a VPDN redirect identifier to use for L2TP call redirection on a stack group tunnel server.
vpdn redirect source
Configures the public redirect IP address of an L2TP stack group tunnel server.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-193
VPDN Commands vpdn redirect attempts
vpdn redirect attempts
To restrict the number of redirect attempts possible for a given Layer 2 Tunneling Protocol (L2TP) call on the L2TP network access server (NAS), use the vpdn redirect attempts command in global configuration mode. To revert to the default of three redirect attempts, use the no form of this command.
vpdn redirect attempts number-of-attempts
no vpdn redirect attempts number-of-attempts
Syntax Description
number-of-attempts
Number of redirect attempts, ranging from 1 to 20.
Command Default
A maximum of three redirect attempts are allowed.
Command Modes
Global configuration
Command History Release
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Note that the number of redirect attempts is by default always restricted to three, even if this command is not explicitly configured. The only use of this command is to configure a redirect attempts value other than the default (which is always in effect).
Examples
The following example configures four redirect attempts:
Router(config)# vpdn redirect attempts 4
Related Commands Command clear vpdn redirect show vpdn redirect vpdn redirect
Description
Clears the L2TP redirect counters shown in the output from the show vpdn
redirect command.
Displays statistics for L2TP redirects and forwards.
Enables L2TP redirect functionality.
vpdn redirect identifier
Configures a VPDN redirect identifier to use for L2TP call redirection on a stack group tunnel server.
vpdn redirect source
Configures the public redirect IP address of an L2TP stack group tunnel server.
VPD-194
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn redirect identifier
vpdn redirect identifier
To configure a virtual private dialup network (VPDN) redirect identifier to use for Layer 2 Tunneling
Protocol (L2TP) call redirection on a stack group tunnel server, use the vpdn redirect identifier command in global configuration mode. To remove the name of the redirect identifier from the tunnel server, use the no form of this command.
vpdn redirect identifier identifier-name
no vpdn redirect identifier identifier-name
Syntax Description
identifier-name
Name of the redirect identifier to use for call redirection.
Command Default
No identifier name is configured.
Command Modes
Global configuration
Command History Release
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
The vpdn redirect identifier command is configured on each of the stack group tunnel servers. To configure the name of the redirect identifier on the network access server (NAS), use the redirect
identifier command in VPDN group configuration mode.
The NAS compares the configured redirect identifier with the one received from the stack group tunnel server to determine authorization information to redirect the call.
Configuring the redirect identifier is not necessary to perform redirects. If the redirect identifier is not configured, the NAS uses the redirect IP address in order to get authorization information to redirect the call. In that case, the IP address of the new redirected tunnel server must be present in the initiate-to command configuration of the VPDN group on the NAS.
The redirect identifier allows new stack group members to be added without the need to update the NAS configuration with their IP addresses. With the redirect identifier configured, a new stack group member can be added and given the same redirect identifier as the rest of the stack group.
If the authorization information for getting to the new redirected tunnel server is different, then you will need to configure the authorization information via RADIUS using tagged attributes:
Cisco:Cisco-Avpair = :0:"vpdn:vpdn-redirect-id= identifier name "
The NAS will choose the correct tagged parameters to get authorization information for the new redirected tunnel server by first trying to match the redirect identifier (if present) or else by matching the
Tunnel-Server-Endpoint IP address.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-195
VPDN Commands vpdn redirect identifier
Examples
The following example configures the redirect identifier named lns1 on a stack group tunnel server:
Router(config)# vpdn redirect identifier lns1
The following attribute-value (AV) pair configures the RADIUS server with the redirect identifier named lns1 for a tunnel server:
Cisco:Cisco-Avpair = :0:"vpdn:vpdn-redirect-id=lns1"
Related Commands Command clear vpdn redirect show vpdn redirect vpdn redirect
Description
Clears the L2TP redirect counters shown in the output from the show vpdn
redirect command.
Displays statistics for L2TP redirects and forwards.
Enables L2TP redirect functionality.
vpdn redirect attempts Restricts the number of redirect attempts possible for an L2TP call on the
NAS.
vpdn redirect source
Configures the public redirect IP address of an L2TP stack group tunnel server.
VPD-196
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn redirect source
vpdn redirect source
To configure the public redirect IP address of a Layer 2 Tunnel Protocol (L2TP) stack group tunnel server, use the vpdn redirect source command in global configuration mode. To remove the public redirect IP address of a stack group tunnel server, use the no form of this command.
vpdn redirect source redirect-ip-address
no vpdn redirect source redirect-ip-address
Syntax Description
redirect-ip-address
Public redirect IP address for a stack group tunnel server.
Command Default
If the vpdn redirect source command is not configured, then the IP address used for Stack Group
Bidding Protocol (SGBP) bidding itself will be used as the redirect address (the public redirect address is then omitted in the bid response).
Command Modes
Global configuration
Command History Release
12.2(8)B
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
On the network access server (NAS), this command will have no effect.
Examples
The following example configures a public IP address as a redirect source:
Router(config)# vpdn redirect source 10.1.1.1
Related Commands Command clear vpdn redirect show vpdn redirect vpdn redirect
Description
Clears the L2TP redirect counters shown in the output from the show vpdn
redirect command.
Displays statistics for L2TP redirects and forwards.
Enables L2TP redirect functionality.
vpdn redirect attempts Restricts the number of redirect attempts possible for an L2TP call on the
NAS.
vpdn redirect identifier
Configures a VPDN redirect identifier to use for L2TP call redirection on a stack group tunnel server.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-197
VPDN Commands vpdn search-order
vpdn search-order
To specify how a network access server (NAS) or tunnel switch is to perform virtual private dialup network (VPDN) tunnel authorization searches, use the vpdn search-order command in global configuration mode. To restore the default search order, use the no form of this command.
vpdn search-order {[dnis] [domain] [multihop-hostname]}
no vpdn search-order
Syntax Description dnis domain multihop-hostname
Searches on the dialed number identification service (DNIS) number.
Searches on the domain name.
Searches on the hostname or tunnel ID of the ingress tunnel for a multihop tunnel switch.
Command Default
When this command is not enabled, by default the router will search first on the DNIS number provided on ISDN lines, and then search on the domain name. This is equivalent to issuing the vpdn search-order
dnis domain command.
Command Modes
Global configuration
Command History Release
11.3
12.2(13)T
12.2(28)SB
Modification
This command was introduced.
Support for the multihop-hostname option was added to Cisco IOS Release
12.2(13)T.
Support for the multihop-hostname option was added to Cisco IOS Release
12.2(28)SB.
Usage Guidelines
To issue the vpdn search-order command, you must include at least one of the search parameter keywords. You may enter multiple keywords, and they can be entered in any order. The order of the keywords specifies the order of precedence given to the search parameters. If you do not issue a particular keyword, no search will be performed on that parameter.
Issue the multihop-hostname keyword only on a device configured as a multihop tunnel switch.
The configuration shows the vpdn search-order command setting only if the command is explicitly configured.
Examples
The following example configures a NAS to perform tunnel authorization searches based on DNIS number only: vpdn search-order dnis
VPD-198
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn search-order
The following example configures a tunnel switch to select a tunnel destination based on the multihop hostname first, then on the domain name, and finally on the DNIS number: vpdn search-order multihop-hostname domain dnis
Related Commands Command Description
multihop-hostname Enables the tunnel switch to initiate a tunnel based on the hostname or tunnel ID of the ingress tunnel.
vpdn multihop
Enables VPDN multihop.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-199
VPDN Commands vpdn session accounting network
vpdn session accounting network
To enable tunnel-link type accounting records to be sent to the RADIUS server, use the vpdn session
accounting network command in global configuration mode. To disable tunnel-link type accounting records, use the no form of this command.
vpdn session accounting network list-name
no vpdn session accounting network list-name
Syntax Description
list-name
Character string used to name the list of at least one accounting method. The
list-name vlaue must match the list-name value defined in the aaa
accounting command; otherwise, network accounting will not occur.
Defaults
Tunnel-link type accounting records are not sent.
Command Modes
Global configuration
Command History Release
12.2(15)B
12.3(14)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
Before you enable the vpdn session accounting network command, you must enable network accounting by using the aaa accounting command.
Note
If the default network accounting method list is configured and no additional accounting configurations are enabled on the interface, network accounting is enabled by default.
If the vpdn session accounting network command is linked to the default method list, all tunnel-link accounting records are enabled for those sessions.
This command displays the following tunnel-link accounting type records, which are used with the
RADIUS accounting attribute Acct-Status-Type (attribute 40):
•
•
Tunnel-Link-Start (12)—Marks the creation of a tunnel link.
Tunnel-Link-Stop (13)—Marks the end of a tunnel link.
Note
Only some tunnel types (such as Layer 2 Transport Protocol [L2TP]) support the multiple links per tunnel; these values should be included only in accounting packets for tunnel types that support multiple links per tunnel.
VPD-200
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn session accounting network
•
Tunnel-Link-Reject (14)—Marks the rejection of a tunnel setup for a new link in an existing tunnel.
Only some tunnel types (L2TP) support the multiple links per tunnel; this value should be included only in accounting packets for tunnel types that support multiple links per tunnel.
Note
If either Tunnel-Link-Start or Tunnel-Link-Stop are enabled, Tunnel-Link-Reject will be sent, even if it has not been enabled.
Examples
The following example shows how to configure an L2TP access concentrator (LAC) to send tunnel-link type accounting records to the RADIUS server: aaa accounting network m1 start-stop group radius vpdn enable vpdn tunnel accounting network m1 vpdn session accounting network m1 vpdn search-order domain dnis
!
vpdn-group 1
request-dialin
protocol l2tp
domain cisco.com
initiate-to ip 10.1.1.1
local name ISP_LAC
Related Commands Command aaa accounting vpdn tunnel accounting network
Description
Enables AAA accounting of requested services for billing or security purposes when you use RADIUS or TACACS+.
Enables tunnel type accounting records to be sent to the RADIUS server.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-201
VPDN Commands vpdn session-limit
vpdn session-limit
To limit the number of simultaneous virtual private dialup network (VPDN) sessions allowed on a router, use the vpdn session-limit command in global configuration mode. To remove a configured session limit restriction, use the no form of this command.
vpdn session-limit sessions
no vpdn session-limit
Syntax Description
sessions
Maximum number of simultaneous VPDN sessions that are allowed on a router. Valid values range from 1 to 5000.
Command Default
No session limit exists for the router.
Command Modes
Global configuration
Command History Release
12.0(6)T
Modification
This command was introduced.
Usage Guidelines
Use the vpdn session-limit command to configure the maximum number of VPDN sessions allowed on the router.
VPDN session limits can be configured globally using the vpdn session-limit command, at the level of a VPDN group using the session-limit (VPDN) command, or for all VPDN groups associated with a particular VPDN template using the group session-limit command.
The hierarchy for the application of VPDN session limits is as follows:
•
Globally configured session limits take precedence over session limits configured for a VPDN group or in a VPDN template. The total number of sessions on a router may not exceed a configured global session limit.
•
Session limits configured for a VPDN template are enforced for all VPDN groups associated with that VPDN template. The total number of sessions for all of the associated VPDN groups may not exceed the configured VPDN template session limit.
•
Session limits configured for a VPDN group are enforced for that VPDN group.
Examples
The following example sets a limit of two simultaneous VPDN sessions on the router: vpdn session-limit 2
VPD-202
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn session-limit
Related Commands Command Description group session-limit
Limits the number of simultaneous VPDN sessions allowed across all VPDN groups associated with a particular VPDN template.
show vpdn session
Displays session information about active Layer 2 sessions for a VPDN.
session-limit
(VPDN)
Limits the number of simultaneous VPDN sessions allowed for a specified
VPDN group.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-203
VPDN Commands vpdn softshut
vpdn softshut
To prevent new sessions from being established on a virtual private dialup networking (VPDN) tunnel without disturbing existing sessions, use the vpdn softshut command in global configuration mode. To return VPDN tunnels to active service, use the no form of this command.
vpdn softshut no vpdn softshut
Syntax Description
This command has no arguments or keywords.
Command Default
New sessions may be established.
Command Modes
Global configuration
Command History Release
12.0(5)T
Modification
This command was introduced.
Usage Guidelines
When this feature is enabled on a network access server (NAS), the potential session will be authorized before it is refused. This authorization ensures that accurate accounting records can be kept.
When this feature is enabled on a home gateway, the reason for the session refusal will be returned to the NAS. This information is recorded in the VPN history failure table.
When this command is enabled, use the show vpdn history failure command to view records of refused attempts to establish new sessions.
Examples
The following example first enables the vpdn softshut command and then shows a syslog message stating that an attempt to establish a new session was refused:
Router(config)# vpdn softshut
Router(config)#
00:11:17:%VPDN-6-SOFTSHUT:L2F HGW great_went has turned on softshut and rejected user [email protected]
Router(config)#
Related Commands Command Description show vpdn history failure
Displays the content of the failure history table.
vpdn session-limit
Limits the number of simultaneous VPDN sessions that can be established on a router.
VPD-204
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn source-ip
vpdn source-ip
To globally specify an IP address that is different from the physical IP address used to open a virtual private dialup network (VPDN) tunnel, use the vpdn source-ip command in global configuration mode.
To disable use of the alternate IP address, use the no form of this command.
vpdn source-ip ip-address
no vpdn source-ip ip-address
Syntax Description
ip-address
Alternate IP address.
Command Default
No alternate IP address is specified.
Command Modes
Global configuration
Command History Release
11.3
Modification
This command was introduced.
Usage Guidelines
Use the vpdn source-ip command to specify a single alternate IP address to be used for all tunnels on the device. A single source IP address can be configured globally per device.
Use the source-ip command in VPDN group configuration mode to configure an alternate IP address to be used for only those tunnels associated with that VPDN group.
The VPDN group-level configuration will override the global configuration.
Examples
This example sets a source IP address of 172.24.48.3: vpdn source-ip 172.24.48.3
Related Commands Command source-ip vpdn enable
Description
Specifies an IP address that is different from the physical IP address used to open a VPDN tunnel for the tunnels associated with a VPDN group.
Enables VPDN on the router and informs the router to look for tunnel definitions in a local database and on a remote authorization server, if one is present.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-205
VPDN Commands vpdn tunnel accounting network
vpdn tunnel accounting network
To enable tunnel type accounting records to be sent to the RADIUS server, use the vpdn tunnel
accounting network command in global configuration mode. To disable tunnel type accounting records, use the no form of this command.
vpdn tunnel accounting network list-name
no vpdn tunnel accounting network list-name
Syntax Description
list-name
Character string used to name the list of at least one accounting method. The
list-name value must match the list-name value defined in the aaa
accounting command; otherwise, network accounting will not occur.
Defaults
Tunnel type accounting records are not sent.
Command Modes
Global configuration
Command History Release
12.2(15)B
12.3(4)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(4)T.
Usage Guidelines
Before you enable the vpdn tunnel accounting network command, you must enable network accounting by using the aaa accounting command.
Note
If the default network accounting method list is configured and no additional accounting configurations are enabled on the interface, network accounting is enabled by default.
If the vpdn tunnel accounting network command is linked to the default method list, all tunnel accounting records are enabled for those sessions.
This command displays the following tunnel accounting type records, which are used with the RADIUS accounting attribute Acct-Status-Type (attribute 40):
Tunnel-Start (9)—Marks the beginning of a tunnel setup with another node.
Tunnel-Stop (10)—Marks the end of a tunnel connection to or from another node.
Tunnel-Reject (11)—Marks the rejection of a tunnel setup with another node.
Note
If either Tunnel-Start or Tunnel-Stop are enabled, Tunnel-Reject will be sent, even if it has not been enabled.
VPD-206
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn tunnel accounting network
Examples
The following example shows how to configure an L2TP access concentrator (LAC) to send tunnel type accounting records to the RADIUS server:
! The method list defined in the VPDN command must be the same as the method list defined
! in aaa accounting command; otherwise, accounting will not occur.
aaa accounting network m1 start-stop group radius vpdn enable vpdn tunnel accounting network m1 vpdn session accounting network m1 vpdn search-order domain dnis
!
vpdn-group 1
request-dialin
protocol l2tp
domain cisco.com
initiate-to ip 10.1.1.1
local name ISP_LAC
Related Commands Command aaa accounting vpdn session accounting network
Description
Enables AAA accounting of requested services for billing or security purposes when you use RADIUS or TACACS+.
Enables tunnel-link type accounting records to be sent to the RADIUS server.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-207
VPDN Commands vpdn tunnel authorization network
vpdn tunnel authorization network
To enable the Layer 2 Tunnel Protocol (L2TP) tunnel server or network access server (NAS) to perform remote authentication, authorization, and accounting (AAA) tunnel authentication and authorization, use the vpdn tunnel authorization network command in global configuration mode. To disable remote tunnel authentication and authorization and return to the default of local tunnel authentication and authorization, use the no form of this command.
vpdn tunnel authorization network {list-name | default}
no vpdn tunnel authorization network {list-name | default}
Syntax Description
list-name
default
Character string used to name the list of at least one accounting method. If the list-name argument was specified in the aaa authorization network command, you must use the same list name with the vpdn tunnel
authorization network command.
Specifies the default authorization methods that are listed with the aaa
authorization network command. If the default keyword was specified in the aaa authorization network command, you must use the default keyword with the vpdn tunnel authorization network command.
Command Default
If this command is not enabled, the device will perform authentication locally.
Command Modes
Global configuration
Command History Release
12.2(15)B
12.3(4)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(4)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use this command to specify the authorization method list that will be used for remote tunnel hostname-based authorization. The method list (named or default) is defined using the
aaa authorization network command.
If a method list for tunnel authorization is not specified via the aaa authorization network command, local authorization using the local virtual private dialup network (VPDN) group configuration will occur.
Note
This method list is only for L2TP tunnel authorization and termination; it is not intended for domain or dialed number identification service (DNIS)-based authorization that is typically done on the tunnel terminator. Thus, this command can be enabled only on the tunnel terminator—the NAS for dial-out and the tunnel server for dial-in.
VPD-208
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn tunnel authorization network
Examples
The following example shows how to configure the tunnel server to enable remote RADIUS tunnel authentication and authorization:
! Define a RADIUS server group
Router(config)# aaa group server radius VPDN-group
Router(config-sg-radius)# server 10.102.48.91 auth-port 1645 acct-port 1646
Router(config-sg-radius)# exit
Router(config)# aaa authorization network mymethodlist group VPDN-Group
Router(config)# vpdn tunnel authorization network mymethodlist
Router(config)# vpdn tunnel authorization virtual-template 10
Related Commands Command aaa authorization
Description
Sets parameters that restrict user access to a network.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-209
VPDN Commands vpdn tunnel authorization password
vpdn tunnel authorization password
To configure a password for the RADIUS authentication request to retrieve the tunnel configuration that is based on the remote tunnel hostname, use the vpdn tunnel authorization password command in global configuration mode. To return to the default password, use the no form of this command.
vpdn tunnel authorization password password
no vpdn tunnel authorization password password
Syntax Description
password
Character string, which is truncated after 25 characters.
Command Default
The password is set to “cisco.”
Command Modes
Global configuration
Command History Release
12.2(15)B
12.3(4)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(4)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
This command can be used on either theLayer 2 Tunnel Protocol (L2TP) network access server (NAS) or L2TP tunnel server when remote RADIUS tunnel authentication is enabled.
Examples
The following example shows how to set the password to configure the tunnel server to enable remote
RADIUS tunnel authentication and authorization and set the password to mypassword:
Router(config)# aaa authorization network mymethodlist group VPDN-Group
Router(config)# vpdn tunnel authorization network mymethodlist
Router(config)# vpdn tunnel authorization virtual-template 10
Router(config)# vpdn tunnel authorization password mypassword
Related Commands Command Description vpdn tunnel authorization network
Enables the L2TP tunnel server or NAS to perform remote
AAA tunnel authentication and authorization.
VPD-210
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn tunnel authorization virtual-template
vpdn tunnel authorization virtual-template
To select the default virtual template from which to clone virtual access interfaces, use the vpdn tunnel
authorization virtual-template command in global configuration mode. To remove the default virtual template, use the no form of this command.
vpdn tunnel authorization virtual-template vtemplate-number
no vpdn tunnel authorization virtual-template vtemplate-number
Syntax Description
vtemplate-number
The default virtual template number that will be used for cloning on the local router. Valid values range from 1 to 200.
Command Default
No default virtual template is specified.
Command Modes
Global configuration
Command History Release
12.2(15)B
12.3(4)T
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(4)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
This command should be used if a virtual template is not specified in the local virtual private dialup network (VPDN) group (for local authentication) or in a remote RADIUS configuration (via the vpdn-vtemplate attribute).
Note
This command applies only on the L2TP tunnel server.
Examples
The following example shows how to configure the tunnel server to enable remote RADIUS tunnel authentication and authorization and how to specify a default virtual template:
! Define a RADIUS server group
Router(config)# aaa group server radius VPDN-group
Router(config-sg-radius)# server 10.102.48.91 auth-port 1645 acct-port 1646
Router(config-sg-radius)# exit
! RADIUS configurations only
Router(config)# aaa authorization network mymethodlist group VPDN-Group
Router(config)# vpdn tunnel authorization network mymethodlist
! Can be used for local vpdn-group tunnel authentication or remote RADIUS tunnel
! authentication
Router(config)# vpdn tunnel authorization virtual-template 10
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-211
VPDN Commands vpdn tunnel authorization virtual-template
Related Commands Command Description vpdn tunnel authorization network
Enables the L2TP tunnel server or NAS to perform remote
AAA tunnel authentication and authorization.
VPD-212
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn-group
vpdn-group
To create a virtual private dialup network (VPDN) group and to enter VPDN group configuration mode, use the vpdn-group command in global configuration mode. To delete a VPDN group, use the no form of this command.
vpdn-group name
no vpdn-group name
Syntax Description
name
Name of the VPDN group.
Defaults
No VPDN groups are defined.
Command Modes
Global configuration
Command History Release
12.0(4)XI
12.0(5)T
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.0(5)T.
Usage Guidelines
Issuing the vpdn-group command creates a VPDN group with the specified name and enters VPDN group configuration mode. If a VPDN group with the specified name already exists, issuing the
vpdn-group command will enter VPDN group configuration mode and allow configuration of that
VPDN group.
A VPDN group can be associated with a customer profile or a VPDN profile by issuing the vpdn group command in customer profile configuration mode or VPDN profile configuration mode.
Examples
Release 12.4T
The following example creates the VPDN group named l2tp and enters VPDN group configuration mode:
Router(config)# vpdn-group l2tp
Router(config-vpdn)#
The following example associates the VPDN group created in the preceding example with the VPDN profile named profile1:
Router(config)# resource-pool profile vpdn profile1
Router(config-vpdn-profile)# vpdn group l2tp
The following example creates a VPDN group named l2f and associates it with the customer profile named customer1:
Router(config)# vpdn-group l2f
!
Router(config)# resource-pool profile customer customer1
Router(config-customer-profile)# vpdn group l2f
Cisco IOS VPDN Command Reference
VPD-213
VPDN Commands vpdn-group
Related Commands Command resource-pool profile customer resource-pool profile vpdn vpdn group
Description
Creates a customer profile and enters customer profile configuration mode.
Creates a VPDN profile and enters VPDN profile configuration mode.
Associates a VPDN group with a customer or VPDN profile.
VPD-214
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn-template
vpdn-template
To create a virtual private dialup network (VPDN) template and enter VPDN template configuration mode, use the vpdn-template command in global configuration mode. To delete a VPDN template, use the no form of this command.
vpdn-template [name]
no vpdn-template [name]
Syntax Description
name
(Optional) Name of a VPDN template.
Command Default
No VPDN template exists. The system default values are applied to individual VPDN groups for any parameters that are not configured in the individual VPDN group.
Command Modes
Global configuration
Command History Release
12.2(4)B
12.2(8)T
12.2(13)T
12.2(28)SB
Modification
This command was introduced on the Cisco 7200 series and Cisco 7401ASR routers.
This command was integrated into Cisco IOS Release 12.2(8)T without support for the name argument.
Support was added for the name argument in Cisco IOS Release 12.2(13)T.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use this command to configure values for VPDN parameters in a VPDN template. A single unnamed
VPDN template may be configured. Multiple named VPDN templates can be configured. A VPDN group can be associated with only one VPDN template.
Values configured in the global (unnamed) VPDN template are applied to all VPDN groups by default.
A VPDN group can be disassociated from the global VPDN template, or associated with a named VPDN template. Associating a VPDN group with a named VPDN template automatically disassociates it from the global VPDN template.
The values configured in a VPDN template are applied to all associated VPDN groups, unless specific values are configured for individual VPDN groups. VPDN parameters that are not specified in the individual VPDN group or in the associated VPDN template are assigned system default values.
The hierarchy for the application of VPDN parameters to a VPDN group is as follows:
•
VPDN parameters configured for the individual VPDN group are always applied to that VPDN group.
•
•
VPDN parameters configured in the associated VPDN template are applied for any settings not specified in the individual VPDN group configuration.
System default settings for VPDN parameters are applied for any settings not configured in the individual VPDN group or the associated VPDN template.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-215
VPDN Commands vpdn-template
Not all commands that are available for configuring a VPDN group can be used to configure a VPDN
template. Table 24 lists the commands that can be used to configure the VPDN template.
Table 24 Commands Available for VPDN Template Configuration
Command Name default (VPDN) description group session-limit ip mtu adjust
Description
Removes a VPDN subgroup configuration, or resets it to its default value.
Adds a description for a VPDN group.
Specifies the maximum number of concurrent sessions allowed across all VPDN groups associated with a particular
VPDN template.
Enables automatic adjustment of the IP maximum transmission unit (MTU) on a virtual access interface.
Enables the discovery of the path MTU for Layer 2 traffic.
ip pmtu ip precedence (VPDN) ip tos (VPDN) l2f ignore-mid-sequence l2f tunnel busy timeout l2tp security crypto-profile l2tp sequencing l2tp tunnel authentication
Sets the precedence value in the VPDN Layer 2 encapsulation header.
Sets the type of service (ToS) bits in the VPDN Layer 2 encapsulation header.
Configures the router to ignore message identifier (MID) sequence numbers for sessions in a Layer 2 Forwarding (L2F) tunnel.
Configures the amount of time that the router will wait before attempting to recontact an L2F peer that was previously busy.
l2f tunnel retransmit initial retries
Configures the number of times that the router will attempt to send the initial control packet for tunnel establishment before considering an L2F peer busy.
l2f tunnel retransmit retries
Configures the number of times the router will attempt to resend an L2F tunnel control packet before tearing the tunnel down.
l2f tunnel timeout setup l2tp attribute clid mask-method l2tp drop out-of-order l2tp hidden
Configures the amount of time that the router will wait for a confirmation message after sending out the initial L2F control packet before considering a peer busy.
Configures a network access server (NAS) to provide Layer
2 Tunnel Protocol (L2TP) calling line ID suppression for local authorization.
Instructs a NAS or tunnel server using L2TP to drop packets that are received out of order.
Enables L2TP attribute-value (AV) pair hiding, which encrypts the value of sensitive AV pairs.
l2tp ip udp checksum
Enables IP User Datagram Protocol (UDP) checksums on
L2TP payload packets.
Configures IP Security (IPSec) protection of L2TP sessions associated with a VPDN group.
Enables sequencing for packets sent over an L2TP tunnel.
Enables L2TP tunnel authentication.
VPD-216
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpdn-template
Table 24 Commands Available for VPDN Template Configuration (continued)
Command Name l2tp tunnel bearer capabilities l2tp tunnel busy timeout l2tp tunnel framing capabilities l2tp tunnel hello l2tp tunnel password l2tp tunnel receive-window l2tp tunnel retransmit initial timeout l2tp tunnel retransmit retries
Configures the number of packets allowed in the local receive window for an L2TP control channel.
l2tp tunnel retransmit initial retries Configures the number of times that the router will attempt to send out the initial L2TP control packet for tunnel establishment before considering a peer busy.
Configures the amount of time that the router will wait before resending an initial L2TP control packet out to establish a tunnel.
Configures the number of retransmission attempts made for an L2TP control packet.
l2tp tunnel retransmit timeout l2tp tunnel timeout no-session l2tp tunnel timeout setup l2tp tunnel zlb delay
Configures the amount of time that the router will wait before resending an L2TP control packet.
Configures the time a router waits after an L2TP tunnel becomes empty before tearing down the tunnel.
Configures the amount of time that the router will wait for a confirmation message after sending out the initial L2TP control packet before considering a peer busy.
Configures the delay time before a zero length bit (ZLB) control message must be acknowledged.
local name
Description
Sets the bearer-capability value used by the Cisco router.
Configures the amount of time that the router will wait before attempting to recontact an L2TP peer that was previously busy.
Sets the framing-capability value used by the Cisco router.
Sets the number of seconds between sending hello keepalive packets for an L2TP tunnel.
Sets the password the router will use to authenticate the tunnel.
pptp flow-control receive-window pptp flow-control static-rtt pptp tunnel echo redirect identifier
Specifies a local hostname that the tunnel will use to identify itself.
Specifies how many packets the Point-to-Point Tunnel
Protocol (PPTP) client can send before it must wait for the acknowledgment from the tunnel server.
Specifies the timeout interval of the PPTP tunnel server between sending a packet to the client and receiving a response.
Specifies the period of idle time on the PPTP tunnel that will trigger an echo message from the tunnel server to the client.
Configures a VPDN redirect identifier to use for L2TP call redirection on a NAS.
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-217
VPDN Commands vpdn-template
Table 24
vpn
Commands Available for VPDN Template Configuration (continued)
Command Name relay pppoe bba-group
Description
Configures the PPP over Ethernet (PPPoE) broadband access
(BBA) group that responds to PPPoE Active Discovery
(PAD) messages.
Specifies that the source and destination IP addresses of a given VPDN group belong to a specified VPN routing and forwarding instance (VRF).
Examples
The following example enters VPDN template configuration mode and configures two VPDN parameters in the global VPDN template:
Router(config)# vpdn-template
Router(config-vpdn-templ)# local name myrouter
Router(config-vpdn-templ)# ip mtu adjust
The following example creates a VPDN template named l2tp, enters VPDN template configuration mode, configures two VPDN parameters in the VPDN template, and associates the VPDN group named l2tptunnels with the VPDN template:
Router(config)# vpdn-template l2tp
Router(config-vpdn-templ)# l2tp tunnel busy timeout 65
Router(config-vpdn-templ)# l2tp tunnel password 7 tunnel4me
!
Router(config)# vpdn-group l2tptunnels
Router(config-vpdn)# source vpdn-template l2tp
The following example configures a VPDN template called customer1 and applies a group session limit of 50 to all VPDN groups associated with that VPDN template:
Router(config)# vpdn-template customer1
Router(config-vpdn-templ)# group session-limit 50
Related Commands Command group session-limit
Description
Specifies the maximum number of concurrent sessions allowed across all
VPDN groups associated with a particular VPDN template.
source vpdn-template
Associates a VPDN group with a VPDN template.
vpdn-group
Creates a VPDN group and enters VPDN group configuration mode.
VPD-218
Cisco IOS VPDN Command Reference
Release 12.4T
VPDN Commands vpn
vpn
To specify that the source and destination IP addresses of a given virtual private dialup network (VPDN) group belong to a specified Virtual Private Network (VPN) routing and forwarding (VRF) instance, use the vpn command in VPDN group or VPDN template configuration mode. To disassociate all IP addresses in a VPDN group from a VRF, use the no form of this command.
vpn {vrf vrf-name | id vpn-id}
no vpn
Syntax Description
vrf vrf-name
id vpn-id
Name of the VRF instance to be associated with the IP addresses of the
VPDN group.
VPN ID of the VRF to be associated with the IP addresses of the VPDN group.
Command Default
VPDN groups are not associated with a VRF.
Command Modes
VPDN group configuration
VPDN template configuration
Command History Release
12.2(15)T
12.3(7)XI7
12.2(28)SB
Modification
This command was introduced.
This command was integrated into Cisco IOS Release 12.3(7)XI7 and implemented on the Cisco 10000 series routers.
This command was integrated into Cisco IOS Release 12.2(28)SB.
Usage Guidelines
Use the vpn command to configure the Cisco IOS software to look up a VPDN source or destination IP address in a specific VPN routing table instead of the global routing table.
Before you can issue the vpn command, a VRF instance must be created using the ip vrf command.
The vpn command can be used with both dial-in and dial-out VPDN scenarios.
Examples
The following example associates the IP addresses configured in the VPDN group named group1 with the VRF named vrf-second:
v
pdn-group group1 request-dialin
!
protocol l2tp vpn vrf vrf-second source-ip 172.16.1.9
initiate-to ip 172.16.1.1
Release 12.4T
Cisco IOS VPDN Command Reference
VPD-219
VPDN Commands vpn
The following example associates the IP addresses configured in the VPDN group named group2 with the VPN ID 11:2222: vpdn-group group2 request-dialin protocol l2tp
!
vpn id 11:2222 source-ip 172.16.1.9
initiate-to ip 172.16.1.1
Related Commands Command ip vrf show ip route show vpdn session show vpdn tunnel vpdn-group vpdn-template
Description
Configures a VRF routing table.
Displays all static IP routes, or those installed using the AAA route download function.
Displays session information about active Layer 2 sessions for a VPDN.
Displays information about active Layer 2 tunnels for a VPDN.
Creates a VPDN group and enters VPDN group configuration mode.
Creates a VPDN template and enters VPDN template configuration mode.
VPD-220
Cisco IOS VPDN Command Reference
Release 12.4T
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Configure and maintain VPDNs
Configure L2TP and L2F tunnels
Configure VPDN groups and templates
Configure dial-in and dial-out calls
Configure VPDN session limits
Configure VPDN security
Troubleshoot VPDN issues
Frequently asked questions
To configure a VPDN group, you must use the vpdn-group command. This command creates a VPDN group and enters VPDN group configuration mode. In VPDN group configuration mode, you can configure the various attributes of the VPDN group, such as the tunneling protocol, the virtual template, the session limit, and the security settings.
To configure a VPDN tunnel, you must use the tunnel command. This command creates a VPDN tunnel and enters VPDN tunnel configuration mode. In VPDN tunnel configuration mode, you can configure the various attributes of the VPDN tunnel, such as the tunneling protocol, the remote IP address, the authentication method, and the encryption method.
To configure a VPDN session, you must use the session command. This command creates a VPDN session and enters VPDN session configuration mode. In VPDN session configuration mode, you can configure the various attributes of the VPDN session, such as the authentication method, the encryption method, and the bandwidth allocation.