ISDN Authentication and Callback with Caller ID

Available Languages

Download Options

  • PDF     (23.9 KB)
    View with Adobe Reader on a variety of devices
Updated:January 29, 2008
Document ID:15925

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

Authentication based on caller ID provides greater security by authenticating remote clients based not only on user ID and password, but also on dialing location.

Prerequisites

Requirements

There are no specific prerequisites for this document.

Components Used

This document is not restricted to specific software and hardware versions.

Conventions

Refer to Cisco Technical Tips Conventions for more information on document conventions.

Background Information

This document first explains the different meanings for the dialer caller command (aside from its use for callback) when used on a dialer profile interface rather than a dialer rotary group interface.

In the latter case, it is a screening command analogous to isdn caller on an ISDN interface. In the former case, it is a command that provides a mechanism to bind incoming calls to the correct dialer profile based on the calling party number that is presented in the incoming Q.931 setup message. Failure to match the presented calling party number with a dialer caller number on a dialer profile does not necessarily cause the call to be rejected as unbindable if the physical interface is configured for PPP authentication. You can also match the presented host name with the configured dialer remote-name value to bind on this basis. This is because binding on the basis of the presented calling party number is not the only possible criterion for a successful bind. Refer to Configuring and Troubleshooting Dialer Profiles for more information on binding and dialer profiles.

From Cisco IOS® Software Release 12.0(7)T and later, remove PPP authentication from the physical interface to be able to screen calls solely based on the calling party number. In such cases, calls for which the router cannot find a matching dialer caller value are rejected as unbindable. You can use PAP or CHAP to configure PPP authentication on the dialer interface if you want to properly authenticate these calls.

The initial call is rejected (not answered) with the callback option added to caller ID authentication. However, callback is initiated to the calling number to make the connection. You can use callback for:

  • Consolidation and centralization of phone billing

  • Cost saving on toll calls

  • Access control

This sample configuration illustrates the use of the dialer caller number[callback] command to configure caller ID screening and optionally to enable ISDN caller ID callback for dialer profile DDR. You can also use this command for legacy DDR. This command configures the Cisco IOS software to accept or reject the ISDN call based on the PSTN number of the calling party. For instance, the dialer caller 1234 command allows the router to accept the ISDN call with the calling number 1234.

Note: This configuration requires that the Telco pass caller ID information to the router or access server. No calls are accepted if you enable caller ID screening but do not have caller ID information being passed to the router.

Refer to Configuring ISDN Caller ID Callback for more information on prerequisites and other optional features available with ISDN caller ID authentication and callback.

Configure

In this section, you are presented with the information to configure the features described in this document.

Note: Use the Command Lookup Tool (registered customers only) to find more information on the commands used in this document.

Note: These configurations are truncated to display only the relevant information.

Network Diagram

This document uses this network setup:

ISDN_3Rt.gif

Configurations

This document uses these configurations:

In this scenario, Routers 2 and 3 both initiate DDR calls to Router 1. Router 1 authenticates both Routers 2 and 3 solely based on caller ID. Router 1 is configured to call back Router 2, but not to call back Router 3.

Tip: Choose the appropriate sections of the configuration to configure either caller ID screening or the caller ID callback feature, but not both. For example, the diagram shows that callback needs the configuration of Router 2 and Router 1. However, choose only the dialer interface configuration associated with Router 2 (it is clearly marked in interface Dialer 1) since Router 1 performs both tasks.

Router 1 
version 12.1
service timestamps debug datetime msec
service timestamps log datetime msec
!
hostname Router1
!
isdn switch-type basic-net3
!
interface Loopback0
ip address 10.0.0.1 255.255.255.0
!
interface BRI0
no ip address
dialer pool-member 1

!--- BRI 0 is a member of dialer pool 1 which is defined !--- under interface Dialer 1.

isdn switch-type basic-net3
!
interface Dialer1

!--- DDR dialer interface to call Router 2.

description for Router2
ip unnumbered Loopback0
encapsulation ppp
dialer pool 1

!--- Interface BRI 0 is a member of dialer pool 1.

dialer enable-timeout 2

!--- The time (in seconds) to wait before initiating callback.

dialer string 6121  

!--- This number is used to call back Router 2.

dialer caller 6121 callback

!--- Permits calls from 6121 and initiates callback !--- to the same number.
 
dialer-group 1

!--- Use dialer-list 1 to define interesting traffic.

!
interface Dialer2

!--- This interface is used to authenticate calls from Router 3. !--- (Callback is NOT initiated to Router 3.)

description for Router3
ip unnumbered Loopback0
encapsulation ppp
dialer pool 1

!--- Interface BRI 0 is a member of dialer pool 1.

dialer caller 6101

!--- Permit calls from number 6101.

dialer-group 1

!--- Use dialer-list 1 to define interesting traffic.

!
dialer-list 1 protocol ip permit

!--- Define IP as interesting traffic.

Router 2 
version 12.1
service timestamps debug datetime msec
service timestamps log datetime ms
!
hostname Router2
!
isdn switch-type basic-net3
!
interface BRI0
no ip address
encapsulation ppp
dialer pool-member 1
isdn switch-type basic-net3
!
interface Dialer1
ip address 10.0.0.2 255.255.255.0
encapsulation ppp
dialer pool 1
dialer string 6122

!--- The number to dial for Router 1 !--- (which initiates a callback).

dialer caller 6122

!--- Accept calls from 6122 (Router 1).

dialer-group 1
no cdp enable
!
dialer-list 1 protocol ip permit

Router 3 
version 12.1
service timestamps debug datetime msec
service timestamps log datetime msec
!
hostname Router3
!
isdn switch-type basic-net3
!
interface BRI0
no ip address
encapsulation ppp
dialer pool-member 1
isdn switch-type basic-net3
!
interface Dialer1
ip address 10.0.0.3 255.255.255.0
dialer pool 1
encapsulation ppp
dialer string 6122

!--- The number to dial for Router 1.

dialer-group 1
no cdp enable
!
dialer-list 1 protocol ip permit

Note: The client router dials the callback server in most callback scenarios. The two routers then negotiate callback parameters. The server disconnects the call and initiates the callback. The calling side might place few consecutive outgoing calls to the server while waiting for the server to call back during the interval between the initial call disconnect and the callback. This is normal DDR behavior because the client detects that the initial call failed and does not know that a callback is in progress.

Issue the dialer redial command on the calling side in order to prevent the client from constantly dialing the callback server. This suppresses additional outgoing calls to the server while waiting for the callback. The calls are suppressed until the predefined timer expires. For example, the client waits 15 seconds before initiating a redial if the dialer redial interval time is 15 seconds. The callback is completed and the client does not not have to dial again within that time.

Refer to Configuring Redial Timers After Failed Callback Dial Attempts for more information on implementing dialer redial.

Verify

Use this section to confirm that your configuration works properly.

The Output Interpreter Tool (registered customers only) (OIT) supports certain show commands. Use the OIT to view an analysis of show command output.

show Commands

Certain show commands are supported by the OIT, which allows you to view an analysis of show command output.

  • show isdn active—Displays information about current calls and provides information on both incoming and outgoing current ISDN calls.

  • show users—Displays information about the active lines on the router. You can also use the show caller command if your version of Cisco IOS supports it.

  • show dialer—Shows general diagnostic information for interfaces configured for DDR.

Sample show Output 

Router1#show isdn active

---------------------------------------------------------------------------
ISDN ACTIVE CALLS
---------------------------------------------------------------------------
Call  Calling   Called    Remote  Seconds Seconds Seconds Charges
Type  Number    Number    Name    Used    Left    Idle    Units/Currency
---------------------------------------------------------------------------
Out              6121     6121       24      96      23      0
In       6101             6101        7     113       6
---------------------------------------------------------------------------

Notice that one incoming and one outgoing call is in progress. The outgoing call is to number 6121, which corresponds to Router 2. The incoming call is from 6101, which corresponds to Router 3. Also note that a number identifies the remote routers in the Remote Name field rather than a name since PPP authentication is not configured.

Router1#show user

Line       User       Host(s)              Idle       Location
*  0 con 0                idle                 00:00:00
BR0:1                   Sync PPP             00:00:33   PPP: 10.0.0.2
BR0:2                   Sync PPP             00:00:15   PPP: 10.0.0.3
Interface  User      Mode                     Idle Peer Address

Notice that one B-channel is used to connect to Router 2 while the other B-channel connects to Router 3. Verify that the IP addresses match those configured on Routers 2 and 3.

Troubleshoot

Use this section to troubleshoot your configuration.

Troubleshooting Commands

The Output Interpreter Tool (registered customers only) (OIT) supports certain show commands. Use the OIT to view an analysis of show command output.

Note: Refer to Important Information on Debug Commands before you use debug commands.

  • debug dialer [events | packets]

  • debug isdn event

  • debug isdn q931

  • debug ppp negotiation—Displays information on PPP traffic and exchanges while negotiating the PPP components including Link Control Protocol (LCP), authentication, and Network Control Protocol (NCP). A successful PPP negotiation first opens the LCP state, then authenticates, and finally negotiates NCP.

Refer to Using the show isdn status Command for BRI Troubleshooting if you encounter ISDN lower-layer issues.

Sample debug Output 

Router1#show debug
     Dial on demand: Dial on demand events debugging is on 
     PPP: PPP protocol negotiation debugging is on 
     ISDN: ISDN Q931 packets debugging is on

This section displays debug output from Router 1 and shows Router 2 calling Router 1. Router 1 then initiates a callback to Router 2 and establishes a connection.

Note: Some of these debug output lines are broken into multiple lines for printing purposes.

*Mar  1 04:50:34.782: ISDN BR0: RX <-  SETUP pd = 8  callref = 0x0B
*Mar  1 04:50:34.790:         Bearer Capability i = 0x8890
*Mar  1 04:50:34.798:         Channel ID i = 0x89
*Mar  1 04:50:34.802:         Calling Party Number i = 0xA1, '6121
',Plan:ISDN, Type:National

!--- Calling party information is provided by the switch.

*Mar  1 04:50:34.818:         Called Party Number i = 0xC1, '6122',Plan:ISDN,
   Type:Subscriber(local)

!--- Called party information is provided by the switch.

*Mar  1 04:50:34.838: ISDN BR0: Event: Received a DATA call from 6121 on
   B1at 64 Kb/s
*Mar  1 04:50:34.842: BR0:1 DDR: Caller id 6121 matched to profile  

!--- The ISDN call (from Router 2) is authenticated.

*Mar  1 04:50:34.842: Di1 DDR: Caller id Callback server starting to  6121

!--- Initiates callback to 6121.
 
*Mar  1 04:50:34.866: ISDN BR0: TX ->  RELEASE_COMP pd = 8  callref = 0x8B
*Mar  1 04:50:34.870:         Cause i = 0x8095 - Call rejected
*Mar  1 04:50:36.778: ISDN BR0: RX <-  SETUP pd = 8  callref = 0x0C
*Mar  1 04:50:36.786:         Bearer Capability i = 0x8890
*Mar  1 04:50:36.794:         Channel ID i = 0x89
*Mar  1 04:50:36.798:         Calling Party Number i = 0xA1, '6121',Plan:ISDN,
   Type:National
*Mar  1 04:50:36.814:         Called Party Number i = 0xC1, '6122',Plan:ISDN,
   Type:Subscriber(local)
*Mar  1 04:50:36.834: ISDN BR0: Event: Received a DATA call from 6121 on B1at
   64 Kb/s
*Mar  1 04:50:36.838: BR0:1 DDR: Caller id 6121 matched to profile
*Mar  1 04:50:36.838: Di1 DDR: callback to 6121 already started
*Mar  1 04:50:36.862: ISDN BR0: TX ->  RELEASE_COMP pd = 8  callref = 0x8C
*Mar  1 04:50:36.866:         Cause i = 0x8095 - Call rejected

!--- Reject call (then initiate callback).

*Mar  1 04:50:36.878: DDR: Callback timer expired

!--- The timer is configured with the dialer enable-timeout command.

*Mar  1 04:50:36.878: Di1 DDR: beginning callback to  6121
*Mar  1 04:50:36.882: BR0 DDR: rotor dialout [priority]
*Mar  1 04:50:36.882: BR0 DDR: Dialing cause Callback return call

!--- The dialing cause is callback.

*Mar  1 04:50:36.886: BR0 DDR: Attempting to dial 6121

!--- Dialing 6121 (Router 2).

*Mar  1 04:50:36.902: ISDN BR0: TX ->  SETUP pd = 8  callref = 0x0E
*Mar  1 04:50:36.906:         Bearer Capability i = 0x8890
*Mar  1 04:50:36.914:         Channel ID i = 0x83
*Mar  1 04:50:36.922:         Called Party Number i = 0x80, '6121',Plan:Unknown,
   Type:Unknown
*Mar  1 04:50:36.998: ISDN BR0: RX <-  CALL_PROC pd = 8  callref = 0x8E
*Mar  1 04:50:37.002:         Channel ID i = 0x89
*Mar  1 04:50:37.402: ISDN BR0: RX <-  CONNECT pd = 8  callref = 0x8E
*Mar  1 04:50:37.418: ISDN BR0: TX ->  CONNECT_ACK pd = 8  callref = 0x0E
*Mar  1 04:50:37.426: %LINK-3-UPDOWN: Interface BRI0:1, changed state to up

!--- The interface is up.

*Mar  1 04:50:37.446: DDR: Freeing callback to  6121
*Mar  1 04:50:37.446: BRI0:1: interface must be fifo queue, force FIFO
*Mar  1 04:50:37.450: BR0:1 PPP: Phase is DOWN, Setup
*Mar  1 04:50:37.454: BR0:1 PPP: Treating connection as a callout
*Mar  1 04:50:37.454: BR0:1 PPP: Phase is ESTABLISHING, Active Open
*Mar  1 04:50:37.462: BR0:1 LCP: O CONFREQ [Closed] id 1 len 10
*Mar  1 04:50:37.462: BR0:1 LCP:    MagicNumber 0xE1288054 (0x0506E1288054)
*Mar  1 04:50:37.466: %DIALER-6-BIND: Interface BR0:1 bound to profile Di1
*Mar  1 04:50:37.478: BR0:1 PPP: Treating connection as a callout
*Mar  1 04:50:37.486: BR0:1 LCP: I CONFREQ [REQsent] id 2 Len 10
*Mar  1 04:50:37.490: BR0:1 LCP:    MagicNumber 0x000F4499 (0x0506000F4499)
*Mar  1 04:50:37.494: BR0:1 LCP: O CONFACK [REQsent] id 2 Len 10
*Mar  1 04:50:37.498: BR0:1 LCP:    MagicNumber 0x000F4499 (0x0506000F4499)
*Mar  1 04:50:37.502: BR0:1 LCP: I CONFACK [ACKsent] id 1 Len 10
*Mar  1 04:50:37.506: BR0:1 LCP:    MagicNumber 0xE1288054 (0x0506E1288054)
*Mar  1 04:50:37.506: BR0:1 LCP: State is Open

!--- The LCP negotiation is complete.

*Mar  1 04:50:37.510: BR0:1 PPP: Phase is UP
*Mar  1 04:50:37.514: BR0:1 IPCP: O CONFREQ [Closed] id 1 Len 10
*Mar  1 04:50:37.518: BR0:1 IPCP:    Address 10.0.0.1 (0x03060A000001)
*Mar  1 04:50:37.522: BR0:1 IPCP: I CONFREQ [REQsent] id 2 Len 10
*Mar  1 04:50:37.526: BR0:1 IPCP:    Address 10.0.0.2 (0x03060A000002)
*Mar  1 04:50:37.530: BR0:1 IPCP: O CONFACK [REQsent] id 2 Len 10
*Mar  1 04:50:37.534: BR0:1 IPCP:    Address 10.0.0.2 (0x03060A000002)
*Mar  1 04:50:37.550: BR0:1 IPCP: I CONFACK [ACKsent] id 1 Len 10
*Mar  1 04:50:37.550: BR0:1 IPCP:    Address 10.0.0.1 (0x03060A000001)

!--- IPCP address negotiation.

*Mar  1 04:50:37.554: BR0:1 IPCP: State is Open
*Mar  1 04:50:37.562: BR0:1 DDR: dialer protocol up
*Mar  1 04:50:37.570: Di1 IPCP: Install route to 10.0.0.2

!--- Route to Router 2 is installed.

*Mar  1 04:50:38.510: %LINEPROTO-5-UPDOWN: Line protocol on InterfaceBRI0:1,
   changed state to up

In this section, the debug output displays Router 3 calling Router 1. Router 3 is then authenticated based on caller ID information and is connected to Router 1 without a callback.

*Mar  1 04:50:54.230: ISDN BR0: RX <-  SETUP pd = 8  callref = 0x0D

!--- Receive a call setup.

*Mar  1 04:50:54.238:         Bearer Capability i = 0x8890
*Mar  1 04:50:54.242:         Channel ID i = 0x8A
*Mar  1 04:50:54.250:         Calling Party Number i = 0xA1, '6101',Plan:ISDN,
   Type:National

!--- Calling party (Router 3) information is provided by the switch.

*Mar  1 04:50:54.266:         Called Party Number i = 0xC1, '6122',Plan:ISDN,
   Type:Subscriber(local)

!--- Called party (Router 1) information is provided by the switch.

*Mar  1 04:50:54.286: ISDN BR0: Event: Received a DATA call from 6101 on B2at
   64 Kb/s
*Mar  1 04:50:54.290: BR0:2 DDR: Caller id 6101 matched to profile 

!--- The ISDN call (from Router 3) is authenticated.

*Mar  1 04:50:54.290: BRI0:2: interface must be FIFO queue, force FIFO
*Mar  1 04:50:54.294: BR0:2 PPP: Phase is DOWN, Setup
*Mar  1 04:50:54.298: %DIALER-6-BIND: Interface BR0:2 bound to profile Di2

!--- The interface is bound to interface Dialer 2.

*Mar  1 04:50:54.314: ISDN BR0: TX ->  CALL_PROC pd = 8  callref = 0x8D
*Mar  1 04:50:54.318:         Channel ID i = 0x8A
*Mar  1 04:50:54.326: %LINK-3-UPDOWN: Interface BRI0:2, changed state to up
*Mar  1 04:50:54.350: BR0:2 PPP: Treating connection as a callin
*Mar  1 04:50:54.354: BR0:2 PPP: Phase is ESTABLISHING, Passive Open
*Mar  1 04:50:54.354: BR0:2 LCP: State is Listen
*Mar  1 04:50:54.630: ISDN BR0: TX ->  CONNECT pd = 8  callref = 0x8D
*Mar  1 04:50:54.698: ISDN BR0: RX <-  CONNECT_ACK pd = 8  callref = 0x0D
*Mar  1 04:50:54.706:         Channel ID i = 0x8A
*Mar  1 04:50:54.766: BR0:2 LCP: I CONFREQ [Listen] id 31 Len 10
*Mar  1 04:50:54.770: BR0:2 LCP:    MagicNumber 0x099285FD (0x0506099285FD)
*Mar  1 04:50:54.774: BR0:2 LCP: O CONFREQ [Listen] id 1 Len 10
*Mar  1 04:50:54.778: BR0:2 LCP:    MagicNumber 0xE128C3F7 (0x0506E128C3F7)
*Mar  1 04:50:54.782: BR0:2 LCP: O CONFACK [Listen] id 31 Len 10
*Mar  1 04:50:54.786: BR0:2 LCP:    MagicNumber 0x099285FD (0x0506099285FD)
*Mar  1 04:50:54.790: BR0:2 LCP: I CONFACK [ACKsent] id 1 Len 10
*Mar  1 04:50:54.794: BR0:2 LCP:    MagicNumber 0xE128C3F7 (0x0506E128C3F7)
*Mar  1 04:50:54.798: BR0:2 LCP: State is Open

!--- LCP negotiation is complete.

*Mar  1 04:50:54.802: BR0:2 PPP: Phase is UP
*Mar  1 04:50:54.806: BR0:2 IPCP: O CONFREQ [Closed] id 1 Len 10
*Mar  1 04:50:54.810: BR0:2 IPCP:    Address 10.0.0.1 (0x03060A000001)
*Mar  1 04:50:54.814: BR0:2 IPCP: I CONFREQ [REQsent] id 17 Len 10
*Mar  1 04:50:54.818: BR0:2 IPCP:    Address 10.0.0.3 (0x03060A000003)
*Mar  1 04:50:54.822: BR0:2 IPCP: O CONFACK [REQsent] id 17 Len 10
*Mar  1 04:50:54.826: BR0:2 IPCP:    Address 10.0.0.3 (0x03060A000003)
*Mar  1 04:50:54.830: BR0:2 IPCP: I CONFACK [ACKsent] id 1 Len 10
*Mar  1 04:50:54.834: BR0:2 IPCP:    Address 10.0.0.1 (0x03060A000001)

!--- IPCP address negotiation is complete.

*Mar  1 04:50:54.834: BR0:2 IPCP: State is Open
*Mar  1 04:50:54.842: BR0:2 DDR: dialer protocol up
*Mar  1 04:50:54.850: Di2 IPCP: Install route to 10.0.0.3

!--- Route to Router 3 is installed.

*Mar  1 04:50:55.802: %LINEPROTO-5-UPDOWN: Line protocol on InterfaceBRI0:2,
   changed state to up

Related Information

Revision History

Revision Publish Date Comments
1.0
29-Jan-2008
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products