Usage Guidelines

You must first enable a tunneling protocol on the VPDN group by using the protocol (VPDN) command before you can enable the virtual-template command. Removing or modifying the protocol command removes the virtual-template command from the VPDN group.

Each VPDN group can clone only VAIs using one virtual template. If you enter a second virtual-template command on a VPDN group, it replaces the first virtual-template command.

The table below lists the VPDN group commands under which the virtual-template command can be entered. Entering the VPDN group command starts VPDN group configuration mode. The table includes the command-line prompt for the VPDN group configuration mode and the type of service configured.

router(config-vpdn-acc-in)#

router(config-vpdn-req-out)#

When the virtual-template command is entered under a request-dialout VPDN subgroup, IP and other per-user attributes can be applied to an L2TP dial-out session from an LNS. Before this command was enhanced, IP per-user configurations from authentication, authorization, and accounting (AAA) servers were not supported; the IP configuration comes from the dialer interface defined on the router.

The enhanced virtual-template command works in a way similar to configuring virtual profiles and L2TP dial-in. The L2TP VAI is first cloned from the virtual template, which means that configurations from the virtual template interface is applied to the L2TP VAI. After authentication, the AAA per-user configuration is applied to the VAI. Because AAA per-user attributes are applied only after the user has been authenticated, the LNS must be configured to authenticate the dial-out user (configuration authentication is needed for this command).

With the enhanced virtual-template command, all software components can now use the configuration present on the VAI rather than what is present on the dialer interface. For example, IP Control Protocol (IPCP) address negotiation uses the local address of the VAI as the router address while negotiating with the peer.

Cisco 10000 Series Router Usage Guidelines

In Cisco IOS Release 12.2(33)SB, the virtual-template snmp command has a new default configuration. Instead of being enabled by default, no virtual-template snmp is the default configuration. This setting enhances scaling and prevents large numbers of entries in the MIB ifTable, thereby avoiding CPU Hog messages as SNMP uses the interfaces MIB and other related MIBs.

If you configure the no virtual-template snmp command, the router no longer accepts the snmp trap link-status command under a virtual-template interface. Instead, the router displays a configuration error message such as the following:

Router(config)# interface virtual-template 1
Router(config-if)# snmp trap link-status
%Unable set link-status enable/disable for interface

If your configuration already has the snmp trap link-status command configured under a virtual-template interface and you upgrade to Cisco IOS Release 12.2(33)SB, the configuration error occurs when the router reloads even though the virtual template interface is already registered in the interfaces MIB.

Usage Guidelines

This command can be used with RADIUS or TACACS+ and is applicable only on the VPDN tunnel server.

The PPP extended NAS-Port format enables the NAS-Port and NAS-Port-Type attributes to provide port details to a RADIUS server when one of the following protocols is configured:

• PPP over ATM

• PPP over Ethernet (PPPoE) over ATM

• PPPoE over 802.1Q VLANs

Before PPP extended NAS-Port format attributes can be reported to the RADIUS server, the radius-server attribute nas-port format command with the d keyword must be configured on both the tunnel server and the NAS, and the tunnel server and the NAS must both be Cisco routers.

When you configure the vpdn aaa attribute nas-ip-address vpdn-nas command, the L2TP network server (LNS) reports the IP address of the last multihop node for multihop over Layer 2 Forwarding (L2F). For multihop over Layer 2 Tunneling Protocol (L2TP), the IP address of the originating NAS is reported.

When you configure the vpdn aaa attribute nas-ip-address vpdn-tunnel-client command, the LNS reports the IP address of the last multihop node in the RADIUS NAS-IP-Address attribute for the L2TP multihop. This eases the migration for customers moving from L2F to L2TP.

Note	Reporting of NAS AAA attributes related to a VPDN on a AAA server is not supported for Point-to-Point Tunneling Protocol (PPTP) sessions with multihop deployment.

Usage Guidelines

This command can be used with RADIUS or TACACS+, and is applicable only on the VPDN network access server (NAS). Configuring this command restricts tunnel authorization to the specified AAA servers only. This command can be used to specify multiple AAA servers.

For TACACS+ configuration, the tacacs-server directed-request command must be configured by using the restricted keyword, or authorization will continue with all configured TACACS+ servers.

Usage Guidelines

Untagged attribute values obtained from the AAA RADIUS server are applied to all attribute sets by default, unless a value for that attribute is already specified in the tagged attribute set. To prevent untagged attribute values from being applied to tagged attribute sets, use the no form of this command.

Usage Guidelines

To configure the NAS to perform authentication of all dial-in L2TP or L2F sessions before the sessions are forwarded to the tunnel server, configure the vpdn authen-before-forward command in global configuration mode.

To configure the NAS to perform authentication of dial-in L2TP or L2F sessions belonging to a specific VPDN group before the sessions are forwarded to the tunnel server, use the authen-before-forward command in VPDN group configuration mode.

Enabling the vpdn authen-before-forward command instructs the NAS to authenticate the complete username before making a forwarding decision based on the domain portion of the username. A user may be forwarded or terminated locally depending on the information contained in the users RADIUS profile. Users with forwarding information in their RADIUS profile are forwarded based on that information. Users without forwarding information in their RADIUS profile are either forwarded or terminated locally based on the Service-Type in their RADIUS profile. The relationship between forwarding decisions and the information contained in the users RADIUS profile is summarized in the table below.

Usage Guidelines

When a username includes both a username and a domain portion, such as user@site.com, directed request configuration allows the authorization request to be sent to a specific RADIUS or TACACS+ server based on the domain name portion of the username (site.com). The vpdn authorize directed-request command must be enabled to allow VPDN authorization of any directed request user.

Directed request for RADIUS users is enabled by issuing the radius-server directed-request command. Directed request for TACACS+ users is enabled by default, and can be disabled by using the no tacacs-server directed request command. The ip host command must be configured to enable directed requests to RADIUS or TACACS+ servers.

The vpdn authorize directed-request command is usually configured on the L2TP network server (LNS). When directed-requests are used on an L2TP access concentrator (LAC) with per-user VPDN configuration, the authen before-forward command must be enabled.

Usage Guidelines

A domain preauthorization RADIUS user profile must also be created. See the Examples section and refer to the Cisco IOS Security Configuration Guide for information on how to create these profiles.

Usage Guidelines

You can enter one vpdn domain-delimiter command to list the suffix delimiters and another vpdn domain-delimiter command to list the prefix delimiters. However, no character can be both a suffix delimiter and a prefix delimiter.

This command allows the network access server to parse a list of home gateway DNS domain names and addresses sent by an AAA server. The AAA server can store domain names or IP addresses in the following AV pair:

cisco-avpair = "lcp:interface-config=ip address 10.1.1.1 255.255.255.255.0",

cisco-avpair = "lcp:interface-config=ip address bigrouter@cisco.com,

Usage Guidelines

The no vpdn enable command does not automatically disable a VPDN tunnel.

To shut down a VPDN tunnel, use the clear vpdn tunnel command or the vpdn softshut command.

Cisco 10000 Series Usage Guidelines

In Cisco IOS Release 12.2(33)SB and later releases, the router no longer accepts the vpdn-group command if you issue the command before you issue the vpdn enable command. Instead, the following warning message displays:

% VPDN configuration is not allowed until VPDN is enabled through 'vpdn enable'.

In releases prior to Cisco IOS Release 12.2(33)SB, if you issue the vpdn-group command before the vpdn enable command, the router accepts the command and displays the following warning message:

% VPDN is not enabled

Usage Guidelines

Use the vpdn group command in customer profile configuration mode or in VPDN profile configuration mode to associate a VPDN group with a customer profile or a VPDN profile, respectively.

VPDN groups are created by using the vpdn-group command in global configuration mode.

Usage Guidelines

Logging of VPDN failure events is enabled by default. You can disable the logging of VPDN failure events by issuing the no vpdn history failure command.

The logging of a failure event to the history table is triggered by event logging by the syslog facility. The syslog facility creates a failure history table entry, which keeps records of failure events. The table starts with 20 entries, and the size of the table can be expanded to a maximum of 50 entries by using the vpdn history failure table-size entries command. You can configure the vpdn history failure table-size entries command only if VPDN failure event logging is enabled.

All failure entries for the user are kept chronologically in the history table. Each entry records the relevant information of a failure event. Only the most recent failure event per user, unique to its name and tunnel client ID (CLID), is kept.

When the total number of entries in the table reaches the configured table size, the oldest record is deleted and a new entry is added.

Usage Guidelines

When users are declared as unauthenticated, their termination is recorded in the VPDN failure log. One method for determining why a subscriber cannot establish a PPP session is for the network operator to check the VPDN failure log for connection failure messages. The router can determine and log specific reasons for session termination, such as authentication failure, exceeding the session limit, timer expiration, and so on. However, a peer LAC or LNS sends the message "VPDN-6-CLOSED" to the router for any type of session termination. All other messages at the console and in the failure log appear under abnormal termination at that router, and the message "The remote server closed the session" is also logged in the VPDN connection failure log. So the failure log, which has maximum of 50 messages, gets filled with messages. Once the maximum message length is reached, new messages begin replacing old messages and information about the unauthenticated users is lost.

The no vpdn logging cause normal command disables all system logging (syslog) messages with the prefix "VPDN-6-CLOSED." The no vpdn history failure cause normal command is used to prevent the message "The remote server closed the session" from being added to the connection failure log.

Both commands are independent so that configuring the no vpdn logging cause normal command does not prevent the message "The remote server closed the session" from being logged. And conversely, configuring the no vpdn history failure cause normal command does not prevent the syslog message "VPDN-6-CLOSED" from appearing.

By default, the vpdn logging cause normal command is enabled only when VPDN logging is enabled and does not appear in the show running-config command display. When configured, the command no vpdn logging cause normal appears in the show running-config command display only when VPDN logging is enabled.

By default, the vpdn history failure cause normal command is enabled only when the VPDN failure log is enabled, and it does not appear in the show running-config command display. When configured, the command no vpdn history failure cause normal shows up only when the VPDN history log is enabled.

Regardless of whether the no vpdn logging cause normal and the no vpdn history failure cause normal commands are configured, all other syslog messages except those with prefix "VPDN-6-CLOSED" appear on the console, and the failure table logs all messages except "The remote server closed the session."

Usage Guidelines

Ignoring UDP checksums is beneficial when the remote tunnel endpoint uses UDP checksums and when you want to use fast switching or Cisco Express Forwarding (CEF). If the remote tunnel endpoint uses UDP checksums and the vpdn ip udp ignore checksum command is disabled, all tunnel traffic is process-switched.

In Cisco IOS Release 12.3(13) and Cisco IOS Release 12.3(14)T, this command was modified to be enabled by default.

Cisco 10000 Series Router

When you configure this command, the router directly queues L2TP hello packets and hello acknowledgments to the L2TP control process. We recommend that you configure this command in all scaled LAC and LNS L2TP tunnel configurations.

If you do not configure the vpdn ip udp ignore checksum command, the L2TP software sends the packet to UDP to validate the checksum. When too many packets are queued to the IP input process, the router starts selective packet discard (SPD), which causes IP packets to be dropped.

Note	Head-of-the-line blocking of the IP input process might occur in other non-L2TP configurations. A flush occurring on an input interface indicates that SPD is discarding packets.

Usage Guidelines

ICRQ and ICCN are the respective first and last of the three message exchanges that are used for establishing sessions with an L2TP tunnel.

Use the vpdn l2tp attribute initial-received-lcp-confreq command in global configuration mode to add the Initial Received LCP CONFREQ AVP to the ICCN packets on the LAC.

Use the vpdn l2tp attribute physical-channel-id command in global configuration mode to add the Physical Channel ID AVP to the ICRQ packets on LAC.

Usage Guidelines

Use the vpdn l2tp attribute clid mask-method command to mask the calling station ID in L2TP attribute-value (AV) pair 22 globally for all virtual private dialup network (VPDN) groups configured on the NAS. This command is compatible with both local and remote RADIUS authorization. You can either substitute characters for a portion of the calling station ID or remove the entire calling station ID.

The l2tp attribute clid mask-method command can be used to mask the calling station ID for calls associated with a specific VPDN group or VPDN template. This command is compatible with only local authorization.

Usage Guidelines

This command controls the logging of VPDN events. By default, all VPDN event logging is disabled.

In Cisco IOS Releases 15.0, 12.2(33)XNE, 12.2(33)SRE, XE 2.5 and later, when you use any keyword with the vpdn logging command, the status of the primary flag, which is recognized by the configuration element vpdn logging, is evaluated. If all types of vpdn logging are in their default states (the default for the vpdn logging cause command is enabled; the defaults for the other VPDN logging types are disabled), the primary flag is turned off, causing the VPDN logging CLI to no longer be generated in the show running-config display by the nvgen process. If you configure any VPDN logging type to a nondefault state, the primary flag is turned on and the vpdn logging output is displayed in the show running-config command output.

To enable the logging of VPDN events to the syslog of the local or the remote tunnel endpoint router, issue the vpdn logging command with the local or the remote keyword.

To log VPDN user events or VPDN tunnel-drop events to the syslog, you must configure the vpdn logging command with the user or the tunnel-drop keyword.

Configuring the vpdn logging command with the accounting keyword causes VPDN event log messages to be sent to a remote AAA server in a AAA vendor-specific attribute (VSA). This allows the correlation of VPDN call success rates with accounting records.

Note	VPDN event logging to the syslog need not be enabled to allow the reporting of VPDN event log messages to a AAA server.

You can configure as many types of VPDN event logging as you want.

Usage Guidelines

When users are declared as unauthenticated, their termination is recorded in the VPDN failure log. One method for determining why a subscriber cannot establish a PPP session is for the network operator to check the VPDN failure log for connection failure messages. The router can determine and log specific reasons for session termination, such as authentication failure, exceeding the session limit, timer expiration, and so on. However, a peer LAC or LNS sends the message "VPDN-6-CLOSED" to the router for any type of session termination. All other messages at the console and in the failure log appear under abnormal termination at that router, and the message “The remote server closed the session" is also logged in the VPDN connection failure log. So the failure log, which has maximum of 50 messages, is filled with messages. Once the maximum message length is reached, new messages begin replacing old messages and information about the unauthenticated users is lost.

The no vpdn logging cause normal command disables all system logging (syslog) messages with the prefix "VPDN-6-CLOSED." The no vpdn history failure cause normal command is used to prevent the message “The remote server closed the session" from being added to the connection failure log.

Both commands are independent so that configuring the no vpdn logging cause normal command does not prevent the message “The remote server closed the session” from being logged. And conversely, configuring the no vpdn history failure cause normal command does not prevent the syslog message "VPDN-6-CLOSED" from appearing.

By default, the vpdn logging cause normal command is enabled only when VPDN logging is enabled, and does not appear in the show running-config command output. When configured, the command no vpdn logging cause normal is listed in the show running-config command output only when VPDN logging is enabled.

By default, the vpdn history failure cause normal command is enabled only when the VPDN failure log is enabled, and it does not appear in the show running-config command output. When configured, the command no vpdn history failure cause normal shows up only when the VPDN history log is enabled.

Regardless of whether the no vpdn logging cause normal and the no vpdn history failure cause normal commands are configured, all other syslog messages except those with prefix "VPDN-6-CLOSED" appear on the console, and the failure table logs all messages except "The remote server closed the session."

Usage Guidelines

Use this command to enable multihop VPDN. Multihop VPDN allows packets to pass through multiple VPDN tunnels. Ordinarily, packets are not allowed to traverse more than one tunnel. With multihop enabled, a packet can traverse as many as four tunnels.

VPDN multihop allows a router configured as a tunnel switch to act as both a network access server (NAS) and a tunnel server, receiving packets from an incoming VPDN tunnel and sending them out over an outgoing VPDN tunnel.

A tunnel switch can terminate incoming VPDN tunnels from multiple devices, and initiate outgoing tunnels to one or more tunnel servers. The outgoing tunnel is selected using either a domain name, a remote tunnel name, or a DNIS number. The order in which these criteria are searched by the software is determined by the vpdn search-order command.

VPDN multihop must be enabled for a Multichassis Multilink PPP (MMP) stack group deployment to function when incoming calls traverse a VPDN tunnel. For more information on configuring multihop VPDN for MMP, refer to the Cisco IOS VPDN Configuration Guide .

Usage Guidelines

Use the vpdn pmtu command to prevent Denial of Service (DoS) attacks against L2TP VPDN deployments that are performing path MTU discovery (PMTUD). PMTUD for an L2TP VPDN is disabled by default. To enable PMTUD, use the ip pmtu command.

When PMTUD is enabled, VPDN deployments are vulnerable to DoS attacks that use crafted Internet Control Message Protocol (ICMP) "fragmentation needed and Don't Fragment (DF) bit set" (code 4) messages, also known as PMTUD attacks.

When an Internet host is performing PMTUD, crafted code 4 ICMP messages can be used to set the path MTU to an impractically low value. This causes higher layer protocols to time out because of a very low throughput, even though the connection is still in the established state. This type of attack is classified as a throughput-reduction attack.

Use the vpdn pmtu command to configure a range of acceptable values for the path MTU when PMTUD is enabled. If the device receives a code 4 ICMP message that advertises a next-hop path MTU outside the configured size range, the device ignores the ICMP message and display this log message:

%VPDN-5-IGNOREICMPMTU Ignoring received ICMP Type 3 Code 4, due to pmtu min or max setting

For information on detecting a PMTUD attack on an L2TP VPDN deployment, see Cisco Security Advisory Crafted ICMP Messages Can Cause Denial of Service.

Cisco software releases that support the ip pmtu command but do not support the vpdn pmtu command are vulnerable to PMTUD attacks. To protect a device running a vulnerable version of software, issue the no ip pmtu command to disable PMTUD.

For a complete list of Cisco software rebuild releases that support thevpdn pmtu command, see Cisco Security Advisory Crafted ICMP Messages Can Cause Denial of Service.

Usage Guidelines

Use the vpdn profile command to associate a VPDN profile with a customer profile.

VPDN profiles can be used to combine session counting over multiple VPDN groups. This ability can be applied to customer profiles by configuring multiple VPDN groups under a VPDN profile and by associating the VPDN profile with the customer profile by using thevpdn profile command.

Usage Guidelines

Configuring this command on the L2TP network access server (NAS) enables the NAS to perform L2TP redirection by sending a new vendor-specific attribute-value (AV) pair to the L2TP tunnel server. Configuring this command on the stack group tunnel server allows the tunnel server to redirect a call by disconnecting it and requesting the NAS to redirect it. The Stack Group Bidding Protocol (SGBP) stack group tunnel servers must have this command enabled to receive redirected calls, or else they receive calls only through the usual multihop forwarding from the tunnel server that first took the call.

Usage Guidelines

The number of redirect attempts is by default always restricted to three even if this command is not explicitly configured. The only use of this command is to configure a redirect attempts value other than the default (which is always in effect).

Usage Guidelines

The vpdn redirect identifier command is configured on each of the stack group tunnel servers. To configure the name of the redirect identifier on the network access server (NAS), use the redirect identifier command in VPDN group configuration mode.

The NAS compares the configured redirect identifier with the one received from the stack group tunnel server to determine authorization information to redirect the call.

Configuring the redirect identifier is not necessary to perform redirects. If the redirect identifier is not configured, the NAS uses the redirect IP address to obtain authorization information to redirect the call. In that case, the IP address of the new redirected tunnel server must be present in the initiate-to command configuration of the VPDN group on the NAS.

The redirect identifier allows new stack group members to be added without the need to update the NAS configuration with their IP addresses. With the redirect identifier configured, a new stack group member can be added and given the same redirect identifier as the rest of the stack group.

If the authorization information for getting to the new redirected tunnel server is different, then you must configure the authorization information via RADIUS using tagged attributes:

Cisco:Cisco-Avpair = :0:"vpdn:vpdn-redirect-id=
identifier name
"

The NAS chooses the correct tagged parameters to get authorization information for the new redirected tunnel server by first trying to match the redirect identifier (if present) or else by matching the Tunnel-Server-Endpoint IP address.

Usage Guidelines

On the network access server (NAS), this command has no effect.

Usage Guidelines

To issue the vpdn search-order command, you must include at least one of the search parameter keywords. You can enter multiple keywords, and they can be entered in any order. The order of the keywords specifies the order of precedence given to the search parameters. If you do not issue a particular keyword, no search is performed on that parameter.

Issue the multihop-hostname keyword only on a device configured as a multihop tunnel switch.

The configuration shows the vpdn search-order command setting only if the command is explicitly configured.

Usage Guidelines

Before you enable the vpdn session accounting network command, you must enable network accounting by using the aaa accounting command.

Note

If the default network accounting method list is configured and no additional accounting configurations are enabled on the interface, network accounting is enabled by default. If the vpdn session accounting network command is linked to the default method list, all tunnel-link accounting records are enabled for those sessions.

This command displays the following tunnel-link accounting type records, which are used with the RADIUS accounting attribute Acct-Status-Type (attribute 40):

• Tunnel-Link-Start (12)--Marks the creation of a tunnel link.

• Tunnel-Link-Stop (13)--Marks the end of a tunnel link.

Note	Only some tunnel types (such as Layer 2 Tunneling Protocol [L2TP]) support the multiple links per tunnel; these values should be included for accounting packets for tunnel types that support multiple links per tunnel.

• Tunnel-Link-Reject (14)--Marks the rejection of a tunnel setup for a new link in an existing tunnel. Only some tunnel types (L2TP) support the multiple links per tunnel; this value should be included only in accounting packets for tunnel types that support multiple links per tunnel.

Note	If either Tunnel-Link-Start or Tunnel-Link-Stop is enabled, Tunnel-Link-Reject is sent even if it has not been enabled.

Usage Guidelines

Use the vpdn session-limit command to configure the maximum number of VPDN sessions allowed on the router.

VPDN session limits can be configured globally by using the vpdn session-limit command, at the level of a VPDN group by using the session-limit (VPDN) command, or for all VPDN groups associated with a particular VPDN template by using the group session-limit command.

The hierarchy for the application of VPDN session limits is as follows:

• Globally configured session limits take precedence over session limits configured for a VPDN group or in a VPDN template. The total number of sessions on a router cannot exceed a configured global session limit.

• Session limits configured for a VPDN template are enforced for all VPDN groups associated with that VPDN template. The total number of sessions for all of the associated VPDN groups cannot exceed the configured VPDN template session limit.

• Session limits configured for a VPDN group are enforced for that VPDN group.

Usage Guidelines

When this feature is enabled on a network access server (NAS), the potential session is authorized before it is refused. This authorization ensures that accurate accounting records can be kept.

When this feature is enabled on a home gateway, the reason for the session refusal is returned to the NAS. This information is recorded in the VPN history failure table.

When this command is enabled, use theshow vpdn history failure command to view records of refused attempts to establish new sessions.

Usage Guidelines

Use the vpdn source-ip command to specify a single alternate IP address to be used for all tunnels on the device. A single source IP address can be configured globally per device.

Use the source-ip command in VPDN group configuration mode to configure an alternate IP address to be used for only those tunnels associated with that VPDN group.

The VPDN group-level configuration overrides the global configuration.

Usage Guidelines

Before you enable the vpdn tunnel accounting network command, you must enable network accounting by using the aaa accounting command.

Note

If the default network accounting method list is configured and no additional accounting configurations are enabled on the interface, network accounting is enabled by default. If the vpdn tunnel accounting network command is linked to the default method list, all tunnel accounting records are enabled for those sessions.

This command displays the following tunnel accounting type records, which are used with the RADIUS accounting attribute Acct-Status-Type (attribute 40):

• Tunnel-Start (9)--Marks the beginning of a tunnel setup with another node.

• Tunnel-Stop (10)--Marks the end of a tunnel connection to or from another node.

• Tunnel-Reject (11)--Marks the rejection of a tunnel setup with another node.

Note	If either Tunnel-Start or Tunnel-Stop are enabled, Tunnel-Reject is sent even if it has not been enabled.

Usage Guidelines

Use this command to specify the authorization method list that is used for remote tunnel hostname-based authorization. The method list (named or default) is defined using the aaa authorization network command.

If a method list for tunnel authorization is not specified via the aaa authorization network command, local authorization using the local virtual private dialup network (VPDN) group configuration occurs.

Note

This method list is only for L2TP tunnel authorization and termination; it is not intended for domain or dialed number identification service (DNIS)-based authorization that is typically done on the tunnel terminator. Thus, this command can be enabled only on the tunnel terminator--the NAS for dial-out and the tunnel server for dial-in.

Usage Guidelines

This command can be used on either the Layer 2 Tunneling Protocol (L2TP) network access server (NAS) or on the L2TP tunnel server when remote RADIUS tunnel authentication is enabled.

Usage Guidelines

This command should be used if a virtual template is not specified in the local virtual private dialup network (VPDN) group (for local authentication) or in a remote RADIUS configuration (via the vpdn-vtemplate attribute).

Note	This command applies only on the L2TP tunnel server.

Usage Guidelines

Use the vpdn-group command to configure VPDN parameters that are always applied to that VPDN group. System default settings for VPDN parameters are applied for any settings not configured in the individual VPDN group or in the associated VPDN template.

VPDN groups are associated with the global VPDN template by default. You can associate individual VPDN groups with a named VPDN template instead. Associating a VPDN group with a named VPDN template disassociates the VPDN group from the global VPDN template.

If you create two VPDN groups with the same configuration, this message displays:

% Warning, the vpdn groups group1 and group2 have the same configuration

You should change one of the group configurations to eliminate the duplicate configuration. Leaving the duplicate configurations in place can lead to unexpected (and unsupported) results.

Cisco 10000 Series Usage Guidelines

In Cisco IOS Release 12.2(33)SB and later releases, the router does not accept the vpdn-group command if you issue the command before you issue the vpdn enable command. Instead, this message displays:

% VPDN configuration is not allowed until VPDN is enabled through 'vpdn enable'.

In releases prior to Cisco IOS Release 12.2(33)SB, if you issue the vpdn-group command before the vpdn enable command, the router accepts the command and displays this message:

% VPDN is not enabled

Usage Guidelines

Use this command to configure values for VPDN parameters in a VPDN template. A single unnamed VPDN template can be configured. Multiple named VPDN templates can be configured. A VPDN group can be associated with only one VPDN template.

Values configured in the global (unnamed) VPDN template are applied to all VPDN groups by default. A VPDN group can be disassociated from the global VPDN template, or associated with a named VPDN template. Associating a VPDN group with a named VPDN template automatically disassociates it from the global VPDN template.

The values configured in a VPDN template are applied to all associated VPDN groups unless specific values are configured for individual VPDN groups. VPDN parameters that are not specified in the individual VPDN group or in the associated VPDN template are assigned system default values.

The hierarchy for the application of VPDN parameters to a VPDN group is as follows:

• VPDN parameters configured for the individual VPDN group are always applied to that VPDN group.

• VPDN parameters configured in the associated VPDN template are applied for any settings not specified in the individual VPDN group configuration.

• System default settings for VPDN parameters are applied for any settings not configured in the individual VPDN group or the associated VPDN template.

Not all commands that are available for configuring a VPDN group can be used to configure a VPDN template. The table below lists the commands that can be used to configure the VPDN template.

Usage Guidelines

Use the vpn command to configure the software to look up a VPDN source or destination IPv4 address in a specific VPN routing table instead of the global routing table.

Before you can issue the vpn command, a VRF instance must be created by using the ip vrf command.

The vpn command can be used with both dial-in and dial-out VPDN scenarios.