RADIUS Attribute 82 Tunnel Assignment ID

Prerequisites for RADIUS Attribute 82 Tunnel Assignment ID

You must be using a Cisco platform that supports VPDN to use this feature.

Restrictions for Radius Attribute 82 Tunnel Assignment ID

This feature is designed only for VPDN dial-in applications. It does not support VPDN dial-out.

Information about RADIUS Attribute 82 Tunnel Assignment ID

The RADIUS Attribute 82: Tunnel Assignment ID feature allows the Layer 2 Transport Protocol access concentrator (LAC) to group users from different per-user or domain RADIUS profiles into the same active tunnel. The RADIUS Attribute 82: Tunnel Assignment ID feature defines a new avpair, Tunnel-Assignment-ID, which allows the LAC to group users from different RADIUS profiles into the same tunnel if the chosen endpoint, tunnel type, and Tunnel-Assignment-ID are identical. This feature introduces new software functionality. No new commands are introduced with this feature.

How to Verify if RADIUS Attribute 82 is Being Used by the LAC

There are no configuration steps for the RADIUS Attribute 82: Tunnel Assignment ID feature. This task verifies the RADIUS attribute 82 used by the LAC during tunnel authorization.

SUMMARY STEPS

  1. enable
  2. configure terminal
  3. Router# debug radius

DETAILED STEPS

  Command or Action Purpose

Step 1

enable

Example:


Router> enable

Enables privileged EXEC mode.

  • Enter your password if prompted.

Step 2

configure terminal

Example:


Router# configure terminal

Enters global configuration mode.

Step 3

Router# debug radius

Example:


Router# debug radius

Displays information associated with RADIUS. The output of this command shows whether attribute 82 is being sent in access requests.

Configuration Examples for RADIUS Attribute 82 Tunnel Assignment ID

LAC Configuration Example

The following example shows a sample LAC configuration when the VPDN group is defined on the router: 


aaa new-model 
aaa authentication ppp default local 
aaa authorization network default local 
! 
bba-group pppoe bba_group1 
virtual-template 1 
! 
interface Loopback1 
no ip address 
vpdn-group VPDN_LAC1 
request-dialin 
protocol l2tp 
local name tb162_LAC1 
domain isp1.com 
initiate-to ip 10.0.0.2 
source-ip 10.0.0.1 
l2tp tunnel receive-window 100 
l2tp tunnel nosession-timeout 30 
l2tp tunnel retransmit retries 5 
l2tp tunnel retransmit timeout min 2 
l2tp tunnel retransmit timeout max 8 
l2tp tunnel hello 60 
l2tp tunnel password tunnel1 
! 
! 
interface virtual-template 1 
no snmp trap link-status 
no keepalive 
ip unnumbered loopback1 
ppp mtu adaptive 
ppp authentication pap 
no logging event link-status 
!

The following example shows a sample LAC configuration when the VPDN group is defined in RADIUS: 


aaa authentication ppp default group radius 
aaa authorization network default radius 
!
bba-group pppoe bba_group1 
virtual-template 1 
! 
interface Loopback1 
no ip address 
interface virtual-template 1 
no snmp trap link-status 
no keepalive 
ip unnumbered loopback1 
ppp mtu adaptive 
ppp authentication pap 
no logging event link-status

LNS Configuration Example

The following example configures VPDN on the LNS: 


hostname lns
aaa new-model
aaa authentication ppp default group radius
aaa authorization network default group radius
vpdn enable
vpdn-group VPDN_LNS1
 accept-dialin
  protocol l2tp
  virtual-template 1
 terminate-from hostname tb162_LAC1
 local name LNS1
 l2tp tunnel hello 90
 l2tp tunnel password 0 hello1
interface Loopback0
 ip address 10.1.1.3 255.255.255.0
interface Virtual-Template1
 ip unnumbered Loopback0
 no keepalive
 peer default ip address pool mypool
 ppp authentication chap
ip local pool mypool 10.1.1.10 10.1.1.50
radius-server host lns-radiusd  auth-port 1645 acct-port 1646
radius-server retransmit 3
radius-server key cisco

RADIUS Configuration Example

The following examples configure the RADIUS server to group sessions in a tunnel:

Per-User Configuration


user@router.com Password = "cisco" Service-Type = Outbound,
       Tunnel-Type = :1:L2TP,
       Tunnel-Server-Endpoint = :1:"10.14.10.54",
       Tunnel-Assignment-Id = :1:"router"
client@router.com Password = "cisco" Service-Type = Outbound,
       Tunnel-Type = :1:L2TP,
       Tunnel-Server-Endpoint = :1:"10.14.10.54",
       Tunnel-Assignment-Id = :1:"router"

Domain Configuration


eng.router.com Password = "cisco" Service-Type = Outbound,
        Tunnel-Type = :1:L2TP,
        Tunnel-Server-Endpoint = :1:"10.14.10.54",
        Tunnel-Assignment-Id = :1:"router"
sales.router.com Password = "cisco" Service-Type = Outbound,
        Tunnel-Type = :1:L2TP,
        Tunnel-Server-Endpoint = :1:"10.14.10.54",
        Tunnel-Assignment-Id = :1:"router"

Additional References

The following sections provide references related to RADIUS Tunnel Attribute Extensions.

Related Documents

Related Topic

Document Title

Authentication

“ Configuring Authentication ” module.

RADIUS Attributes

“ RADIUS Attributes Overview and RADIUS IETF Attributes ” module.

Virtual private dialup networks (VPDN)

Cisco IOS VPDN Configuration Guide , Release 15.0.

Standards

Standard

Title

None.

--

MIBs

MIB

MIBs Link

None.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFC

Title

RFC 2868

RADIUS Attributes for Tunnel Protocol Support

Technical Assistance

Description

Link

The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies.

To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds.

Access to most tools on the Cisco Support website requires a Cisco.com user ID and password.

http://www.cisco.com/techsupport

Feature Information for RADIUS Attribute 82 Tunnel Assignment ID

The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 1. Feature Information for RADIUS Attribute 82: Tunnel Assignment ID

Feature Name

Releases

Feature Information

RADIUS Attribute 82: Tunnel Assignment Id

Cisco IOS XE Release 2.1

The RADIUS Attribute 82: Tunnel Assignment ID feature allows the Layer 2 Transport Protocol access concentrator (LAC) to group users from different per-user or domain RADIUS profiles into the same active tunnel.

In Cisco IOS XE Release 2.1, support was added for the Cisco ASR 1000 Series Aggregation Services Routers.