Полезная информация

cc/td/doc/product/software/ios120/12cgcr/dial_r
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Virtual Private Dialup Network Commands

Virtual Private Dialup Network Commands

This chapter describes the commands required to configure virtual private dialup networks. For information about configuring this feature, see the "Configuring Virtual Private Dialup Networks" chapter of the Dial Solutions Configuration Guide.

clear vpdn history failure

To clear the content of the failure history table, use the clear vpdn history failure EXEC command.

clear vpdn history failure

Syntax Description

This command has no arguments or keywords.

Command Mode

EXEC

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3 T.

Example

The following example clears the content of the failure history table:

clear vpdn history failure

clear vpdn tunnel

To shut down a specified tunnel and all the MIDs within it, use the clear vpdn tunnel EXEC command.

clear vpdn tunnel network-access-server gateway-name

Syntax Description

network-access-server

Name of the network access server at the far end of the tunnel, probably the point of presence of the public data network or the Internet Service Provider's.

gateway-name

Host name of home gateway at the local end of the tunnel.

Command Mode

EXEC

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

This command is used primarily for troubleshooting. You can use the command to force the tunnel to come down without unconfiguring it (the tunnel could be restarted immediately by a user logging in).

Example

The following example clears a tunnel between a network access server called orion and a home gateway called sampson:

clear vpdn tunnel orion sampson

show vpdn

To display information about active Level 2 Forwarding (L2F) protocol tunnel and Level 2 Forwarding (L2F) message identifiers in a virtual private dialup network, use the show vpdn EXEC command.

show vpdn

Syntax Description

This command has no keywords or arguments.

Command Mode

EXEC

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

Sample Display

The following is sample output of the show vpdn command:

Router# show vpdn 
Active L2F tunnels
NAS Name   Gateway Name    NAS CLID   Gateway CLID   State
nas        gateway           4            2          open
L2F MIDs
Name                NAS Name    Interface    MID      State
phil@cisco.com       nas          As7          1       open
sam@cisco.com        nas          As8          2       open

Table 139 describes the fields in this sample display.


Table 139: Show VPDN Field Descriptions
Field Description
Active L2F tunnels

NAS Name

Host name of the network access server, which is the remote termination point of the tunnel.

Gateway Name

Host name of the home gateway, which is local termination point of the tunnel.

NAS CLID

A number uniquely identifying the VPDN tunnel on the network access server.

Gateway CLID

A number uniquely identifying the VPDN tunnel on the gateway

State

Indicates whether the tunnel is open, opening, closing, or closed.

L2F MIDs

Name

Username of the person from whom a protocol message was forwarded over the tunnel.

NAS Name

Host name of the network access server.

Interface

Interface from which the protocol message was sent.

MID

A number uniquely identifying this user in this tunnel.

State

Indicates status for the individual user in the tunnel. The states are: opening, open, closed, closing, and waiting_for_tunnel.

The waiting_for_tunnel state means that the user connection is waiting until the main tunnel can be brought up before it moves to the opening state.

Related Commands

You can use the master indexes or search online to find documentation of related commands.

vpdn enable
vpdn history failure table-size
vpdn logging history failure

show vpdn history failure

To show the content of the failure history table, use the show vpdn history failure with the optional username keyword EXEC command.

show vpdn history failure [username]

Syntax Description

username

(Optional) Specifies the username. The specified username helps to display only the entries mapped to that particular user.

Command Mode

EXEC

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3 T.

If a username is specified, only the entries mapped to that username are displayed; when the username is not specified, the whole table is displayed.

Sample Display

The following is a sample output from the show vpdn history failure command, which displays the failure history table for a specific user:

router> show vpdn history failure
    Table size: 20
    Number of entries in table: 1

    User: jcchan@cisco.com, MID = 1
    NAS: isp, IP address = 172.21.9.25, CLID = 1
    Gateway: hp-gw, IP address = 172.21.9.15, CLID = 1
    Log time: 13:08:02, Error repeat count: 1
    Failure type: The remote server closed this session
    Failure reason: Administrative intervention

Table 140 describes the fields shown in the sample output.


Table 140: Show VPDN History Failure Field Descriptions
Field Description

Table size

Configurable VPDN history table size.

Number of entries in table

Number of entries currently in the history table.

User

Username for the entry displayed.

MID

VPDN user session ID that correlates to the logged event. The MID is a unique ID per user session.

NAS

Network access server identity.

IP address

IP address of the NAS or home gateway (HGW).

CLID

Tunnel endpoint for the NAS and HGW.

Gateway

HGW end of the VPDN tunnel.

Log time

The event logged time.

Error repeat count

Number of times a failure entry has been logged under a specific user. Only one log entry is allowed per user and is unique to its MID, with the older one being overwritten.

Failure type

Description of failure.

Failure reason

Reason for failure.

Related Commands

You can use the master indexes or search online to find documentatin of related commands.

clear vpdn history failure

vpdn domain-delimiter

To specify the characters to be use to delimit the domain prefix or domain suffix, use the vpdn domain-delimiter global configuration command.

vpdn domain-delimiter characters [suffix | prefix]

Syntax Description

characters

One or more specific characters to be used as suffix or prefix delimiters. Available characters are %, -, @, \ , #, and /.

If a backslash (\) is the last delimiter in the command line, enter it as a double backslash (\\).

suffix | prefix

(Optional) Usage of the specified characters.

Default

This command is disabled.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3.

You can enter one vpdn domain-delimiter command to list the suffix delimiters and another vpdn domain-delimiter command to list the prefix delimiters. However, no character can be both a suffix delimiter and a prefix delimiter.

This command allows the network access server to parse a list of home gateway DNS domain names and addresses sent by an AAA server. The AAA server can store domain names or IP addresses in the following AV pair:

cisco-avpair = "lcp:interface-config=ip address 1.1.1.1 255.255.255.255.0",

cisco-avpair = "lcp:interface-config=ip address bigrouter@excellentinc.com,

Examples

The following example lists three suffix delimiters and three prefix delimiters:

vpdn domain-delimiter %-@ suffix
vpdn domain-delimiter #/\\ prefix

This example allows the following host and domain names:

cisco.com#houstonddr
houstonddr@cisco.com

Related Commands

You can use the master indexes or search online to find documentation of related commands.

vpdn enable
vpdn history failure table-size
vpdn logging history failure
vpdn search-order

vpdn enable

To enable virtual private dialup networking on the router and inform the router to look for tunnel definitions in a local database and on a remote authorization server (home gateway), if one is present, use the vpdn enable global configuration command.

vpdn enable

Syntax Description

This command has no keywords or arguments.

Default

Disabled

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

Example

The following example enables virtual private dialup networking on the router:

vpdn enable

Related Commands

You can use the master indexes or search online to find documentation of related commands.

vpdn history failure table-size
vpdn logging history failure

vpdn force-local-chap

To cause the home gateway to issue its own CHAP challenge even if one has already been issued from the network access server, use the vpdn force-local-chap global configuration command. To disable the home gateway's issuing its own CHAP challenge, use the no form of this command.

vpdn force-local-chap
no vpdn force-local-chap

Syntax Description

This command has no arguments or keywords.

Default

The home gateway does not issue its own CHAP challenge.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

Example

The following example configures a virtual template interface on the home gateway and then enables VPDN and forces the home gateway to issue its own CHAP challenge.

interface virtual-template 1
ip unnumbered ethernet 0
encapsulation ppp
ppp authentication chap
!
vpdn enable
vpdn incoming world12 troll virtual-template 1 
vpdn force-local-chap

vpdn history failure table-size

To set the failure history table depth, use the vpdn history failure table-size global configuration command.

vpdn history failure table-size entries

Syntax Description

entries

Defines the number of entries. Valid entries are 20 to 50.

Default

20 entries

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3 T.

The logging of a failure history event is triggered by event logging by the Syslog facility. The Syslog facility creates a failure history table entry, which keeps records of failure events. The table starts with 20 entries and the size of the table can be expanded to a maximum of 50 entries.

All failure entries for the user are kept chronologically in the history table. Each entry records the relevant information of a failure event. Only the most recent failure event per user, unique to its name and tunnel client ID (CLID), is kept.

When the total number of entries in the table reaches the configured table size, the oldest record is deleted and a new entry is added.

Example

The following example sets the history failure table size to 40 entries:

vpdn history failure table-size 40

vpdn incoming

To specify the local name to use for authenticating and the virtual template to use for building interfaces for incoming connections when a Level 2 Forwarding (tunnel) connection is requested from a certain remote host, use the vpdn incoming global configuration command.

vpdn incoming remote-name local-name virtual-template number

Syntax Description

remote-name

Case-sensitive name of the remote host requesting the connection.

local-name

Case-sensitive local name to use when authenticating back to the remote host.

virtual-template number

Virtual template to use for building interfaces for incoming calls.

Default

Disabled. No host name, IP address, or local name for authentication are provided.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2.

The remote-name and local-name arguments are case sensitive.

This command is usually used on a home gateway, not on the network access server in the ISP or public data network.

Example

The following partial example specifies use of local host go_blue and virtual template interface  6 for connections with remote host dallas_wan:

vpdn incoming dallas_wan go_blue virtual-template 6

vpdn local-authentication

To enable local authentication of users on the network access server before the connection is forwarded to the home gateway, use the vpdn local-authentication global configuration command. To reset the network access server to the default in which local authentication is disabled, use the no form of this command.

vpdn local-authentication
no vpdn local-authentication

Syntax Description

This command has no arguments and keywords.

Default

This command is disabled.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3.

Example

The following example configures the network access server to select tunnels based on the dialed number of incoming calls and to authenticate users locally:

vpdn enable 
vpdn outgoing dnis 4592367 spartan ip 172.34.16.244
vpdn local-authentication

Related Commands

You can use the master indexes or search online for documentation of related commands.

vpdn enable
vpdn outgoing

vpdn logging

To enable the logging of VPDN events, use the vpdn logging global configuration command. To disable the logging of VPDN events, use the no form of this command.

vpdn logging [local | remote]
no vpdn logging [local | remote]

Syntax Description

local

(Optional) Log VPDN events locally.

remote

(Optional) Log VPDN events to a remote tunnel endpoint.

Default

Enabled

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3 T.

This command logs VPDN events. By default, VPDN logging is enabled; therefore, if you wish to disable VPDN event logging, you must explicitly configure the router using the no form of the command.

Example

The default behavior is to log VPDN events; however, if you wish to reenable the feature after removal, the following example shows how to reenable VPDN logging locally:

vpdn logging local

Related Commands

You can use the master indexes or search online for documentation of related commands.

vpdn logging history failure

vpdn logging history failure

To enable the logging of failure events to the failure history table, use the vpdn logging history failure global configuration command. To disable the logging of failure events, use the no form of this command.

vpdn logging history failure
no vpdn logging history failure

Syntax Description

This command has no arguments or keywords.

Default

Enabled

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3 T.

Example

The default behavior is to enable logging of VPDN history failures; however, if you wish to reenable the feature after removal, the following example shows how to reenable the logging of history failures:

vpdn logging history failure

Related Commands

You can use the master indexes or search online to find documentation of related commands.

show vpdn history failure

vpdn outgoing

To specify use of Dialed Number Information Service (DNIS) or use of a domain name when selecting a tunnel for forwarding traffic to the remote host (the home gateway) on a virtual private dialup network, use the vpdn outgoing global configuration command.

vpdn outgoing {dnis dialed-number | domain-name} local-name ip ip-address

Syntax Description

dnis dialed-number

Dialed number to be used for selecting a specific tunnel to be used for forwarding traffic to a home gateway.

domain-name

Case-sensitive name of the domain to forward traffic to.

local-name

Case-sensitive local name to use when authenticating the tunnel to the remote host.

ip ip-address

IP address of the remote host (home gateway).

Default

Disabled. No remote names and local names are defined.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.2

The domain-name and local-name arguments are case sensitive.

This command is usually used on a network access server, not on a home gateway.

When use of the Dialed Number Information Service is enabled and a dialed number is provided, the network service provider can use the dialed number to select a specific tunnel destination.

The domain name can be used to choose a tunnel destination. For example, if a user dials in as "joe@company-a.com," then matching on "company-a.com," a tunnel destination can be chosen.

If both DNIS information and a CHAP or PAP name map to a valid tunnel, the DNIS information is used.

If TACACS+ is used to get tunnel information, the string "dnis:" is prepended to the phone number before attempting to look up the information in AAA.

Examples

The following example selects a tunnel destination based on the domain name:

vpdn outgoing chicago-main go-blue ip 172.17.33.125 

The following example selects a tunnel destination based on the use of DNIS and a specific dialed number:

vpdn outgoing dnis 2387765 gocardinal ip 170.16.44.56

Related Commands

You can use the master indexes or search online to find documentation of related commands.

vpdn enable
vpdn history failure table-size

vpdn search-order

To specify how the service provider's network access server is to perform VPDN tunnel authorization searches, use the vpdn search-order global configuration command. To remove a prior specification, use the no form of the command.

vpdn search-order {dnis domain | domain dnis | domain | dnis}
no vpdn search-order

Syntax Description

dnis domain

Search first on the Dialed Number Information Service (DNIS) information provided on ISDN lines and then search on the domain name.

domain dnis

Search first on the domain name and then search on the DNIS information.

domain

Search on the domain name only.

dnis

Search on the DNIS information only.

Default

When this command is not used, the default is to search first on the Dialed Number Information Service (DNIS) information provided on ISDN lines and then search on the domain name. This is equivalent to using the vpdn search-order dnis domain command.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3.

VPDN authorization searches are performed only as specified.

The configuration shows the vpdn search-order command setting only if the command is explicitly configured.

Example

The following example configures a network access server to select a tunnel destination based on the use of DNIS and a specific dialed number and to perform tunnel authorization searches based on the DNIS information only.

vpdn enable
vpdn outgoing dnis 2387765 gocardinal ip 170.16.44.56
vpdn search-order dnis

Related Commands

You can use the master indexes or search online to find documentation of related commands.

vpdn outgoing

vpdn source-ip

To set the source IP address of the network access server, use the vpdn source-ip global configuration command.

vpdn source-ip address

Syntax Description

address

IP address of the network access server.

Default

This command is disabled. No default IP address is provided.

Command Mode

Global configuration

Usage Guidelines

This command first appeared in Cisco IOS Release 11.3.

One source IP address is configured on the network access server. The source IP address is configured per network access server, not per domain.

Example

This example enables VPDN on the network access server and sets an IP source address of 171.4.48.3.

vpdn enable 
vpdn source-ip 171.4.48.3

Related Commands

You can use the master indexes or search online for documentation of related commands.

vpdn enable


hometocprevnextglossaryfeedbacksearchhelp
Copyright 1989-1998 © Cisco Systems Inc.