<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-2022-jp">
<META NAME="Generator" CONTENT="MS Exchange Server version 14.02.5004.000">
<TITLE>RE: [cisco-bba] LNS Error on Cisco ASR 1004</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Thanks</FONT></SPAN><SPAN LANG="en-us"> <FONT FACE="Calibri">for your suggestions, Chris:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I></I></SPAN><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Cambria Math">$B"d(J</FONT></I></SPAN><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri"></FONT></I></SPAN><SPAN LANG="en-us"><I> <FONT COLOR="#FF0000" FACE="Calibri">? If yes, try removing the following attribute from your tunnel configuration:</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I></I></SPAN><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Cambria Math">$B"d(J</FONT></I></SPAN><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri"></FONT></I></SPAN><SPAN LANG="en-us"><I> <FONT COLOR="#FF0000" FACE="Calibri">| 123 | telco1-pppoe-static | Cisco-Avpair | += | interface-config=ppp ipcp dns xx.xx.xx.234 xx.xx.xx.235 |</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Yep, t</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">ried tha</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">t, sa</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">me result. I have whittled down the supplied radius attributes to the barest minimum, but the result is the same.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> Also applied "</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"></FONT></SPAN><SPAN LANG="en-us"><I> <FONT COLOR="#FF0000" FACE="Calibri">aaa policy interface-config allow-subinterfac</FONT></I></SPAN><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">e",</FONT></I></SPAN><SPAN LANG="en-us"> <FONT COLOR="#000000" FACE="Calibri">both on the ASR and via radius</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Calibri">,</FONT></SPAN><SPAN LANG="en-us"><FONT COLOR="#000000" FACE="Calibri"> and</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#000000" FACE="Calibri">the</FONT></SPAN><SPAN LANG="en-us"> <FONT COLOR="#000000" FACE="Calibri">result is same.</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">>></FONT></I></SPAN><SPAN LANG="en-us"><I> <FONT COLOR="#FF0000" FACE="Calibri">Is radius authentication performed and does the</FONT></I></SPAN><SPAN LANG="en-us"><I></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">>></FONT></I></SPAN><SPAN LANG="en-us"><I> <FONT COLOR="#FF0000" FACE="Calibri"> error appear _after_ the authentication during setup of the channel?</FONT></I></SPAN><SPAN LANG="en-us"><I></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">After</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">_</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri">authentication.</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> As far as I can tell, the</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> radius negotiation completes successfully, the</FONT></SPAN><SPAN LANG="en-us"><FONT FACE="Calibri"> vtemplate is cloned successfully, and IP even assigned, before interface goes down. See quick snapshot form the vtemplate debug:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468674: 8w5d: VT[Vi3]:Added new vtemplate cloneblk, now cloning from vtemplate</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468675: 8w5d: VT[Vi3]:Clone Vaccess from Virtual-Template1 (79 bytes)</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468676: 8w5d: VT[Vi3]:mtu 1492</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468677: 8w5d: VT[Vi3]:no ip redirects</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468678: 8w5d: VT[Vi3]:ip tcp adjust-mss 1420</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468679: 8w5d: VT[Vi3]:logging event link-status</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468680: 8w5d: VT[Vi3]:end</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468681: 8w5d: VT[Vi3]:Applying config commands on process "VTEMPLATE Background Mgr" (528)</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468682: 8w5d: VT[Vi3]:mtu 1492</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468683: 8w5d: VT[Vi3]:no ip redirects</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468684: 8w5d: VT[Vi3]:ip tcp adjust-mss 1420</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468685: 8w5d: VT[Vi3]:logging event link-status</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468686: 8w5d: VT[Vi3]:end</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468687: 8w5d: VT[Vi3]:Request took 2 msec, 2 msec processing time</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468688: 8w5d: VT[Vi3]:MTUs ip 1492, sub 1492, max 1492, default 1500</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468689: 8w5d: VT[Vi3]:Processing vaccess response, id 0x6D000D09, result success (1)</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468690: Jan 3 12:22:42: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access3, changed state to up</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468691: Jan 3 12:22:42: %LINK-3-UPDOWN: Interface Virtual-Access3, changed state to up</FONT></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri">Jan 3 12:22:42 aggr.rt1 468692: Jan 3 12:22:42: %</FONT></I></SPAN><SPAN LANG="en-us"><B><I><FONT COLOR="#FF0000" FACE="Calibri">FMANRP_ESS-4-FULLVAI: Session creation failed due to Full Virtual-Access Interfaces not being supported. Check that all applied Virtual-Template and RADIUS features support Virtual-Access sub-interfaces. swidb= 0x7FEDB5942B98, ifnum=</FONT></I></B></SPAN><SPAN LANG="en-us"><I><FONT COLOR="#FF0000" FACE="Calibri"> 37</FONT></I></SPAN><SPAN LANG="en-us"><I></I></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Dominic</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-----Original Message-----<BR>
From: Christoph Loibl [<A HREF="mailto:cl@sil.at">mailto:cl@sil.at</A>]<BR>
Sent: Thursday, January 03, 2013 2:40 AM<BR>
To: Dominic<BR>
Cc: cisco-bba@puck.nether.net<BR>
Subject: Re: [cisco-bba] LNS Error on Cisco ASR 1004</FONT></SPAN><SPAN LANG="en-us"></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Hi Dominic,</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">On Jan 3, 2013, at 1:21 AM, "Dominic" <</FONT></SPAN><SPAN LANG="en-us"></SPAN><A HREF="mailto:dominic@broadconnect.ca"><SPAN LANG="en-us"><FONT FACE="Calibri">dominic@broadconnect.ca</FONT></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"><FONT FACE="Calibri">> wrote:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> "%FMANRP_ESS-4-FULLVAI: Session creation failed due to Full Virtual-Access Interfaces not being supported. Check that all applied Virtual-Template and RADIUS features support Virtual-Access sub-interfaces. swidb=</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> 0x7FEDB5942B98, ifnum= 37"</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> The funny thing is, if the CPE is a Cisco 1841, the pppoe negotiation is successfully negotiated, and everything works great. If some other CPE however, we end up with the above error. </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">> Any idea what we are doing wrong? </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Some features you use may require a Full Virtual-Access to be created on the ASR which is, as far as I know, not supported on the ASR1k. Additionally some attributes sent by the radius may force the ASR to create a full Va. (Cisco-AVPair Interface-config is my first guess)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Is radius authentication performed and does the error appear _after_ the authentication during setup of the channel? If yes, try removing the following attribute from your tunnel configuration:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">| 123 | telco1-pppoe-static | Cisco-Avpair | += | interface-config=ppp ipcp dns xx.xx.xx.234 xx.xx.xx.235 |</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">^^^^ (By the way: Does this attribute really make sense/matter at all? When you forward the session to a remote LAC IPCP is performed by the remote LAC not the LNS itself)</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">You may also try to add the following configuration line on the LNS:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">aaa policy interface-config allow-subinterface</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">And/or add the following to the response attributes of that particular user on the radius:</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Cisco-Avpair += lcp:interface-config=allow-subinterface=yes</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Best regards</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Christoph</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">-- </FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">SILVER SERVER \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ \\\\\\ \\ \</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">Ing Christoph Loibl, MSc <</FONT></SPAN><SPAN LANG="en-us"></SPAN><A HREF="mailto:cl@sil.at"><SPAN LANG="en-us"><FONT FACE="Calibri">cl@sil.at</FONT></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"><FONT FACE="Calibri">> Senior Network Engineer</FONT></SPAN></P>
<P DIR=LTR><SPAN LANG="en-us"><FONT FACE="Calibri">CL8-RIPE </FONT></SPAN><SPAN LANG="en-us"> </SPAN><A HREF="http://www.sil.at"><SPAN LANG="en-us"><FONT FACE="Calibri">http://www.sil.at</FONT></SPAN><SPAN LANG="en-us"></SPAN></A><SPAN LANG="en-us"></SPAN></P>
</BODY>
</HTML>