[cisco-nas] isdn-bri dialing + CHAP + AAA

Tassos Chatzithomaoglou achatz at forthnet.gr
Tue Dec 21 12:55:31 EST 2004


I'm trying to configure the following on a 1751 (12.3(11)T2), but it doesn't seem to be 
working.

This bri is supposed to make an outgoing call to an AS5300. The AS5300 already accepts 
calls from PC clients or other routers and it's working fine.

!-----------------------------------------
! 1751 config
!-----------------------------------------
aaa new-model
!
aaa authentication login default enable
aaa authentication ppp default local
aaa authorization exec default local if-authenticated
aaa authorization network default local
!
username user1 password pass1
!
interface BRI1/0
  ip address x.x.x.x y.y.y.y
  encapsulation ppp
  dialer idle-timeout 600
  dialer string xxxx
  dialer-group 1
  isdn switch-type basic-net3
  no fair-queue
  no cdp enable
  ppp authentication chap callin
  ppp chap hostname user1
  ppp chap password pass1
!-----------------------------------------

!-----------------------------------------
! AS5300 config
!-----------------------------------------
aaa authentication ppp RADIUS-AAA if-needed group RADIUS-SERVERS
aaa authorization network RADIUS-AAA group RADIUS-SERVERS
aaa accounting network RADIUS-AAA start-stop group RADIUS-SERVERS-ACCT
!-----------------------------------------
interface Dialer2
  ip unnumbered Loopback0
  encapsulation ppp
  no ip mroute-cache
  dialer in-band
  dialer idle-timeout 1200 either
  dialer-group 1
  peer default ip address pool isdn
  ppp authentication pap chap ms-chap callin RADIUS-AAA
  ppp authorization RADIUS-AAA
  ppp accounting RADIUS-AAA
!-----------------------------------------

If i remove the whole aaa configuration from the 1751, then it's working fine (!). The 
user gets CHAP authenticated.

If i add "ppp pap sent-username user1 password pass1" and ENABLE AAA (!) on the 1751, then 
it's working fine (!!). The user gets PAP authenticated.

Is there a problem somewhere with chap and AAA?




More information about the cisco-nas mailing list