[cisco-nas] isdn-bri dialing + CHAP + AAA
Tassos Chatzithomaoglou
achatz at forthnet.gr
Tue Dec 21 12:55:31 EST 2004
I'm trying to configure the following on a 1751 (12.3(11)T2), but it doesn't seem to be
working.
This bri is supposed to make an outgoing call to an AS5300. The AS5300 already accepts
calls from PC clients or other routers and it's working fine.
!-----------------------------------------
! 1751 config
!-----------------------------------------
aaa new-model
!
aaa authentication login default enable
aaa authentication ppp default local
aaa authorization exec default local if-authenticated
aaa authorization network default local
!
username user1 password pass1
!
interface BRI1/0
ip address x.x.x.x y.y.y.y
encapsulation ppp
dialer idle-timeout 600
dialer string xxxx
dialer-group 1
isdn switch-type basic-net3
no fair-queue
no cdp enable
ppp authentication chap callin
ppp chap hostname user1
ppp chap password pass1
!-----------------------------------------
!-----------------------------------------
! AS5300 config
!-----------------------------------------
aaa authentication ppp RADIUS-AAA if-needed group RADIUS-SERVERS
aaa authorization network RADIUS-AAA group RADIUS-SERVERS
aaa accounting network RADIUS-AAA start-stop group RADIUS-SERVERS-ACCT
!-----------------------------------------
interface Dialer2
ip unnumbered Loopback0
encapsulation ppp
no ip mroute-cache
dialer in-band
dialer idle-timeout 1200 either
dialer-group 1
peer default ip address pool isdn
ppp authentication pap chap ms-chap callin RADIUS-AAA
ppp authorization RADIUS-AAA
ppp accounting RADIUS-AAA
!-----------------------------------------
If i remove the whole aaa configuration from the 1751, then it's working fine (!). The
user gets CHAP authenticated.
If i add "ppp pap sent-username user1 password pass1" and ENABLE AAA (!) on the 1751, then
it's working fine (!!). The user gets PAP authenticated.
Is there a problem somewhere with chap and AAA?
More information about the cisco-nas
mailing list