[c-nsp] PPPoE Relay from 1811 to 7206VXR
Skeeve Stevens
skeeve at skeeve.org
Tue Jun 5 03:29:04 EDT 2007
Hey Oli,
1811(config-vpdn-acc-in)#protocol ?
any Use any protocol
l2f Use L2F
l2tp Use L2TP
pptp Use PPTP
doesn't seem to have protocol pppoe.
So at the moment I have:
-------
username Tunnel-In password 7 x
username LAC-Gosford-Test password 7 x
vpdn enable
vpdn multihop
!
vpdn-group forward-as-l2tp
request-dialin
protocol l2tp
initiate-to ip 58.x.x.x
local name LAC-Gosford-Test
!
vpdn-group pppoe
! Default L2TP VPDN group
! Default PPTP VPDN group
accept-dialin
protocol any
virtual-template 1
local name LAC-Gosford-Test
!
interface Virtual-Template1
mtu 1492
no ip address
no peer default ip address
no keepalive
ppp authentication chap pap
-------
Can the users use no domain? Or do they have to? I've tried with a domain
and it didn't seem to help.
1811 Debug:
PPPoE:
PPPoE protocol events debugging is on
VPN:
L2X protocol events debugging is on
VPDN call event debugging is on
VPDN events debugging is on
VPDN errors debugging is on
VPDN packet debugging is on
L2TP data sequencing debugging is on
===
Jun 5 07:28:58.147: PPPoE : encap string prepared
Jun 5 07:28:58.147: [561]PPPoE 21582: Access IE handle allocated
Jun 5 07:28:58.147: [561]PPPoE 21582: pppoe SSS switch updated
Jun 5 07:28:58.151: [561]PPPoE 21582: AAA unique ID allocated
Jun 5 07:28:58.151: [561]PPPoE 21582: Destroying R:0017.3101.664e
L:0017.5902.2d34 Fa0
Jun 5 07:28:58.151: [561]PPPoE 21582: AAA account stopped
Jun 5 07:29:03.147: PPPoE 0: I PADR R:0017.3101.664e L:0017.5902.2d34 Fa0
Jun 5 07:29:03.147: Service tag: NULL Tag
Jun 5 07:29:03.147: PPPoE : encap string prepared
Jun 5 07:29:03.147: [562]PPPoE 21583: Access IE handle allocated
Jun 5 07:29:03.147: [562]PPPoE 21583: pppoe SSS switch updated
Jun 5 07:29:03.147: [562]PPPoE 21583: AAA unique ID allocated
Jun 5 07:29:03.147: [562]PPPoE 21583: Destroying R:0017.3101.664e
L:0017.5902.2d34 Fa0
Jun 5 07:29:03.151: [562]PPPoE 21583: AAA account stopped
Jun 5 07:29:18.179: PPPoE 0: I PADI R:0017.3101.664e L:ffff.ffff.ffff Fa0
Jun 5 07:29:18.179: Service tag: NULL Tag
Jun 5 07:29:18.179: PPPoE 0: O PADO, R:0017.5902.2d34 L:0017.3101.664e Fa0
Jun 5 07:29:18.179: Service tag: NULL Tag
Jun 5 07:29:18.179: PPPoE 0: I PADR R:0017.3101.664e L:0017.5902.2d34 Fa0
Jun 5 07:29:18.179: Service tag: NULL Tag
Jun 5 07:29:18.179: PPPoE : encap string prepared
Jun 5 07:29:18.179: [563]PPPoE 21584: Access IE handle allocated
Jun 5 07:29:18.179: [563]PPPoE 21584: pppoe SSS switch updated
Jun 5 07:29:18.179: [563]PPPoE 21584: AAA unique ID allocated
Jun 5 07:29:18.179: [563]PPPoE 21584: Destroying R:0017.3101.664e
L:0017.5902.2d34 Fa0
Jun 5 07:29:18.179: [563]PPPoE 21584: AAA account stopped
Jun 5 07:29:23.179: PPPoE 0: I PADR R:0017.3101.664e L:0017.5902.2d34 Fa0
Jun 5 07:29:23.179: Service tag: NULL Tag
Jun 5 07:29:23.179: PPPoE : encap string prepared
Jun 5 07:29:23.179: [564]PPPoE 21585: Access IE handle allocated
Jun 5 07:29:23.179: [564]PPPoE 21585: pppoe SSS switch updated
Jun 5 07:29:23.179: [564]PPPoE 21585: AAA unique ID allocated
Jun 5 07:29:23.179: [564]PPPoE 21585: Destroying R:0017.3101.664e
L:0017.5902.2d34 Fa0
Jun 5 07:29:23.179: [564]PPPoE 21585: AAA account stopped
===
The 7200 Radius is testing fine, but it isn't seeing the tunnel come up at
all.
Here is the config.
-------
aaa new-model
aaa group server radius isp
server x auth-port 1812 acct-port 1813
!
aaa authentication login default local
aaa authentication ppp isp group isp
aaa authorization exec default local group isp
aaa authorization network isp group isp
aaa accounting delay-start
aaa accounting update periodic 30
aaa accounting network default start-stop group isp
aaa accounting connection default start-stop group isp
aaa accounting system default start-stop group isp
username Tunnel-In password 7 1042081B0C03
username LAC-Gosford-Test password 7 03085A090F1B
vpdn enable
vpdn multihop
vpdn aaa attribute nas-port vpdn-nas
vpdn logging
vpdn logging local
vpdn logging tunnel-drop
vpdn history failure table-size 50
vpdn session-limit 2048
vpdn search-order domain
vpdn domain-delimiter @ suffix
vpdn domain-delimiter / prefix
!
vpdn-group 1
accept-dialin
protocol l2tp
virtual-template 1
terminate-from hostname LAC-Gosford-Test
local name Tunnel-In
lcp renegotiation on-mismatch
!
interface Virtual-Template1
mtu 1492
ip unnumbered Loopback0
peer default ip address pool eqpool
down-when-looped
ppp mtu adaptive
ppp authentication chap pap isp
ppp authorization isp
ppp accounting isp
!
ip local pool eqpool x x
!
!
radius-server configure-nas
radius-server host x auth-port 1812 acct-port 1813
radius-server retransmit 2
radius-server timeout 2
radius-server key 7 x
radius-server authorization permit missing Service-Type
-------
-----Original Message-----
From: Oliver Boehmer (oboehmer) [mailto:oboehmer at cisco.com]
Sent: Tuesday, 29 May 2007 8:17 PM
To: skeeve at skeeve.org; Cisco-nsp
Subject: RE: [c-nsp] PPPoE Relay from 1811 to 7206VXR
Skeeve,
you need to configure vpdn multihop on the 1811, something like this
vpdn enable
vpdn multihop
vpdn-group pppoe
accept-dialin
protocol pppoe
virtual-template 1
!
vpdn-group forward-as-l2tp
request-dialin
protocol l2tp
domain domain.com
initiate-to ip <address-of-the-7200>
local name pppoe-relay
The trick could be to match the forward-as-l2tp tunnel using the domain,
the example above assumes all the users authenticate via
xxxx at domain.com..
You can also use Radius and return a tunnel profile within the
access-request..
Don't think you need the bba-group stuff, but not entirely sure..
oli
Skeeve Stevens <> wrote on Monday, May 28, 2007 4:31 PM:
> Hi guys,
>
> I've just spent most of the day trying to get an 1811 relay
PPPoE
> calls to a central server, and I've failed miserably.
>
> I have established that the max number of sessions an 1811 can
relay
> is 300.
>
> I do need some help from you wonderful people.
>
> Imagine the 1811(12.4) and 7206(12.2) are configless. Where do
I
> start from?
>
> I assume the following:
>
> 1. 1811 can accept PPPoE calls
> 2. 1811 needs to make a l2tp tunnel to the 7206 which is already
> configured to accept PPPoE
>
>
> If anyone can assist that would be wonderful. The areas that are new
> to me on the 1811 in 12.4
> - No idea how the new bba-group pppoe global works for pppoe
dialin
>
> The basic scenario is about 30 * 1811's out in regional
pops
> with between 20 and 200 clients on a layer 2 wireless network behind
> the 1811. The 1811 remote pops are all connected in an MPLS cloud
> which goes back to a central 7206vxr-npe400. The goal is to have the
> end user be able to pppoe into the 7200 some how.
>
> All assistance is welcome.
>
> .Skeeve
>
>
>
> --
> Skeeve Stevens, RHCE
> skeeve at skeeve.org / www.skeeve.org
> Cell +61 (0)414 753 383 / skype://skeeve
>
> eintellego - skeeve at eintellego.net - www.eintellego.net
> --
> I'm a groove licked love child king of the verse
> Si vis pacem, para bellum
>
>
> _______________________________________________
> cisco-nsp mailing list cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
More information about the cisco-nsp
mailing list