To specify which virtual template is used to clone virtual access interfaces (VAI), use the virtual-template command in BBA group configuration mode and in VPDN group configuration mode. To remove the virtual template from a virtual private dialup network (VPDN) group, use the no form of this command.

Syntax Description

Command Default

No virtual template is enabled.

Command Modes

BBA group configuration mode (config-bba-group)

VPDN group configuration (config-vpdn)

Command History

Usage Guidelines

You must first enable a tunneling protocol on the VPDN group by using the protocol (VPDN) command before you can enable the virtual-template command. Removing or modifying the protocol command removes the virtual-template command from the VPDN group.

Each VPDN group can clone only VAIs using one virtual template. If you enter a second virtual-template command on a VPDN group, it replaces the first virtual-template command.

The table below lists the VPDN group commands under which the virtual-template command can be entered. Entering the VPDN group command starts VPDN group configuration mode. The table includes the command-line prompt for the VPDN group configuration mode and the type of service configured.

router(config-vpdn-acc-in)#

router(config-vpdn-req-out)#

When the virtual-template command is entered under a request-dialout VPDN subgroup, IP and other per-user attributes can be applied to an L2TP dial-out session from an LNS. Before this command was enhanced, IP per-user configurations from authentication, authorization, and accounting (AAA) servers were not supported; the IP configuration comes from the dialer interface defined on the router.

The enhanced virtual-template command works in a way similar to configuring virtual profiles and L2TP dial-in. The L2TP VAI is first cloned from the virtual template, which means that configurations from the virtual template interface is applied to the L2TP VAI. After authentication, the AAA per-user configuration is applied to the VAI. Because AAA per-user attributes are applied only after the user has been authenticated, the LNS must be configured to authenticate the dial-out user (configuration authentication is needed for this command).

With the enhanced virtual-template command, all software components can now use the configuration present on the VAI rather than what is present on the dialer interface. For example, IP Control Protocol (IPCP) address negotiation uses the local address of the VAI as the router address while negotiating with the peer.

Cisco 10000 Series Router Usage Guidelines

In Cisco IOS Release 12.2(33)SB, the virtual-template snmp command has a new default configuration. Instead of being enabled by default, no virtual-template snmp is the default configuration. This setting enhances scaling and prevents large numbers of entries in the MIB ifTable, thereby avoiding CPU Hog messages as SNMP uses the interfaces MIB and other related MIBs.

If you configure the no virtual-template snmp command, the router no longer accepts the snmp trap link-status command under a virtual-template interface. Instead, the router displays a configuration error message such as the following:

Router(config)# interface virtual-template 1
Router(config-if)# snmp trap link-status
%Unable set link-status enable/disable for interface

If your configuration already has the snmp trap link-status command configured under a virtual-template interface and you upgrade to Cisco IOS Release 12.2(33)SB, the configuration error occurs when the router reloads even though the virtual template interface is already registered in the interfaces MIB.

Related Commands

To enable reporting of network access server (NAS) authentication, authorization, and accounting (AAA) attributes related to a virtual private dialup network (VPDN) to the AAA server, use the vpdn aaa attribute command in global configuration mode. To disable reporting of AAA attributes related to VPDN, use the no form of this command.

Syntax Description

Command Default

AAA attributes are not reported to the AAA server.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

This command can be used with RADIUS or TACACS+ and is applicable only on the VPDN tunnel server.

The PPP extended NAS-Port format enables the NAS-Port and NAS-Port-Type attributes to provide port details to a RADIUS server when one of the following protocols is configured:

• PPP over ATM
• PPP over Ethernet (PPPoE) over ATM
• PPPoE over 802.1Q VLANs

Before PPP extended NAS-Port format attributes can be reported to the RADIUS server, the radius-server attribute nas-port format command with the d keyword must be configured on both the tunnel server and the NAS, and the tunnel server and the NAS must both be Cisco routers.

When you configure the vpdn aaa attribute nas-ip-address vpdn-nas command, the L2TP network server (LNS) reports the IP address of the last multihop node for multihop over Layer 2 Forwarding (L2F). For multihop over Layer 2 Tunneling Protocol (L2TP), the IP address of the originating NAS is reported.

When you configure the vpdn aaa attribute nas-ip-address vpdn-tunnel-client command, the LNS reports the IP address of the last multihop node in the RADIUS NAS-IP-Address attribute for the L2TP multihop. This eases the migration for customers moving from L2F to L2TP.

Note	Reporting of NAS AAA attributes related to a VPDN on a AAA server is not supported for Point-to-Point Tunneling Protocol (PPTP) sessions with multihop deployment.

Related Commands

To specify an authentication, authorization, and accounting (AAA) server to be used for virtual private dialup network (VPDN) tunnel authorization other than the default AAA server, use the vpdn aaa override-server command in global configuration mode. To return to the default setting, use the no form of this command.

Syntax Description

Command Default

If the AAA server is not specified, the default AAA server configured for network authorization is used.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

This command can be used with RADIUS or TACACS+, and is applicable only on the VPDN network access server (NAS). Configuring this command restricts tunnel authorization to the specified AAA servers only. This command can be used to specify multiple AAA servers.

For TACACS+ configuration, the tacacs-server directed-request command must be configured by using the restricted keyword, or authorization will continue with all configured TACACS+ servers.

Related Commands

To apply untagged attribute values obtained from the authentication, authorization, and accounting (AAA) RADIUS server to all attribute sets for virtual private dialup network (VPDN) tunnels, use the vpdn aaa untagged command in global configuration mode. To disable this function, use the no form of this command.

Syntax Description

Command Default

Untagged attribute values are applied to all attribute sets.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Untagged attribute values obtained from the AAA RADIUS server are applied to all attribute sets by default, unless a value for that attribute is already specified in the tagged attribute set. To prevent untagged attribute values from being applied to tagged attribute sets, use the no form of this command.

Related Commands

Note	Effective with Cisco Release 12.4(11)T, the support for L2F was removed in Cisco IOS Software.

To configure a network access server (NAS) to request authentication of a complete username before making a forwarding decision for all dial-in Layer 2 Tunneling Protocol (L2TP) or Layer 2 Forwarding (L2F) tunnels, use the vpdn authen-before-forward command in global configuration mode. To disable this configuration, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

L2TP or L2F tunnels are forwarded to the tunnel server without first requesting authentication of the complete username.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

To configure the NAS to perform authentication of all dial-in L2TP or L2F sessions before the sessions are forwarded to the tunnel server, configure the vpdn authen-before-forward command in global configuration mode.

To configure the NAS to perform authentication of dial-in L2TP or L2F sessions belonging to a specific VPDN group before the sessions are forwarded to the tunnel server, use the authen-before-forward command in VPDN group configuration mode.

Enabling the vpdn authen-before-forward command instructs the NAS to authenticate the complete username before making a forwarding decision based on the domain portion of the username. A user may be forwarded or terminated locally depending on the information contained in the users RADIUS profile. Users with forwarding information in their RADIUS profile are forwarded based on that information. Users without forwarding information in their RADIUS profile are either forwarded or terminated locally based on the Service-Type in their RADIUS profile. The relationship between forwarding decisions and the information contained in the users RADIUS profile is summarized in the table below.

Related Commands

To enable virtual private dialup network (VPDN) authorization for directed-request users, use the vpdn authorize directed-request command in global configuration mode. To disable VPDN authorization for directed request users, use the no form of this command.

Syntax Description

This command has no keywords or arguments.

Command Default

VPDN authorization for directed-request users is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

When a username includes both a username and a domain portion, such as user@site.com, directed request configuration allows the authorization request to be sent to a specific RADIUS or TACACS+ server based on the domain name portion of the username (site.com). The vpdn authorize directed-request command must be enabled to allow VPDN authorization of any directed request user.

Directed request for RADIUS users is enabled by issuing the radius-server directed-request command. Directed request for TACACS+ users is enabled by default, and can be disabled by using the no tacacs-server directed request command. The ip host command must be configured to enable directed requests to RADIUS or TACACS+ servers.

The vpdn authorize directed-request command is usually configured on the L2TP network server (LNS). When directed-requests are used on an L2TP access concentrator (LAC) with per-user VPDN configuration, the authen before-forward command must be enabled.

Related Commands

To enable domain preauthorization on a network access server (NAS), use the vpdn authorize domain command in global configuration mode. To disable domain preauthorization, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Domain preauthorization is disabled by default.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

A domain preauthorization RADIUS user profile must also be created. See the Examples section and refer to the Cisco IOS Security Configuration Guide for information on how to create these profiles.

Related Commands

To specify the characters to be used to delimit the domain prefix or domain suffix, use the vpdn domain-delimiter command in global configuration mode. To disable this function, use the no form of this command.

Syntax Description

Command Default

Disabled

Command Modes

Global configuration (config)

Command History

Usage Guidelines

You can enter one vpdn domain-delimiter command to list the suffix delimiters and another vpdn domain-delimiter command to list the prefix delimiters. However, no character can be both a suffix delimiter and a prefix delimiter.

This command allows the network access server to parse a list of home gateway DNS domain names and addresses sent by an AAA server. The AAA server can store domain names or IP addresses in the following AV pair:

cisco-avpair = "lcp:interface-config=ip address 10.1.1.1 255.255.255.255.0",

cisco-avpair = "lcp:interface-config=ip address bigrouter@cisco.com,

Related Commands

To enable virtual private dialup networking (VPDN) on the router and inform the router to look for tunnel definitions in a local database and on a remote authorization server (home gateway), if one is present, use the vpdn enable command in global configuration mode. To disable, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

VPDN is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The no vpdn enable command does not automatically disable a VPDN tunnel.

To shut down a VPDN tunnel, use the clear vpdn tunnel command or the vpdn softshut command.

Cisco 10000 Series Usage Guidelines

In Cisco IOS Release 12.2(33)SB and later releases, the router no longer accepts the vpdn-group command if you issue the command before you issue the vpdn enable command. Instead, the following warning message displays:

% VPDN configuration is not allowed until VPDN is enabled through 'vpdn enable'.

In releases prior to Cisco IOS Release 12.2(33)SB, if you issue the vpdn-group command before the vpdn enable command, the router accepts the command and displays the following warning message:

% VPDN is not enabled

Related Commands

To associate a virtual private dialup network (VPDN) group with a customer or VPDN profile, use the vpdn group command in customer profile or in VPDN profile configuration mode. To disassociate a VPDN group from a customer or VPDN profile, use the no form of this command.

Syntax Description

Command Default

No default behavior or values.

Command Modes

Customer profile configuration

VPDN profile configuration (config-vpdn-profile)

Command History

Usage Guidelines

Use the vpdn group command in customer profile configuration mode or in VPDN profile configuration mode to associate a VPDN group with a customer profile or a VPDN profile, respectively.

VPDN groups are created by using the vpdn-group command in global configuration mode.

Related Commands

To enable logging of virtual private dialup network (VPDN) failures to the history failure table or to set the failure history table size, use the vpdn history failure command in global configuration mode. To disable logging of VPDN history failures or to restore the default table size, use the no form of this command.

Syntax Description

Command Default

VPDN failures are logged by default. The table size is 20 entries

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Logging of VPDN failure events is enabled by default. You can disable the logging of VPDN failure events by issuing the no vpdn history failure command.

The logging of a failure event to the history table is triggered by event logging by the syslog facility. The syslog facility creates a failure history table entry, which keeps records of failure events. The table starts with 20 entries, and the size of the table can be expanded to a maximum of 50 entries by using the vpdn history failure table-size entries command. You can configure the vpdn history failure table-size entries command only if VPDN failure event logging is enabled.

All failure entries for the user are kept chronologically in the history table. Each entry records the relevant information of a failure event. Only the most recent failure event per user, unique to its name and tunnel client ID (CLID), is kept.

When the total number of entries in the table reaches the configured table size, the oldest record is deleted and a new entry is added.

Related Commands

To prevent the message "The remote server closed the session" from overwriting useful messages in the virtual private dialup network (VPDN) connection failure log, use the no vpdn history failure cause normal command in global configuration mode. To reenable logging of the message (the default), use the vpdn history failure cause normal command.

Syntax Description

This command has no arguments or keywords.

Command Default

This command is enabled when the VPDN failure log is enabled, but it does not appear in the configuration of a Layer 2 access concentrator (LAC) or Layer 2 network server (LNS) when the running configuration is listed. When the no form of this command is configured, the command be listed in the running configuration. See the "Usage Guidelines" section for more information.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

When users are declared as unauthenticated, their termination is recorded in the VPDN failure log. One method for determining why a subscriber cannot establish a PPP session is for the network operator to check the VPDN failure log for connection failure messages. The router can determine and log specific reasons for session termination, such as authentication failure, exceeding the session limit, timer expiration, and so on. However, a peer LAC or LNS sends the message "VPDN-6-CLOSED" to the router for any type of session termination. All other messages at the console and in the failure log appear under abnormal termination at that router, and the message "The remote server closed the session" is also logged in the VPDN connection failure log. So the failure log, which has maximum of 50 messages, gets filled with messages. Once the maximum message length is reached, new messages begin replacing old messages and information about the unauthenticated users is lost.

The no vpdn logging cause normal command disables all system logging (syslog) messages with the prefix "VPDN-6-CLOSED." The no vpdn history failure cause normal command is used to prevent the message "The remote server closed the session" from being added to the connection failure log.

Both commands are independent so that configuring the no vpdn logging cause normal command does not prevent the message "The remote server closed the session" from being logged. And conversely, configuring the no vpdn history failure cause normal command does not prevent the syslog message "VPDN-6-CLOSED" from appearing.

By default, the vpdn logging cause normal command is enabled only when VPDN logging is enabled and does not appear in the show running-config command display. When configured, the command no vpdn logging cause normal appears in the show running-config command display only when VPDN logging is enabled.

By default, the vpdn history failure cause normal command is enabled only when the VPDN failure log is enabled, and it does not appear in the show running-config command display. When configured, the command no vpdn history failure cause normal shows up only when the VPDN history log is enabled.

Regardless of whether the no vpdn logging cause normal and the no vpdn history failure cause normal commands are configured, all other syslog messages except those with prefix "VPDN-6-CLOSED" appear on the console, and the failure table logs all messages except "The remote server closed the session."

Related Commands

The vpdn incoming command is replaced by the accept-dialin command. See the description of the accept-dialin command for more information.

Note	Effective with Cisco Release 12.4(33)T, the support for L2F is not available in Cisco IOS Software.

To allow the router to ignore User Datagram Protocol (UDP) checksums for Layer 2 Forwarding (L2F) and Layer 2 Tunneling Protocol (L2TP) virtual private dialup network (VPDN) traffic, use the vpdn ip udp ignore checksum command in global configuration mode. To disable the ignoring of UDP checksums, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Releases prior to Cisco IOS Release 12.3(13) and 12.3(14)T: UDP checksums are not ignored by default.

Cisco IOS Release 12.3(13) and 12.3(14)T and later releases: UDP checksums are ignored by default.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Ignoring UDP checksums is beneficial when the remote tunnel endpoint uses UDP checksums and when you want to use fast switching or Cisco Express Forwarding (CEF). If the remote tunnel endpoint uses UDP checksums and the vpdn ip udp ignore checksum command is disabled, all tunnel traffic is process-switched.

In Cisco IOS Release 12.3(13) and Cisco IOS Release 12.3(14)T, this command was modified to be enabled by default.

Cisco 10000 Series Router

When you configure this command, the router directly queues L2TP hello packets and hello acknowledgments to the L2TP control process. We recommend that you configure this command in all scaled LAC and LNS L2TP tunnel configurations.

If you do not configure the vpdn ip udp ignore checksum command, the L2TP software sends the packet to UDP to validate the checksum. When too many packets are queued to the IP input process, the router starts selective packet discard (SPD), which causes IP packets to be dropped.

Note	Head-of-the-line blocking of the IP input process might occur in other non-L2TP configurations. A flush occurring on an input interface indicates that SPD is discarding packets.

To send the attribute value pairs (AVP) in the session creation packets from the L2TP (Layer 2 Tunneling Protocol) Access Controller (LAC) to the L2TP Network Server (LNS), use the vpdn l2tp attribute command in global configuration mode. To disable the sending of AVPs, use the no form of this command.

Syntax Description

Command Default

The ICCN and the ICRQ packets do not carry the AVPs to the LNS.

Command Modes

        Global configuration (config)
      

Command History

Usage Guidelines

ICRQ and ICCN are the respective first and last of the three message exchanges that are used for establishing sessions with an L2TP tunnel.

Use the vpdn l2tp attribute initial-received-lcp-confreq command in global configuration mode to add the Initial Received LCP CONFREQ AVP to the ICCN packets on the LAC.

Use the vpdn l2tp attribute physical-channel-id command in global configuration mode to add the Physical Channel ID AVP to the ICRQ packets on LAC.

To configure a network access server (NAS) to suppress Layer 2 Tunneling Protocol (L2TP) calling station IDs globally, use the vpdn l2tp attribute clid mask-method command in global configuration mode. To disable this function, use the no form of this command.

Syntax Description

Command Default

The calling station ID is not masked or dropped.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the vpdn l2tp attribute clid mask-method command to mask the calling station ID in L2TP attribute-value (AV) pair 22 globally for all virtual private dialup network (VPDN) groups configured on the NAS. This command is compatible with both local and remote RADIUS authorization. You can either substitute characters for a portion of the calling station ID or remove the entire calling station ID.

The l2tp attribute clid mask-method command can be used to mask the calling station ID for calls associated with a specific VPDN group or VPDN template. This command is compatible with only local authorization.

Related Commands

To enable the logging of virtual private dialup network (VPDN) events , use the vpdn logging command in global configuration mode. To disable the logging of VPDN events, use the no form of this command.

Syntax Description

Command Default

All VPDN event logging is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

This command controls the logging of VPDN events. By default, all VPDN event logging is disabled.

In Cisco IOS Releases 15.0, 12.2(33)XNE, 12.2(33)SRE, XE 2.5 and later, when you use any keyword with the vpdn logging command, the status of the master flag, which is recognized by the configuration element vpdn logging, is evaluated. If all types of vpdn logging are in their default states (the default for the vpdn logging cause command is enabled; the defaults for the other VPDN logging types are disabled), the master flag is turned off, causing the VPDN logging CLI to no longer be generated in the show running-config display by the nvgen process. If you configure any VPDN logging type to a nondefault state, the master flag is turned on and the vpdn logging output is displayed in the show running-config command output.

To enable the logging of VPDN events to the syslog of the local or the remote tunnel endpoint router, issue the vpdn logging command with the local or the remote keyword.

To log VPDN user events or VPDN tunnel-drop events to the syslog, you must configure the vpdn logging command with the user or the tunnel-drop keyword.

Configuring the vpdn logging command with the accounting keyword causes VPDN event log messages to be sent to a remote AAA server in a AAA vendor-specific attribute (VSA). This allows the correlation of VPDN call success rates with accounting records.

Note	VPDN event logging to the syslog need not be enabled to allow the reporting of VPDN event log messages to a AAA server.

You can configure as many types of VPDN event logging as you want.

Related Commands

To prevent display of the syslog message "VPDN-6-CLOSED" on the router console, use the no vpdn logging cause normal command in global configuration mode. To reenable display of the message (the default), use the vpdn logging cause normal command.

Syntax Description

This command has no arguments or keywords.

Command Default

This command is enabled when VPDN logging is enabled, but it does not appear in the configuration of a Layer 2 access concentrator (LAC) or Layer 2 network server (LNS) when the running configuration is listed. When the no form of this commands is configured, it is listed in the running configuration. See the "Usage Guidelines" section for more information.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

When users are declared as unauthenticated, their termination is recorded in the VPDN failure log. One method for determining why a subscriber cannot establish a PPP session is for the network operator to check the VPDN failure log for connection failure messages. The router can determine and log specific reasons for session termination, such as authentication failure, exceeding the session limit, timer expiration, and so on. However, a peer LAC or LNS sends the message "VPDN-6-CLOSED" to the router for any type of session termination. All other messages at the console and in the failure log appear under abnormal termination at that router, and the message "The remote server closed the session" is also logged in the VPDN connection failure log. So the failure log, which has maximum of 50 messages, is filled with messages. Once the maximum message length is reached, new messages begin replacing old messages and information about the unauthenticated users is lost.

The no vpdn logging cause normal command disables all system logging (syslog) messages with the prefix "VPDN-6-CLOSED." The no vpdn history failure cause normal command is used to prevent the message "The remote server closed the session" from being added to the connection failure log.

Both commands are independent so that configuring the no vpdn logging cause normal command does not prevent the message "The remote server closed the session" from being logged. And conversely, configuring the no vpdn history failure cause normal command does not prevent the syslog message "VPDN-6-CLOSED" from appearing.

By default, the vpdn logging cause normal command is enabled only when VPDN logging is enabled, and does not appear in the show running-config command output. When configured, the command no vpdn logging cause normal is listed in the show running-config command output only when VPDN logging is enabled.

By default, the vpdn history failure cause normal command is enabled only when the VPDN failure log is enabled, and it does not appear in the show running-config command output. When configured, the command no vpdn history failure cause normal shows up only when the VPDN history log is enabled.

Regardless of whether the no vpdn logging cause normal and the no vpdn history failure cause normal commands are configured, all other syslog messages except those with prefix "VPDN-6-CLOSED" appear on the console, and the failure table logs all messages except "The remote server closed the session."

Related Commands

To enable virtual private dialup network (VPDN) multihop, use the vpdn multihop command in global configuration mode. To disable VPDN multihop capability, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

Multihop is disabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to enable multihop VPDN. Multihop VPDN allows packets to pass through multiple VPDN tunnels. Ordinarily, packets are not allowed to traverse more than one tunnel. With multihop enabled, a packet can traverse as many as four tunnels.

VPDN multihop allows a router configured as a tunnel switch to act as both a network access server (NAS) and a tunnel server, receiving packets from an incoming VPDN tunnel and sending them out over an outgoing VPDN tunnel.

A tunnel switch can terminate incoming VPDN tunnels from multiple devices, and initiate outgoing tunnels to one or more tunnel servers. The outgoing tunnel is selected using either a domain name, a remote tunnel name, or a DNIS number. The order in which these criteria are searched by the software is determined by the vpdn search-order command.

VPDN multihop must be enabled for a Multichassis Multilink PPP (MMP) stack group deployment to function when incoming calls traverse a VPDN tunnel. For more information on configuring multihop VPDN for MMP, refer to the Cisco IOS VPDN Configuration Guide .

Related Commands

The vpdn outgoing command is replaced by the request-dialin command. See the description of the request-dialin command for more information.

To manually configure a range of allowed path maximum transmission unit (MTU) sizes for a Layer 2 Tunneling Protocol (L2TP) virtual private dialup network (VPDN), use the vpdn pmtu command in global configuration mode. To restore the default value, use the no form of this command.

Syntax Description

Command Default

No maximum or minimum path MTU size is defined.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the vpdn pmtu command to prevent Denial of Service (DoS) attacks against L2TP VPDN deployments that are performing path MTU discovery (PMTUD). PMTUD for an L2TP VPDN is disabled by default. To enable PMTUD, use the ip pmtu command.

When PMTUD is enabled, VPDN deployments are vulnerable to DoS attacks that use crafted Internet Control Message Protocol (ICMP) "fragmentation needed and Don't Fragment (DF) bit set" (code 4) messages, also known as PMTUD attacks.

When an Internet host is performing PMTUD, crafted code 4 ICMP messages can be used to set the path MTU to an impractically low value. This causes higher layer protocols to time out because of a very low throughput, even though the connection is still in the established state. This type of attack is classified as a throughput-reduction attack.

Use the vpdn pmtu command to configure a range of acceptable values for the path MTU when PMTUD is enabled. If the device receives a code 4 ICMP message that advertises a next-hop path MTU outside the configured size range, the device ignores the ICMP message and display this log message:

%VPDN-5-IGNOREICMPMTU Ignoring received ICMP Type 3 Code 4, due to pmtu min or max setting

For information on detecting a PMTUD attack on an L2TP VPDN deployment, see Cisco Security Advisory Crafted ICMP Messages Can Cause Denial of Service.

Cisco software releases that support the ip pmtu command but do not support the vpdn pmtu command are vulnerable to PMTUD attacks. To protect a device running a vulnerable version of software, issue the no ip pmtu command to disable PMTUD.

For a complete list of Cisco software rebuild releases that support thevpdn pmtu command, see Cisco Security Advisory Crafted ICMP Messages Can Cause Denial of Service.

Related Commands

To associate a virtual private dialup network (VPDN) profile with a customer profile, use the vpdn profile command in customer profile configuration mode. To remove a VPDN profile from a customer profile, use the no form of this command.

Syntax Description

Command Default

No default behavior or values.

Command Modes

Customer profile configuration

Command History

Usage Guidelines

Use the vpdn profile command to associate a VPDN profile with a customer profile.

VPDN profiles can be used to combine session counting over multiple VPDN groups. This ability can be applied to customer profiles by configuring multiple VPDN groups under a VPDN profile and by associating the VPDN profile with the customer profile by using thevpdn profile command.

Related Commands

To enable Layer 2 Tunneling Protocol (L2TP) redirect functionality, use the vpdn redirect command in global configuration mode. To disable L2TP redirect functionality, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

L2TP redirect functionality is disabled so that current multihop forwarding behavior is preserved.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Configuring this command on the L2TP network access server (NAS) enables the NAS to perform L2TP redirection by sending a new vendor-specific attribute-value (AV) pair to the L2TP tunnel server. Configuring this command on the stack group tunnel server allows the tunnel server to redirect a call by disconnecting it and requesting the NAS to redirect it. The Stack Group Bidding Protocol (SGBP) stack group tunnel servers must have this command enabled to receive redirected calls, or else they receive calls only through the usual multihop forwarding from the tunnel server that first took the call.

Related Commands

To restrict the number of redirect attempts possible for a given Layer 2 Tunneling Protocol (L2TP) call on the L2TP network access server (NAS), use the vpdn redirect attempts command in global configuration mode. To restore the default value, use the no form of this command.

Syntax Description

Command Default

A maximum of three redirect attempts are allowed.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The number of redirect attempts is by default always restricted to three even if this command is not explicitly configured. The only use of this command is to configure a redirect attempts value other than the default (which is always in effect).

Related Commands

To configure a virtual private dialup network (VPDN) redirect identifier to use for Layer 2 Tunneling Protocol (L2TP) call redirection on a stack group tunnel server, use the vpdn redirect identifier command in global configuration mode. To remove the name of the redirect identifier from the tunnel server, use the no form of this command.

Syntax Description

Command Default

No identifier name is configured.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The vpdn redirect identifier command is configured on each of the stack group tunnel servers. To configure the name of the redirect identifier on the network access server (NAS), use the redirect identifier command in VPDN group configuration mode.

The NAS compares the configured redirect identifier with the one received from the stack group tunnel server to determine authorization information to redirect the call.

Configuring the redirect identifier is not necessary to perform redirects. If the redirect identifier is not configured, the NAS uses the redirect IP address to obtain authorization information to redirect the call. In that case, the IP address of the new redirected tunnel server must be present in the initiate-to command configuration of the VPDN group on the NAS.

The redirect identifier allows new stack group members to be added without the need to update the NAS configuration with their IP addresses. With the redirect identifier configured, a new stack group member can be added and given the same redirect identifier as the rest of the stack group.

If the authorization information for getting to the new redirected tunnel server is different, then you must configure the authorization information via RADIUS using tagged attributes:

Cisco:Cisco-Avpair = :0:"vpdn:vpdn-redirect-id=
identifier name
"

The NAS chooses the correct tagged parameters to get authorization information for the new redirected tunnel server by first trying to match the redirect identifier (if present) or else by matching the Tunnel-Server-Endpoint IP address.

Related Commands

To configure the public redirect IP address of a Layer 2 Tunneling Protocol (L2TP) stack group tunnel server, use the vpdn redirect source command in global configuration mode. To remove the public redirect IP address of a stack group tunnel server, use the no form of this command.

Syntax Description

Command Default

If the vpdn redirect source command is not configured, then the IP address used for Stack Group Bidding Protocol (SGBP) bidding itself is used as the redirect address (the public redirect address is then omitted in the bid response).

Command Modes

Global configuration (config)

Command History

Usage Guidelines

On the network access server (NAS), this command has no effect.

Related Commands

To specify how a network access server (NAS) or tunnel switch performs virtual private dialup network (VPDN) tunnel authorization searches, use the vpdn search-order command in global configuration mode. To restore the default search order, use the no form of this command.

Syntax Description

Command Default

When this command is disabled, by default the router searches first on the DNIS number provided on ISDN lines and then searches on the domain name. This is equivalent to issuing the vpdn search-order dnis domain command.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

To issue the vpdn search-order command, you must include at least one of the search parameter keywords. You can enter multiple keywords, and they can be entered in any order. The order of the keywords specifies the order of precedence given to the search parameters. If you do not issue a particular keyword, no search is performed on that parameter.

Issue the multihop-hostname keyword only on a device configured as a multihop tunnel switch.

The configuration shows the vpdn search-order command setting only if the command is explicitly configured.

Related Commands

To enable tunnel-link type accounting records to be sent to the RADIUS server, use the vpdn session accounting command in global configuration mode. To disable the tunnel-link type accounting records, use the no form of this command.

Syntax Description

Command Default

Tunnel-link type accounting records are not sent.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Before you enable the vpdn session accounting network command, you must enable network accounting by using the aaa accounting command.

Note

If the default network accounting method list is configured and no additional accounting configurations are enabled on the interface, network accounting is enabled by default. If the vpdn session accounting network command is linked to the default method list, all tunnel-link accounting records are enabled for those sessions.

This command displays the following tunnel-link accounting type records, which are used with the RADIUS accounting attribute Acct-Status-Type (attribute 40):

• Tunnel-Link-Start (12)--Marks the creation of a tunnel link.
• Tunnel-Link-Stop (13)--Marks the end of a tunnel link.

Note	Only some tunnel types (such as Layer 2 Tunneling Protocol [L2TP]) support the multiple links per tunnel; these values should be included for accounting packets for tunnel types that support multiple links per tunnel.

• Tunnel-Link-Reject (14)--Marks the rejection of a tunnel setup for a new link in an existing tunnel. Only some tunnel types (L2TP) support the multiple links per tunnel; this value should be included only in accounting packets for tunnel types that support multiple links per tunnel.

Note	If either Tunnel-Link-Start or Tunnel-Link-Stop is enabled, Tunnel-Link-Reject is sent even if it has not been enabled.

Related Commands

To limit the number of simultaneous virtual private dialup network (VPDN) sessions allowed on a router, use the vpdn session-limit command in global configuration mode. To remove a configured session limit restriction, use the no form of this command.

Syntax Description

Command Default

No session limit exists for the router.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the vpdn session-limit command to configure the maximum number of VPDN sessions allowed on the router.

VPDN session limits can be configured globally by using the vpdn session-limit command, at the level of a VPDN group by using the session-limit (VPDN) command, or for all VPDN groups associated with a particular VPDN template by using the group session-limit command.

The hierarchy for the application of VPDN session limits is as follows:

• Globally configured session limits take precedence over session limits configured for a VPDN group or in a VPDN template. The total number of sessions on a router cannot exceed a configured global session limit.
• Session limits configured for a VPDN template are enforced for all VPDN groups associated with that VPDN template. The total number of sessions for all of the associated VPDN groups cannot exceed the configured VPDN template session limit.
• Session limits configured for a VPDN group are enforced for that VPDN group.

Related Commands

To prevent new sessions from being established on a virtual private dialup networking (VPDN) tunnel without disturbing existing sessions, use the vpdn softshut command in global configuration mode. To return VPDN tunnels to active service, use the no form of this command.

Syntax Description

This command has no arguments or keywords.

Command Default

New sessions can be established.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

When this feature is enabled on a network access server (NAS), the potential session is authorized before it is refused. This authorization ensures that accurate accounting records can be kept.

When this feature is enabled on a home gateway, the reason for the session refusal is returned to the NAS. This information is recorded in the VPN history failure table.

When this command is enabled, use theshow vpdn history failure command to view records of refused attempts to establish new sessions.

Related Commands

To globally specify an IP address that is different from the physical IP address used to open a virtual private dialup network (VPDN) tunnel, use the vpdn source-ip command in global configuration mode. To disable use of the alternate IP address, use the no form of this command.

Syntax Description

Command Default

No alternate IP address is specified.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the vpdn source-ip command to specify a single alternate IP address to be used for all tunnels on the device. A single source IP address can be configured globally per device.

Use the source-ip command in VPDN group configuration mode to configure an alternate IP address to be used for only those tunnels associated with that VPDN group.

The VPDN group-level configuration overrides the global configuration.

Related Commands

To enable tunnel type accounting records to be sent to the RADIUS server, use the vpdn tunnel accounting network command in global configuration mode. To disable tunnel type accounting records, use the no form of this command.

Syntax Description

Command Default

Tunnel type accounting records are not sent.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Before you enable the vpdn tunnel accounting network command, you must enable network accounting by using the aaa accounting command.

Note

If the default network accounting method list is configured and no additional accounting configurations are enabled on the interface, network accounting is enabled by default. If the vpdn tunnel accounting network command is linked to the default method list, all tunnel accounting records are enabled for those sessions.

This command displays the following tunnel accounting type records, which are used with the RADIUS accounting attribute Acct-Status-Type (attribute 40):

• Tunnel-Start (9)--Marks the beginning of a tunnel setup with another node.
• Tunnel-Stop (10)--Marks the end of a tunnel connection to or from another node.
• Tunnel-Reject (11)--Marks the rejection of a tunnel setup with another node.

Note	If either Tunnel-Start or Tunnel-Stop are enabled, Tunnel-Reject is sent even if it has not been enabled.

Related Commands

To enable the Layer 2 Tunnel Protocol (L2TP) tunnel server or network access server (NAS) to perform remote authentication, authorization, and accounting (AAA) tunnel authentication and authorization, use the vpdn tunnel authorization network command in global configuration mode. To disable remote tunnel authentication and authorization and return to the default setting, use the no form of this command.

Syntax Description

Command Default

If this command is not enabled, the device performs authentication locally.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to specify the authorization method list that is used for remote tunnel hostname-based authorization. The method list (named or default) is defined using the aaa authorization network command.

If a method list for tunnel authorization is not specified via the aaa authorization network command, local authorization using the local virtual private dialup network (VPDN) group configuration occurs.

Note

This method list is only for L2TP tunnel authorization and termination; it is not intended for domain or dialed number identification service (DNIS)-based authorization that is typically done on the tunnel terminator. Thus, this command can be enabled only on the tunnel terminator--the NAS for dial-out and the tunnel server for dial-in.

Related Commands

To configure a password for the RADIUS authentication request to retrieve the tunnel configuration that is based on the remote tunnel hostname, use the vpdn tunnel authorization password command in global configuration mode. To return to the default password, use the no form of this command.

Syntax Description

Command Default

The password is set to "cisco."

Command Modes

Global configuration (config)

Command History

Usage Guidelines

This command can be used on either the Layer 2 Tunneling Protocol (L2TP) network access server (NAS) or on the L2TP tunnel server when remote RADIUS tunnel authentication is enabled.

Related Commands

To select the default virtual template from which to clone virtual access interfaces, use the vpdn tunnel authorization virtual-template command in global configuration mode. To remove the default virtual template, use the no form of this command.

Syntax Description

Command Default

No default virtual template is specified.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

This command should be used if a virtual template is not specified in the local virtual private dialup network (VPDN) group (for local authentication) or in a remote RADIUS configuration (via the vpdn-vtemplate attribute).

Note	This command applies only on the L2TP tunnel server.

Related Commands

To create a virtual private dialup network (VPDN) group and to enter VPDN group configuration mode, use the vpdn-group command in global configuration mode. To remove the group, use the no form of this command.

Syntax Description

Command Default

VPDN groups are not created.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use the vpdn-group command to configure VPDN parameters that are always applied to that VPDN group. System default settings for VPDN parameters are applied for any settings not configured in the individual VPDN group or in the associated VPDN template.

VPDN groups are associated with the global VPDN template by default. You can associate individual VPDN groups with a named VPDN template instead. Associating a VPDN group with a named VPDN template disassociates the VPDN group from the global VPDN template.

If you create two VPDN groups with the same configuration, this message displays:

% Warning, the vpdn groups group1 and group2 have the same configuration

You should change one of the group configurations to eliminate the duplicate configuration. Leaving the duplicate configurations in place can lead to unexpected (and unsupported) results.

Cisco 10000 Series Usage Guidelines

In Cisco IOS Release 12.2(33)SB and later releases, the router does not accept the vpdn-group command if you issue the command before you issue the vpdn enable command. Instead, this message displays:

% VPDN configuration is not allowed until VPDN is enabled through 'vpdn enable'.

In releases prior to Cisco IOS Release 12.2(33)SB, if you issue the vpdn-group command before the vpdn enable command, the router accepts the command and displays this message:

% VPDN is not enabled

Related Commands

To create a virtual private dialup network (VPDN) template and enter VPDN template configuration mode, use the vpdn-template command in global configuration mode. To delete a VPDN template, use the no form of this command.

Syntax Description

Command Default

No VPDN template exists. The system default values are applied to individual VPDN groups for any parameters that are not configured in the individual VPDN group.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

Use this command to configure values for VPDN parameters in a VPDN template. A single unnamed VPDN template can be configured. Multiple named VPDN templates can be configured. A VPDN group can be associated with only one VPDN template.

Values configured in the global (unnamed) VPDN template are applied to all VPDN groups by default. A VPDN group can be disassociated from the global VPDN template, or associated with a named VPDN template. Associating a VPDN group with a named VPDN template automatically disassociates it from the global VPDN template.

The values configured in a VPDN template are applied to all associated VPDN groups unless specific values are configured for individual VPDN groups. VPDN parameters that are not specified in the individual VPDN group or in the associated VPDN template are assigned system default values.

The hierarchy for the application of VPDN parameters to a VPDN group is as follows:

• VPDN parameters configured for the individual VPDN group are always applied to that VPDN group.
• VPDN parameters configured in the associated VPDN template are applied for any settings not specified in the individual VPDN group configuration.
• System default settings for VPDN parameters are applied for any settings not configured in the individual VPDN group or the associated VPDN template.

Not all commands that are available for configuring a VPDN group can be used to configure a VPDN template. The table below lists the commands that can be used to configure the VPDN template.

Related Commands

To specify that the source and destination IPv4 addresses of a given virtual private dialup network (VPDN) group belong to a specified virtual private network (VPN) routing and forwarding (VRF) instance, use the vpn command in VPDN group or VPDN template configuration mode. To disassociate all IPv4 addresses in a VPDN group from a VRF, use the no form of this command.

Syntax Description

Command Default

VPDN groups are not associated with a VRF.

Command Modes

VPDN group configuration (config-vpdn)

VPDN template configuration (config-vpdn-temp)

Command History

Usage Guidelines

Use the vpn command to configure the software to look up a VPDN source or destination IPv4 address in a specific VPN routing table instead of the global routing table.

Before you can issue the vpn command, a VRF instance must be created by using the ip vrf command.

The vpn command can be used with both dial-in and dial-out VPDN scenarios.

Related Commands