3Com 10014299 Implement local AAA authentication on VPN user, Configure BDR dialup parameters

618CHAPTER 43: CONFIGURING L2TP

II.Networking diagram

Figure 183 Networking diagram of NAS-originated VPN

	Async2		Internet
		S1	S0
	PSTN/ISDN
			tunnel
VPN User	NAS	LAC	LNS

Company

headquarters

III. Configuration procedure

1Configuration at the LAC (NAS) side:)

a Configure username and password (when dialing in Windows2000).

[Router-LAC]local-user lac service-type ppp password simple lac

bImplement local AAA authentication on VPN user.

[Router-LAC] aaa-enable

[Router-LAC]aaa authentication-scheme ppp default local

[Router-LAC]aaa accounting-scheme optional

cConfigure the IP address of Serial1 interface of LAC.

[Router-LAC] interface serial 1 [Router-LAC-Serial1] ip address 192.167.0.2 255.255.255.0

dEnable L2TP service and configure a L2TP group.

[Router-LAC] l2tp enable

[Router-LAC] l2tp-group 1 [Router-LAC-l2tp1] tunnel name lac-end

[Router-LAC-l2tp1]start l2tp ip 192.167.0.1 fullusername lac

eEnable tunnel authentication and configure a tunnel authentication password.

[Router-LAC-l2tp1]tunnel authentication

[Router-LAC-l2tp1]tunnel password simple 3Com router

fConfigure BDR dialup parameters.

[Router-LAC]dialer-rule 1 ip permit

[Router-LAC] interface async 2 [Router-LAC-Async2] async mode protocol

[Router-LAC-Async2] link-protocol ppp

[Router-LAC-Async2]ppp authentication-mode chap

[Router-LAC-Async2] dialer enable-legacy

[Router-LAC-Async2] dialer-group 1

2Configuration at LNS side

aConfigure username and password (they should be the same as those configured at LAC side)

[Router-LNS]local-user lac service-type ppp password simple lac

bDefine an address pool and assign an address for the dialup user.

[Router-LNS]ip pool 1 192.168.0.3 192.168.0.100

cImplement local AAA authentication for the VPN user.

[Router-LNS] aaa-enable

[Router-LNS]aaa authentication-scheme ppp default local

[Router-LNS]aaa accounting-scheme optional