Enabling The Radius Server To Conduct Tunnel Service Authorization - Cisco 10000-2P2-2DC Software Configuration Manual

Layer 2 Access Concentrator
VPDN Group
The vpdn-group attribute specifies the group to which the service belongs. All services with matching
group names are considered members of the same VPDN group. This attribute has the following syntax:
Cisco-AVpair="vpdn:vpdn-group=group-name"
group-name is the group to which the service belongs.
Example 5-6
Cisco-AVpair="vpdn:vpdn-group=group1"
Tunnel Share
The tunnel-share attribute indicates that the tunnel sharing feature is enabled for the service.
Example 5-7
Cisco-AVpair="vpdn:tunnel-share=yes"
Verifying the Tunnel Sharing Configuration in the RADIUS Service Profile
To verify the RADIUS service profile, see the user documentation for your RADIUS server.

Enabling the RADIUS Server to Conduct Tunnel Service Authorization

To enable the RADIUS server to conduct dynamic tunnel service authorization, perform the following
tasks:
•
•
Configuring the RADIUS User Profile for Domain Preauthorization
To enable domain preauthorization, enter the following configuration parameters in the user profile on
the RADIUS server:
RADIUS Entry
nas-port:ip-address:slot/subslot/port/vpi.vci
Password = "cisco"
User-Service-Type = Outbound-User
Cisco-AVpair = "vpdn:vpn-domain-list=domain1,
domain2,..."
Cisco 10000 Series Router Software Configuration Guide
5-14
Chapter 5
VPDN Group—RADIUS Freeware Format
Tunnel Share—RADIUS Freeware Format
Configuring the RADIUS User Profile for Domain Preauthorization, page 5-14
Configuring the RADIUS Service Profile for Tunnel Service Authorization, page 5-15
Configuring the Layer 2 Tunnel Protocol Access Concentrator and Network Server
Purpose
Configures the NAS port username for domain preauthorization.
The ip-address argument is the management IP address of the
network service provider (NSP).
The slot/subslot/port argument specifies the ATM interface.
The vpi.vci arguments are the VPI and VCI values for the PVC.
Sets the fixed password.
Configures the service-type as outbound.
Specifies the domains accessible to the user.
OL-2226-23