
Configuring and Troubleshooting Bay Dial VPN Services
6-2 303509-A Rev 00
The NAS uses RADIUS accounting messages to determine when the TMS tunnel
to the local RADIUS server starts and stops. The NAS logs these occurrences and
uses the information to confirm and decrement tunnel usage counts.
The NAS security parameter settings that control RADIUS also control RADIUS
support for tunneling.
Tunnel Negotiation Message Sequence
Figure 6-1 shows the flow of messages for a Layer 3 tunnel between the remote
node and the customer’s home network when the RADIUS server on the service
provider’s network maintains the TMS database.
When it receives an incoming call, the NAS issues a standard access-request
message to the RADIUS server. The server determines that this is a tunnel user by
processing the Username and Called-Number attributes. If no match exists for the
domain or user name in the TMS database, the server returns an access-reject
message to the NAS.
If the server finds a match in its TMS database, it returns an access-accept
message. This message contains the following attributes for the RADIUS
message:
• Username -- the original contents of the user field
• Tunnel-type -- DVS (Layer 3) or L2TP (required)
• Tunnel-media-type -- IP
• Tunnel-server-end point -- the server address and outbound line identifier
• Authentication-server -- the remote authentication server(s) for this user
• Accounting-server -- the remote accounting server(s) for this user
The user session’s authorization information flows from the remote customer
RADIUS return message. The local tunnel client does not have the validated user
identification until after the tunnel is formed.
Note:
For TMS and local authentication to work, the BSAC RADIUS clients
and the shared secrets between the client and the BSAC server must be
defined.
Comentarios a estos manuales