
Configuring and Troubleshooting Bay Dial VPN Services
3-4 302272-A Rev. 00
10.
Make sure that the home network is configured to connect to the Dial
VPN network.
Specifically, ensure that:
• The RADIUS server on the home network is configured to work with the
RADIUS client on the Dial VPN network. If dynamic IP address
allocation or DHCP is enabled, the RADIUS or DHCP server must have a
pool of addresses allocated for authenticated dial-in users. For dynamic IP
address allocation, you must have RADIUS accounting enabled.
• The CPE router is configured with a frame relay or PPP connection to the
Dial VPN gateway (including a static route and an adjacent host if the
CPE router is not a Cisco device), and a separate but similar frame relay
or PPP connection to the RADIUS client on the gateway.
• Any shared information, such as passwords, “secrets,” or phone numbers,
is consistent across the link.
11.
Individually test each network component, then test the entire system.
How Tunnel Management Works
Tunnel management operates differently on erpcd-based and RADIUS-only
networks, but the end result is the same.
Tunnel Management in an
erpcd
-Based Network
For an erpcd-based network, the tunnel management server (TMS) runs on the
same host as the Remote Access Concentrator (erpcd) and Access Control
Protocol (ACP) software. The TMS verifies that the user at the remote node is a
Dial VPN user. If the domain portion of the user name exists in the TMS database,
ACP increases the number of current users by one and sends a Grant message to
the NAS. The Grant message contains the tunnel addressing information needed
to send a packet from the remote node to the home network.
Note:
The Dial VPN RADIUS server for Layer 3 tunnels must be on a
separate physical device from any RADIUS server for Layer 2 tunnels or for
dial services. The RADIUS server for Layer 2 tunnels can be the same
physical device as any dial services RADIUS server.
Comentarios a estos manuales