
Configuring and Troubleshooting Bay Dial VPN Services
5-2 302272-A Rev. 00
Managing TMS Using the TMS Default Database
Tunnel management in an erpcd-based network is an extension of the Expedited
Remote Procedure Call Daemon (erpcd) that allows users dialing in to the Dial
VPN system to be authenticated by their destination sites, rather than by an
authentication server residing on the Dial VPN service provider’s network. The
destination site, therefore, retains the authentication information, providing an
extra measure of security. The TMS communicates with the NAS and establishes
tunnels based on the information that you enter into the TMS database.
You tell the NAS where the TMS resides when you configure the following RAC
parameter:
set annex pref_secure1_host
<ip address of TMS host >
TMS tells the NAS how to authenticate the user, either locally or remotely (with
RADIUS). You create TMS entries on the UNIX workstation that serves as the
TMS/ACP server. By default, you use the tms_dbm program to create these entries
as a file in /usr/annex, the “security” directory. Alternatively, you can create a text
file of entries using the syntax format that follows. These entries are really TMS
commands. You can either type them at the UNIX command line prompt or copy
them from a text file and paste them at the UNIX command line prompt.
Create one TMS entry for each domain name that you want to authenticate/serve.
The following is a sample TMS command that adds an entry to the TMS database:
tms_dbm add abc.com 0 te=128.128.64.5 maxu=unlimited\
hwtype=fr hwaddr=64 hwalen=1 srvloc=remote tutype=dvs\
pauth=128.128.64.50 paddr=128.128.64.51 authp=radius \
addrp=dhcp spi=256 tatype=kmd5-128 tamode=pref-suff\
takey=00000000000000000000000000000001
The value that you specify for the tunnel authentication key parameter (takey)
must match the value of the key associated with the specified security parameter
index (
spi) value; in this case, the spi value is 256, and the takey value is a 128-bit
key, represented as 32 hexadecimal digits.
The syntax of the command that creates a TMS entry is:
tms_dbm add <domain> <dnis> te=<ip addr of the gateway>\
maxu=<maximum count of users> [hwtype=<fr or ppp>\
[hwaddr=<hardware link address from home agent to CPE>\
hwalen=<length of hardware link address>]]\
[srvloc=servers_location] [tutype=tunnel_type]\
pauth=<ip addr of primary authentication server>\
Comentarios a estos manuales