Page 2 - Trademarks
ii 303532-A Rev 00 4401 Great America Parkway 8 Federal Street Santa Clara, CA 95054 Billerica, MA 01821 Copyright © 1998 Bay Networks, Inc. All rights reserved. Printed in the USA. October 1998. The information in this document is subject to change without notice. The statements, configurations, te...
Page 3 - Bay Networks, Inc. Software License Agreement
303532-A Rev 00 iii Bay Networks, Inc. Software License Agreement NOTICE: Please carefully read this license agreement before copying or using the accompanying software or installing the hardware unit with pre-enabled software (each of which is referred to as “Software” in this Agreement). BY COPYIN...
Page 5 - Contents; Preface
303532-A Rev 00 v Contents Preface Before You Begin ............................................................................................................. xiii Text Conventions .............................................................................................................xiv Acr...
Page 7 - Index
303532-A Rev 00 vii Appendix B Configuration Examples Example 1: Remote PC Calling the Corporate Network ................................................ B-1 Configuring the Remote Hosts ................................................................................ B-2 Configuring the LACs and the...
Page 9 - Figures
303532-A Rev 00 ix Figures Figure 1-1. L2TP Network Using a LAC ..................................................................... 1-7 Figure 1-2. L2TP Network Using a RAS ..................................................................... 1-7 Figure 1-3. Packet Encapsulation Process .............
Page 11 - Tables
303532-A Rev 00 xi Tables Table C-1. Common L2TP Network Problems and Solutions .................................. C-1
Page 13 - Before You Begin; and
303532-A Rev 00 xiii Preface This guide describes Layer 2 Tunneling Protocol (L2TP) and what you do to start and customize L2TP services on a Bay Networks ® router. Before You Begin Before using this guide, you must complete the following procedures. For a new router: • Install the router (refer to ...
Page 14 - Text Conventions; This guide uses the following text conventions:; bold text; italic text; show ip alerts; or; show ip routes
Configuring L2TP Services xiv 303532-A Rev 00 Text Conventions This guide uses the following text conventions: bold text Indicates text that you need to enter and command names and options.Example: Enter show ip {alerts | routes} Example: Use the dinfo command. italic text Indicates file and directo...
Page 15 - Acronyms
Preface 303532-A Rev 00 xv Acronyms CHAP Challenge Handshake Authentication Protocol IP Internet Protocol ISDN Integrated Services Digital Network ISP Internet Service Provider L2TP Layer 2 Tunneling Protocol LAC L2TP access concentrator LAN local area network LCP Link Control Protocol LNS L2TP netw...
Page 16 - Bay Networks Technical Publications; The “CD ROMs” section lists available CDs.; How to Get Help; Or telephone the Bay Networks Technical Solutions Center at:
Configuring L2TP Services xvi 303532-A Rev 00 Bay Networks Technical Publications You can now print Bay Networks technical manuals and release notes free, directly from the Internet. Go to support.baynetworks.com/library/tpubs/. Find the Bay Networks product for which you need documentation. Then lo...
Page 17 - This chapter contains the following information:
303532-A Rev 00 1-1 Chapter 1 L2TP Overview The Layer 2 Tunneling Protocol (L2TP) provides remote users, such as telecommuters, mobile professionals, and personnel in remote branch offices, with dial-in access to a corporate network. L2TP enables users to create a virtual private network (VPN), whic...
Page 18 - L2TP Benefits; L2TP has several advantages:
Configuring L2TP Services 1-2 303532-A Rev 00 L2TP Benefits L2TP has several advantages: • Users and businesses can take advantage of existing network equipment and resources. Corporations do not need to maintain and manage remote access servers and other special networking equipment for remote user...
Page 19 - The LAC brings down the tunnel for any one of the following reasons:; L2TP Sessions; To enable flow control, see
L2TP Overview 303532-A Rev 00 1-3 Multiple users can communicate through a single tunnel between the same LAC and LNS pair. Each user transmits and receives data in an individual L2TP session. The LAC brings down the tunnel for any one of the following reasons: • A network failure occurs. • The LAC ...
Page 20 - Components of an L2TP Network; Remote Host; This guide’s primary focus is on an L2TP network between a remote
Configuring L2TP Services 1-4 303532-A Rev 00 Components of an L2TP Network The following sections describe the components of an L2TP network. For illustrations of L2TP networks, see Figures 1-1 and 1-2 on page 1-7 . Remote Host At the remote site is the user who wants to dial in to the corporate ne...
Page 21 - Bay Networks L2TP Implementation
L2TP Overview 303532-A Rev 00 1-5 L2TP Access Concentrator (LAC) The L2TP access concentrator (LAC) resides at the ISP network. The LAC establishes the L2TP tunnel between itself and the LNS. When the remote user places a call to the ISP network, this call goes to the LAC. The LAC then negotiates th...
Page 22 - RADIUS Server; RADIUS User Authentication
Configuring L2TP Services 1-6 303532-A Rev 00 L2TP Network Server (LNS) The L2TP network server (LNS) is a router that resides at the corporate network and serves as the termination point for L2TP tunnels and sessions. The LNS authenticates the PPP connection request and allows the end-to-end PPP tu...
Page 23 - Examples of L2TP Networks; shows an L2TP network that uses a LAC to connect to the LNS. The; L2TP Network Using a LAC; shows an L2TP network that uses a RAS to connect to the LNS. The; L2TP Network Using a RAS
L2TP Overview 303532-A Rev 00 1-7 Examples of L2TP Networks Figure 1-1 shows an L2TP network that uses a LAC to connect to the LNS. The tunnel is between the LAC and the LNS. Figure 1-1. L2TP Network Using a LAC Figure 1-2 shows an L2TP network that uses a RAS to connect to the LNS. The tunnel is be...
Page 24 - L2TP Packet Encapsulation; shows how data is encapsulated for transmission over an L2TP; Packet Encapsulation Process
Configuring L2TP Services 1-8 303532-A Rev 00 L2TP Packet Encapsulation The PC or router at the remote site sends PPP packets to the LAC. The LAC encapsulates these incoming packets in an L2TP packet and sends it across an IP network through a bidirectional tunnel. After the LNS receives the packets...
Page 25 - Making a Connection Across an L2TP Network; on
L2TP Overview 303532-A Rev 00 1-9 Making a Connection Across an L2TP Network The following steps explain how a remote user connects across an L2TP network that includes a Bay Networks LAC, TMS, and LNS (see Figure 1-1 on page 1-7 ): 1. The remote user dials a LAC at the local ISP network to establis...
Page 26 - Security in an L2TP Network; Tunnel Authentication
Configuring L2TP Services 1-10 303532-A Rev 00 Security in an L2TP Network You can configure two layers of security in an L2TP network: • Tunnel authentication Tunnel authentication is the process of negotiating the establishment of a tunnel between the LAC and the LNS. • User authentication The net...
Page 27 - The Bay Networks LNS has the following characteristics:
L2TP Overview 303532-A Rev 00 1-11 Bay Networks L2TP Implementation In an L2TP network, the Bay Networks router is the LNS. LNS software operates on the BLN ® , BCN ® , and ASN ™ platforms. The Bay Networks LNS has the following characteristics: • Each slot can act as an LNS, which means that one ro...
Page 28 - Tunnel Management
Configuring L2TP Services 1-12 303532-A Rev 00 Tunnel Management The Bay Networks tunnel management server (TMS), which resides at the ISP network, stores the TMS database. This database contains the remote users’ domain name, the IP address information of each LNS, and other tunnel addressing infor...
Page 29 - shows tunnel authentication.; Tunnel Authentication Control Messages
L2TP Overview 303532-A Rev 00 1-13 You can enable tunnel authentication on the Bay Networks LNS. If tunnel authentication is disabled, which is the default, the LNS sends a default challenge response to the LAC during the authentication process so that the tunnel can be established. The LNS cannot s...
Page 30 - Chapter 3
Configuring L2TP Services 1-14 303532-A Rev 00 After tunnel authentication is complete, it does not need to be repeated for other calls to the same LAC. RADIUS User Authentication RADIUS user authentication is enabled by default on the Bay Networks LNS; you must configure this feature so that the LN...
Page 31 - RADIUS Accounting
L2TP Overview 303532-A Rev 00 1-15 RADIUS Accounting The RADIUS server can provide accounting services in addition to its authentication services. RADIUS accounting is enabled by default on the Bay Networks LNS. The RADIUS accounting server calculates billing charges for an L2TP session between the ...
Page 32 - Remote Router Configuration; Remote Router Dialing the LNS
Configuring L2TP Services 1-16 303532-A Rev 00 Remote Router Configuration If the host at the remote site is a Bay Networks router, you may need to configure a dial-on-demand circuit for the remote router’s dial-up interface to the LAC at the ISP network. Enable RIP on both the dial-on-demand circui...
Page 33 - Where to Go Next; Go to one of the following chapters for more information:
L2TP Overview 303532-A Rev 00 1-17 Where to Go Next Go to one of the following chapters for more information: If you want to Go to Start L2TP on a router using default parameter settings. Chapter 2 Change default settings for L2TP parameters. Chapter 3 Obtain information about Site Manager parameter...
Page 35 - This chapter includes the following information:
303532-A Rev 00 2-1 Chapter 2 Starting L2TP The quickest way to start L2TP is to enable it with the default configuration that Bay Networks software supplies. This configuration uses all available parameter defaults. You need to supply values for several parameters that do not have default values. T...
Page 36 - Planning Considerations for an L2TP Network; Tunnel Authentication Passwords; RADIUS Server Information; Configure the RADIUS server with user names and domain names.
Configuring L2TP Services 2-2 303532-A Rev 00 Planning Considerations for an L2TP Network This guide primarily explains how to configure a Bay Networks BLN, BCN, or ASN router as an LNS in an L2TP network. To successfully operate in an L2TP network, obtain the following information to configure the ...
Page 37 - Preparing a Configuration File; To open the configuration file, complete the following tasks:
Starting L2TP 303532-A Rev 00 2-3 Preparing a Configuration File Before starting L2TP, you must create and save a configuration file with at least one WAN interface, for example, a synchronous or MCT1 port. For information about the Site Manager configuration tool and how to work with configuration ...
Page 39 - Enabling L2TP on an Existing PPP Interface
Starting L2TP 303532-A Rev 00 2-5 Enabling L2TP on an Existing PPP Interface To enable L2TP on an interface with PPP and IP already enabled, complete the following tasks: 11. Click on OK. 12. Click on Done. You return to the Configuration Manager window. Site Manager Procedure You do this System res...
Page 41 - Enabling L2TP on an Existing Frame Relay Interface
Starting L2TP 303532-A Rev 00 2-7 Enabling L2TP on an Existing Frame Relay Interface To enable L2TP on an interface with frame relay and IP already enabled, complete the following tasks: Site Manager Procedure You do this System responds 1. In the Configuration Manager window, choose a WAN connector...
Page 43 - Enabling L2TP on an Existing ATM Interface
Starting L2TP 303532-A Rev 00 2-9 Enabling L2TP on an Existing ATM Interface To enable L2TP on an interface with ATM and IP already enabled, you can enable L2TP in two ways. If your interface uses a COM connector, complete the tasks in the following table. If your interface uses an ATM connector, go...
Page 45 - Appendix A
303532-A Rev 00 3-1 Chapter 3 Customizing L2TP Services When you enable L2TP, default values are in effect for most parameters (see parameter descriptions in Appendix A , “ L2TP Parameters ”). You may want to change some of these values, depending on the requirements of your network. This chapter in...
Page 46 - Modifying the L2TP Protocol Configuration
Configuring L2TP Services 3-2 303532-A Rev 00 Modifying the L2TP Protocol Configuration To modify how data is transmitted across an L2TP network, such as the number, frequency, and timing of data and acknowledgment packets exchanged between the LNS and LAC, you can modify the L2TP protocol parameter...
Page 47 - Modifying RADIUS Server Information
Customizing L2TP Services 303532-A Rev 00 3-3 Modifying RADIUS Server Information If you change the address of the RADIUS server that you are using to authenticate remote users and manage accounting functions, you must update the server address information on the LNS. For more information about usin...
Page 48 - Changing the LNS System Name; To change the LNS system name, complete the following tasks:
Configuring L2TP Services 3-4 303532-A Rev 00 Changing the LNS System Name The LNS system name is the name of the router. This name is used during tunnel setup to identify the LNS uniquely. By default, Site Manager enters the system name that you initially configured when first accessing the router....
Page 49 - Modifying the Number of L2TP Sessions Permitted; For more information about L2TP sessions, see “
Customizing L2TP Services 303532-A Rev 00 3-5 Modifying the Number of L2TP Sessions Permitted You can modify the maximum number of active L2TP sessions that the LNS can manage. The default is 100 sessions. For more information about L2TP sessions, see “ L2TP Sessions ” on page 1-3 . To change the ma...
Page 50 - Keeping the Remote User’s Domain Name
Configuring L2TP Services 3-6 303532-A Rev 00 Keeping the Remote User’s Domain Name The LNS removes the domain name from the complete user name by default, before passing it on to the RADIUS server for user authentication. To keep the domain name with the user name, complete the following tasks: Sit...
Page 51 - Changing the Domain Name Delimiter; To change the delimiter, complete the following tasks:
Customizing L2TP Services 303532-A Rev 00 3-7 Changing the Domain Name Delimiter In the complete user name there is a single-character delimiter that separates the user name from the domain name. By default, the LNS removes the domain name when it receives a call. The delimiter tells the LNS which c...
Page 52 - Enabling Tunnel Authentication; For more information about tunnel authentication, see “
Configuring L2TP Services 3-8 303532-A Rev 00 Enabling Tunnel Authentication To prevent unauthorized users from accessing the corporate network, you can enable tunnel authentication. During tunnel negotiation, the LAC sends its tunnel authentication password to the LNS. If the password is not recogn...
Page 53 - Modifying L2TP IP Interface Addresses; For more information about the L2TP IP interface, see “
Customizing L2TP Services 303532-A Rev 00 3-9 Modifying L2TP IP Interface Addresses The L2TP IP Interface List window lists the L2TP IP interface addresses for each slot that has L2TP configured. The LNS uses the addresses internally to identify the remote sites. For more information about the L2TP ...
Page 54 - Disabling RIP; To disable RIP, complete the following tasks:; Disabling L2TP; To disable L2TP on a slot, complete the following tasks:
Configuring L2TP Services 3-10 303532-A Rev 00 Disabling RIP RIP is enabled on the LNS by default so that the LNS can learn routes from the remote dial-in router. If the LNS does not require RIP support, you can disable it. To disable RIP, complete the following tasks: Disabling L2TP To disable L2TP...
Page 55 - Deleting L2TP from a PPP Interface; To delete L2TP from a PPP interface, complete the following tasks:
Customizing L2TP Services 303532-A Rev 00 3-11 Deleting L2TP from a PPP Interface To delete L2TP from a PPP interface, complete the following tasks: 6. Set the Enable L2TP parameter to Disable. Click on Help or see the parameter description on page A-3 . Site Manager disables L2TP for the slot. 7. C...
Page 56 - Deleting L2TP from a Frame Relay Interface
Configuring L2TP Services 3-12 303532-A Rev 00 Deleting L2TP from a Frame Relay Interface To delete L2TP from a frame relay interface, complete the following tasks: Site Manager Procedure You do this System responds 1. In the Configuration Manager window, click on a WAN connector configured with L2T...
Page 57 - Deleting L2TP from an ATM Interface
Customizing L2TP Services 303532-A Rev 00 3-13 Deleting L2TP from an ATM Interface To delete L2TP from an ATM interface on a COM connector, complete the following tasks: To delete L2TP from an ATM interface on an ATM connector, complete the following tasks: Site Manager Procedure You do this System ...
Page 60 - set; L2TP Configuration List Window
Configuring L2TP Services A-2 303532-A Rev 00 The Technician Interface allows you to modify parameters by issuing set and commit commands with the MIB object ID. This process is equivalent to modifying parameters using Site Manager. For more information about using the Technician Interface to access...
Page 61 - Parameter: Enable L2TP; Disable; Parameter: Max L2TP Sessions; Options: 1 to 7 packets
L2TP Parameters 303532-A Rev 00 A-3 Parameter: Enable L2TP Path: Configuration Manager > Protocols > IP > L2TP > L2TP Configuration Default: Enable Options: Enable | Disable Function: Enables or disables L2TP on this interface. Instructions: Site Manager automatically sets this parameter...
Page 62 - Parameter: Maximum Retransmit; Options: 1 to 60 seconds
Configuring L2TP Services A-4 303532-A Rev 00 Parameter: Retransmit Timer (seconds) Path: Configuration Manager > Protocols > IP > L2TP > L2TP Configuration Default: 1 Options: 1 to 60 seconds Function: Indicates the number of seconds that the LNS waits for an acknowledgment from the LAC...
Page 63 - Options: 1 to 350 milliseconds; Parameter: LNS System Name; Options: The router’s system name or any name you specify; Parameter: RADIUS Primary Server IP Address; configured, Site Manager automatically supplies the address.
L2TP Parameters 303532-A Rev 00 A-5 Parameter: Ack Timeout (milliseconds) Path: Configuration Manager > Protocols > IP > L2TP > L2TP Configuration Default: 250 Options: 1 to 350 milliseconds Function: Specifies the maximum number of milliseconds that can elapse before the LNS sends an ac...
Page 64 - Parameter: RADIUS Primary Server Password
Configuring L2TP Services A-6 303532-A Rev 00 Parameter: RADIUS Primary Server Password Path: Configuration Manager > Protocols > IP > L2TP > L2TP Configuration Default: None Options: Any alphanumeric string, up to a maximum of 64 characters Function: Specifies the primary RADIUS server’...
Page 65 - Parameter: Remove Domain Name; Parameter: Domain Name Delimiter
L2TP Parameters 303532-A Rev 00 A-7 Parameter: Remove Domain Name Path: Configuration Manager > Protocols > IP > L2TP > L2TP Configuration Default: Enable Options: Enable | Disable Function: Instructs the router whether to remove the domain name from the complete user name before RADIUS ...
Page 66 - L2TP Tunnel Security Parameters; The L2TP Tunnel Security List window; L2TP Tunnel Security List Window; The parameter descriptions follow.
Configuring L2TP Services A-8 303532-A Rev 00 L2TP Tunnel Security Parameters The L2TP Tunnel Security List window (Figure A-2) contains the tunnel authentication parameters. Figure A-2. L2TP Tunnel Security List Window The parameter descriptions follow.
Page 67 - Parameter: Enable Tunnel Authentication; Parameter: Tunnel Authentication Password; Options: An alphanumeric string, up to a maximum of 40 characters
L2TP Parameters 303532-A Rev 00 A-9 Parameter: Enable Tunnel Authentication Path: Configuration Manager > Protocols > IP > L2TP > Tunnel Authentication Default: Disable Options: Enable | Disable Function: Enables or disables the use of tunnel authentication for a slot on the LNS. Tunnel ...
Page 68 - L2TP IP Interface Parameters; The L2TP IP Interface List window; L2TP IP Interface List Window
Configuring L2TP Services A-10 303532-A Rev 00 L2TP IP Interface Parameters The L2TP IP Interface List window (Figure A-3) contains the list of IP interfaces for each slot on the router configured with L2TP. Figure A-3. L2TP IP Interface List Window When you click on Change, Site Manager displays th...
Page 69 - Parameter: L2TP IP Interface Address; Options: Any unique IP address; Parameter: Subnet Mask
L2TP Parameters 303532-A Rev 00 A-11 The parameter descriptions follow. Parameter: L2TP IP Interface Address Path: Configuration Manager > Protocols > IP > L2TP > L2TP IP Interface Default: None Options: Any unique IP address Function: Specifies the IP address that identifies the L2TP IP...
Page 70 - Parameter: RIP Enable
Configuring L2TP Services A-12 303532-A Rev 00 Parameter: RIP Enable Path: Configuration Manager > Protocols > IP > L2TP > L2TP IP Interface Default: Enable Options: Enable | Disable Function: Specifies whether RIP Listen is enabled on this interface. See Configuring IP Services for more...
Page 71 - Example 1: Remote PC Calling the Corporate Network; shows a sample L2TP network. In this network, note the following:
303532-A Rev 00 B-1 Appendix B Configuration Examples This appendix provides two examples of L2TP network configurations. It includes only those parameters that require changes from their default settings for proper configuration. For instructions on modifying parameters, see Chapter 3, “Customizing...
Page 72 - L2TP Network with PCs at the Remote Site; Configuring the Remote Hosts
Configuring L2TP Services B-2 303532-A Rev 00 Figure B-1. L2TP Network with PCs at the Remote Site Configuring the Remote Hosts The remote hosts in this network are two PCs running Windows 95. Neither PC has internal L2TP capabilities. In this network, one PC has a synchronous dial connection to the...
Page 73 - Configuring the LACs and the TMS; Choose a WAN port for the slot you want as the LNS.
Configuration Examples 303532-A Rev 00 B-3 Configuring the LACs and the TMS The LACs in this network are Model 5399 Remote Access Concentrators. Both devices have L2TP modules installed. See Model 5399 Remote Access Concentrator documentation for information about configuring L2TP. The LACs use the ...
Page 74 - In the L2TP IP Interface window, enter the L2TP IP address.; These addresses are stored in the RADIUS server database.; Data Path Through the Network
Configuring L2TP Services B-4 303532-A Rev 00 6. In the L2TP Tunneling Security window, enable tunnel authentication. 7. In the L2TP IP Interface window, enter the L2TP IP address. During the L2TP session, the RADIUS server assigns the following IP addresses: [email protected]: 192.32.40.1mmark...
Page 75 - Example 2: Remote Router Calling the Corporate Network; shows a network with two BayStackTM AN; L2TP Network with Routers at the Remote Site
Configuration Examples 303532-A Rev 00 B-5 Example 2: Remote Router Calling the Corporate Network Figure B-2 shows a network with two BayStack™ AN ® routers at the remote site. The AN routers are using dial-on-demand service for dial-up connections. In this network, note the following: • PPP is the ...
Page 76 - Disable outbound authentication.; Configuring the PPP Interface; Select the PPP interface to the ISP network.; For more information about PPP, see Configuring PPP Services.
Configuring L2TP Services B-6 303532-A Rev 00 Configuring the Dial-on-Demand Circuit Modify the dial-on-demand circuit configuration for the AN routers as follows: 1. In the Configuration Manager window, choose Dialup > Demand Circuits > Demand Pools > PPP Circuits > PPP Demand Circuits ...
Page 77 - Common L2TP Network Problems and Solutions
303532-A Rev 00 C-1 Appendix C Troubleshooting To monitor your L2TP network and solve problems that may occur, first check the event log file for any messages recorded by the LNS. For information about viewing and reading event messages, see Event Messages for Routers and Configuring and Managing Ro...