Table of Contents

Benefits
Restrictions
Related Documents

Configuring Per-User VPDN
Verifying Per-User VPDN

authen before-forward

Syntax Description
Defaults
Command Modes
Command History
Usage Guidelines
Examples
Related Commands

VPDN Per-User Configuration

This document includes the following sections:

• Feature Overview

• Supported Platforms

• Supported Standards, MIBs, and RFCs

• Configuration Tasks

• Configuration Example

• Command Reference

Feature Overview

In a virtual private dialup network (VPDN) that uses remote AAA, when a user dials in, the access server that receives the call forwards information about the user to its remote AAA server. With basic VPDN, the access server only sends the user's domain name (when performing domain name-based authentication) or the telephone number the user dialed in from (when performing DNIS-based authentication).

The VPDN Per-User Configuration feature sends the entire structured username to the AAA server the first time the router contacts the AAA server. This enables the Cisco IOS software to customize tunnel attributes for individual users who use a common domain name or dialed number identification service (DNIS).

Previously, Cisco IOS sent only the domain name or DNIS to determine VPDN tunnel attribute information. Then, if no VPDN tunnel attributes were returned, Cisco IOS sent the entire username string. Because of this behavior, there was no way to define specific tunnel attributes for a particular user within a domain. It also limited the types of connections that were possible in a RADIUS proxy VPDN roaming environment. All VPDN users were forwarded to the tunnel endpoint, even if they just needed generic Internet access.

Benefits

The VPDN Per-User Configuration feature adds new flexibility to Cisco IOS VPDN functionality. It enables you to customize tunnel attributes for individual users who use a common domain name or DNIS.

This feature also enables you to specify whether or not a user is forwarded to the tunnel endpoint or given generic Internet access.

Restrictions

The VPDN Per-User Configuration feature only supports RADIUS as the AAA protocol.

This feature is currently not supported for TACACS+.

Related Documents

For more information about Cisco VPDN and dialout technologies, see the following documents:

• The Layer 2 Tunnel Protocol feature module, which is located under New Features in Release 12.0(1)T from CCO.

• The Large Scale Dialout feature module, which is located under New Features in Release 12.0(3)T from CCO.

• The Resource Pool Management, VPDN Group Reorganization, L2TP Dialout and L2TP Tunnel Preservation of IP TOS feature modules, which are located under New Features in Release 12.0(5)T from CCO.

• The "Virtual Private Dialup Network" chapter in the Dial Solutions Configuration Guide.

• The Access VPN Solutions Using Tunneling Technology solutions guide, which is located under the Internetworking Solutions Guides index on CCO's documentation home page.

Supported Platforms

• Cisco 1600 series

• Cisco 1720 VPN Access Router

• Cisco 2500 series

• Cisco 2600

• Cisco 3600 series

• Cisco 4000-M series (Cisco 4000-M, 4500-M, 4700-M)

• Cisco 7000 series

• Cisco 7100 series

• Cisco 7200 series

• Cisco 7500 series

• Cisco AS5200

• Cisco AS5300

• Cisco AS5800

Supported Standards, MIBs, and RFCs

MIBs

• CISCO-VPDN-MGMT-MIB.my

• CISCO-VPDN-MGMT-MIB-V1SMI.my

For descriptions of supported MIBs and how to use MIBs, see the Cisco MIB web site on CCO at http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml.

RFCs

L2TP RFC

Standards

• None

Configuration Tasks

Perform the following task to configure the VPDN Per-User Configuration feature.

• Configuring Per-User VPDN (Required)

Configuring Per-User VPDN

To configure per-user VPDN, use the following commands:

Verifying Per-User VPDN

To verify the VPDN Per-User Configuration feature, use the show vpdn command.

Configuration Example

In the following example, the router is configured to send the entire username to the AAA server the first time it contacts the AAA server:

Command Reference

This section documents new commands. All other commands used with this feature are documented in the Cisco IOS Release 12.0 command references.

• authen before-forward

authen before-forward

To specify that VPDN send the entire structured username to the AAA server the first time the router contacts the AAA server, use the authen before-forward command in VPDN group configuration mode. Use the no form of this command to send just the domain name or DNIS.

Syntax Description

This command has no keywords or arguments.

Defaults

No default behavior or values.

Command Modes

VPDN group mode

Command History

Usage Guidelines

You must enable the request-dialin command on the VPDN group before you can use the authen before-forward command.

Examples

The following example creates a VPDN group that send the entire username to the AAA server when a user dials in with a username that has the domain name philzone.com:

Related Commands

Posted: Tue Jul 27 14:15:15 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.