L2TP for Subscriber Access — LAC

The L2TPv2 header consists of following fields (RFC 2611):

The AVP header consists of following fields (RFC 2611):

RADIUS-triggered tunnel/session setup without LNS renegotiation depicts the complete PPP session setup, using RADIUS authentication on both LAC and LNS. After the discovery phase (PADI/PADO/PADR/PADS) and LCP negotiation phase (LCP config_request/ack), the LAC initiates the L2TP tunnel setup based on RADIUS authentication information (RADIUS request/accept) and includes the negotiated PPP user-LAC information (called LCP proxy information). The LNS replies directly with a successful CHAP authentication if it agrees with the received proxy information. IP negotiation (IPCP config_request/ack) is handled between the user and the LNS, and the LAC has no IP knowledge of this PPP session.

RADIUS-triggered tunnel/session setup with LNS renegotiation shows the scenario where the LNS does not agree with the received LCP proxy information and (re)starts the LCP phase (LCP config_request/ack) directly with the PPP user. The rest of this scenario is the same as shown in RADIUS-triggered tunnel/session setup without LNS renegotiation.

PPP user-initiated release/terminate shows the user initiated terminate_request tunneled by the LAC followed by the user initiated PADT terminated on the LAC. The LAC informs the LNS about the termination of the session via the L2TP CDN message. The L2TP tunnel can be optionally (idle-timeout) terminated via the L2TP StopCCN message.

L2TP tunnel and session state diagram gives an overview of the main L2TP tunnel and session states. An L2TP tunnel in the establishedIdle state is a tunnel without sessions. A tools command (see Advanced topics) can put an L2TP tunnel in a draining state (this prevents adding new sessions on tunnel but leaves the current sessions intact) or in a drained state (moved from draining to drained when all sessions terminated). The draining and drained state are not shown in the state diagram.

The L2TP tunnel setup occurs first with the triggers being: session activation, auto-establish, and a tools start command (see the Advanced topics section). An L2TP session setup trigger is always session based.

Using the mandatory L2TP RADIUS attributes (see the following RADIUS user file) the LAC initiates an L2TP tunnel, as shown in Base router hosted LAC with single endpoint/single tunnel. The source address for the tunnel is the IPv4 address of a loopback interface in the base router system (LAC tunnel endpoint).The destination for the tunnel is defined by the Tunnel-Server-Endpoint RADIUS attribute [67], and is also known as the peer tunnel LNS endpoint address.

The PPPoE user terminates on IES service 1, sap 1/1/3:100, and is authenticated via RADIUS authentication-policy authentication-1 which provides wholesale/retail (L2TP) information.

configure
    service
        ies 1 customer 1 create
            subscriber-interface "sub-l2tp" create
                unnumbered "system"
                group-interface "grp-l2tp" create
                    authentication-policy "radius-1"
                    sap 1/1/3:100 create
                        sub-sla-mgmt
                            sub-ident-policy "all-subscribers"
                            multi-sub-sap 1000
                            no shutdown
                        exit
                    exit
                    pppoe
                        sap-session-limit 10
                        no shutdown
                    exit
                exit
            exit
            no shutdown
        exit
    exit
exit

The excerpt from the FreeRADIUS users file below shows the attributes to be returned.

user1@wholesale.com     Cleartext-Password := "letmein", NAS-Identifier == "LAC"
                        Alc-Subsc-ID-Str = "%{User-name}",
                        Alc-Subsc-Prof-Str = "sub-profile-1",
                        Alc-SLA-Prof-Str = "sla-profile-1",
                        Tunnel-Type:1 += L2TP,
                        Tunnel-Medium-Type:1 +=IP,
                        Tunnel-Server-Endpoint:1 += 192.168.22.2,

L2TP is enabled (no shutdown) in the related service instance.

The L2TP tunnel is set up in the base instance and not in a VRF because the attribute Alc-Tunnel-Serv-Id is not returned from RADIUS.

Missing L2TP parameters are taken from defaults defined in the router l2tp context.

configure router l2tp 
       calling-number-format "%S %s"  # L2TP AVP 22 format 
                                      # Default format ‛system-name sap-id’
       ---snip---                  
       no local-name                  # default name equals system-name
       no max-retries-estab           # default value equals 5
       ---snip--- 
       no shutdown                    # enable L2TP

This scenario shows the PPPoE session termination (base IES service 1) and the L2TP tunnel setup in the base router instance.

Base router hosted LAC with multiple endpoints shows a scenario with the PPPoE session termination (base IES service 1) and the L2TP tunnel setup in the base router instance.

The following excerpt from the FreeRADIUS users file shows that user user1@wholesale.com has four possible endpoints (LNS), each with its own tunnel preference. The LAC selects one L2TP endpoint out of these four tunnel specifications according to the configured L2TP selection process. This use case uses weighted load balancing between RADIUS-tunnel-1 and RADIUS-tunnel-2. The L2TP tunnel selection process is out of the scope of this chapter.

user1@wholesale.com     Cleartext-Password := "letmein", NAS-Identifier == "LAC"
                        Alc-Subsc-ID-Str = "%{User-name}",
                        Alc-Subsc-Prof-Str = "sub-profile-1",
                        Alc-SLA-Prof-Str = "sla-profile-1",
# group related info
                        Tunnel-Client-Endpoint:0 = 192.168.22.1,
                        Alc-Tunnel-Algorithm:0 = weighted-access,
                        Tunnel-Client-Auth-Id:0 = "lac-pe1",
                        Tunnel-Assignment-Id:0 = "RADIUS-group",
                        Alc-Tunnel-Max-Retries-Estab:0 = 2,
# tunnel-1 related info
                        Tunnel-Type:1 += L2TP,
                        Tunnel-Medium-Type:1 +=IP,
                        Tunnel-Server-Endpoint:1 += 192.168.22.2,
                        Tunnel-Assignment-Id:1 += "RADIUS-tunnel-1",
                        Tunnel-Preference:1 += 100,
# tunnel-2 related info
                        Tunnel-Type:2 += L2TP,
                        Tunnel-Medium-Type:2 +=IP,
                        Tunnel-Server-Endpoint:2 += 192.168.22.3,
                        Tunnel-Assignment-Id:2 += "RADIUS-tunnel-2",
                        Tunnel-Preference:2 += 80,
# tunnel-3 related info
                        Tunnel-Type:3 += L2TP,
                        Tunnel-Medium-Type:3 +=IP,
                        Tunnel-Server-Endpoint:3 += 192.168.22.4,
                        Tunnel-Assignment-Id:3 += "RADIUS-tunnel-3",
                          
---snip--- 

VRF hosted LAC shows the PPPoE session termination (base IES service 1) and the L2TP tunnel setup in a different router instance (VPRN 65536).

Using the following L2TP RADIUS attributes, the LAC initiates an L2TP tunnel in VPRN 65536. The PPPoE session is still handled by IES service 1, which proves that both router instances can be different. (See use-case A for configuration details of IES service 1).

user1@wholesale.com     Cleartext-Password := "letmein", NAS-Identifier == "LAC"
                        Alc-Subsc-ID-Str = "%{User-name}",
                        Alc-Subsc-Prof-Str = "sub-profile-1",
                        Alc-SLA-Prof-Str = "sla-profile-1",
                        Alc-Tunnel-Serv-Id = 65536,
                        Tunnel-Client-Auth-Id:0 = "lac-pe1",
                        Tunnel-Assignment-Id:0 = "RADIUS-returned-TG",
                        Tunnel-Type:1 += L2TP,
                        Tunnel-Medium-Type:1 +=IP,
                        Tunnel-Server-Endpoint:1 += 192.168.33.2,
                        Tunnel-Assignment-Id:1 += "RADIUS-returned-TN",

If RADIUS does not return the L2TP source IP address (Tunnel-Client-Endpoint), then the IP address from the VPRN 65536 interface named ‛system’ is used as the L2TP source address. The tunnel setup fails if this system interface does not exist.

configure
    service
        vprn 65536
            interface "system" create
                address 192.168.33.1/32
                loopback
            exit
            l2tp
                no shutdown
            exit

RADIUS returns L2TP tunnel group shows use case D, where the L2TP tunnel-group-name is assigned during RADIUS authentication.

 
user1@wholesale.com     Cleartext-Password := "letmein", NAS-Identifier == "LAC"
                        Alc-Subsc-ID-Str = "%{User-name}",
                        Alc-Subsc-Prof-Str = "sub-profile-1",
                        Alc-SLA-Prof-Str = "sla-profile-1",
                        Alc-Tunnel-Serv-Id = 65536,
                        Alc-Tunnel-Group = "wholesale.com",

The L2TP tunnel is initiated from VPRN 65536 (Alc-Tunnel-Serv-Id) and all L2TP tunnel information is taken from the l2tp group wholesale.com hierarchy (Alc-Tunnel-Group) as defined on the node.

configure
    service
        vprn 65536
            ---snip---
            interface "system" create
                address 192.168.33.1/32
                loopback
            exit
            l2tp
                group "wholesale.com" create
                    tunnel "wholesale.com" create
                        local-address 192.168.33.1
                        local-name "lac-pe1"
                        peer 192.168.33.2
                        no auto-establish
                        no shutdown
                    exit
                    no shutdown
                exit
                no shutdown
            exit
            no shutdown
        exit
    exit
exit

An L2TP tunnel is set up by either a PPP session-trigger, a tools command or by the l2tp group tunnel auto-establish parameter configuration. See the Advanced topics section for the non-session-triggered tunnel setup.

LUDB returns L2TP tunnel group shows use case E, where the L2TP tunnel-group-name is assigned during LUDB authentication, so this essentially is a RADIUS-less scenario.

The PPPoE user enters on an IES service 1, sap 1/1/3:100, and is authenticated via the LUDB which provides L2TP wholesale/retail and ESM information. The PPPoE context refers to a local-user database l2tp to provide the subscriber authentication and the tunnel setup parameters, so no RADIUS is needed.

configure
    service
        ies 1 customer 1 create
            subscriber-interface "sub-l2tp" create
                unnumbered "system"
                group-interface "grp-l2tp" create
                    sap 1/1/3:100 create
                        sub-sla-mgmt
                            sub-ident-policy "all-subscribers"
                            multi-sub-sap 1000
                            no shutdown
                        exit
                    exit
                    pppoe
                        sap-session-limit 10
                        user-db "l2tp"
                        no shutdown
                    exit
                exit
            exit
            no shutdown
        exit
    exit
exit

The referenced local user database l2tp configuration provides all of the required L2TP and ESM information.

configure
    subscriber-mgmt
        local-user-db "l2tp" create
            ppp
                match-list username
                host "wholesale.com" create
                    host-identification
                        username "wholesale.com" domain-only
                    exit
                    password ignore
                    identification-strings 254 create
                        subscriber-id "user@wholesale.com"
                        sla-profile-string "sla-profile-1"
                        sub-profile-string "sub-profile-1"
                    exit
                    l2tp
                        group "wholesale.com" service-id 65536
                    exit
                    no shutdown
                exit
            exit
            no shutdown
        exit
    exit
exit

The debug service id <service-id> ppp packet mode egr-ingr-and-dropped command shows the PPPoE packet exchange. The following PADI packet shows the service, SAP, and received PPPoE tags. The received PPPoE DSL forum tags are by default copied during the LAC L2TP tunnel setup into the Incoming Call Request (ICRQ) DSL Forum AVPs (RFC 5515).

1 2019/05/21 14:02:10.779 CEST MINOR: DEBUG #2001 Base PPPoE
"PPPoE: RX Packet
   IES 1, SAP 1/1/3:100
 
   DMAC: ff:ff:ff:ff:ff:ff
   SMAC: 00:00:00:00:01:01
   Ether Type: 0x8863 (Discovery)
 
   PPPoE Header:
   Version: 1                 Type      : 1
   Code   : 0x09 (PADI)       Session-Id: 0x0000 (0)
   Length : 48
 
   PPPoE Tags:
   [0x0101] Service-Name: ""
   [0x0103] Host-Uniq: len = 1, value = 31
   [0x0105] Vendor-Specific: vendor-id = 0x0de9 (ADSL Forum)
      [0x01] Agent-Circuit-Id: "circuit0"
      [0x02] Agent-Remote-Id: "remote0"
      [0x81] Actual-Upstream: 2000
      [0x82] Actual-Downstream: 4000
"

The debug router radius packet-type authentication command shows the actual authentication parameters returned by RADIUS. This example returns the minimum set of L2TP related RADIUS attributes.

12 2019/05/21 14:02:10.806 CEST MINOR: DEBUG #2001 Base RADIUS
"RADIUS: Receive
  Access-Accept(2) id 16 len 89 from 172.16.1.11:1812 vrid 1 pol rsp-radius-1
    VSA [26] 15 Nokia(6527)
      SUBSC PROF STR [12] 13 sub-profile-1
    VSA [26] 15 Nokia(6527)
      SLA PROF STR [13] 13 sla-profile-1
    TUNNEL TYPE [64] 4 1 L2TP(3)
    TUNNEL MEDIUM TYPE [65] 4 1 IPv4(1)
    TUNNEL SERVER ENDPOINT [67] 13 1 192.168.22.2
"

The debug router l2tp event lac-session-setup command shows the LAC tunnel selection for this example. An L2TP group-name default_radius_group with tunnel-name unnamed is created in this case, because RADIUS did not return an explicit group and tunnel name.

13 2019/05/21 14:02:10.808 CEST MINOR: DEBUG #2001 Base PPPoE 13->L2TP
"PPPoE 13->L2TP: UDP 192.0.2.1:1701 -> 192.168.22.2:1701
preference 50 tunnel default_radius_group:unnamed
    request to open new tunnel 1640"

14 2019/05/21 14:02:10.808 CEST MINOR: DEBUG #2001 Base PPPoE 13->L2TP
"PPPoE 13->L2TP: UDP 192.0.2.1:1701 -> 192.168.22.2:1701
preference 50 tunnel default_radius_group:unnamed
    create session 107505580"

The debug router l2tp packet detail-level command shows the L2TP tunnel and session setup for this example.

For the tunnel setup, the LAC sends a start-control-connection-request (SCCRQ) containing the assigned tunnel ID (no tunnel authentication in the example). The tunnel is now in a wait-reply state.

15 2019/05/21 14:02:10.808 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 0 session 0, ns 0 nr 0, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        StartControlConnectionRequest(1)
    AVP ProtocolVersion(0,2), flags: mandatory, reserved=0
        version=1, revision=0
    AVP HostName(0,7), flags: mandatory, reserved=0
        "lac-pe1"
    AVP WindowSize(0,10), flags: mandatory, reserved=0
        64
    AVP FramingCapabilities(0,3), flags: mandatory, reserved=0
        sync=no, async=no
    AVP BearerCapabilities(0,4), flags: mandatory, reserved=0
        digital=yes, analogue=no
    AVP FirmwareRevision(0,6), flags:, reserved=0
        4869
    AVP VendorName(0,8), flags:, reserved=0
        "Nokia"
    AVP AssignedTunnelId(0,9), flags: mandatory, reserved=0
        1640"

The LNS can bring up the tunnel, so the LNS replies with a start-control-connection-reply (SCCRP) including the assigned tunnel-id.

16 2019/05/21 14:02:10.809 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, ingress)
"L2TP(v2, ctrl, ingress): UDP 192.168.22.2:1701 -> 192.0.2.1:1701
tunnel 1640 session 0, ns 0 nr 1, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        StartControlConnectionReply(2)
    AVP ProtocolVersion(0,2), flags: mandatory, reserved=0
        version=1, revision=0
    AVP HostName(0,7), flags: mandatory, reserved=0
        "lns-pe2"
    AVP WindowSize(0,10), flags: mandatory, reserved=0
        64
    AVP FramingCapabilities(0,3), flags: mandatory, reserved=0
        sync=no, async=no
    AVP BearerCapabilities(0,4), flags: mandatory, reserved=0
        digital=yes, analogue=no
    AVP FirmwareRevision(0,6), flags:, reserved=0
        4869
    AVP VendorName(0,8), flags:, reserved=0
        "Nokia"
    AVP AssignedTunnelId(0,9), flags: mandatory, reserved=0
        13008"

As the last step in the tunnel setup phase, the LAC responds with a start-control-connection-connected (SCCCN) message. After an LNS ZLB acknowledgment, the tunnel is in the establishedIdle state.

17 2019/05/21 14:02:10.810 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 13008 session 0, ns 1 nr 1, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        StartControlConnectionConnected(3)"

Once the tunnel exists the session setup starts, a three-way exchange for session establishment within the tunnel is performed. The LAC sends an incoming-call-request (ICRQ) with the parameter information for the session. The session is now in the wait-reply state.

19 2019/05/21 14:02:10.811 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 13008 session 0, ns 2 nr 1, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        IncomingCallRequest(10)
    AVP AssignedSessionId(0,14), flags: mandatory, reserved=0
        26540
    AVP CallSerialNumber(0,15), flags: mandatory, reserved=0
        25216
    AVP CallingNumber(0,22), flags: mandatory, reserved=0
        "LAC 1/1/3:100"
    AVP AgentCircuitId(3561,1), flags:, reserved=0
        "circuit0"
    AVP AgentRemoteId(3561,2), flags:, reserved=0
        "remote0"
    AVP ActDataRateUp(3561,129), flags:, reserved=0
        2000000
    AVP ActDataRateDown(3561,130), flags:, reserved=0
        4000000"

The LNS then sends an incoming-call-reply (ICRP) that contains the assigned session ID. The session is now in the connect state.

21 2019/05/21 14:02:10.813 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, ingress)
"L2TP(v2, ctrl, ingress): UDP 192.168.22.2:1701 -> 192.0.2.1:1701
tunnel 1640 session 26540, ns 1 nr 3, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        IncomingCallReply(11)
    AVP AssignedSessionId(0,14), flags: mandatory, reserved=0
        2466"

Finally, the LAC sends an incoming call connected (ICCN) and provides the LNS with additional information from the user initiated session. This information includes the LCP information from the negotiation that the LAC and remote user performed. This information is used by the LNS to decide whether to start LCP re-negotiation and/or authentication re-negotiation with the PPP user or not. After an LNS ZLB acknowledgment, the session is in the established state.

24 2019/05/21 14:02:10.814 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 13008 session 2466, ns 3 nr 2, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        IncomingCallConnected(12)
    AVP FramingType(0,19), flags: mandatory, reserved=0
        sync=no, async=no
    AVP TxConnectSpeed(0,24), flags: mandatory, reserved=0
        4294967295
    AVP InitialRxLcpConfReq(0,26), flags:, reserved=0
         01 04 05 d4
         [1] MRU: 1492
    AVP LastTxLcpConfReq(0,27), flags:, reserved=0
         01 04 05 d4 03 05 c2 23 05 05 06 75 25 ad d3
         [1] MRU: 1492
         [3] Authentication-Protocol: 0xc223 (CHAP), Algorithm = 5 (MD5)
         [5] Magic-Number: 0x7525add3
    AVP LastRxLcpConfReq(0,28), flags:, reserved=0
         01 04 05 d4
         [1] MRU: 1492
    AVP ProxyAuthenType(0,29), flags:, reserved=0
        chap(2)
    AVP ProxyAuthenName(0,30), flags:, reserved=0
         "user1@wholesale.com"
    AVP ProxyAuthenChallenge(0,31), flags:, reserved=0
         13 ba fc db 18 15 b5 21 03 c9 61 8d 8a 1b 43 00
         c3 4a 80 51 df 52 f4 06 26 c8 16 db ce 2b 7d 62
         e5 7a bd 7d 0f
    AVP ProxyAuthenId(0,32), flags:, reserved=0
        id=1, reserved=0
    AVP ProxyAuthenResponse(0,33), flags:, reserved=0
         da c4 40 35 e4 4b 3f 72 3f eb 84 7b 09 99 5d f7
    AVP RxConnectSpeed(0,38), flags:, reserved=0
        4294967295"

The operational PPPoE session information for the IES 1 (base router) instance is as follows.

*A:LAC# show service id 1 ppp session
  
===============================================================================
PPP sessions for service 1
===============================================================================
User-Name
  Descr.
           Up Time       Type  Termination     IP/L2TP-Id/Interface-Id MC-Stdby
-------------------------------------------------------------------------------
user1@wholesale.com
  svc:1 sap:1/1/3:100 mac:00:00:00:00:01:01 sid:1
           0d 00:10:01   oE    lac             107505580
-------------------------------------------------------------------------------
No. of PPP sessions: 1
===============================================================================
*A:LAC#

The operational tunnel information in the base instance shows that the tunnel is established.

*A:LAC# show router l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
107479040  1640      13008     established        not-blacklisted   1
  default_radius_group                                              1
    unnamed
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

Detailed operational tunnel information is obtained using following command.

*A:LAC# show router l2tp tunnel tunnel-id 1640 detail
 
===============================================================================
L2TP Tunnel 107479040
===============================================================================
 
Connection ID: 107479040
Protocol     : v2
State        : established
IP           : 192.0.2.1
UDP          : 1701
Peer IP      : 192.168.22.2
Peer UDP     : 1701
Tx dst-IP    : 192.168.22.2
Tx dst-UDP   : 1701
Rx src-IP    : 192.168.22.2
Rx src-UDP   : 1701
Name         : lac-pe1
Remote Name  : lns-pe2
Assignment ID: unnamed
Group Name   : default_radius_group
Acct. Policy : N/A
Error Message: N/A
 
                                        Remote Conn ID    : 852492288
Tunnel ID         : 1640                Remote Tunnel ID  : 13008
Preference        : 50                  Receive Window    : 64
Hello Interval (s): 300                 AVP Hiding        : never
Idle TO (s)       : infinite            Destruct TO (s)   : 60
Max Retr Estab    : 5                   Max Retr Not Estab: 5
Cfg'd Sess Limit  : unlimited           Oper Session Limit: 32767                  '
Transport Type    : udpIp               Challenge         : never
Time Started      : 05/21/2019 14:02:11 Time Idle         : N/A
Time Established  : 05/21/2019 14:02:11 Time Closed       : N/A
Stop CCN Result   : noError             General Error     : noError
Blacklist-state   : not-blacklisted
Set Dont Fragment : true
 
Failover
State             : not-recoverable
Recovery Conn ID  : N/A
Recovery state    : not-applicable
Recovered Conn ID : N/A
Recovery method   : mcs
Track SRRP        : (Not specified)
Ctrl msg behavior : handle
Recovery time (ms)
Requested         : N/A
Peer              : N/A
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

The operational L2TP session information shows the L2TP session is established.

*A:LAC# show router l2tp session
  
===============================================================================
L2TP Session Summary
===============================================================================
ID                  Control Conn ID     Tunnel-ID   Session-ID  State
-------------------------------------------------------------------------------
107505580           107479040           1640        26540       established
-------------------------------------------------------------------------------
No. of sessions: 1
===============================================================================
*A:LAC#

For detailed operational L2TP session information use the following command.

*A:LAC# show router l2tp session session-id 26540 detail
  
===============================================================================
L2TP Session 107505580
===============================================================================
  
Connection ID: 107505580
State        : established
Tunnel Group : default_radius_group
Assignment ID: unnamed
Error Message: N/A
  
Control Conn ID   : 107479040           Rem Cntrl Conn ID : 852492288
Tunnel ID         : 1640                Remote Tunnel ID  : 13008
Session ID        : 26540               Remote Session ID : 2466
PW Type           : ppp                 Remote Conn ID    : 852494754
Time Started      : 05/21/2019 14:02:11
Time Established  : 05/21/2019 14:02:11 Time Closed       : N/A
CDN Result        : noError             General Error     : noError
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
No. of sessions: 1
===============================================================================
*A:LAC#

The debug router radius packet-type authentication command shows the actual RADIUS authentication parameters returned. This example returns multiple tunnel endpoints from which the LAC selects one. This example uses weighted load balancing. (The L2TP tunnel selection process is out of the scope of this example).

12 2019/05/22 10:57:38.331 CEST MINOR: DEBUG #2001 Base RADIUS
"RADIUS: Receive
  Access-Accept(2) id 83 len 225 from 172.16.1.11:1812 vrid 1 pol rsp-radius-1
    VSA [26] 15 Nokia(6527)
      SUBSC PROF STR [12] 13 sub-profile-1
    VSA [26] 15 Nokia(6527)
      SLA PROF STR [13] 13 sla-profile-1
    TUNNEL CLIENT ENDPOINT [66] 12 192.168.22.1
    VSA [26] 6 Nokia(6527)
      TUNNEL ALGORITHM [47] 4 weighted access(1)
    TUNNEL CLIENT AUTH ID [90] 7 lac-pe1
    TUNNEL ASSIGNMENT ID [82] 12 RADIUS-group
    VSA [26] 6 Nokia(6527)
      TUNNEL MAX RETRIES ESTAB [52] 4 0 2
    TUNNEL TYPE [64] 4 1 L2TP(3)
    TUNNEL MEDIUM TYPE [65] 4 1 IPv4(1)
    TUNNEL SERVER ENDPOINT [67] 13 1 192.168.22.2
    TUNNEL ASSIGNMENT ID [82] 16 1 RADIUS-tunnel-1
    TUNNEL PREFERENCE [83] 4 1 100
    TUNNEL TYPE [64] 4 2 L2TP(3)
    TUNNEL MEDIUM TYPE [65] 4 2 IPv4(1)
    TUNNEL SERVER ENDPOINT [67] 13 2 192.168.22.3
    TUNNEL ASSIGNMENT ID [82] 16 2 RADIUS-tunnel-2
    TUNNEL PREFERENCE [83] 4 2 80
"

The debug router l2tp event lac-session-setup command shows the LAC tunnel LNS2-T2 is selected for this example.

13 2019/05/22 10:57:38.332 CEST MINOR: DEBUG #2001 Base PPPoE 38->L2TP
"PPPoE 38->L2TP: UDP 192.168.22.1:1701 -> 192.168.22.3:1701
preference 80 tunnel RADIUS-group:RADIUS-tunnel-2
    request to open new tunnel 8880"

14 2019/05/22 10:57:38.332 CEST MINOR: DEBUG #2001 Base PPPoE 38->L2TP
"PPPoE 38->L2TP: UDP 192.168.22.1:1701 -> 192.168.22.3:1701
preference 80 tunnel RADIUS-group:RADIUS-tunnel-2
    create session 581989428"

The operational PPPoE session information in IES 1/base instance is shown as follows.

*A:LAC# show service id 1 ppp session
  
===============================================================================
PPP sessions for service 1
===============================================================================
User-Name
  Descr.
           Up Time       Type  Termination     IP/L2TP-Id/Interface-Id MC-Stdby
-------------------------------------------------------------------------------
user1@wholesale.com
  svc:1 sap:1/1/3:100 mac:00:00:00:00:01:01 sid:1
           0d 00:01:19   oE    lac             1066935934
-------------------------------------------------------------------------------
No. of PPP sessions: 1
===============================================================================
*A:LAC#

The operational L2TP tunnel information (base instance) is shown below.

*A:LAC# show router l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
581959680  8880      11367     established        not-blacklisted   1
  RADIUS-group                                                      1
    RADIUS-tunnel-2
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

Operational session information (base instance) shows the session is in the established state.

*A:LAC# show router l2tp session
 
===============================================================================
L2TP Session Summary
===============================================================================
ID                  Control Conn ID     Tunnel-ID   Session-ID  State
-------------------------------------------------------------------------------
581989428           581959680           8880        29748       established
-------------------------------------------------------------------------------
No. of sessions: 1
===============================================================================
*A:LAC#

The L2TP endpoint/peer information shows there are two tunnels for tunnel endpoint 192.168.22.2.

*A:LAC# show router l2tp peer
===============================================================================
L2TP Peers
===============================================================================
Peer IP                                            Port  Tun Active Ses Active
                                      Drain Reachability Tun Total  Ses Total
-------------------------------------------------------------------------------
192.168.22.2                                       1701  0          0
                                                         0          0
192.168.22.3                                       1701  1          1
                                                         1          1
-------------------------------------------------------------------------------
No. of peers: 2
===============================================================================
*A:LAC#

The following command gives a system overview of subscriber session related data. This system overview shows the current and peak values per session type (local PTA, LAC, LTS, LNS) and an overview of the number of originated or terminated L2TP tunnels. Peak values can be cleared via the clear subscriber-mgmt peakvalue-stats command.

*A:LAC# show subscriber-mgmt statistics session system
 
===============================================================================
Subscriber Management Statistics for System
===============================================================================
       Type                                Current     Peak      Peak Timestamp
-------------------------------------------------------------------------------
 
-------------------------------------------------------------------------------
PPP Session Statistics
-------------------------------------------------------------------------------
Local  PPP Sessions     - PPPoE                  0        0
       PPP Sessions     - PPPoEoA                0        0
       PPP Sessions     - PPPoA                  0        0
       PPP Sessions     - L2TP (LNS)             0        0
-------------------------------------------------------------------------------
LAC    PPP Sessions     - PPPoE                  1        2 05/22/2019 10:13:30
       PPP Sessions     - PPPoEoA                0        0
       PPP Sessions     - PPPoA                  0        0
       PPP Sessions     - L2TP (LTS)             0        0
-------------------------------------------------------------------------------
Total  PPP Sessions     - established            1        2 05/22/2019 10:13:30
       PPP Sessions     - in setup               0        1 05/22/2019 10:57:38
       PPP Sessions     - local                  0        0
       PPP Sessions     - LAC                    1        2 05/22/2019 10:13:30
-------------------------------------------------------------------------------
L2TP   L2TP Tunnels     - originator             1        3 05/21/2019 14:49:38
       L2TP Tunnels     - receiver               0        0
       Total L2TP Tunnels                        1        3 05/21/2019 14:49:38
-------------------------------------------------------------------------------
 
-------------------------------------------------------------------------------
IPOE Session Statistics
-------------------------------------------------------------------------------
Total  IPOE Sessions    - established            0        0
       IPOE Sessions    - in setup               0        0
-------------------------------------------------------------------------------
===============================================================================
Peak values last reset at : n/a
*A:LAC#

This example returns VPRN 65536 as the L2TP service instance [26-6527-104 Alc-Tunnel-Serv-Id]. The VPRN 65536 interface system address is used as the L2TP source address because the attribute Tunnel-Client-Endpoint is not returned.

The IP address 192.168.33.1 (Tunnel-Server-Endpoint) needs to be routable in VRF 65536 over a SAP or to a remote PE. This example uses BGP/MPLS IP virtual private networks (VPNs) (RFC 4364) to access the remote PE.

*A:LAC# show router 65536 route-table
 
===============================================================================
Route Table (Service: 65536)
===============================================================================
Dest Prefix[Flags]                            Type    Proto     Age        Pref
      Next Hop[Interface Name]                                    Metric
-------------------------------------------------------------------------------
---snip---
192.168.33.1/32                               Local   Local     01d21h26m  0
       system                                                       0
192.168.33.2/32                               Remote  BGP VPN   20h03m54s  170
       192.0.2.2 (tunneled)                                         10
---snip---
===============================================================================
*A:LAC#

Operational PPPoE session information for IES 1 (base instance) is shown using following command.

*A:LAC# show service id 1 ppp session
 
===============================================================================
PPP sessions for service 1
===============================================================================
User-Name
  Descr.
           Up Time       Type  Termination     IP/L2TP-Id/Interface-Id MC-Stdby
-------------------------------------------------------------------------------
user1@wholesale.com
  svc:1 sap:1/1/3:100 mac:00:00:00:00:01:01 sid:1
           0d 00:07:40   oE    lac             893192647
-------------------------------------------------------------------------------
No. of PPP sessions: 1
===============================================================================
*A:LAC#

Operational tunnel information for VPRN 65536 is displayed as follows.

*A:LAC# show router 65536 l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
893190144  13629     14251     established        not-blacklisted   1
  RADIUS-returned-TG                                                1
    RADIUS-returned-TN
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

Operational session information for VPRN 65536 is displayed using following command, and shows that the session is established.

*A:LAC# show router 65536 l2tp session
 
===============================================================================
L2TP Session Summary
===============================================================================
ID                  Control Conn ID     Tunnel-ID   Session-ID  State
-------------------------------------------------------------------------------
893192647           893190144           13629       2503        established
-------------------------------------------------------------------------------
No. of sessions: 1
===============================================================================
*A:LAC#

This example returns VPRN 65536 as the L2TP service instance [26-6527-104 ] Alc-Tunnel-Serv-Id and an L2TP group name wholesale.com [26-6527-46 ] Alc-Tunnel-Group.

12 2019/05/22 11:15:46.604 CEST MINOR: DEBUG #2001 Base RADIUS
"RADIUS: Receive
  Access-Accept(2) id 85 len 95 from 172.16.1.11:1812 vrid 1 pol rsp-radius-1
    VSA [26] 15 Nokia(6527)
      SUBSC PROF STR [12] 13 sub-profile-1
    VSA [26] 15 Nokia(6527)
      SLA PROF STR [13] 13 sla-profile-1
    VSA [26] 6 Nokia(6527)
      TUNNEL SERVICE ID [104] 4 65536
    VSA [26] 15 Nokia(6527)
      TUNNEL GROUP [46] 13 wholesale.com
"

For operational PPPoE session information in IES 1/base instance, use following command.

A:LAC# show service id 1 ppp session
 
===============================================================================
PPP sessions for service 1
===============================================================================
User-Name
  Descr.
           Up Time       Type  Termination     IP/L2TP-Id/Interface-Id MC-Stdby
-------------------------------------------------------------------------------
user1@wholesale.com
  svc:1 sap:1/1/3:100 mac:00:00:00:00:01:01 sid:1
           0d 00:02:35   oE    lac             217909462
-------------------------------------------------------------------------------
No. of PPP sessions: 1
===============================================================================
*A:LAC#

Operational tunnel information for VPRN 65536 shows the tunnel is in the established state.

*A:LAC# show router 65536 l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
217907200  3325      374       established        not-blacklisted   1
  wholesale.com                                                     1
    wholesale.com
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

The operational session information for VPRN 65536 shows the session is in the established state.

*A:LAC# show router 65536 l2tp session
===============================================================================
L2TP Session Summary
===============================================================================
ID                  Control Conn ID     Tunnel-ID   Session-ID  State
-------------------------------------------------------------------------------
217909462           217907200           3325        2262        established
-------------------------------------------------------------------------------
No. of sessions: 1
===============================================================================
*A:LAC#

This example returns VPRN 65536 as the L2TP service instance and L2TP group name wholesale.com (LUDB L2TP group "wholesale.com" service-id 65536).

The debug subscriber-mgmt local-user-db l2tp detail all command shows the LUDB authentication access (The returned parameter details are not shown).

11 2019/05/22 11:26:21.277 CEST MINOR: DEBUG #2001 Base LUDB
"LUDB: User lookup success - host found
  user-name:
    original:  user1@wholesale.com
    masked:    user1@wholesale.com
 
  Host wholesale.com found in user data base l2tp"

To show the operational data from LUDB l2tp, use the following command.

*A:LAC# show subscriber-mgmt local-user-db "l2tp" ppp-host "wholesale.com" 
                                      | match N/A invert-match 
                                      | match none invert-match
  
===============================================================================
PPP Host "wholesale.com"
===============================================================================
Admin State          : Up
Last Mgmt Change     : 05/20/2019 13:45:52
 
Host Identification
 User Name           : wholesale.com (domain only)
 
Matched Objects      : userName
 
Password Type        : ignore
PADO Delay           : 0msec
Diameter app policy  : (Not Specified)
Diameter auth policy : (Not Specified)
Force IPv6CP         : Disabled
Ignore DF Bit        : Disabled
 
DHCPv6 lease times
 Renew timer         : > 9999 days
 Rebind timer        : > 9999 days
 Preferred lifetime  : 0d 00:00:00
 Valid lifetime      : 0d 00:00:00
 
Identification Strings (option 254)
 Subscriber Id       : user@wholesale.com
 SLA Profile String  : sla-profile-1
 Sub Profile String  : sub-profile-1
 
L2TP
 Service             : 65536
 Tunnel Group        : wholesale.com
 
MSAP defaults
 
Filter Overrules
 
Access loop info
===============================================================================
*A:LAC#

The debug router l2tp event lac-session-setup command shows the LAC tunnel selected for this example.

12 2019/05/22 11:26:21.278 CEST MINOR: DEBUG #2001 vprn65536 PPPoE 41->L2TP
"PPPoE 41->L2TP: UDP 192.168.33.1:1701 -> 192.168.33.2:1701
preference 50 tunnel wholesale.com:wholesale.com
    request to open new tunnel 11734"

13 2019/05/22 11:26:21.278 CEST MINOR: DEBUG #2001 vprn65536 PPPoE 41->L2TP
"PPPoE 41->L2TP: UDP 192.168.33.1:1701 -> 192.168.33.2:1701
preference 50 tunnel wholesale.com:wholesale.com
    create session 769017741"

For the operational PPPoE session information in IES 1/base instance, use the following command.

*A:LAC# show service id 1 ppp session
 
===============================================================================
PPP sessions for service 1
===============================================================================
User-Name
  Descr.
           Up Time       Type  Termination     IP/L2TP-Id/Interface-Id MC-Stdby
-------------------------------------------------------------------------------
user1@wholesale.com
  svc:1 sap:1/1/3:100 mac:00:00:00:00:01:01 sid:1
           0d 00:03:12   oE    lac             769017741
-------------------------------------------------------------------------------
No. of PPP sessions: 1
===============================================================================
*A:LAC#

Operational tunnel information for VPRN 65536 can be obtained using following command.

*A:LAC# show router 65536 l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
768999424  11734     4184      established        not-blacklisted   1
  wholesale.com                                                     1
    wholesale.com
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

The operational session information for VPRN 65536 shows the session is in the established state.

*A:LAC# show router 65536 l2tp session
 
===============================================================================
L2TP Session Summary
===============================================================================
ID                  Control Conn ID     Tunnel-ID   Session-ID  State
-------------------------------------------------------------------------------
769017741           768999424           11734       18317       established
-------------------------------------------------------------------------------
No. of sessions: 1
===============================================================================
*A:LAC#

In addition to the PPP-session-triggered setup, an L2TP tunnel can also be set up via a tools command or an auto-establish command.

These non-session triggers are useful, for example, during the initial configuration phase where the LAC-LNS tunnel setup can be tested without the need for a user to attempt and establish a PPPoE connection.

The PPPoE user still triggers the L2TP session-setup over this L2TP tunnel and RADIUS needs to return an L2TP group name with the relevant name during authentication.

An L2TP tunnel can be torn down automatically, after the expiration of an idle timer, or manually through a tools command.

A keepalive mechanism is employed by L2TP in order to differentiate between tunnel outages and no control or data activity on a tunnel for an extended period. This is accomplished by injecting hello control messages after a specified period of time has elapsed since the last data or control message (ZLB not included) was received on a tunnel. As for any other L2TP control message, if the hello message is not reliably delivered, then the tunnel is declared down and reset, as defined in RFC 2661. This means that SR OS does not send hello packets if session control traffic is handled over this tunnel. The hello timer is reset if the system transmits any control packet over this tunnel (ZLB packets and data traffic are not taken into account).

The keepalive function is disabled (not recommended) using RADIUS [26-6527-50] Alc-Tunnel-Hello-Interval -1 or hello-interval infinite (default 300). The number of retries for unsuccessful hello packet delivery equals RADIUS [26-6527-52] Alc-Tunnel-Max-Retries-Estab or node parameter max-retries-estab (default 5). The retry interval is initially set to 1 second and doubles on each retry with a maximum interval of 8 seconds. Using a max-retries-estab 7 results in a retry of [1,2,4,8,8,8,8 seconds].

configure router l2tp | configure service vprn l2tp]
    hello-interval [60..3600] s | infinite  # default 300 s
    max-retries-estab [2..7]                # default 5
    ---snip---
    group <tunnel-group-name>
        hello-interval [60..3600] s | infinite
        max-retries-estab [2..7]     
        ---snip---
        tunnel  <tunnel-name>
            hello-interval [60..3600] s | infinite
            max-retries-estab [2..7]     
            ---snip---

For example, the LAC can be configured with an hello timer of 1 minute and the LNS with an hello timer of 2 minutes. The hello timer interval for LAC and LNS do not have to be same because the keepalive mechanism works asynchronous. See L2TP keepalive mechanism.

*A:LAC# show router l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
794361856  11364     5391      established        not-blacklisted   1
  default_radius_group                                              1
    unnamed
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================

L2TP keepalive mechanism shows the tunnel being closed after 5 unsuccessful Hello deliveries with error-message connection with peer lost.

*A:LAC# show router 65536 l2tp tunnel detail
 
===============================================================================
L2TP Tunnel 479985664
===============================================================================
 
Connection ID: 479985664

---snip---

Acct. Policy : N/A
Error Message: connection with peer lost
 
                                        Remote Conn ID    : 201195520
Tunnel ID         : 7324                Remote Tunnel ID  : 3070
Preference        : 50                  Receive Window    : 64
Hello Interval (s): 60                  AVP Hiding        : never
 
---snip---
 
No. of tunnels: 1
===============================================================================
*A:LAC#

The destruct-timeout parameter (expressed in seconds) controls the period of time that the tunnel, or session data related to a closed (disconnected) tunnel, or session persists before being removed. The destruct timeout is a debugging aid by keeping underlying memory structures after the tunnel or session is terminated. It is configured via the RADIUS [26-6527-51] Alc-Tunnel-Destruct-Timeout attribute or the corresponding node parameter. Default value for this parameter is 60 seconds.

configure router l2tp | configure service vprn l2tp
    destruct-timeout [60..86400] 
    ---snip---  
    group <tunnel-group-name>
        destruct-timeout [60..86400]
        ---snip--- 
        tunnel  <tunnel-name>
            destruct-timeout [60..86400] 

The following output shows a session that is closed and the reason for it being terminated.

*A:LAC# show router l2tp session detail
 
===============================================================================
L2TP Session 900466242
===============================================================================
 
Connection ID: 900466242
State        : closed
Tunnel Group : default_radius_group
Assignment ID: unnamed
Error Message: Terminated by PPPoE: Received PPPoE PADT
 
Control Conn ID   : 900464640           Rem Cntrl Conn ID : 899416064
Tunnel ID         : 13740               Remote Tunnel ID  : 13724
Session ID        : 1602                Remote Session ID : 23489
PW Type           : ppp                 Remote Conn ID    : 899439553
Time Started      : 05/22/2019 13:54:44
Time Established  : 05/22/2019 13:54:44 Time Closed       : 05/22/2019 13:54:50
CDN Result        : generalError        General Error     : vendorSpecific
-------------------------------------------------------------------------------
-------------------------------------------------------------------------------
No. of sessions: 1
===============================================================================
*A:LAC#

The following output shows a tunnel that is closed and the reason for it being closed.

*A:LAC# show router l2tp tunnel detail
 
===============================================================================
L2TP Tunnel 900464640
===============================================================================
 
Connection ID: 900464640
Protocol     : v2
State        : closed
IP           : 192.0.2.1
UDP          : 1701
Peer IP      : 192.168.22.2
Peer UDP     : 1701
Tx dst-IP    : 192.168.22.2
Tx dst-UDP   : 1701
Rx src-IP    : 192.168.22.2
Rx src-UDP   : 1701
Name         : lac-pe1
Remote Name  : lns-pe2
Assignment ID: unnamed
Group Name   : default_radius_group
Acct. Policy : N/A
Error Message: idle timeout (60 seconds) expired
 
---snip---
 
No. of tunnels: 1
===============================================================================
*A:LAC#

When the destruct timeout expires the tunnel and session is deleted, as follows:

*A:LAC# show router l2tp session detail
No entries found.
*A:LAC# show router l2tp tunnel detail
No entries found.
*A:LAC#

A floating peer exists if the peer LNS address indicated in the source address of the SCCRP is different from the peer address known on the LAC. Floating peer allowance is configuration driven and is rejected by default.

The parameter peer-address-change-policy specifies whether the LAC accepts, ignores or rejects requests from a peer to change the destination IP address or UDP port.

configure router l2tp | configure service vprn l2tp
       peer-address-change-policy accept | ignore | reject

• accept — Specifies that this system accepts any source IP address change for received L2TP control messages related to a locally originated tunnel in the state wait-reply and rejects any peer address change for other tunnels. In case the new peer IP address is accepted, it is learned and used as destination address in subsequent L2TP messages, as shown in Floating peers accept.

  

• ignore — Specifies that this system ignores any source IP address change for received L2TP control messages, does not learn any new peer IP address and does not change the destination address in subsequent L2TP messages, as shown in Floating peers ignore.

  

• reject — Specifies that this system rejects any source IP address change for received L2TP control messages and drops those messages, as shown in Floating peers reject.

  

The values Peer IP, Tx dst-IP and Rx src-IP in the show router l2tp tunnel detail command indicates if floating peers are used or not.

An example of a floating peer (peer-address-change-policy accept) is as follows.

*A:LAC# show router l2tp tunnel detail 
=======================================
L2TP Tunnel Status
=======================================
Connection ID: 897122304
State        : established
IP           : 192.0.2.1
UDP          : 1701
Peer IP      : 192.0.2.2 # (1) peer address used in SCCRQ 
Peer UDP     : 1701
Tx dst-IP    : 192.0.2.12 # (3) peer address used in SCCCN 
Tx dst-UDP   : 1701
Rx src-IP    : 192.0.2.12 # (2) SCCRP different IP received
Rx src-UDP   : 1701
---snip---

The connect speed (TX AVP 24 and RX AVP 38) is passed in the ICCN messages sent from the LAC to the LNS. The L2TP AVP 24 defines the (Tx) connect speed in bps from the perspective of traffic flowing from the LAC towards the subscriber (BNG downstream rate).The L2TP AVP 38 defines the (Rx) connect speed in bps from the perspective of traffic flowing from the subscriber toward the LAC (BNG upstream rate).

The report-rate configuration option indicates what rate is reported to the LNS when creating an L2TP session.

configure subscriber-mgmt sla-profile <sla-profile-name> ingress | egress
    report-rate agg-rate-limit|scheduler|pppoe-actual-rate|policer|rfc5515-actual-rate

• agg-rate-limit — Take the aggregate rate as received from the RADIUS Access-Accept message in VSA Alc-Subscriber-QoS-Override. When this RADIUS VSA is not present in the Access-Accept, or when RADIUS is not used, then take the configured aggregate rate limit. In the case where this is not configured, then take the port rate.

• scheduler <scheduler-name> — Take the rate of the specified scheduler. In case the scheduler is not linked with the scheduler-policy from the subscriber-profile, then take the port rate.

• pppoe-actual-rate — Take the rate from the DSL-Forum Vendor-Specific PPPoE Tag when available, otherwise take the port rate.

• rfc5515-actual-rate — Put the same value as the transmitted Actual-Data-Rate-Upstream AVP in the Rx-Connect-Speed AVP, and the same value as the transmitted Actual-Data-Rate-Downstream AVP in the Tx-Connect-Speed AVP.

The format of AVP 22 calling number in the ICRQ message is configurable via the parameter calling-number-format. The default format is "%S<space>%s" and corresponds to the concatenation of system-name<space>sap-id. Available parameters are %S (system-name), %c (Agent Circuit Id), %r Agent Remote Id, %s (sap-id), %l (Logical Line ID) and fixed strings. A combination can be configured from any of these parameters, but the total configured format cannot exceed 255 characters.

Example 1: Default configuration.

configure router l2tp calling-number-format "%S %s"

19 2019/05/22 14:01:04.885 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 5593 session 0, ns 2 nr 1, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        IncomingCallRequest(10)
    AVP AssignedSessionId(0,14), flags: mandatory, reserved=0
        15342
    AVP CallSerialNumber(0,15), flags: mandatory, reserved=0
        84781
    AVP CallingNumber(0,22), flags: mandatory, reserved=0
        "LAC 1/1/3:100"
    AVP AgentCircuitId(3561,1), flags:, reserved=0
        "circuit0"
    AVP AgentRemoteId(3561,2), flags:, reserved=0
        "remote0"
    AVP ActDataRateUp(3561,129), flags:, reserved=0
        2000000
    AVP ActDataRateDown(3561,130), flags:, reserved=0
        4000000"

Example 2: Customized configuration and all parameters (%S %s %c) are available to construct the requested AVP 22.

configure router l2tp calling-number-format "start-%S###%s###%c-end"

19 2019/05/22 14:05:28.116 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 832 session 0, ns 2 nr 1, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        IncomingCallRequest(10)
    AVP AssignedSessionId(0,14), flags: mandatory, reserved=0
        24748
    AVP CallSerialNumber(0,15), flags: mandatory, reserved=0
        84782
    AVP CallingNumber(0,22), flags: mandatory, reserved=0
        "start-LAC###1/1/3:100###circuit0-end"
    AVP AgentCircuitId(3561,1), flags:, reserved=0
        "circuit0"
    AVP AgentRemoteId(3561,2), flags:, reserved=0
        "remote0"
    AVP ActDataRateUp(3561,129), flags:, reserved=0
        2000000
    AVP ActDataRateDown(3561,130), flags:, reserved=0
        4000000"

Example 3: Customized configuration and not all parameters are available to construct the requested AVP 22. Option-82 circuit-id (%c),remote-id (%r), and LLID (%l) information are lacking and therefore missing (skipped) in the formatted attribute.

configure router l2tp calling-number-format "%S#%c#%r#%l#%s"

19 2019/05/22 14:07:26.302 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 255 session 0, ns 2 nr 1, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        IncomingCallRequest(10)
    AVP AssignedSessionId(0,14), flags: mandatory, reserved=0
        20814
    AVP CallSerialNumber(0,15), flags: mandatory, reserved=0
        84783
    AVP CallingNumber(0,22), flags: mandatory, reserved=0
        "LAC#circuit0#remote0##1/1/3:100"
    AVP AgentCircuitId(3561,1), flags:, reserved=0
        "circuit0"
    AVP AgentRemoteId(3561,2), flags:, reserved=0
        "remote0"
    AVP ActDataRateUp(3561,129), flags:, reserved=0
        2000000

By default, the LAC includes the calling number AVP 22 in the L2TP incoming-call-request (ICRQ) packets transmitted to LNS. This AVP identifies the interface that is connected to the customer in the access network. Network access interface information can be hidden by configuring the LAC not to send the calling number AVP to the LNS.

Use the following command to disable the sending of L2TP calling number AVP 22.

configure router l2tp 
        exclude-avps calling-number

Interoperation with a Cisco LNS requires that the LAC communicates a NAS port type to the LNS via the L2TP ICRQ ‛Cisco Nas Port Info AVP (100)’. This AVP (100) includes information that identifies the NAS port and indicates whether the port type is Ethernet or ATM and is configured via the cisco-nas-port parameter.

The Cisco AVP 100 format is as follows:

• First 5 bytes are NAS-Port-Type:

  • 0f10090203 (Ethernet)

  • 0f10090201 (ATM)

• Remaining four bytes correspond with the configured cisco-nas-port value

Example:

• Ethernet 12b s-vlan-id; 10b c-vlan-id; 3b slot number; 2b MDA nbr; 5b port

• ATM 12b VPI; 10b VCI; 3b slot number; 2b MDA nbr; 5b port

configure router l2tp 
        cisco-nas-port ethernet "*12o*10i*3s*2m*5p" atm "*12v*10c*3s*2m*5p"

nas-port 1/1/3:100 corresponds to 102563 (000000000000 0001100100 001 01 00011).

19 2019/05/22 14:11:49.431 CEST MINOR: DEBUG #2001 Base L2TP(v2, ctrl, egress)
"L2TP(v2, ctrl, egress): UDP 192.0.2.1:1701 -> 192.168.22.2:1701
tunnel 13002 session 0, ns 2 nr 1, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        IncomingCallRequest(10)
    AVP CiscoNasPort(9,100), flags:, reserved=0
        102563 type=ethernet(0f:10:09:02:03)
    AVP AssignedSessionId(0,14), flags: mandatory, reserved=0
        2461
    AVP CallSerialNumber(0,15), flags: mandatory, reserved=0
        84784
    AVP CallingNumber(0,22), flags: mandatory, reserved=0
        "LAC 1/1/3:100"
    AVP AgentCircuitId(3561,1), flags:, reserved=0
        "circuit0"
    AVP AgentRemoteId(3561,2), flags:, reserved=0
        "remote0"
    AVP ActDataRateUp(3561,129), flags:, reserved=0
        2000000
    AVP ActDataRateDown(3561,130), flags:, reserved=0
        4000000"

When the LAC has established sessions, the LAC can avoid the creation of new sessions for a specific group, peer, or tunnel, via the drain command.

No new sessions are created for a group, peer or tunnel that is being drained (draining state) but the current sessions are left intact.

After the drain command is issued, the group, peer, or tunnel moves from a draining to drained state when the last session is closed. A drained group, peer, or tunnel can then be managed (reconfigured, deleted) without any user impact.

Be aware that a group, peer, or tunnel in a draining or drained state is skipped in the tunnel selection process. The next example shows a tunnel draining; group and peer draining works according in the same way.

A tunnel has 1 session and is in established state.

*A:LAC# show router 65536 l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
1023868928 15623     9957      established        not-blacklisted   1
  wholesale.com                                                     1
    wholesale.com
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

The following tools drain command puts the tunnel in a draining state and leaves the sessions intact.

*A:LAC# tools perform router 65536 l2tp tunnel 1023868928 drain
*A:LAC#

Initially the tunnel is in the draining state.

*A:LAC# show router 65536 l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
1023868928 15623     9957      draining           not-blacklisted   1
  wholesale.com                                                     1
    wholesale.com
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

The tunnel moves to the drained state at the moment the last session is closed. Debugging shows that a drained tunnel is also not used as last resort and is skipped during the tunnel selection process.

*A:LAC# show router 65536 l2tp tunnel
===============================================================================
Conn ID    Loc-Tu-ID Rem-Tu-ID State              Blacklist-state   Ses Active
  Group                                                             Ses Total
    Assignment
-------------------------------------------------------------------------------
1023868928 15623     9957      drained            not-blacklisted   0
  wholesale.com                                                     1
    wholesale.com
-------------------------------------------------------------------------------
No. of tunnels: 1
===============================================================================
*A:LAC#

The following output shows new sessions cannot select a drained tunnel.

82289 2019/05/22 14:43:56.549 CEST MINOR: DEBUG #2001 vprn65536 PPPoE 19644->L2TP
"PPPoE 19644->L2TP: UDP 192.168.33.1:1701 -> 192.168.33.2:1701
preference 50 tunnel wholesale.com:wholesale.com
    no additional session can be created in tunnel 15623"

82290 2019/05/22 14:43:56.549 CEST MINOR: DEBUG #2001 vprn65536 PPPoE 19644->L2TP
"PPPoE 19644->L2TP:
    stop: no more tunnels can be tried"

The drained tunnel can then be closed without user impact.

*A:LAC# tools perform router 65536 l2tp tunnel 1023868928 stop
*A:LAC#

207376 2019/05/22 14:45:01.981 CEST MINOR: DEBUG #2001 vprn65536 L2TP(v2, ctrl,
                                                                   ingress)
"L2TP(v2, ctrl, ingress): UDP 192.168.33.2:1701 -> 192.168.33.1:1701
tunnel 15623 session 0, ns 2 nr 8, flags:, reserved=0"

207377 2019/05/22 14:46:01.853 CEST MINOR: DEBUG #2001 vprn65536 L2TP(v2, ctrl,
                                                                   ingress)
"L2TP(v2, ctrl, ingress): UDP 192.168.33.2:1701 -> 192.168.33.1:1701
tunnel 15623 session 0, ns 2 nr 8, flags:, reserved=0
    AVP MessageType(0,0), flags: mandatory, reserved=0
        StopControlConnectionNotification(4)
    AVP ResultCode(0,1), flags: mandatory, reserved=0
        result-code: "generalRequestToClearControlConnection"(1), 
                                         error-code: "noGeneralError"(0)
        error-msg: "idle timeout (60 seconds) expired"
    AVP AssignedTunnelId(0,9), flags: mandatory, reserved=0
        9957"

For draining and undraining for example a group, following commands can be used.

tools perform router 65536 l2tp group "wholesale.com" drain
tools perform router 65536 l2tp group "wholesale.com" no drain