Setting Up Virtual Private Networks in RADIUS

This chapter contains:

Introducing ATMP

Overview of RADIUS attributes for ATMP

Overview of MAX configuration parameters for ATMP

Setting up a tunnel in router mode for an IP network

Setting up a tunnel in gateway mode for an IP network

Tunneling ATMP between two IP networks

Tunneling IPX across the Internet

Setting up the MAX as a multi-mode agent

Setting up ATMP to bypass a foreign agent

Configuring call routing to PPTP servers

Introducing ATMP

ATMP provides a Virtual Private Network (VPN) solution over the backbone resources of Internet Service Providers (ISPs) and carriers. Without ATMP, each mobile node and remote user has to dial directly into the network, resulting in long-distance charges. With ATMP, these users can make a local call and have the transmission securely tunnelled across the Internet or frame relay network.

As described in RFC 1701, GRE hides packet contents and enables transmission of packets that would otherwise be unacceptable on the Internet. These include IP packets that use unregistered addresses or IPX packets from roaming clients.

ATMP creates and tears down the tunnel between two Ascend units. In effect, the tunnel collapses the Internet cloud and provides what looks like direct access to a home network from a remote node. ATMP applies only to IP or IPX networks.

You can also set up RADIUS accounting so that the Accounting Stop packet indicates if a session authenticated and encapsulated using the ATMP tunneling protocol. See Non-accounting attributes in accounting records.

How ATMP connections work

Figure 7-1. Sample cross-Internet ATMP tunnel

Table 7-1 lists the network elements that work together in an ATMP connection.

Table 7-1. ATMP network elements

Element	Description
Home network	The home network is a private corporate network. A private network is one that cannot communicate directly on the Internet. It might be an IPX network, or an IP network with an unregistered network number.
Mobile node	A mobile node is a user who accesses a private home network across the Internet. The mobile node could be a salesperson on the road who wants to dial into a local ISP and log into his or her home network.
Foreign agent	The foreign agent is an Ascend unit that the mobile node dials into. It is the starting point of the ATMP tunnel. The foreign agent must be able to bring up an IP connection to the home agent, and it must authenticate the mobile node using a RADIUS user profile that includes ATMP attributes.
Home agent	The home agent is an Ascend unit that represents the terminating part of the tunnel. It must be able to communicate with the home network directly, through another router, or across a nailed-up WAN connection.

When a mobile node wants to establish an ATMP connection with the home network, these events take place:

1. The mobile node dials a connection to the foreign agent.

2. The foreign agent authenticates the mobile node using a RADIUS user profile.

3. The foreign agent locates a Connection profile or RADIUS user profile for the home agent based on the Ascend-Primary-Home-Agent or Ascend-Secondary-Home-Agent attribute in the mobile node's RADIUS user profile.

   The Ascend-Primary-Home-Agent attribute specifies the IP address or hostname of the first home agent the foreign agent tries to reach when setting up an ATMP tunnel. The Ascend-Secondary-Home-Agent specifies the home agent the foreign agent tries to reach if the primary home agent is unavailable.

4. The foreign agent connects to the home agent using a regular IP connection.

   The MAX authenticates the connection in the usual way (for example, by using CHAP).

5. The foreign agent informs the home agent that the mobile node has connected, and requests a tunnel.

   The foreign agent sends up to ten RegisterRequest messages at two-second intervals, timing out and logging a message if it receives no response to those requests.

6. The home agent requests authentication of the mobile node by sending a challenge request to the foreign agent.

7. The foreign agent sends back a challenge reply to the home agent.

   This reply includes an encrypted version of the Ascend-Home-Agent-Password value in the mobile node's RADIUS profile. This password must match the value of the home agent's Password parameter in the Ethernet > Mod Config > ATMP Options menu.

8. The home agent returns a RegisterReply with a number that identifies the tunnel.

   If registration fails, the home agent logs a message and the foreign agent disconnects the mobile node. If registration succeeds, the MAX creates a tunnel between the foreign agent and the home agent. At this point, the mobile node connects to the home network as though it had dialed locally, and can transfer data across the tunnel.

9. When the mobile node disconnects from the foreign agent, the foreign agent sends a DeregisterRequest to the home agent to close down the tunnel.

   The foreign agent can send its request a maximum of ten times, or until it receives a DeregisterReply. If the foreign agent receives packets for a mobile node whose connection has gone down, the foreign agent silently discards the packets.

Router mode

In the case of routing an IPX packet from the mobile node, the home agent must see the mobile node as connected to another IPX network. ATMP adds this virtual IPX network to the home agent's routing table based on the IPX attributes it receives from the foreign agent. The RADIUS user profile for the mobile node must specify the IPX network number unique within the enterprise.

Gateway mode

Overview of RADIUS attributes for ATMP

Table 7-2. RADIUS attributes required for ATMP connections

For information on non-ATMP attributes

Overview of MAX configuration parameters for ATMP

Table 7-3. ATMP parameters

For information on non-ATMP parameters

Setting up a tunnel in router mode for an IP network

Figure 7-2 shows a tunnel in which the home agent is in router mode.

Figure 7-2. ATMP router mode

When the home agent is in router mode, it receives GRE-encapsulated IP packets from the foreign agent, strips off the encapsulation, and passes the packets to its bridge/router software. It also adds a host route to the mobile node in its routing table.

This section describes how to set up a foreign agent and a home agent in router mode.

Configuring the foreign agent in router mode

• Configure ATMP in the foreign agent's Ethernet profile using the MAX configuration interface.

• Configure the foreign agent to authenticate via RADIUS.

• Create an incoming RADIUS user profile for the mobile node.

• For the foreign agent, configure an outgoing RADIUS user profile with IP routing to the home agent.

  Instead of an outgoing RADIUS user profile, you can set up a Connection profile to the home agent. For details, see the MAX ISP and Telecommuting Configuration Guide.

1. Open the Ethernet menu.

2. Open the Mod Config menu.

3. Open the ATMP Options menu.

4. Set these parameters:

   ATMP options...
           ATMP Mode=Foreign
           Type=N/A
           Password=N/A
           UDP Port=5150
   

5. Save your changes.

Configuring an incoming RADIUS profile for the mobile node

1. On the first line of the profile, specify the User-Name and Password attributes:

2. To specify the type of encapsulation in use for the call, set the Framed-Protocol attribute.

3. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

4. To specify the mobile node's IP address, set the Framed-Address attribute, and optionally, the Framed-Netmask attribute.

5. Set the Ascend-Primary-Home-Agent attribute.

   This attribute specifies the first home agent the foreign agent tries to reach when setting up the ATMP tunnel, and indicates the UDP port the foreign agent uses for the link.

   Specify the primary home agent using this syntax:

   Ascend-Primary-Home-Agent="hostname | ip_address [:udp_port]"

   • The hostname argument indicates the home agent's symbolic hostname.

   • The ip_address argument indicates the home agent's IP address in dotted decimal notation. Specify an IP address if no DNS server exists for the home agent. You can specify a hostname or an IP address, but not both.

   • The optional udp_port argument indicates the UDP port on which the foreign agent communicates with the home agent. The default value is 5150.

   • The colon (:) separates the hostname or IP address from the UDP port specification.

6. Set the Ascend-Secondary-Home-Agent attribute.

   This attribute specifies the secondary home agent the foreign agent tries to reach when the primary home agent (specified by Ascend-Primary-Home-Agent) is unavailable. The attribute also indicates the UDP port the foreign agent uses for the link.

7. For the Ascend-Home-Agent-Password attribute, specify the home agent's password.

   You must specify the same password indicated by the Password parameter in the Ethernet > Mod Config > ATMP Options menu on the home agent.

8. To specify the UDP port for ATMP operation, set the Ascend-Home-Agent-UDP-Port attribute.

   By default, ATMP uses UDP port 5150 for communicating ATMP messages between the foreign and home agents. Both the foreign and home agent must agree on the UDP port number. If you specify a non-default UDP port number in one unit's configuration, make sure that the other end of the tunnel specifies the same number.

   You need not specify a value for Ascend-Home-Agent-UDP-Port if you specify a UDP port number for Ascend-Primary-Home-Agent or Ascend-Secondary-Home Agent, or if you accept the default for any of these attributes.

Node1 Password="Top-secret"

      Ascend-Metric=2,

      Framed-Protocol=PPP,

      Ascend-IP-Route=Route-IP-Yes,

      Framed-Address=200.1.1.2,

      Framed-Netmask=255.255.255.0,

      Ascend-Primary-Home-Agent=10.8.9.10,

      Ascend-Home-Agent-Password="private"

Configuring an outgoing RADIUS user profile for the foreign agent

1. On the first line of the user profile, specify the User-Name, Password, and User-Service attributes.

   Set the attributes on the first line in this way:

   • For the User-Name attribute, specify the name of the foreign agent, appending -Out to the user name.

   • Set Password="Ascend".

   • Set User-Service=Dialout-Framed-User. This setting ensures that RADIUS cannot use the profile for authentication of an incoming call.

   For example, you might enter this first line in the profile for the foreign agent Alameda:

   Alameda-Out Password="Ascend", User-Service=Dialout-Framed-User
   

2. On the second line of the user profile, set the User-Name attribute to the name of the foreign agent.

3. To specify the encapsulation type in use on the line, set the Framed-Protocol attribute.

4. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

5. If the receiving end (the home agent) requires an IP address, and does not assign one dynamically, specify the foreign agent's IP address using the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

   The values of the Framed-Address and Framed-Netmask attributes for the local MAX must match the value of the NAS-Identifier attribute on the home agent. If there is no match, the home agent clears the call.

6. To indicate the phone number the MAX dials to reach the home agent, set the Ascend- Dial-Number attribute.

7. To specify the type of phone number the MAX dials, set the Ascend-PRI-Number-Type attribute.

8. Set the Ascend-Send-Auth attribute.

   The Ascend-Send-Auth attribute specifies the authentication protocol that the MAX requests when initiating a connection using PPP or MP+ encapsulation. The answering side of the connection determines which authentication protocol, if any, the connection uses.

9. If you request PAP or CHAP authentication, you must also specify a password using Ascend-Send-Secret or Ascend-Send-Passwd.

   Both of these attributes specify the password that the MAX sends to the remote end of a connection on outgoing calls. If the value you specify for Ascend-Send-Secret or Ascend-Send-Password does not match the value of the remote end's Ascend-Receive-Secret attribute (in a RADIUS user profile) or Recv PW parameter (in a Connection profile), the remote system rejects the call.

   Use Ascend-Send-Passwd only if your version of the MAX does not support Ascend-Send-Secret.

Alameda-Out Password="Ascend", User-Service=Dialout-Framed-User

     User-Name="Alameda",

     Framed-Protocol=PPP,

     Ascend-Route-IP=Route-IP-Yes,

     Framed-Address=10.0.100.1,

     Framed-Netmask=255.255.255.0,

     Ascend-Metric=2,

     Framed-Routing=None,

     Ascend-Idle-Limit=30,

     Ascend-Dial-Number=1-800-555-5555,

     Ascend-PRI-Number-Type=National-Number,

     Ascend-Send-Auth=Send-Auth-PAP,

     Ascend-Send-Secret="Password1"

• Configure ATMP in the home agent's Ethernet profile using the MAX configuration interface.

• For the home agent, configure an outgoing RADIUS user profile with IP routing to the foreign agent.

  Instead of an outgoing RADIUS user profile, you can set up a Connection profile to the foreign agent. For details, see the MAX ISP and Telecommuting Configuration Guide.

• Ensure that other hosts or networks can route to the mobile node.

1. Open the Ethernet menu.

2. Open the Mod Config menu.

3. Open the ATMP Options menu.

4. Set these parameters:

   ATMP options...
           ATMP Mode=Home
           Type=Router
           Password=private
           UDP Port=5150
   

   The value you specify for Password must match the value of the Ascend-Home-Agent-Password attribute in the mobile node's RADIUS user profile. All mobile node profiles that access this home agent must specify the same password for Ascend-Home-Agent-Password.

5. Save your changes.

1. On the first line of the user profile, specify the User-Name, Password, and User-Service attributes.

   Set the attributes on the first line in this way:

   • For the User-Name attribute, specify the name of the home agent, appending -Out to the user name.

   • Set Password="Ascend".

   • Set User-Service=Dialout-Framed-User. This setting ensures that RADIUS cannot use the profile for authentication of an incoming call.

   For example, you might enter this first line in the profile for the home agent Boston:

   Boston-Out Password="Ascend", User-Service=Dialout-Framed-User
   

2. On the second line of the user profile, specify the name of the home agent by indicating a value for the User-Name attribute.

3. To specify the encapsulation type in use on the line, set the Framed-Protocol attribute.

4. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

5. If the receiving end (the foreign agent) requires an IP address, and does not assign one dynamically, specify the home agent's IP address using the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

   The values of the Framed-Address and Framed-Netmask attributes for the local MAX must match the value of the NAS-Identifier attribute on the foreign agent. If there is no match, the home agent clears the call.

6. To indicate the phone number the MAX dials to reach the foreign agent, set the Ascend- Dial-Number attribute.

7. To specify the type of phone number the MAX dials, set the Ascend-PRI-Number-Type attribute.

8. Set the Ascend-Send-Auth attribute.

9. If you request PAP or CHAP authentication, you must also specify a password using Ascend-Send-Secret or Ascend-Send-Passwd.

Boston-Out Password="Ascend", User-Service=Dialout-Framed-User

     User-Name="Boston",

     Framed-Protocol=PPP,

     Ascend-Route-IP=Route-IP-Yes,

     Framed-Address=10.0.100.1,

     Framed-Netmask=255.255.255.0,

     Ascend-Metric=2,

     Framed-Routing=None,

     Ascend-Idle-Limit=30,

     Ascend-Dial-Number=1-800-555-1111,

     Ascend-PRI-Number-Type=National-Number,

     Ascend-Send-Auth=Send-Auth-PAP,

     Ascend-Send-Secret="Password1"

Table 7-4. Routing mechanisms

Setting up a tunnel in gateway mode for an IP network

Figure 7-3 shows an ATMP gateway mode setup:

Figure 7-3. ATMP gateway mode

When the home agent is in gateway mode, it receives GRE-encapsulated IP packets from the foreign agent, strips off the encapsulation, and passes the packets across a nailed-up WAN connection to the home network.

To enable hosts and routers on the home network to reach the mobile node, you must configure a static route on the Customer Premises Equipment (CPE) router on the home network (not on the home agent). The static route must specify the home agent as the route to the mobile node. For information on setting up static IP routes, see Configuring static IP routes.

Configuring the foreign agent in gateway mode

• Configure ATMP in the foreign agent's Ethernet profile using the MAX configuration interface.

• Configure the foreign agent to authenticate via RADIUS.

• Create an incoming RADIUS user profile for the mobile node.

• For the foreign agent, configure an outgoing RADIUS user profile with IP routing to the home agent.

  Instead of an outgoing RADIUS user profile, you can set up a Connection profile to the home agent. For details, see the MAX ISP and Telecommuting Configuration Guide.

1. Open the Ethernet menu.

2. Open the Mod Config menu.

3. Open the ATMP Options menu.

4. Set these parameters:

   ATMP options...
           ATMP Mode=Foreign
           Type=N/A
           Password=N/A
           UDP Port=5150
   

5. Save your changes

Configuring an incoming RADIUS user profile for the mobile node

1. On the first line of the profile, specify the User-Name and Password attributes:

2. To specify the type of encapsulation in use for the call, set the Framed-Protocol attribute.

3. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

4. To specify the mobile node's IP address, set the Framed-Address attribute, and optionally, the Framed-Netmask attribute.

5. Set the Ascend-Primary-Home-Agent attribute.

   This attribute specifies the first home agent the foreign agent tries to reach when setting up the ATMP tunnel, and indicates the UDP port the foreign agent uses for the link.

   Specify the primary home agent using this syntax:

   Ascend-Primary-Home-Agent="hostname | ip_address [:udp_port]"

   • The hostname argument indicates the home agent's symbolic hostname.

   • The ip_address argument indicates the home agent's IP address in dotted decimal notation. Specify an IP address if no DNS server exists for the home agent. You can specify a hostname or an IP address, but not both.

   • The optional udp_port argument indicates the UDP port on which the foreign agent communicates with the home agent.
     The default value is 5150.

     The colon (:) separates the hostname or IP address from the UDP port specification.

6. Set the Ascend-Secondary-Home-Agent attribute.

   This attribute specifies the secondary home agent the foreign agent tries to reach when the primary home agent (specified by Ascend-Primary-Home-Agent) is unavailable. The attribute also indicates the UDP port the foreign agent uses for the link.

7. For the Ascend-Home-Agent-Password attribute, specify the home agent's password.

   You must specify the same password indicated by the Password parameter in the Ethernet > Mod Config > ATMP Options menu on the home agent.

8. To identify the home agent's resident Connection profile to the home network, set the Ascend-Home-Network-Name attribute.

   The Connection profile must have the ATMP Gateway parameter set to Yes in the Session Options submenu.

9. To specify the UDP port for ATMP operation, set the Ascend-Home-Agent-UDP-Port attribute.

   By default, ATMP uses UDP port 5150 for communicating ATMP messages between the foreign and home agents. Both the foreign and home agent must agree on the UDP port number. If you specify a non-default UDP port number in one unit's configuration, make sure that the other end of the tunnel specifies the same number.

   You need not specify a value for Ascend-Home-Agent-UDP-Port if you specify a UDP port number for Ascend-Primary-Home-Agent or Ascend-Secondary-Home Agent, or if you accept the default for any of these attributes.

Node3 Password="Top-secret"

   Ascend-Metric=2,

   Framed-Protocol=PPP,

   Ascend-Route-IP=Route-IP-Yes,

   Framed-Address=200.1.1.2,

   Framed-Netmask=255.255.255.0,

   Ascend-Primary-Home-Agent=10.8.9.10,

   Ascend-Home-Agent-Password="private", 

   Ascend-Home-Network-Name="Homenet"

Configuring an outgoing RADIUS user profile for the foreign agent

1. On the first line of the user profile, specify the User-Name, Password, and User-Service attributes.

   Set the attributes on the first line in this way:

   • For the User-Name attribute, specify the name of the foreign agent, appending -Out to the user name.

   • Set Password="Ascend".

   • Set User-Service=Dialout-Framed-User. This setting ensures that RADIUS cannot use the profile for authentication of an incoming call.

   For example, you might enter this first line in the profile for the foreign agent Alameda:

   Alameda-Out Password="Ascend", User-Service=Dialout-Framed-User

2. On the second line of the user profile, set the User-Name attribute to the name of the foreign agent.

3. To specify the encapsulation type in use on the line, set the Framed-Protocol attribute.

4. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

5. If the receiving end (the home agent) requires an IP address, and does not assign one dynamically, specify the foreign agent's IP address using the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

   The values of the Framed-Address and Framed-Netmask attributes for the local MAX must match the value of the NAS-Identifier attribute for the home agent. If there is no match, the home agent clears the call.

6. To indicate the phone number the MAX dials to reach the home agent, set the Ascend- Dial-Number attribute.

7. To specify the type of phone number the MAX dials, set the Ascend-PRI-Number-Type attribute.

8. Set the Ascend-Send-Auth attribute.

   The Ascend-Send-Auth attribute specifies the authentication protocol that the MAX requests when initiating a connection using PPP or MP+ encapsulation. The answering side of the connection determines which authentication protocol, if any, the connection uses.

9. If you request PAP or CHAP authentication, you must also specify a password using Ascend-Send-Secret or Ascend-Send-Passwd.

   Both of these attributes specify the password that the MAX sends to the remote end of a connection on outgoing calls. If the value you specify for Ascend-Send-Secret or Ascend-Send-Password does not match the value of the remote end's Ascend-Receive-Secret attribute (in a RADIUS user profile) or Recv PW parameter (in a Connection profile), the remote system rejects the call.

   Use Ascend-Send-Passwd only if your version of the MAX does not support Ascend-Send-Secret.

Alameda-Out Password="Ascend", User-Service=Dialout-Framed-User

User-Name="Alameda",

        Framed-Protocol=PPP,

        Framed-Address=10.0.100.1,

        Framed-Netmask=255.255.255.0,

        Ascend-Route-IP=Route-IP-Yes,

        Ascend-Metric=2,

        Framed-Routing=None,

        Ascend-Idle-Limit=30,

        Ascend-Dial-Number=1-800-555-5555,

        Ascend-PRI-Number-Type=National-Number,

        Ascend-Send-Auth=Send-Auth-PAP,

        Ascend-Send-Secret="Password1"

• Configure ATMP in the home agent's Ethernet profile using the MAX configuration interface.

• For the home agent, configure an outgoing RADIUS user profile to the foreign agent.

  Instead of an outgoing RADIUS user profile, you can set up a Connection profile to the foreign agent. For details, see the MAX ISP and Telecommuting Configuration Guide.

• Configure a nailed-up Connection profile to the home network using the MAX configuration interface.

  The Connection profile to the home network must be a resident profile. You cannot configure this profile in RADIUS.

1. Open the Ethernet menu.

2. Open the Mod Config menu.

3. Open the ATMP Options menu.

4. Set these parameters:

   ATMP options...
           ATMP Mode=Home
           Type=Gateway
           Password=private
           UDP Port=5150
   

   The value you specify for Password must match the value of the Ascend-Home-Agent-Password attribute in the mobile node's RADIUS user profile. All mobile node profiles that access this home agent must specify the same password for Ascend-Home-Agent-Password.

5. Save your changes.

1. On the first line of the user profile, specify the User-Name, Password, and User-Service attributes.

   Set the attributes on the first line in this way:

   • For the User-Name attribute, specify the name of the home agent, appending -Out to the user name.

   • Set Password="Ascend".

   • Set User-Service=Dialout-Framed-User. This setting ensures that RADIUS cannot use the profile for authentication of an incoming call.

   For example, you might enter this first line in the profile for the home agent Boston:

   Boston-Out Password="Ascend", User-Service=Dialout-Framed-User

2. On the second line of the user profile, specify the name of the home agent by indicating a value for the User-Name attribute.

3. To specify the encapsulation type in use on the line, set the Framed-Protocol attribute.

4. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

5. If the receiving end (the foreign agent) requires an IP address, and does not assign one dynamically, specify the home agent's IP address using the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

   The values of the Framed-Address and Framed-Netmask attributes for the local MAX must match the value of the NAS-Identifier attribute on the foreign agent. If there is no match, the home agent clears the call.

6. To indicate the phone number the MAX dials to reach the foreign agent, set the Ascend- Dial-Number attribute.

7. To specify the type of phone number the MAX dials, set the Ascend-PRI-Number-Type attribute.

8. Set the Ascend-Send-Auth attribute.

9. If you request PAP or CHAP authentication, you must also specify a password using Ascend-Send-Secret or Ascend-Send-Passwd.

Boston-Out Password="Ascend", User-Service=Dialout-Framed-User

     User-Name="Boston",

     Framed-Protocol=PPP,

     Ascend-Route-IP=Route-IP-Yes,

     Framed-Address=10.0.100.1,

     Framed-Netmask=255.255.255.0,

     Ascend-Metric=2,

     Framed-Routing=None,

     Ascend-Idle-Limit=30,

     Ascend-Dial-Number=1-800-555-1111,

     Ascend-PRI-Number-Type=National-Number,

     Ascend-Send-Auth=Send-Auth-PAP,

     Ascend-Send-Secret="Password1"

1. Open the Ethernet menu.

2. Open the Connections menu.

3. Open a Connection profile.

4. For the Station parameter, specify the name of the home agent.

   The value you enter becomes the name of the Connection profile. The name of this Connection profile must match the name specified by the Ascend-Home-Network-Name attribute in the mobile node's RADIUS user profile.

5. To activate the profile, set Active=Yes.

6. Set Encaps=FR.

7. To specify the type of phone number the MAX dials, set the PRI # Type parameter

8. Set Route IP=Yes.

9. Set Bridge=No.

10. In the Encaps Options submenu, set the FR Prof parameter to specify the name of the Frame Relay profile this connection uses.

11. For the DLCI parameter, specify the name of the DLCI used for the connection.

12. In the IP Options submenu, specify the IP address of the home agent.

13. In the Session Options submenu, set ATMP Gateway=Yes.

14. Close the Connection profile, saving your changes.

Station=homenet

Active=Yes

Encaps=FR

PRI # Type=National

Dial #=N/A

Calling #=N/A

Route IP=Yes

Route IPX=N/A

Bridge=No

Dial brdcast=N/A

Encaps options...

        FR Prof=Pac Bell

        DLCI=18

IP options...

        LAN Adrs=10.9.8.32/24

Session options...

        ATMP Gateway=Yes

Tunneling ATMP between two IP networks

When configuring ATMP for LAN-to-LAN connectivity, you follow the same steps as when you configure ATMP for a dial-in user, keeping in mind the additional instructions in this section.

For details on configuring a tunnel when the home agent is a router, see Setting up a tunnel in router mode for an IP network. For details on configuring a tunnel when the home agent is a gateway, see Setting up a tunnel in gateway mode for an IP network.

Specifying the mobile node's subnet mask

For example, to connect to a home network whose router has the address 10.168.3.1/28, the foreign agent's RADIUS entry for the remote router must contain these lines:

Framed-Address=10.168.6.21,

Framed-Netmask=255.255.255.240,

• The all zeros (network base) address for the subnet is 10.168.6.16.

  The network base address represents the network cable itself, which is always address 0 (zero).

• The all ones (broadcast) address for the subnet is 10.168.6.31.

  The broadcast address of any subnet is always all ones.

• The remaining host address range for the LAN is10.168.6.17 - 10.168.6.30

  In this example, the mobile node router has this address 10.168.6.21/28.

Home agent in router mode

If the home agent does not connect directly to the home network, the situation is the same as for any remote network-you must enable the router to learn about routes through dynamic updates, or you must configure static routes.

The mobile node always requires static routes to the home agent as well as to other networks it reaches through the home agent. (It cannot learn routes from the home agent.)

Home agent in gateway mode

In addition, because the mobile node and the home agent do not exchange routing information, the mobile node's LAN can only support local subnets that fall within the network specified in the RADIUS entry.

For example, a mobile node router at the address 10.168.6.21/28 could support two subnets with a subnet mask of 255.255.255.248-one at the 10.168.6.16 address and the other at the 10.168.6.24 address. The answering unit on the home network would have only one route to the router itself (10.168.6.21/28).

Tunneling IPX across the Internet

You can configure the home agent in an IPX routing connection in ATMP router mode or gateway mode, as defined in ATMP router and gateway modes. The example in this section shows router mode.

Configuring the foreign agent

To configure the foreign agent, you must perform these tasks:

• Configure ATMP in the foreign agent's Ethernet profile using the MAX configuration interface.

• Configure the foreign agent to authenticate via RADIUS.

• Create an incoming RADIUS user profile for the mobile node.

• For the foreign agent, configure an outgoing RADIUS user profile with IP routing to the home agent.

  Instead of an outgoing RADIUS user profile, you can set up a Connection profile to the home agent. For details, see the MAX ISP and Telecommuting Configuration Guide.

1. Open the Ethernet menu.

2. Open the Mod Config menu.

3. Open the ATMP Options menu.

4. Set these parameters:

ATMP options...

        ATMP Mode=Foreign

        Type=N/A

        Password=N/A

        UDP Port=5150

1. Save your changes.

Configuring an incoming RADIUS user profile for the mobile node

1. On the first line of the profile, specify the User-Name and Password attributes:

2. To specify the type of encapsulation in use for the call, set the Framed-Protocol attribute.

3. To enable IPX routing, set Ascend-Route-IPX=Route-IPX-Yes.

4. To specify whether the mobile node is an IPX router or a device dialing in without an Ethernet interface, see the IPX-Peer-Dialin attribute.

5. To specify a virtual IPX network number that is unique within the enterprise, set the Framed-IPX-Network attribute.

   You must specify the IPX network number in decimal format, not hexadecimal. (IPX network numbers are typically specified in hexadecimal.) It must be unique in the IPX routing domain. All mobile nodes logging into an IPX home network through the same foreign agent typically use the same Framed-IPX-Network number.

6. To assign the mobile node a unique IPX node address on the network specified by Framed-IPX-Network, set the Ascend-IPX-Node-Addr attribute.

   The number you indicate must be unique for each mobile node on the virtual IPX network. Specify the number as a 12-digit string enclosed in double quotes. This value completes the IPX address of a mobile node.

7. Set the Ascend-Primary-Home-Agent attribute.

   This attribute specifies the first home agent the foreign agent tries to reach when setting up the ATMP tunnel, and indicates the UDP port the foreign agent uses for the link.

   Specify the primary home agent using this syntax:

   Ascend-Primary-Home-Agent="hostname | ip_address [:udp_port]"

   • The hostname argument indicates the home agent's symbolic hostname.

   • The ip_address argument indicates the home agent's IP address in dotted decimal notation. Specify an IP address if no DNS server exists for the home agent. You can specify a hostname or an IP address, but not both.

   • The optional udp_port argument indicates the UDP port on which the foreign agent communicates with the home agent. The default value is 5150.

   • The colon (:) separates the hostname or IP address from the UDP port specification.

8. Set the Ascend-Secondary-Home-Agent attribute.

   This attribute specifies the secondary home agent the foreign agent tries to reach when the primary home agent (specified by Ascend-Primary-Home-Agent) is unavailable. The attribute also indicates the UDP port the foreign agent uses for the link.

9. For the Ascend-Home-Agent-Password attribute, specify the home agent's password.

   You must specify the same password indicated by the Password parameter in the Ethernet > Mod Config > ATMP Options menu on the home agent.

10. To identify the home agent's resident Connection profile to the home network, set the Ascend-Home-Network-Name attribute.

    The named Connection profile must have the ATMP Gateway parameter set to Yes in the Session Options submenu.

11. To specify the UDP port for ATMP operation, set the Ascend-Home-Agent-UDP-Port attribute.

    By default, ATMP uses UDP port 5150 for communicating ATMP messages between the foreign and home agents. Both the foreign and home agent must agree on the UDP port number. If you specify a non-default UDP port number in one unit's configuration, make sure that the other end of the tunnel specifies the same number.

    You need not specify a value for Ascend-Home-Agent-UDP-Port if you specify a UDP port number for Ascend-Primary-Home-Agent or Ascend-Secondary-Home Agent, or if you accept the default for any of these attributes.

Node2 Password="Top-secret"

   Ascend-Metric=2,

   Framed-Protocol=PPP,

   Ascend-Route-IPX=Route-IPX-Yes,

   Ascend-IPX-Peer-Mode=IPX-Peer-Dialin,

   Framed-IPX-Network=4999,

   Ascend-IPX-Node-Addr="001122334567",

   Ascend-Route-IPX=Route-IPX-Yes

   Ascend-Primary-Home-Agent=10.8.9.10,

   Ascend-Home-Agent-Password="private", 

   Ascend-Home-Network-Name="Homenet"

Configuring an outgoing RADIUS user profile for the foreign agent

1. On the first line of the user profile, specify the User-Name, Password, and User-Service attributes.

   Set the attributes on the first line in this way:

   • For the User-Name attribute, specify the name of the foreign agent, appending -Out to the user name.

   • Set Password="Ascend".

   • Set User-Service=Dialout-Framed-User. This setting ensures that RADIUS cannot use the profile for authentication of an incoming call.

   For example, you might enter this first line in the profile for the foreign agent Alameda:

   Alameda-Out Password="Ascend", User-Service=Dialout-Framed-User
   

2. On the second line of the user profile, set the User-Name attribute to the name of the foreign agent.

3. To specify the encapsulation type in use on the line, set the Framed-Protocol attribute.

4. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

5. If the receiving end (the home agent) requires an IP address, and does not assign one dynamically, specify the foreign agent's IP address using the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

   The values of the Framed-Address and Framed-Netmask attributes for the local MAX must match the value of the NAS-Identifier attribute on the home agent. If there is no match, the home agent clears the call.

6. To indicate the phone number the MAX dials to reach the home agent, set the Ascend- Dial-Number attribute.

7. To specify the type of phone number the MAX dials, set the Ascend-PRI-Number-Type attribute.

8. Set the Ascend-Send-Auth attribute.

   The Ascend-Send-Auth attribute specifies the authentication protocol that the MAX requests when initiating a connection using PPP or MP+ encapsulation. The answering side of the connection determines which authentication protocol, if any, the connection uses.

9. If you request PAP or CHAP authentication, you must also specify a password using Ascend-Send-Secret or Ascend-Send-Passwd.

   Both of these attributes specify the password that the MAX sends to the remote end of a connection on outgoing calls. If the value you specify for Ascend-Send-Secret or Ascend-Send-Password does not match the value of the remote end's Ascend-Receive-Secret attribute (in a RADIUS user profile) or Recv PW parameter (in a Connection profile), the remote system rejects the call.

   Use Ascend-Send-Passwd only if your version of the MAX does not support Ascend-Send-Secret.

Alameda-Out Password="Ascend", User-Service=Dialout-Framed-User

     User-Name="Alameda",

     Framed-Protocol=PPP,

     Ascend-Route-IP=Route-IP-Yes, 

     Framed-Address=10.0.100.1,

     Framed-Netmask=255.255.255.0,

     Ascend-Metric=2,

     Framed-Routing=None,

     Ascend-Idle-Limit=30,

     Ascend-Dial-Number=1-800-555-5555,

     Ascend-PRI-Number-Type=National-Number,

     Ascend-Send-Auth=Send-Auth-PAP,

     Ascend-Send-Secret="Password1"

To configure the home agent in router mode, you must perform these tasks:

• Configure ATMP in the home agent's Ethernet profile using the MAX configuration interface.

• Configure an outgoing RADIUS user profile to the foreign agent.

  Instead of an outgoing RADIUS user profile, you can set up a Connection profile to the foreign agent. For details, see the MAX ISP and Telecommuting Configuration Guide.

1. Open the Ethernet menu.

2. Open the Mod Config menu.

3. Open the ATMP Options menu.

4. Set these parameters:

   ATMP options...
           ATMP Mode=Home
           Type=Router
           Password=private
           UDP Port=5150
   

   The value you specify for Password must match the value of the Ascend-Home-Agent-Password attribute in the mobile node's RADIUS user profile. All mobile node profiles that access this home agent must specify the same password for Ascend-Home-Agent-Password.

5. Save your changes.

1. On the first line of the user profile, specify the User-Name, Password, and User-Service attributes.

   Set the attributes on the first line in this way:

   • For the User-Name attribute, specify the name of the home agent, appending -Out to the user name.

   • Set Password="Ascend".

   • Set User-Service=Dialout-Framed-User. This setting ensures that RADIUS cannot use the profile for authentication of an incoming call.

   For example, you might enter this first line in the profile for the home agent Boston:

   Boston-Out Password="Ascend", User-Service=Dialout-Framed-User
   

2. On the second line of the user profile, specify the name of the home agent by indicating a value for the User-Name attribute.

3. To specify the encapsulation type in use on the line, set the Framed-Protocol attribute.

4. Enable IP routing for the profile by setting Ascend-Route-IP=Route-IP-Yes.

5. If the receiving end (the foreign agent) requires an IP address, and does not assign one dynamically, specify the home agent's IP address using the Framed-Address attribute (and, optionally, the Framed-Netmask attribute).

   The values of the Framed-Address and Framed-Netmask attributes for the local MAX must match the value of the NAS-Identifier attribute on the foreign agent. If there is no match, the home agent clears the call.

6. To indicate the phone number the MAX dials to reach the foreign agent, set the Ascend- Dial-Number attribute.

7. To specify the type of phone number the MAX dials, set the Ascend-PRI-Number-Type attribute.

8. Set the Ascend-Send-Auth attribute.

9. If you request PAP or CHAP authentication, you must also specify a password using Ascend-Send-Secret or Ascend-Send-Passwd.

Denver-Out Password="Ascend", User-Service=Dialout-Framed-User

     User-Name="Denver",

     Framed-Protocol=PPP,

     Ascend-Route-IP=Route-IP-Yes,

     Framed-Address=10.0.100.1,

     Framed-Netmask=255.255.255.0,

     Ascend-Metric=2,

     Framed-Routing=None,

     Ascend-Idle-Limit=30,

     Ascend-Dial-Number=1-800-555-7777,

     Ascend-PRI-Number-Type=National-Number,

     Ascend-Send-Auth=Send-Auth-PAP,

     Ascend-Send-Secret="Password1"

Setting up the MAX as a multi-mode agent

Figure 7-4. The MAX acting as a home agent and a foreign agent

To configure the MAX to act as a foreign agent and home agent on a tunnel-by-tunnel basis, follow these steps:

1. Open the Ethernet menu.

2. Open the Mod Config menu.

3. Open the ATMP Options menu.

4. Set ATMP Mode=Both.

   This setting indicates that the MAX will function as both a home agent and foreign agent on a tunnel-by-tunnel basis.

5. Set the Type parameter to Router or Gateway, as appropriate.

6. For the Password parameter, specify a password.

   The mobile node must specify this password only when the unit acts as its home agent.

7. Set SAP Reply to Yes or No.

   This parameter applies only when the unit is acting as a home agent. It enables or disables a home agent's ability to reply to the mobile node's IPX Nearest Server Query. If you set SAP Reply=Yes, the home agent replies to the mobile node's Nearest Server Query if it knows about a server on the home network. If you set SAP Reply=No, the home agent simply tunnels the mobile node's request to the home network.

8. For the UDP Port parameter, specify the UDP port or accept the default of 5150.

9. Save your changes.

Setting up ATMP to bypass a foreign agent

An ATMP-based RADIUS entry local to the home agent enables the mobile node to bypass a foreign agent connection, but it does not preclude a foreign agent. If both the home agent and the foreign agent have local RADIUS profiles for the mobile node, the node can choose between a direct connection or a tunneled connection through the foreign agent.

For information about how to set up a RADIUS user profile for the mobile node in router mode, see Configuring an incoming RADIUS profile for the mobile node. For information about how to set up a RADIUS user profile for the mobile node in gateway mode, see Configuring an incoming RADIUS user profile for the mobile node.

In this example, the RADIUS user profile authenticates a mobile NetWare client that connects directly to a home agent in gateway mode.

Mobile-IPX Password="unit"

        User-Service=Framed-User,

        Ascend-Route-IPX=Route-IPX-Yes,

        Framed-Protocol=PPP,

        Ascend-IPX-Peer-Mode=IPX-Peer-Dialin,

        Framed-IPX-Network=40000000,

        Ascend-IPX-Node-Addr=12345678,

        Ascend-Primary-Home-Agent=192.168.6.18,

        Ascend-Home-Network-Name="Dave's Max",

        Ascend-Home-Agent-Password="Pipeline"

Configuring call routing to PPTP servers

Creating tunnels on a per-user basis

While you can still use the Route Line n parameters to create tunnels on the basis of the T1 line, you can now create a tunnel on a per-user basis as well. In a RADIUS user profile, you specify the IP address or host name of a PPTP server. The profile creates a tunnel between the MAX and the PPTP server. When the name and password of an incoming call match the name and password in a RADIUS user profile set up for PPTP, the MAX creates the PPTP tunnel to the PPTP server.

The changes to PPTP functionality affect PPP connections and terminal-server users. This release includes the following new RADIUS attributes:

• Tunnel-Type (64)

• Tunnel-Medium-Type (65)

• Tunnel-Server-Endpoint (66)

• Tunnel-Client-Endpoint (67)

• Tunnel-ID (68)

When a PPP call comes in on any WAN line and the authentication process begins, the MAX will first check whether the line is a dedicated PPTP line (the same behavior as previously).

However, if the line is not a PPTP line, the MAX will check the data returned from RADIUS to determine whether:

• CLID or DNIS is supported

• the call is PPTP-based

Example RADIUS entries

CLID RADIUS entry

5105551212 Password = "Ascend-CLID"

        Tunnel-Server-Endpoint = "192.168.6.199",

        Tunnel-Type = PPTP,

        Tunnel-Medium-Type = IP

7894 Password = "Ascend-DNIS"

        Tunnel-Server-Endpoint = "eng-lab-199",

        Tunnel-Type = PPTP,

        Tunnel-Medium-Type = IP

Copyright © 1998, Ascend Communications, Inc. All rights reserved.