Router is a Cisco 7206VXR, with NPE-G2 running 12.4(4)XD5. It is deployed as an LNS terminating PPPOE sessions. Everything worked fine for years, but we needed to upgrade to 12.2(2x)T. After the upgrade:
1. Cisco (1841) endpoints doing bonded adsl seem to re-connect just fine
2. All other adsl endpoints seem to 'fail'. Radius authentication is always "OK", but the same accounts keeps requesting authentication every other 5 seconds, so the OK-ed authentication does not seem to be making it back to the pppoe client. Radius is getting hammered with authentication requests, and it is giving an "Auth OK" response, but the LNS keeps re-submitting the authentication requests.
For these failing users, a "show vpdn history failure" on LNS reveals the following entries:
----------------------------
"User: [email protected], MID = 76
NAS: ba-autr01, IP address = 91.56.40.227, CLID = 12441
Gateway: lns1-dsl, IP address = 192.168.50.242, CLID = 20365
Log time: *Oct 28 19:40:19.907, Error repeat count: 3
Failure type: Call disconnected for administrative reasons
Failure reason: Result 2, Error 6, admin-reset/VPDN Admin Disconnect"
NAS: ba-autr01, IP address = 91.56.40.227, CLID = 12441
Gateway: lns1-dsl, IP address = 192.168.50.242, CLID = 20365
Log time: *Oct 28 19:40:19.907, Error repeat count: 3
Failure type: Call disconnected for administrative reasons
Failure reason: Result 2, Error 6, admin-reset/VPDN Admin Disconnect"
----------------------------
BTW, the LNS is on a private network, because it is fronted by another box that forwards the L2TP sessions. Worked fine with the old firmware. Relevant Cisco config on LNS looks like this:
-----------
aaa authentication ppp telcoVPDN group telcaRADIUS
aaa authorization network telcoVPDN group telcaRADIUS
aaa authorization auth-proxy default group telcaRADIUS
vpdn enable
vpdn multihop
vpdn logging
vpdn logging user
vpdn logging tunnel-drop
vpdn history failure table-size 50
!
vpdn-group telca-ADSL
! Default L2TP VPDN group
accept-dialin
protocol l2tp
virtual-template 1
lcp renegotiation always
l2tp tunnel password 7 XXXXXXXXX
ip pmtu
ip mtu adjust
interface Virtual-Template1
description telca-ADSL-STATIC
mtu 1492
ip unnumbered GigabitEthernet0/1.104
ip verify unicast reverse-path
no ip redirects
no ip proxy-arp
ip tcp adjust-mss 1420
no logging event link-status
no peer default ip address
ppp mtu adaptive
ppp authentication pap telcoVPDN
ppp authorization telcoVPDN
ppp accounting telcoVPDN
ppp chap refuse
ppp ipcp dns x.x.x.x x.x.x.x
ppp multilink
aaa authorization network telcoVPDN group telcaRADIUS
aaa authorization auth-proxy default group telcaRADIUS
vpdn enable
vpdn multihop
vpdn logging
vpdn logging user
vpdn logging tunnel-drop
vpdn history failure table-size 50
!
vpdn-group telca-ADSL
! Default L2TP VPDN group
accept-dialin
protocol l2tp
virtual-template 1
lcp renegotiation always
l2tp tunnel password 7 XXXXXXXXX
ip pmtu
ip mtu adjust
interface Virtual-Template1
description telca-ADSL-STATIC
mtu 1492
ip unnumbered GigabitEthernet0/1.104
ip verify unicast reverse-path
no ip redirects
no ip proxy-arp
ip tcp adjust-mss 1420
no logging event link-status
no peer default ip address
ppp mtu adaptive
ppp authentication pap telcoVPDN
ppp authorization telcoVPDN
ppp accounting telcoVPDN
ppp chap refuse
ppp ipcp dns x.x.x.x x.x.x.x
ppp multilink
-----------------------
Any ideas?
Dominic
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
