This chapter describes the Layer 2 tunneling (L2T) configuration and operational commands. L2T includes Layer 2 Tunneling Protocol (L2TP), Layer 2 Forwarding Protocol (L2F), and Point-to-Point Tunneling Protocol (PPTP). Sections in this chapter include:
To access the L2T interface configuration prompt:
Config> add device layer-2-tunneling Enter the number of Layer-2-Tunneling interfaces [1] Adding device as interface 8 Defaulting Data-link protocol to PPP Config> n 8 Session configuration L2T config: 8>
Table 57 summarizes the L2T interface configuration commands.
Enter these commands at the L2T Config n> prompt (where
n is the net number).
Table 57. L2 Tunneling Interface Configuration Commands
Command | Function | ||
---|---|---|---|
? (Help) | Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help". | ||
Disable | Disables outgoing calls. | ||
Enable | Enables outgoing calls. | ||
Encapsulator | Allows you to configure PPP parameters the L2T interface.
| ||
List | Displays information about the L2T interface. | ||
Set | Allows you to set various L2T interface parameters. | ||
Exit | Returns you to the previous command level. See "Exiting a Lower Level Environment". |
Use the disable command to disable outbound calls from the L2TP access concentrator (LAC).
Syntax:
Use the enable command to enable outbound calls from the L2TP access concentrator (LAC). This command should only be used with L2TP.
Syntax:
Example:
L2T 10> enable outbound-call-from-lac Outbound Call Type (ISDN)? [ISDN] Outbound calling address: 1234 Outbound calling subaddress: L2T 10>
Use the encapsulator command to configure the PPP parameters for the L2T interface.
Syntax:
This command is available only when a remote-hostname has been configured. For a list of commands available at the ppp-L2tp config>prompt, see Encapsulator.
Use the list command to display the state of the various L2T interface configuration parameters.
Syntax:
Layer-2-Tunneling Config>list CONNECTION TYPE ---------- ----- Connection Direction INBOUND Remote Tunnel Hostname *ANY*
Use the set command to configure the L2T interface operational parameters.
Syntax:
Default value: inbound
Valid range: 0 to 1024
Default value: 0
For an outbound tunnel, the hostname specifies a tunnel profile configured in the AAA subsystem. This should be the tunnel hostname that the peer uses to identify itself.
For an inbound tunnel, only tunnel peers that identify themselves by this hostname can connect to this interface.
Valid values: Any name from 1 to 64 ASCII characters
Default value: Name
To access the L2 tunneling feature configuration prompt:
Table 58 summarizes the L2 tunneling feature configuration commands
and the rest of this section explains the commands. Enter these
commands at the Layer-2-Tunneling Config> prompt.
Table 58. L2 Tunneling Feature Configuration Commands
Command | Function |
---|---|
? (Help) | Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help". |
Add | Adds L2 tunneling nets and peers. |
Disable | Disables L2 tunneling functions. |
Enable | Enables L2 tunneling functions. |
Encapsulator | Allows you to configure PPP parameters for all of the L2 tunneling nets that are not configured with a remote-hostname (ANY). |
List | Displays information about the L2 tunneling configuration. |
Set | Allows you to set buffers, the call receive window, and other L2 tunneling parameters. |
Exit | Returns you to the previous command level. See "Exiting a Lower Level Environment". |
Use the add command to add L2-Nets. One L2-Net is required for each concurrent PPP session that ends on this router. The end of a tunneled PPP session is the LNS end point of the tunnel.
Syntax:
Note: | This command can be entered entirely in lower case. The initial character is shown in upper case for clarity. |
Adds L2-Nets to the L2 tunneling configuration. One L2-Net is required for each concurrent PPP session that is to be terminated at this router. If this router is to be used strictly as an LAC, no virtual L2-Nets are necessary. When you enter this command, you are prompted for the number of additional nets and whether to add unnumbered IP addresses for each L2 net.
The number of additional nets refers to how many nets are automatically added at this time. These nets are in addition to any L2-Nets that already exist.
Adding unnumbered IP addresses for each L2-Net automatically adds unnumbered IP entries into the IP routing table for each of the L2-Nets. Unnumbered IP addresses are the preferred mode of operation. If you need numbered addresses for the L2-Nets, you can alter them in the IP protocol configuration environment (refer to the chapter entitled "Configuring IP" in the Protocol Configuration and Monitoring Reference Volume 1).
Use the disable command to disable L2 tunneling functions.
Syntax:
Use the enable command to enable L2 tunneling functions.
Syntax:
Use the encapsulator command to access the ppp-L2tp config> prompt in order to configure the PPP parameters for all Layer 2 Tunneling interfaces that are configured as inbound and *any* remote-hostname.
Syntax:
Use the list command to display the state of the various L2 tunneling configuration parameters.
Syntax:
Layer-2-Tunneling Config>list GENERAL ADMINISTRATION ------- -------------- L2TP = Enabled L2F = Disabled PPTP = Disabled Maximum number of tunnels = 20 Maximum number of calls (total) = 50 Buffers Requested = 300 CONTROL CHANNEL SETTINGS ------- ------- -------- Tunnel Auth = Enabled Tunnel Rcv Window = 4 Retransmit Retries = 6 Local Hostname = Host6 DATA CHANNEL SETTINGS ---- ------- -------- Force CHAP Challenge (extra security)= Disabled Hiding for PAP Attributes = Disabled Hardware Error Polling Period (Sec) = 120 Sequencing = Enabled MISCELLANEOUS ------------- SEND PROXY-LCP FROM LAC = Enabled SEND PROXY-AUTH FROM LAC = Enabled Fixed UDP Source Port (1701) = Enabled Fixed Source IP Address = Enabled
Use the set command to configure the L2 tunneling operational parameters.
Syntax:
Valid range: 1 to 4000
Default value: 900
Default value: 120 seconds.
Default value: None.
Default value: IBM
Valid range: 1 to 2500
Default value: 300
Valid range: 1 to 2500
Default value: 300
Valid range: 2 to 100
Default value: 6
Valid range: 1 to 100
Default value: 4
To access the L2 tunneling monitoring prompt:
This section summarizes and then describes the L2 tunneling monitoring commands. Enter the commands at the Layer-2-Tunneling Console> prompt.
Table 59 summarizes the L2 tunneling monitoring commands.
Table 59. L2 Tunneling Monitoring Commands
Command | Function |
---|---|
? (Help) | Displays all the commands available for this command level or lists the options for specific commands (if available). See "Getting Help". |
Call | Displays statistics and information about each call in progress. |
Kill | Ends a tunnel immediately. |
Memory | Displays the current L2 tunneling buffer allocation and use. |
Start | Starts a tunnel with another peer. |
Stop | Stops a tunnel and allows each peer to perform any needed administration. |
Tunnel | Displays statistics and information on each existing tunnel. |
Exit | Returns you to the previous command level. See "Exiting a Lower Level Environment". |
Use the call command to display call statistics and information.
Syntax:
Example:
Layer-2-Tunneling Console> call errors CallID | Serial # | ACK-timeout | Dropped pkts 56744 | 1 | 0 | 0
Example:
Layer-2-Tunneling Console> call physical-errors CallID | Serial# | CRC |framing| HW | buffer|timeout| align-| time since | | Errors| Errors|overrun|overrun| Errors| ment | updated 56744 | 1 | 0 | 0 | 0 | 0 | 0 | 0 |
Example:
Layer-2-Tunneling Console> call queue CallID | Serial # |Tx Win|Rx Win| Ns | Nr |Rx Q|Tx Q|priority| out Q 56744 | 1 | 4 | 4 | 100 | 200 | 0 | 0 | 0 | 0
Example:
Layer-2-Tunneling Console> call state CallID | Serial # | Net # | State | Time Since Chg | PeerID | TunnelID 56744 | 1 | 2 | Established | 00:00:00 | 345 | 45678
Example:
Layer-2-Tunneling Console> call statistics CallID | Serial # | Tx Pkts | Tx Bytes | Rx Pkts | Rx Bytes | RTT | ATO 56744 | 1 | 34 | 1056 | 45 | 1567 | 10 | 34
Use the kill to immediately end a tunnel. This command releases all of the local resources for a tunnel thereby forcing the end of the connection. No notification of the end of the tunnel is sent to the peer.
Note: | Use this command only if the stop command is unable to end a tunnel. |
Syntax:
Use the memory command to display L2TP's current memory utilization.
Syntax:
Layer-2-Tunneling Console> mem Number of layer-2-tunneling buffers: Requested = 2000, Total = 1200, Free = 1000
In this example, you configured 2000 buffers but were able to allocate only 1200. Currently, 200 buffers are in use leaving 1000 free.
Use the start command to start a tunnel with another peer.
Syntax:
(no parameters prompts you for hostname)
Use the stop command to stop a tunnel. Any required cleanup is completed before the tunnel ends.
Syntax:
Use the tunnel command to display statistics and information about all tunnels.
Syntax:
Example:
Layer-2-Tunneling Console> tunnel errors Tunnel ID | Type |ACK-timeouts 96785 | L2TP | 0 43690 | PPTP | 2 96785 | L2F | 0
Example:
Layer-2-Tunneling Console> tunnel peer Tunnel ID | Type | Peer ID | Peer Hostname 96785 | L2TP | 89777 | peer1 11264 | L2F | 46538 | peer2 34653 | L2F | 11209 | peer3 87511 | PPTP | 55377 | peer4
Example:
Layer-2-Tunneling Console> tunnel queue Tunnel ID | Type | Rx Win | Tx Win | Ns | Nr | Rx Q | Tx Q 96785 | L2TP | 4 | 4 | 5 | 6 | 0 | 0 76488 | L2F | 4 | 4 | 5 | 6 | 0 | 0 22209 | PPTP | 4 | 4 | 5 | 6 | 0 | 0
Example:
Layer-2-Tunneling Console> tunnel state Tunnel ID | Type | Peer ID | State | Time Since Chg | # Calls | Flags 17404 | PPTP | 0 | Established | 00:00:00 | 1 | 0 96785 | L2TP | 0 | Established | 00:02:05 | 2 | 0 38237 | L2F | 0 | Established | 00:00:00 | 1 | 0
Example:
Layer-2-Tunneling Console> tunnel statistics Tunnel ID | Type | Tx Pkts | Tx Bytes | Rx Pkts | Rx Bytes | RTT | ATO 96785 | L2TP | 4 | 78 | 5 | 89 | 10 | 31 96366 | L2F | 9344 | 34578 | 305 | 4300 | 10 | 31 12344 | PPTP | 24 | 478 | 115 | 2745 | 10 | 31
Example:
Layer-2-Tunneling Console> tunnel transport Tunnel ID | Type | Peer IP Address | UDP Src | UDP Dest 96785 | L2TP | 11.0.0.102 | 1056 | 1089 30000 | L2F | 11.0.0.104 | 1058 | 1090 45772 | PPTP | 11.4.4.027 | 1345 | 1020
This section describes dynamic reconfiguration (DR) as it affects Talk 6 and Talk 5 commands.
Layer 2 Tunneling supports the CONFIG (Talk 6) delete interface command with no restrictions.
Layer 2 Tunneling supports the GWCON (Talk 5) activate interface command with the following consideration:
There are no additional limitations over other PPP interfaces.
All Layer 2 Tunneling configuration changes are automatically activated
except the following:
Commands whose changes are not activated by the GWCON (Talk 5) activate interface command | ||
CONFIG, net, enable ccp
| ||
CONFIG, net, set lcp options (mru option)
|
Layer 2 Tunneling supports the GWCON (Talk 5) reset interface command with the following consideration:
There are no additional limitations over other PPP interfaces.
All Layer 2 Tunneling configuration changes are automatically activated
except the following:
Commands whose changes are not activated by the GWCON (Talk 5) reset interface command | ||
CONFIG, net, enable ccp
| ||
CONFIG, net, set lcp options (mru option)
|
Layer 2 Tunneling supports the following CONFIG commands that
immediately change the operational state of the device. These changes
are saved and are preserved if the device is reloaded, restarted, or you
execute a dynamically reconfigurable command.
Commands |
CONFIG, feature layer-2-tunneling, disable fixed-ip-source-address |
CONFIG, feature layer-2-tunneling, disable fixed-udp-source-port |
CONFIG, feature layer-2-tunneling, disable force-chap-challenge |
CONFIG, feature layer-2-tunneling, disable hiding-for-pap-attributes |
CONFIG, feature layer-2-tunneling, disable proxy-auth |
CONFIG, feature layer-2-tunneling, disable proxy-lcp |
CONFIG, feature layer-2-tunneling, disable sequencing |
CONFIG, feature layer-2-tunneling, disable tunnel-auth |
CONFIG, feature layer-2-tunneling, enable fixed-ip-source-address |
CONFIG, feature layer-2-tunneling, enable fixed-udp-source-port |
CONFIG, feature layer-2-tunneling, enable force-chap-challenge |
CONFIG, feature layer-2-tunneling, enable hiding-for-pap-attributes |
CONFIG, feature layer-2-tunneling, enable proxy-auth |
CONFIG, feature layer-2-tunneling, enable proxy-lcp |
CONFIG, feature layer-2-tunneling, enable sequencing |
CONFIG, feature layer-2-tunneling, enable tunnel-auth |
CONFIG, feature layer-2-tunneling, set error-check-period |
CONFIG, feature layer-2-tunneling, set host-lookup-password |
CONFIG, feature layer-2-tunneling, set local-hostname |
CONFIG, feature layer-2-tunneling, set transmit-retries |
CONFIG, feature layer-2-tunneling, set tunnel-rcv-window |
CONFIG, add tunnel-profile |
The following table describes the Layer 2 Tunneling configuration
commands that cannot be dynamically changed. To activate these
commands, you need to reload or restart the device.
Commands |
CONFIG, feature layer-2-tunneling, enable l2f |
CONFIG, feature layer-2-tunneling, enable l2tp |
CONFIG, feature layer-2-tunneling, enable pptp |
CONFIG, feature layer-2-tunneling, disable l2f |
CONFIG, feature layer-2-tunneling, disable l2tp |
CONFIG, feature layer-2-tunneling, disable pptp |
CONFIG, feature layer-2-tunneling, set buffers |
CONFIG, feature layer-2-tunneling, set max-calls |
CONFIG, feature layer-2-tunneling, set max-tunnels |