Configuring the Router to Obtain the LLID for a Subscriber

To configure the router to obtain the LLID for a subscriber:

1. Create an AAA profile that supports subscriber preauthentication.

   host1(config)#aaa profile preAuthLlid

   host1(config-aaa-profile)#pre-authenticate

   host1(config-aaa-profile)#exit

2. Define a RADIUS preauthentication server.

   host1(config)#radius pre-authentication server 10.10.10.1

   host1(config-radius)#key abc123

   host1(config-radius)#exit

3. Associate the AAA profile with the designated PPP interface.

   host1(config)#interface atm 4/3.101

   host1(config-subif)#ppp aaa-profile preAuthLlid

4. (Optional) Verify that preauthentication support is configured for the AAA profile.

   host1(config-subif)#run show aaa profile name PreAuthLlid
   preAuthLlid:
       atm nas-port-type: ADLSL-CAP
       ethernet nas-port-type: Cable
       profile-service-description: xyzService
       pre-authenticate 
       allow xyz.com
       deny default
       translate xyz1.com abc.com

   For information, see Setting Baselines for Remote Access.

5. (Optional) Verify configuration of the RADIUS preauthentication server.

   host1(config-subif)#run show radius pre-authentication servers
   
   

                  RADIUS Pre-Authentication Configuration
                  ---------------------------------------
                   Udp    Retry             Maximum    Dead
    IP Address     Port   Count   Timeout   Sessions   Time   Secret
   -------------   ----   -----   -------   --------   ----   ------
   10.10.10.1      1812   3       3         255        0      radius

   You can also display configuration information for preauthentication servers by using the show radius servers command. For information, see Setting Baselines for Remote Access.

6. (Optional) Display statistics for the RADIUS preauthentication server.

   To display preauthentication statistics, use the show radius pre-authentication statistics command. For information, see Setting Baselines for Remote Access.

   To display a count of preauthentication requests and responses, use the show aaa statistics command. For information, see Setting Baselines for Remote Access.

aaa profile

• Use to configure a new AAA profile.
• Example

  host1(config)#aaa profile boston123

• Use the no version to delete the AAA profile.
• See aaa profile

key

• Use from RADIUS Configuration mode to configure the secret for a RADIUS preauthentication server.
• The server secret is a text string used by RADIUS to encrypt the client and server authenticator field during exchanges between the router and a RADIUS preauthentication server. The router encrypts PPP PAP passwords using this text string.
• The default behavior is no server secret.
• Example

  host1(config-radius)#key gismo

• Use the no version to remove the secret.

  Note: The preauthentication request fails if you do not specify a key for the preauthentication server.

• See key

ppp aaa-profile

• Use to assign an AAA profile to static and dynamic, multilink and nonmultilink PPP interfaces.
• For more information about how to use this command, see ppp aaa-profile.
• Example

  host1(config-if)#ppp aaa-profile preAuth

• Use the no version to remove the AAA profile assignment.
• See ppp aaa-profile

pre-authenticate

• Use to configure an AAA profile to support RADIUS preauthentication.
• During preauthentication, the router sends an Access-Request message to a RADIUS preauthentication server to obtain an LLID for a subscriber. In response, the preauthentication server returns the LLID in the RADIUS Calling-Station-Id [31] attribute of an Access-Accept message.
• Example

  host1(config-aaa-profile)#pre-authenticate

• Use the no version to remove preauthentication support from the AAA profile.
• See pre-authenticate

radius pre-authentication server

• Use to specify the IP address of a RADIUS preauthentication server.
• This command accesses RADIUS Configuration mode, from which you can configure additional parameters for the RADIUS preauthentication server.
• Example

  host1(config)#radius pre-authentication server 10.10.10.2

• Use the no version to delete the instance of the RADIUS preauthentication server.
• See radius pre-authentication server

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.