Using Domain Name Aliases

You can translate an original domain name to a new domain name via the translate command. The command allows you to create domain name aliases; that is, the grouping of multiple domain names into a single domain name. You can partition PPP subscribers with the same domain into separate domains, based on the PPP interface.

Note: Partitioning subscribers does not cause modification of a user’s name or domain.

When you use aliases, you greatly simplify the configuration process. When there are a large number of domains and you use aliases, it reduces the configuration volume, thus requiring less NVS and memory usage.

Example 1

In this example, an administrator wants to associate all subscribers of a PPP interface with a specific domain name.

1. Create an AAA profile.

   host1(config)#aaa profile forwardToXyz

2. Map the original domain name to the mapped domain name for domain map lookup.

   host1(config-aaa-profile)#translate default xyz.com

3. Associate the AAA profile with the designated PPP interface.

   host1(config-if)#ppp aaa-profile forwardToXyz

When configured as such, the following scenario is typical:

• PPP passes the AAA profile forwardToXyz to AAA in the authentication request.
• AAA performs the following tasks:
  • Receives the authentication request from PPP with the subscriber’s name morris@abc.com.
  • Parses the domain name abc.com and examines the specified AAA profile forwardToXyz.
  • Determines that the AAA profile forwardToXyz is valid.
  • Searches forwardToXyz for a match on the PPP subscriber’s domain name and finds no match.
  • Searches forwardToXyz for a match on the domain name default.
  • Finds a match and continues as normal using the domain name xyz.com.

    Note: If there is no matching entry in the AAA profile for the user’s domain name or for the domain name default, then AAA continues processing as if there were no AAA profile. If the user’s name does not contain a domain name, then AAA attempts to match to the domain name none in the AAA profile. If there is no entry for none, then AAA attempts to match for the domain name default in the AAA profile. If there is no entry for either none or default, then AAA continues processing as if there were no AAA profile.

Example 2

In this example, an administrator wants to use aliases; that is, to associate multiple domain names with a specific domain name and not allow other domain names.

1. Create an AAA profile.

   host1(config)#aaa profile toAbc

2. Map the original domain name to the mapped domain name for domain map lookup.

   host1(config-aaa-profile)#translate abc1.com abc.com

   host1(config-aaa-profile)#translate abc2.com abc.com

   host1(config-aaa-profile)#translate abc3.com abc.com

3. Specify the domain name you want to restrict.

   host1(config-aaa-profile)#deny default

4. Associate the AAA profile with the designated PPP interface.

   host1(config-if)#ppp aaa-profile toAbc

When configured as such, the following scenario is typical:

• PPP passes the AAA profile toAbc to AAA in the authentication request.
• AAA:
  • Receives the authentication request from PPP with the subscriber’s name jane@abc1.com
  • Parses the domain name abc1.com and examines the specified AAA profile toAbc
  • Determines that the AAA profile toAbc is valid
  • Searches toAbc for a match on the PPP subscriber’s domain name and finds a match
  • Continues as normal using the domain name abc.com

    Note: If there is no matching entry in the AAA profile for the user’s domain name or for the domain name default, then AAA continues processing as if there were no AAA profile. If the user’s name does not contain a domain name, then AAA attempts to match to the domain name none in the AAA profile. If there is no entry for none, then AAA attempts to match for the domain name default in the AAA profile. If there is no entry for either none or default, then AAA continues processing as if there were no AAA profile.

aaa profile

• Use to configure a new AAA profile.
• Example

  host1(config)#aaa profile boston123

• Use the no version to delete the AAA profile.
• See aaa profile

allow

• Use to specify the domain name(s) that you want to be allowed access to AAA authentication.
• This command does not indicate that the user will be granted access; it is simply the first access point to AAA authentication.
• Using this command does not implicitly deny all other domains.
• Example

  host1(config-aaa-profile)#allow xyz.com

• Use the no version to negate the command.
• Seeallow

deny

• Use to specify the domain name(s) that you want to be denied access to AAA authentication.
• Example

  host1(config-aaa-profile)#deny xyz.com

• Use the no version to negate the command.
• See deny

ppp aaa-profile

• Use to assign an AAA profile to static and dynamic, multilink and nonmultilink PPP interfaces.
• The PPP application associates the AAA profile with the interface and passes the AAA profile to AAA for authentication.
• If an AAA profile is deleted after it has been assigned to an interface, AAA will deny the authentication and log a message.
• When you remove an AAA profile, it does not remove any corresponding bindings between PPP interfaces or interface profiles and the AAA profile. If an AAA profile with the same name is added, the interface cannot authenticate until the AAA profile is reassigned.

  Note: Although an AAA profile and an interface profile have similar functionality, they are not related and should be treated differently.

• Example

  host1(config-if)#ppp aaa-profile westford24

• Use the no version to remove the AAA profile assignment.
• See ppp aaa-profile

translate

• Use to map the original domain name to the mapped domain name for domain map lookup.
• This command allows you to group multiple domain names into a single domain name (that is, to use aliases).
• You can use this command to partition PPP subscribers with the same domain into separate domains, based on the PPP interface. By doing this, you do not cause modification of the user’s name or domain.
• Example

  host1(config-aaa-profile)#translate abc.com xyz.com

• Use the no version to negate the command.
• See translate

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.