Cisco IOS VPDN Command Reference

l2f ignore-mid-sequence

Note Effective with Cisco Release 12.4(11)T, the l2f ignore-mid-sequence command is not available in
Cisco IOS software.

To configure the router to ignore multiplex ID (MID) sequence numbers for sessions in a Layer 2 Forwarding (L2F) tunnel, use the l2f ignore-mid-sequence command in VPDN group or VPDN template configuration mode. To remove the ability to ignore MID sequencing, use the no form of this command.

l2f ignore-mid-sequence

no l2f ignore-mid-sequence

Syntax Description

This command has no arguments or keywords.

Command Default

MID sequence numbers are not ignored.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

This command applies only to L2F initiated tunnels and control packets for initial link control protocol (LCP) tunnel negotiation.

This command is not required when both tunnel endpoints are Cisco equipment, and is required only if MID sequence numbering is not supported by third-party hardware.

Examples

The following example configures the VPDN group named group1 to ignore MID sequencing for L2F sessions between a Cisco router and a non-Cisco hardware device that does not support MID sequencing:

vpdn-group group1

 l2f ignore-mid-sequence

Related Commands

l2f tunnel busy timeout

Note Effective with Cisco Release 12.4(11)T, the l2f tunnel busy timeout command is not available in
Cisco IOS software.

To configure the amount of time that the router will wait before attempting to recontact a Layer 2 Forwarding (L2F) peer that was previously busy, use the l2f tunnel busy timeout command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2f tunnel busy timeout seconds

no l2f tunnel busy timeout

Syntax Description

Command Default

The router will wait 300 seconds before attempting to recontact a previously busy peer.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Examples

The following example configures the router to leave an L2F peer on the busy list for 90 seconds. This configuration affects only tunnels associated with the virtual private dialup network (VPDN) group named group1.

vpdn-group group1

 l2f tunnel busy timeout 90

Related Commands

l2f tunnel retransmit initial retries

Note Effective with Cisco Release 12.4(11)T, the l2f tunnel retransmit initial retries command is not available in Cisco IOS software.

To configure the number of times that the router will attempt to send the initial control packet for tunnel establishment before considering a Layer 2 Forwarding (L2F) peer busy, use the l2f tunnel retransmit initial retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2f tunnel retransmit initial retries number

no l2f tunnel retransmit initial retries

Syntax Description

Command Default

The router will send the initial control packet twice.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

This command can be used only if load sharing is enabled.

Examples

The following example configures a dial-in VPDN group on a network access server (NAS) to load balance calls between two tunnel servers, and to attempt to send the initial L2F control packet five times:

vpdn-group 1

 request-dialin

  protocol l2f

  domain cisco.com

!

 initiate-to ip 172.16.0.1 priority 1

 initiate-to ip 172.16.1.1 priority 2

 l2f tunnel retransmit initial retries 5

Related Commands

l2f tunnel retransmit retries

Note Effective with Cisco Release 12.4(11)T, the l2f tunnel retransmit retries command is not available in Cisco IOS software.

To configure the number of times the router will attempt to resend a Layer 2 Forwarding (L2F) tunnel control packet before tearing the tunnel down, use the l2f tunnel retransmit retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2f tunnel retransmit retries number

no l2f tunnel retransmit retries

Syntax Description

Command Default

The router will resend control packets six times.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

This command does not affect the initial tunnel setup message or session control packets.

Examples

The following example configures the router to resend L2F tunnel control packets ten times before tearing the tunnel down. This configuration affects only tunnels associated with the virtual private dialup network (VPDN) group named group1.

vpdn-group group1

 l2f tunnel retransmit retries 10

Related Commands

l2f tunnel timeout setup

Note Effective with Cisco Release 12.4(11)T, the l2f tunnel timeout setup command is not available in
Cisco IOS software.

To configure the amount of time that the router will wait for a confirmation message after sending out the initial Layer 2 Forwarding (L2F) control packet before considering a peer busy, use the l2f tunnel timeout setup command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2f tunnel timeout setup seconds

no l2f tunnel timeout setup

Syntax Description

Command Default

The router will wait 10 seconds for a confirmation message.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

If the router has not received a confirmation message from the peer device before the tunnel timeout setup timer expires, the peer will be placed on the busy list.

Examples

The following example configures a router to wait 25 seconds for confirmation that the initial L2F control packet was received by the peer. This configuration will affect only tunnels associated with the virtual private dialup network (VPDN) group named group1.

vpdn-group group1

 l2f tunnel timeout setup 25

Related Commands

l2tp attribute clid mask-method

To configure a network access server (NAS) to suppress Layer 2 Tunnel Protocol (L2TP) calling station IDs for sessions associated with a virtual private dialup network (VPDN) group or VPDN template, use the l2tp attribute clid mask-method command in VPDN group or VPDN template configuration mode. To disable L2TP calling station ID suppression, use the no form of this command.

l2tp attribute clid mask-method {right mask-character characters | remove} [match match-string]

no l2tp attribute clid mask-method {right mask-character characters | remove} [match match-string]

Syntax Description

Command Default

The calling station ID is not masked or dropped.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

The l2tp attribute clid mask-method command can be used to mask the calling station ID in L2TP attribute-value (AV) pair 22. This command is compatible with only local authorization. You can either substitute characters for a portion of the calling station ID, or remove the entire calling station ID.

Use the l2tp attribute clid mask-method command in VPDN group configuration mode to mask the calling station ID for calls belonging to that virtual private dialup network (VPDN) group.

Use the l2tp attribute clid mask-method command in VPDN template configuration mode to mask the calling station ID for calls belonging to any VPDN group associated with that VPDN template.

The vpdn l2tp attribute clid mask-method command masks the calling station ID globally for all VPDN groups configured on the NAS, and is compatibe with both local and remote RADIUS AAA authorization.

Examples

The following example shows how to use the l2tp attribute clid mask-method command to remove the calling station ID during local authorization if the username contains the string #184. This configuration will apply only to calls belonging to the VPDN group named l2tp.

vpdn-group l2tp

 request-dialin

  protocol l2tp

  domain cisco.com

  domain cisco.com#184

!

 initiate-to ip 10.168.1.4

 local name router32

 l2tp tunnel password 0 cisco

 l2tp attribute clid mask-method remove match #184

Related Commands

l2tp congestion-control

To enable Layer 2 Transport Protocol (L2TP) congestion avoidance, use the l2tp congestion-control command in global configuration mode. To disable L2TP congestion avoidance, use the no form of this command.

l2tp congestion-control

no l2tp congestion-control

Syntax Description

This command has no arguments or keywords.

Command Default

L2TP congestion avoidance is enabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

The l2tp congestion-control command operates as a user-controlled on-off switch. An L2TP sliding window mechanism is enabled or disabled by this command. The l2tp congestion-control command is by default enabled and congestion control is enabled on any existing Virtual Private Dialup Network (VPDN) tunnel. To disable congestion control, use the no l2tp congestion-control command.

The congestion window size is not allowed to exceed the size of the advertised window obtained from the receive window size set by the l2tp tunnel receive-window VPDN group configuration command. Lowering the value of the receive window will result in lowering the number of calls per second being negotiated, and if a network is congested, the receive window size should be lowered. Increasing this value depends on how congested the network is. When the network becomes less congested, the receive window size can be increased again.

Examples

The following example enables L2TP congestion avoidance:

Router(config)# l2tp congestion-control

Related Commands

l2tp drop out-of-order

To instruct a network access server (NAS) or tunnel server using Layer 2 Tunneling Protocol (L2TP) to drop packets that are received out of order, use the l2tp drop out-of-order command in VPDN group or VPDN template configuration mode. To disable dropping of out-of-sequence packets, use the no form of this command.

l2tp drop out-of-order

no l2tp drop out-of-order

Syntax Description

This command has no arguments or keywords.

Command Default

Out of order packets are not dropped.

Command Modes

VPDN group configuration
VPDN template configuraton

Command History

Usage Guidelines

This command is valid only for tunnels where sequencing is enabled.

Examples

The following example enables sequencing and configures the router to drop any out-of-order packets that are received on a tunnel associated with the VPDN group named tunnelme:

vpdn-group tunnelme

 l2tp sequencing

 l2tp drop out-of-order

Related Commands

l2tp hidden

To enable Layer 2 Tunneling Protocol (L2TP) attribute-value (AV) pair hiding, which encrypts the value of sensitive AV pairs, use the l2tp hidden command in VPDN group or VPDN template configuration mode. To disable L2TP AV pair value hiding, use the no form of this command.

l2tp hidden

no l2tp hidden

Syntax Description

This command has no arguments or keywords.

Command Default

L2TP AV pair hiding is disabled.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

This command is not required if one-time Password Authentication Protocol (PAP) password authentication is used. This command is useful for additional security if PPP is using PAP or proxy authentication between the L2TP access concentrator (LAC) and Layer 2 Tunneling Protocol Network Server (LNS). When AV pair hiding is enabled, the L2TP hiding algorithm is executed, and sensitive passwords that are used between the L2TP AV pairs are encrypted during PAP or proxy authentication.

In Figure 1, the client initiates a PPP session with the LAC, and tunnel authentication begins. The LAC in turn exchanges authentication requests with the LNS. Upon successful authentication between the LAC and LNS, a tunnel is created. Proxy authentication is done by the LAC using either PAP or Challenge Handshake Authentication Protocol (CHAP). Because PAP username and password information is exchanged between devices in clear-text, it is beneficial to use the l2tp hidden command where L2TP AV pair values are encrypted.

Figure 1 LAC-LNS Proxy Authentication

Examples

The following example encrypts the AV pair value exchanged between the endpoints of tunnels associated with the VPDN group named group1:

vpdn-group group1

 l2tp hidden

Related Commands

l2tp ip udp checksum

To enable IP User Data Protocol (UDP) checksums on Layer 2 Tunneling Protocol (L2TP) data packets, use the l2tp ip udp checksum command in VPDN group or VPDN template configuration mode. To disable IP UDP checksums, use the no form of this command.

l2tp ip udp checksum

no l2tp ip udp checksum

Syntax Description

This command has no arguments or keywords.

Command Default

UDP checksums are not used on L2TP data packets.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Enabling IP UDP checksums on data packets causes the switching path to revert to process-level switching, which results in slower performance. The drop in performance may be acceptable if the connection between the network access server (NAS) and the tunnel server is poor. Enabling IP UDP checksums will minimize delays that occur when the ultimate error correction is done end-to-end rather than at the tunnel endpoints.

Examples

The following example enables IP UDP checksums on L2TP data packets for tunnels associated with the virtual private dialup network (VPDN) group named group1:

vpdn-group group1

 l2tp ip udp checksum

Related Commands

l2tp rx-speed

To configure the receive-speed (rx-speed) value for Layer 2 Tunneling Protocol (L2TP) to be sent to L2TP Network Server (LNS), use the l2tp rx-speed command in VPDN group configuration or VPDN template configuration mode. To return the default value, use the no form of this command.

l2tp rx-speed {value | ancp [value] | ram-min [value]}

no l2tp rx-speed {value | ancp [value] | ram-min [value]}

Syntax Description

Command Default

L2TP obtains the rx-speed value from Point-to-Point Protocol over Ethernet (PPPoE) and sends it to LNS.

Command Modes

VPDN group configuration (config-vpdn)
VPDN template configuration (config-vpdn-temp)

Command History

Usage Guidelines

Use the l2tp rx-speed command to configure the rx-speed value that the L2TP has to send to LNS.

•If the source specified is ANCP, L2TP sends the upstream value configured for ANCP to LNS.

•If the source specified is RAM-min, L2TP sends the rx-speed value configured for RAM-min to LNS.

•If the rx-speed is not configured for ANCP or RAM-min, L2TP sends the rx-speed value specified in the command.

Examples

The following example shows how to configure the rx-speed value locally:

Router(config)# vpdn-group 1

Router(config-vpdn)# l2tp rx-speed 8000

The following example shows how to configure L2TP to obtain the rx-speed value from ANCP, and if rx-speed is not configured for ANCP, L2TP sends the locally configured rx-speed value to LNS:

Router(config)# vpdn-template 2

Router(config-vpdn-temp)# l2tp rx-speed ancp 15000

The following example shows how to configure L2TP to obtain the rx-speed value from RAM-min, and if rx-speed is not configured for RAM-min, L2TP sends the locally configured rx-speed value to LNS:

Router(config)# vpdn-group 1

Router(config-vpdn)# l2tp rx-speed ram-min 10000

Related Commands

l2tp security crypto-profile

To configure IP Security (IPSec) protection of Layer 2 Tunnel Protocol (L2TP) sessions associated with a virtual private dialup network (VPDN) group, use the l2tp security crypto-profile command in VPDN group or VPDN template configuration mode. To disable IPSec protection for a VPDN group, use the no form of this command.

l2tp security crypto-profile profile-name [keep-sa]

no l2tp security crypto-profile

Syntax Description

Command Default

IPSec security is disabled.
IKE phase 1 SAs are destroyed on tunnel teardown.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Enabling this command for a VPDN group ensures that no L2TP packets will be processed unless they have IPSec protection.

A crypto profile must be configured using the crypto map (global IPSec) command before it can be associated with a VPDN group using the l2tp security crypto-profile command. The profile-name argument must match the name of a profile configured using the crypto map command.

The keep-sa keyword can be used to prevent the destruction of IKE phase 1 SAs when the L2TP tunnel between the network access server (NAS) and tunnel server is considered permanent, and the IP addresses of the peer devices rarely change. This option is not useful with short-lived tunnels, such as those generated by client-initiated L2TP tunneling.

Examples

The following example configures VPDN group 1, associates it with the crypto profile named l2tp, and prevents the destruction of IKE phase 1 SAs on tunnel teardown:

vpdn-group 1

 request-dialin

  protocol l2tp

  domain cisco.com

 initiate-to ip 10.0.0.13 

 local name LAC

l2tp security crypto-profile l2tp keep-sa

Related Commands

l2tp security ip address-check

To enable the checking of an IP address from an L2TP Network Server (LNS) before the setup of an L2TP tunnel from the L2TP Access Concentrator (LAC) to the LNS, use the l2tp security ip address-check command in VPDN-group configuration mode. To disable the checking of an IP address from an LNS before the setup of an L2TP tunnel from the LAC to the LNS, use the no form of this command.

l2tp security ip address-check

no l2tp security ip address-check

Syntax Description

This command has no arguments or keywords.

Command Default

The command is disabled.

Command Modes

VPDN-group configuration (config-vpdn)

Command History

Usage Guidelines

You can configure the l2tp security ip address-check command only on a LAC; this command is not accepted on an LNS.

Use the l2tp security ip address-check command to enable or disable the matching, prior to an L2TP tunnel setup of an incoming transport IP address from a LNS against the output IP address of the LNS by the LAC. Once enabled, the LAC inspects, prior to establishing an L2TP tunnel if the IP addresses contained in the Start Control Connection Reply (SCCRP) and Start Control Connection Request (SCCRQ) messages, are identical. If these IP addresses do not match, an L2TP tunnel is not established.

You cannot configure the l2tp security ip address-check command on a VPDN group that has the accept-dialin command configured.

You can use the debug vpdn 12x-error command with the l2tp security ip address-check command to display informational messages on each control packet dropped.

Examples

The following example shows how to enable the verification of an incoming transport IP address from an LNS against the output IP address of the LNS:

LAC> enable 

LAC# configure terminal

LAC(config)# vpdn enable

LAC(config)# vpdn-group example

LAC(config-vpdn)# l2tp security ip address-check

Related Commands

l2tp sequencing

To enable sequencing for packets sent over a Layer 2 Tunnel Protocol (L2TP) tunnel, use the l2tp sequencing command in VPDN group or VPDN template configuration mode. To disable sequencing, use the no form of this command.

l2tp sequencing

no l2tp sequencing

Syntax Description

This command has no arguments or keywords.

Command Default

Sequencing is disabled by default. However, if the peer device requests sequencing, it will be enabled.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Use the l2tp sequencing command to control sequencing for packets sent over an L2TP tunnel.

The l2tp sequencing command configuration may be overridden by a request for sequencing from the peer device. The following sections describe the default behavior and sequencing request interactions of the two tunnel endpoints.

Tunnel Initiator

•By default, sequence numbers are off.

•By default, the Sequencing Required attribute-value (AV) pair will not be sent from the tunnel initiator to the tunnel terminator.

•If the tunnel initiator receives data packets from the tunnel terminator that include sequencing numbers, the tunnel initiator will include sequence numbers on data packets regardless of the l2tp sequencing command configuration.

•Enabling the l2tp sequencing command will cause the tunnel initiator to send the Sequencing Required AV pair to the tunnel terminator and to include sequencing numbers on data packets.

Tunnel Terminator

•By default, sequence numbers are off.

•If the tunnel terminator receives the Sequencing Required AV pair from the tunnel initiator, the tunnel terminator will include sequence numbers on data packets regardless of the l2tp sequencing command configuration.

•Enabling the l2tp sequencing command will cause the tunnel terminator to include sequence numbers.

Examples

The following example configures sequencing on a network access server (NAS) for dial-in L2TP tunnels associated with the VPDN group named tunnelme. The NAS will send the Sequencing Required AV pair to the tunnel server, and sequencing will be enabled on both devices.

vpdn-group tunnelme

 request-dialin

  protocol l2tp

  domain cisco.com

!

 local name router32

 initiate to 172.16.1.1

 l2tp sequencing

Related Commands

l2tp sso enable

To enable the Layer 2 Tunneling Protocol (L2TP) high availability (HA) feature, use the l2tp sso enable command in global configuration mode. To disable the L2TP HA feature, use the no form of this command.

l2tp sso enable

no l2tp sso enable

Syntax Description

This command has no arguments or keywords.

Command Default

L2TP SSO is enabled.

Command Modes

Global configuration (config)

Command History

Usage Guidelines

This command is enabled by default and is hidden from the output of the show running-config command.

Use the no l2tp sso enable command to disable L2TP HA globally and for any virtual private dial-in network (VPDN) group previously enabled by using the sso enable command. If you disable L2TP HA, the l2tp sso enable command displays as NVGEN in the output of the show running-config command.

Use the debug l2tp redundancy and debug vpdn redundancy commands in privileged EXEC mode to display a list L2TP HA checkpointed events and errors.

Use the show l2tp redundancy command in privileged EXEC mode to display L2TP checkpointed status information.

Examples

The following example shows how to globally disable L2TP HA functionality for all VPDN groups:

Router> configure terminal

Router(config)# no l2tp sso enable

Related Commands

l2tp tunnel authentication

To enable Layer 2 Tunneling Protocol (L2TP) tunnel authentication, use the l2tp tunnel authentication command in VPDN group or VPDN template configuration mode. To disable L2TP tunnel authentication, use the no form of this command.

l2tp tunnel authentication

no l2tp tunnel authentication

Syntax Description

This command has no arguments or keywords.

Command Default

L2TP tunnel authentication is enabled.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Examples

The following example disables L2TP tunnel authentication for tunnels associated with the virtual private dialup network (VPDN) group named group1:

vpdn-group group1

 no l2tp tunnel authentication

The following example reenables L2TP tunnel authentication for tunnels associated with the VPDN group named group1:

vpdn-group group1

 l2tp tunnel authentication

Note L2TP tunnel authentication is enabled by default, so there is no need to enable this command unless it was previously disabled.

Related Commands

l2tp tunnel bearer capabilities

To set the Layer 2 Tunnel Protocol (L2TP) bearer-capability value used by the Cisco router, use the l2tp tunnel bearer capabilities command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel bearer capabilities {none | digital | analog | all}

no l2tp tunnel bearer capabilities

Syntax Description

Command Default

If the accept-dialout command is not configured, no access types are supported.
If the accept-dialout command is configured, all access types are supported.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

By default, Cisco routers use a bearer-capability value of none. If the accept-dialout command is configured, Cisco routers use a bearer-capability value of all. To ensure compatibility with some non-Cisco routers, you may be required to override the default bearer-capability value by configuring the l2tp tunnel bearer capabilities command.

Examples

The following example configures the bearer-capability value to support only digital access for tunnels associated with the virtual private dialup network (VPDN) group named group1:

vpdn-group group1

 l2tp tunnel bearer capabilities digital

Related Commands

l2tp tunnel busy timeout

To configure the amount of time that the router will wait before attempting to recontact a Layer 2 Transport Protocol (L2TP) peer that was previously busy, use the l2tp tunnel busy timeout command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel busy timeout seconds

no l2tp tunnel busy timeout

Syntax Description

Command Default

The router will wait 300 seconds before attempting to recontact a previously busy peer.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Examples

The following example configures tunnels associated with the virtual private dialup network (VPDN) group named group1 to leave an L2TP destination router on the busy list for 90 seconds:

vpdn-group group1

 l2tp tunnel busy timeout 90

Related Commands

l2tp tunnel framing capabilities

To set the Layer 2 Tunnel Protocol (L2TP) framing-capability value used by the Cisco router, use the l2tp tunnel framing capabilities command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel framing capabilities {none | synchronous | asynchronous | all}

no l2tp tunnel framing capabilities

Syntax Description

Command Default

If the accept-dialout command is not configured, no framing types are supported.
If the accept-dialout command is configured, all framing types are supported.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

By default, Cisco routers use a framing-capability value of none. If the accept-dialout command is configured, Cisco routers use a framing-capability value of all. To ensure compatibility with some non-Cisco routers, you may be required to override the default framing-capability value by configuring the l2tp tunnel framing capabilities command.

Examples

The following example configures the framing-capability value to support only asynchronous framing for tunnels associated with the virtual private dialup network (VPDN) group named group1:

vpnd-group group1

 l2tp tunnel framing capabilities asynchronous

Related Commands

l2tp tunnel hello

To set the number of seconds between sending hello keepalive packets for a Layer 2 Tunneling Protocol (L2TP) tunnel, use the l2tp tunnel hello command in virtual private dialup network (VPDN) group or VPDN template configuration mode. To return to the default setting, use the no form of this command.

l2tp tunnel hello seconds

no l2tp tunnel hello

Syntax Description

Command Default

Hello keepalive packets are sent every 60 seconds.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

To change the tunnel hello value, reenter the command with the new value.

The L2TP tunnel keepalive timers need not use the same value on both sides of the tunnel. For example, a NAS can use a keepalive value of 30 seconds, and a tunnel server can use the default value of 60 seconds.

Note We do not recommend setting the l2tp tunnel hello command to zero seconds. Disabling the sending of L2TP tunnel hello messages can prevent the NAS or tunnel server from tearing down a tunnel and cleaning up a half-open session if the connection with the peer becomes stuck.

The NAS or tunnel server sends hello packets only if it does not receive packets from the peer over the tunnel for 60 seconds (or the configured value). In a normal connection, hello packets are not sent; they are sent only if the connection becomes stuck.

Examples

The following example sets the L2TP tunnel hello value to 90 seconds for tunnels associated with the VPDN group named group1:

vpdn-group group1

 l2tp tunnel hello 90

Related Commands

l2tp tunnel password

To set the password that the router will use to authenticate Layer 2 Tunnel Protocol (L2TP) tunnels, use the l2tp tunnel password command in VPDN group or VPDN template configuration mode. To remove a previously configured password, use the no form of this command.

l2tp tunnel password password

no l2tp tunnel password

Syntax Description

Command Default

The password associated with the local name of the router is used to authenticate the tunnel.
If no local name password is configured, the password associated with the hostname of the router is used to authenticate the tunnel.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

The password defined with the l2tp tunnel password command is also used for attribute-value (AV) pair hiding.

The password hierarchy sequence that is used for tunnel identification, and subsequently tunnel authentication, is as follows:

•An L2TP tunnel password is used if one is configured.

•If no L2TP tunnel password exists, the password associated with the local name of the router is used.

•If a local name password does not exist, the password associated with the hostname of the router is used.

The username command is used to define the passwords associated with the local name and the hostname.

Examples

The following example configures the L2TP tunnel password, secret, which will be used to authenticate tunnels associated with the virtual private dialup network (VPDN) group named group1:

vpdn-group group1

 l2tp tunnel password secret

Related Commands

l2tp tunnel receive-window

To configure the number of packets allowed in the local receive window for a Layer 2 Tunnel Protocol (L2TP) control channel, use the l2tp tunnel receive-window command in VPDN group configuration or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel receive-window packets

no l2tp tunnel receive-window

Syntax Description

Command Default

The default size of the control channel receive window is platform-dependent.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Use the l2tp tunnel receive-window command to set the size of the advertised control channel receive window. The receive window size controls the number of L2TP control packets that can be queued by the system for processing. Increasing the size of the control channel receive window allows the system to open PPP sessions more quickly; a smaller size is desirable on networks that cannot handle large bursts of traffic.

Cisco 10000 Series Router

We recommend that you configure the L2TP tunnel receive window to 100 packets on the Cisco 10000 series router.

Examples

The following example configures the receive window to hold up to 500 packets for tunnels associated with the virtual private dialup network (VPDN) group named group1:

vpdn-group group1

 l2tp tunnel receive-window 500

Related Commands

l2tp tunnel resync

To control the number of packets after a stateful switchover (SSO), a Layer 2 Tunneling Protocol (L2TP) high availability (HA) tunnel sends before waiting for an acknowledgement, use the l2tp tunnel resync command in VPDN group configuration mode. To disable the control of packets sent, use the no form of this command.

l2tp tunnel resync packets

no l2tp tunnel resync

Syntax Description

Command Default

This command is disabled

Command Modes

VPDN group configuration (config-vpdn)#

Command History

Usage Guidelines

Use the l2tp tunnel resync command in VPDN group configuration mode to control the number of unacknowledged messages sent to a peer router during SSO.

Use the show l2tp redundancy command in privileged EXEC mode to display information on the state of the L2TP or a specific L2TP redundancy session.

Examples

The following example shows setting the L2TP resync packet value to 100 packets:

Router> enable 

Router# configure terminal

Router(conf)# vpdn enable

Router(conf-vpdn)# vpdn-group example

Router(conf-vpdn)# l2tp tunnel resync 100

Router(conf-vpdn)# exit

Related Commands

l2tp tunnel retransmit initial retries

To configure the number of times that the router will attempt to send out the initial Layer 2 Tunnel Protocol (L2TP) control packet for tunnel establishment before considering a peer busy, use the l2tp tunnel retransmit initial retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel retransmit initial retries number

no l2tp tunnel retransmit initial retries

Syntax Description

Command Default

The router will resend the initial L2TP control packet twice.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Use the l2tp tunnel retransmist initial retries command to configure the number of times a device will attempt to resend the initial control packet used to establish an L2TP tunnel.

Examples

The following example configures the router to attempt to send the initial L2TP control packet five times for tunnels associated with the virtual private dialup network (VPDN) group named group1:

vpdn-group group1

 l2tp tunnel retransmit initial retries 5

Related Commands

l2tp tunnel retransmit initial timeout

To configure the amount of time that the router will wait before resending an initial Layer 2 Tunnel Protocol (L2TP) control packet out to establish a tunnel, use the l2tp tunnel retransmit initial timeout command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel retransmit initial timeout {min | max} seconds

no l2tp tunnel retransmit initial timeout {min | max}

Syntax Description

Command Default

The minimum timeout is one second.
The maximum timeout is eight seconds.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

This command will take effect only when load balancing is enabled.

Control channel retransmissions follow an exponential backoff, starting at the minimum retransmit timeout length specified by the min seconds keyword and argument combination. After each packet that is not acknowledged, the timeout exponentially increases until it reaches the value specified by the max seconds keyword and argument combination. For example, if the minimum timeout length is set to one second, the next retransmission attempt occurs two seconds later. The following attempt occurs four seconds later, and all additional attempts occur in eight second intervals.

Examples

The following example configures a network access server (NAS) virtual private dialup network (VPDN) group to establish L2TP tunnels that are load balanced across two tunnel servers. The NAS is configured to attempt to recontact a peer with an initial control packet five times before considering it busy. The timers are set so that the first attempt to recontact the peer will occur two seconds after the initial failure, and the final attempt will occur seven seconds after the previous failure.

vpdn-group 1

 request-dialin

  protocol l2tp

  domain cisco.com

!

 initiate-to ip 172.16.0.1 priority 1

 initiate-to ip 172.16.1.1 priority 2

 l2tp tunnel retransmit initial retries 5

 l2tp tunnel retransmit initial timeout min 2

 l2tp tunnel retransmit initial timeout max 7

Related Commands

l2tp tunnel retransmit retries

To configure the number of retransmission attempts made for a Layer 2 Tunnel Protocol (L2TP) control packet, use the l2tp tunnel retransmit retries command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel retransmit retries number

no l2tp tunnel retransmit retries number

Syntax Description

Command Default

The router will resend control packets ten times.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Use the l2tp tunnel retransmist retries command to configure the number of times a device will attempt to resend an L2TP control packet.

Examples

The following example tunnels associated with the virtual private dialup network (VPDN) group named group1 to make eight retransmission attempts:

vpdn-group group1

 l2tp tunnel retransmit retries 8

Related Commands

l2tp tunnel retransmit timeout

To configure the amount of time that the router will wait before resending a Layer 2 Tunnel Protocol (L2TP) control packet, use the l2tp tunnel retransmit timeout command in VPDN group configuration or VPDN template configuration mode. To disable a parameter setting, use the no form of this command.

l2tp tunnel retransmit timeout {min | max} seconds

no l2tp tunnel retransmit timeout {min | max} seconds

Syntax Description

Command Default

The router will use the default timeout values: 1 second minimum and 8 seconds maximum.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Control channel retransmissions follow an exponential backoff, starting at the minimum retransmit timeout length specified by the min seconds keyword and argument combination. After each packet that is not acknowledged, the timeout exponentially increases until it reaches the value specified by the max seconds keyword and argument combination. For example, if the minimum timeout length is set to 1 second, the next retransmission attempt occurs 2 seconds later. The following attempt occurs 4 seconds later, and all additional attempts occur in 8-second intervals.

Cisco 10000 Series Router

We recommend that you configure the L2TP tunnel retransmit timeout to 2 seconds (minimum) and 8 seconds (maximum) on the Cisco 10000 series router.

Examples

The following example configures the VPDN group named group1 to make 8 retransmission attempts, with the minimum timeout length set at 2 seconds, and the maximum timeout length set at 4 seconds:

vpdn-group group1

 l2tp tunnel retransmit retries 8

 l2tp tunnel retransmit timeout min 2

 l2tp tunnel retransmit timeout max 4

Related Commands

l2tp tunnel timeout no-session

To configure the time a router waits after a Layer 2 Tunnel Protocol (L2TP) tunnel becomes empty before tearing down the tunnel, use the l2tp tunnel timeout no-session command in VPDN group or VPDN template configuration mode. To restore the default timeout value, use the no form of this command.

l2tp tunnel timeout no-session {seconds | never}

no l2tp tunnel timeout no-session

Syntax Description

Command Default

Empty tunnels will be torn down after the default timeout.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Use the l2tp tunnel timeout no-session command to configure the amount of time a device will wait before tearing down an empty tunnel. It may be desirable to leave an empty tunnel up beyond the default timeout value if you expect that a new session will be established imminently, or if you want to display statistics for a tunnel after all sessions have been terminated.

A router is considered a NAS if it has either a request-dialin or accept-dialout virtual private dialup network (VPDN) group configured.

A router is considered a tunnel server if it has either an accept-dialin or request-dialout VPDN group configured.

Examples

The following example configures the router to never tear down empty L2TP tunnels associated with the VPDN group named group1:

vpdn-group group1

 l2tp tunnel timeout no-session never

The following example returns the router to the default timeout duration for tearing down empty L2TP tunnels. This default value depends on whether the router is configured as a NAS or a tunnel server.

vpdn-group group1

 no l2tp tunnel timeout no-session 

Related Commands

l2tp tunnel timeout setup

To configure the amount of time that the router will wait for a confirmation message after sending out the initial Layer 2 Tunnel Protocol (L2TP) control packet before considering a peer busy, use the l2tp tunnel timeout setup command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel timeout setup seconds

no l2tp tunnel timeout setup seconds

Syntax Description

Command Default

The router will wait 10 seconds for a confirmation message from the peer device before considering it busy.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

If the router has not received a confirmation message from the peer device before the tunnel timeout setup timer expires, the peer will be placed on the busy list.

Examples

The following example configures a router to wait 25 seconds for confirmation that the initial L2TP control packet was received by the peer. This configuration will apply only to tunnels associated with the virtual private dialup network (VPDN) group named group1.

vpdn-group group1

 l2tp tunnel timeout setup 25

Related Commands

l2tp tunnel zlb delay

To configure the delay time before a zero length bit (ZLB) control message must be acknowledged, use the l2tp tunnel zlb delay command in VPDN group or VPDN template configuration mode. To restore the default value, use the no form of this command.

l2tp tunnel zlb delay seconds

no l2tp tunnel zlb delay seconds

Syntax Description

Command Default

The router waits up to 3 seconds before acknowledging ZLB control messages.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

Use the l2tp tunnel zlb delay command to change the maximum allowable delay in responding to ZLB messages in a virtual private dialup network (VPDN) deployment. Changing the delay time may be beneficial when the peer device at the other end of the control channel requires a faster response to ZLB messages. This situation can occur if the remote peer has short keepalive timers configured.

Examples

The following example configures control channels associated with the VPDN group named group1 to delay no more than 2 seconds before responding to a ZLB message:

vpdn-group group1

 l2tp tunnel zlb delay 2

Related Commands

l2tp tx-speed

To configure the transmit-speed (tx-speed) value for Layer 2 Tunneling Protocol (L2TP) to be sent to L2TP Network Server (LNS), use the l2tp tx-speed command in VPDN group configuration or VPDN template configuration mode. To return to the default value, use the no form of this command.

l2tp tx-speed {value | ancp [value] | ram-min [value]}

no l2tp tx-speed {value | ancp [value] | ram-min [value]}

Syntax Description

Command Default

L2TP obtains the tx-speed value from Point-to-Point Protocol over Ethernet (PPPoE) and sends it to LNS.

Command Modes

VPDN group configuration (config-vpdn)
VPDN template configuration (config-vpdn-temp)

Command History

Usage Guidelines

Use the l2tp tx-speed command to configure the tx-speed value that the L2TP has to send to LNS.

•If the source specified is ANCP, L2TP sends the downstream value configured for ANCP to LNS.

•If the source specified is RAM-min, L2TP sends the tx-speed value configured for RAM-min to LNS.

•If the tx-speed is not configured for ANCP or RAM-min, L2TP sends the tx-speed value specified in the command.

Examples

The following example shows how to configure the tx-speed value locally:

Router(config)# vpdn-group 1

Router(config-vpdn)# l2tp tx-speed 8000

The following example shows how to configure the tx-speed value obtained from ANCP, and if tx-speed is not configured for ANCP, L2TP sends the locally configured tx-speed value to LNS:

Router(config)# vpdn-template 2

Router(config-vpdn-temp)# l2tp tx-speed ancp 15000

The following example shows how to configure the tx-speed value obtained from RAM-min, and if tx-speed is not configured for RAM-min, L2TP sends the locally configured tx-speed value to LNS.

Router(config)# vpdn-group 1

Router(config-vpdn)# l2tp tx-speed ram-min 10000

Related Commands

lcp renegotiation

To allow the L2TP network server (LNS) to renegotiate the PPP Link Control Protocol (LCP) on dial-in calls, using Layer 2 Tunneling Protocol (L2TP) or Layer 2 Forwarding (L2F), use the lcp renegotiation command in virtual private dialup network (VPDN) group configuration mode. To remove LCP renegotiation, use the no form of this command.

lcp renegotiation {always | on-mismatch}

no lcp renegotiation

Syntax Description

Defaults

LCP renegotiation is disabled on the LNS.

Command Modes

VPDN group configuration

Command History

Usage Guidelines

You must enable the accept-dialin command on the VPDN group before you can use the lcp renegotiation command. Removing the accept-dialin command will remove the lcp renegotiation command from the VPDN group.

This command is valid only at the LNS. This command is useful for an LNS that tunnels to a non-Cisco L2TP access concentrator (LAC), where the LAC may negotiate a different set of LCP options than what the LNS expects.

When a PPP session is started at the LAC, LCP parameters are negotiated, and a tunnel is initiated, the LNS can either accept the LAC LCP negotiations or can request LCP renegotiation. Using the lcp renegotiation always command forces renegotiation to occur at the LNS. If the lcp renegotiation on-mismatch command is configured, then renegotiation will only occur if there is an LCP mismatch between the LNS and LAC.

Note Older PC PPP clients may experience a "lock up" during PPP LCP renegotiation.

Examples

The following example configures the LNS to renegotiate PPP LCP with a non-Cisco LAC:

vpdn-group 1

 accept dialin 

  protocol l2tp

  virtual-template 1 

 terminate-from router32

 lcp renegotiation on-mismatch

Related Commands

loadsharing

To configure endpoints for load sharing, use the loadsharing command in virtual private dialup network (VPDN) group configuration mode. To remove this function, use the no form of this command.

loadsharing ip ip-address [limit session-limit]

no loadsharing ip ip-address [limit session-limit]

Syntax Description

Defaults

No default is set, and this function is not used when not configured.

Command Modes

VPDN group configuration

Command History

Usage Guidelines

Use the loadsharing VPDN group configuration command to configure endpoints for loadsharing.

Examples

In the following example, VPDN group customer1-vpdng is created. L2TP IP traffic load is shared between two HGW/LNS. The IP addresses for the HGW/LNS WAN ports are 172.21.9.67 and 172.21.9.68 (the home gateway is a Cisco IOS router terminating L2TP sessions). The characteristics for link 172.21.9.67 are defined by using the request dialin command. The characteristics for link 172.21.9.68 are defined by using the loadsharing command.

A backup home-gateway router is specified at 172.21.9.69 by using the backup command. This router serves as a backup device for two load-sharing HGW/LNS:

vpdn-group customer1-vpdng

 request dialin l2tp ip 172.21.9.67 domain cisco.com

 loadsharing ip 172.21.9.68 limit 100

 backup ip 172.21.9.69 priority 5

 domain cisco2.com

Related Commands

local name

To specify a local hostname that the tunnel will use to identify itself, use the local name command in VPDN group or VPDN template configuration mode. To remove the configured local hostname, use the no form of this command.

local name host-name

no local name

Syntax Description

Command Default

No local hostname is configured.

Command Modes

VPDN group configuration
VPDN template configuration

Command History

Usage Guidelines

This command allows each virtual private dialup network (VPDN) group to use a unique local hostname. The password hierarchy sequence that is used for tunnel identification and, subsequently, tunnel authentication, is as follows:

•A Layer 2 Tunnel Protocol (L2TP) tunnel password is used first (defined by the l2tp tunnel password command).

•If no L2TP tunnel password exists, the password associated with the local name is used.

•If no local name password exists, the password associated with the hostname is used.

The username command defines the passwords associated with the local name and the hostname.

Examples

The following example configures the local hostname Tunnel1 for the tunnels associated with the VPDN group named tunnelme:

vpdn-group tunnelme

 local name Tunnel1

Related Commands