使用L3 SSG/SSD將PC配置為PPPoA客戶端

下載選項

PDF (436.8 KB)
在多種裝置上使用 Adobe Reader 檢視

已更新: 2008 年 2 月 26 日

文件 ID:4614

無偏見用語

本產品的文件集力求使用無偏見用語。針對本文件集的目的，無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言，或引用第三方產品的語言，因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。

關於此翻譯

思科已使用電腦和人工技術翻譯本文件，讓全世界的使用者能夠以自己的語言理解支援內容。請注意，即使是最佳機器翻譯，也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責，並建議一律查看原始英文文件（提供連結）。

簡介

本文檔中介紹的示例配置顯示了使用非同步傳輸模式(PPPoA)上的點對點協定訪問Internet服務提供商(ISP)網路的遠端客戶端。

遠端使用者端想要使用第3層服務選取閘道/服務選取儀表板(SSG/SSD)存取第2層通道通訊協定(L2TP)服務。L2TP服務在配置中以主機IP地址15.15.15.5表示。使用動態主機配置協定(DHCP)，Cisco 677為PC提供從10.0.0.2到10.0.0.254的IP地址池的IP地址，掩碼為255.255.255.0。此外，在Cisco 677上啟用了埠地址轉換(PAT)。

此配置示例有三項測試：

遠端客戶端登入服務的不同步驟期間與SSG相關的調試。
單一登入SSD 2.5.1功能。
啟用SSD調試。

開始之前

採用元件

本檔案中的資訊是根據以下軟體和硬體版本而定。

Cisco C6400R軟體(C6400R-G4P5-M)，版本12.1(5)DC1
Cisco 7200軟體(C7200-IS-M)，版本12.2(1)

本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您在即時網路中工作，請確保在使用任何命令之前瞭解其潛在影響。

設定

本節提供用於設定本文件中所述功能的資訊。

注意：要查詢有關本文檔中使用的命令的其他資訊，請使用命令查詢工具(僅限註冊客戶)。

組態

本文檔使用以下配置。

Cisco 6400 LAC (airelle_nrp3)
Cisco 7204 LNS（主機名ior）
思科677

Cisco 6400 LAC (airelle_nrp3)
Building configuration... Current configuration : 125008 bytes ! ! Last configuration change at 02:11:30 UTC Mon Jun 18 2001 ! NVRAM config last updated at 00:43:51 UTC Mon Jun 18 2001 ! version 12.1 no service single-slot-reload-enable service timestamps debug datetime msec service timestamps log uptime no service password-encryption ! hostname arielle_nrp3 ! boot system tftp c6400r-g4p5-mz.121-5.DC1 172.17.247.195 logging rate-limit console 10 except errors aaa new-model aaa authentication login default none aaa authentication login tty enable aaa authentication ppp ayman group radius aaa nas port extended enable password ww ! username ayman@cairo.com password 0 ayman redundancy main-cpu auto-sync standard no secondary console enable ip subnet-zero ip cef no ip finger no ip domain-lookup ! ! vpdn enable no vpdn logging vpdn search-order domain ! ! ssg enable ssg default-network 10.200.56.0 255.255.255.0 ssg service-password cisco ssg radius-helper auth-port 1645 acct-port 1646 ssg radius-helper key cisco ssg next-hop download nxthoptbl cisco ssg bind direction downlink Virtual-Template66 ssg service-search-order remote local ! ! interface Loopback3 ip address 200.200.200.1 255.255.255.252 ! ! interface ATM0/0/0.61 point-to-point description LAC L2TP connection to Ior ip address 14.14.14.6 255.255.255.252 pvc 61/61 broadcast encapsulation aal5snap ! ! ! interface ATM0/0/0.5555 multipoint pvc 66/66 encapsulation aal5mux ppp Virtual-Template66 ! ! ! interface Ethernet0/0/1 no ip address ! interface Ethernet0/0/0 ip address 3.0.0.2 255.255.255.0 no ip mroute-cache shutdown tag-switching ip ! interface FastEthernet0/0/0 ip address 10.200.56.6 255.255.255.0 no ip mroute-cache half-duplex ! ! interface Virtual-Template66 ip unnumbered Loopback3 peer default ip address pool ayman ppp authentication pap ayman ! ! router eigrp 5 network 14.14.14.4 0.0.0.3 no auto-summary no eigrp log-neighbor-changes ! ip local pool ayman 212.93.193.114 212.93.193.126 ip route 10.0.0.0 255.255.255.0 212.93.193.114 ! radius-server host 10.200.56.16 auth-port 1645 acct-port 1646 radius-server retransmit 3 radius-server attribute 25 nas-port format d radius-server attribute nas-port format d radius-server key cisco ! ! line con 0 exec-timeout 0 0 login authentication tty transport input none line aux 0 line vty 0 4 exec-timeout 0 0 password ww login authentication tty ! end

Cisco 6400 LAC (airelle_nrp3)

Building configuration... 


Current configuration : 125008 bytes 
! 
! Last configuration change at 02:11:30 UTC Mon Jun 18 2001 
! NVRAM config last updated at 00:43:51 UTC Mon Jun 18 2001 
! 
version 12.1 
no service single-slot-reload-enable 
service timestamps debug datetime msec 
service timestamps log uptime 
no service password-encryption 
! 
hostname arielle_nrp3 
! 
boot system tftp c6400r-g4p5-mz.121-5.DC1 172.17.247.195 
logging rate-limit console 10 except errors 
aaa new-model 
aaa authentication login default none 
aaa authentication login tty enable 
aaa authentication ppp ayman group radius 
aaa nas port extended 
enable password ww 
! 
username ayman@cairo.com password 0 ayman 
redundancy 
main-cpu 
 auto-sync standard 
no secondary console enable 
ip subnet-zero 
ip cef 
no ip finger 
no ip domain-lookup 
! 
! 
vpdn enable 
no vpdn logging 
vpdn search-order domain 
! 
! 
ssg enable 
ssg default-network 10.200.56.0 255.255.255.0 
ssg service-password cisco 
ssg radius-helper auth-port 1645 acct-port 1646 
ssg radius-helper key cisco 
ssg next-hop download nxthoptbl cisco 
ssg bind direction downlink Virtual-Template66 
ssg service-search-order remote local 
! 
! 
interface Loopback3 
ip address 200.200.200.1 255.255.255.252 
! 
! 
interface ATM0/0/0.61 point-to-point 
description LAC L2TP connection to Ior 
ip address 14.14.14.6 255.255.255.252 
pvc 61/61 
 broadcast 
 encapsulation aal5snap 
! 
! 
! 
interface ATM0/0/0.5555 multipoint 
pvc 66/66 
 encapsulation aal5mux ppp Virtual-Template66 
! 
! 
! 
interface Ethernet0/0/1 
no ip address 
! 
interface Ethernet0/0/0 
ip address 3.0.0.2 255.255.255.0 
no ip mroute-cache 
shutdown 
tag-switching ip 
! 
interface FastEthernet0/0/0 
ip address 10.200.56.6 255.255.255.0 
no ip mroute-cache 
half-duplex 
! 
! 
interface Virtual-Template66 
ip unnumbered Loopback3 
peer default ip address pool ayman 
ppp authentication pap ayman 
! 
! 
router eigrp 5 
network 14.14.14.4 0.0.0.3 
no auto-summary 
no eigrp log-neighbor-changes 
! 
ip local pool ayman 212.93.193.114 212.93.193.126 
ip route 10.0.0.0 255.255.255.0 212.93.193.114 
! 
radius-server host 10.200.56.16 auth-port 1645 acct-port 1646 
radius-server retransmit 3 
radius-server attribute 25 nas-port format d 
radius-server attribute nas-port format d 
radius-server key cisco 
! 
! 
line con 0 
exec-timeout 0 0 
login authentication tty 
transport input none 
line aux 0 
line vty 0 4 
exec-timeout 0 0 
password ww 
login authentication tty 
! 
end

Cisco 7204 LNS（主機名ior）
Building configuration... Current configuration : 6769 bytes ! version 12.2 no service single-slot-reload-enable service timestamps debug datetime msec localtime show-timezone service timestamps log datetime localtime show-timezone no service password-encryption ! hostname ior ! boot system flash c7200-is-mz.122-1.bin logging buffered 16384 debugging logging rate-limit console 10 except errors aaa new-model aaa authentication login default none aaa authentication login tty enable aaa authentication ppp ayman local aaa nas port extended enable password 7 03134C ! username ayman@cairo.com password 0 ayman clock timezone GMT+1 1 clock summer-time PDT recurring ip subnet-zero no ip source-route ip cef ! ! no ip finger ip tcp window-size 8192 ip ftp username tftp ip ftp password 7 061118 ip host rund 172.17.247.195 ip host PAGENT-SECURITY-V3 57.63.30.76 95.26.0.0 ! ! ! ! ! vpdn enable no vpdn logging vpdn search-order domain ! vpdn-group 1 accept-dialin protocol l2tp virtual-template 24 terminate-from hostname nap local name cairo l2tp tunnel password 7 052827261363 ! ! interface Loopback1 ip address 212.93.194.5 255.255.255.252 ! interface Loopback2 ip address 15.15.15.5 255.255.255.252 ! ! interface FastEthernet0/0 ip address 10.200.56.2 255.255.255.0 ip ospf network point-to-multipoint no ip mroute-cache load-interval 60 duplex half no cdp enable ! interface ATM2/0 no ip mroute-cache atm pvc 1 0 5 qsaal atm pvc 2 0 16 ilmi no atm ilmi-keepalive ! ! ! ! ! interface ATM2/0.61 point-to-point description L2TP tunnel link ip address 14.14.14.5 255.255.255.252 pvc 61/61 broadcast encapsulation aal5snap ! ! interface ATM2/0.5555 multipoint pvc 55/55 encapsulation aal5mux ppp Virtual-Template24 ! ! ! interface Virtual-Template24 ip unnumbered Loopback1 peer default ip address pool SSG-L2TP ppp authentication pap ayman ! ! router eigrp 5 network 14.14.14.4 0.0.0.3 network 15.15.15.4 0.0.0.3 no auto-summary no eigrp log-neighbor-changes ! ! ip route 212.93.193.112 255.255.255.252 14.14.14.6 ip local pool SSG-L2TP 212.93.197.114 212.93.197.126 radius-server host 10.200.56.16 auth-port 1645 acct-port 1646 radius-server retransmit 3 radius-server attribute 25 nas-port format d radius-server attribute nas-port format d radius-server key cisco radius-server vsa send accounting radius-server vsa send authentication ! ! ! ! line con 0 exec-timeout 0 0 password 7 010411 login authentication tty transport input none line aux 0 password 7 021113 line vty 0 4 exec-timeout 0 0 password 7 010411 login authentication tty line vty 5 15 ! end !

Cisco 7204 LNS（主機名ior）

Building configuration... 

Current configuration : 6769 bytes 
! 
version 12.2 
no service single-slot-reload-enable 
service timestamps debug datetime msec localtime show-timezone 
service timestamps log datetime localtime show-timezone 
no service password-encryption 
! 
hostname ior 
! 
boot system flash c7200-is-mz.122-1.bin 
logging buffered 16384 debugging 
logging rate-limit console 10 except errors 
aaa new-model 
aaa authentication login default none 
aaa authentication login tty enable 
aaa authentication ppp ayman local 
aaa nas port extended 
enable password 7 03134C 
! 
username ayman@cairo.com password 0 ayman 
clock timezone GMT+1 1 
clock summer-time PDT recurring 
ip subnet-zero 
no ip source-route 
ip cef 
! 
! 
no ip finger 
ip tcp window-size 8192 
ip ftp username tftp 
ip ftp password 7 061118
ip host rund 172.17.247.195 
ip host PAGENT-SECURITY-V3 57.63.30.76 95.26.0.0 
! 
! 
! 
! 
! 
vpdn enable 
no vpdn logging 
vpdn search-order domain 
! 
vpdn-group 1 
accept-dialin 
  protocol l2tp 
  virtual-template 24 
terminate-from hostname nap 
local name cairo 
l2tp tunnel password 7 052827261363 
! 
! 
interface Loopback1 
ip address 212.93.194.5 255.255.255.252 
! 
interface Loopback2 
ip address 15.15.15.5 255.255.255.252 
! 
! 
interface FastEthernet0/0 
ip address 10.200.56.2 255.255.255.0 
ip ospf network point-to-multipoint 
no ip mroute-cache 
load-interval 60 
duplex half 
no cdp enable 
! 
interface ATM2/0 
no ip mroute-cache 
atm pvc 1 0 5 qsaal 
atm pvc 2 0 16 ilmi 
no atm ilmi-keepalive 
! 
! 
! 
! 
! 
interface ATM2/0.61 point-to-point 
description L2TP tunnel link
ip address 14.14.14.5 255.255.255.252 
pvc 61/61 
  broadcast 
  encapsulation aal5snap 
! 
! 
interface ATM2/0.5555 multipoint 
pvc 55/55 
  encapsulation aal5mux ppp Virtual-Template24 
! 
! 
! 
interface Virtual-Template24 
ip unnumbered Loopback1 
peer default ip address pool SSG-L2TP 
ppp authentication pap ayman 
! 
! 
router eigrp 5 
network 14.14.14.4 0.0.0.3 
network 15.15.15.4 0.0.0.3 
no auto-summary 
no eigrp log-neighbor-changes 
! 
! 
ip route 212.93.193.112 255.255.255.252 14.14.14.6 
ip local pool SSG-L2TP 212.93.197.114 212.93.197.126 
radius-server host 10.200.56.16 auth-port 1645 acct-port 1646 
radius-server retransmit 3 
radius-server attribute 25 nas-port format d 
radius-server attribute nas-port format d 
radius-server key cisco 
radius-server vsa send accounting 
radius-server vsa send authentication 
! 
! 
! 
!
line con 0 
exec-timeout 0 0 
password 7 010411 
login authentication tty 
transport input none 
line aux 0 
password 7 021113 
line vty 0 4 
exec-timeout 0 0 
password 7 010411 
login authentication tty 
line vty 5 15 
! 
end 
!

在實施新配置之前，您必須將Cisco 677重置為其預設配置。要恢復預設配置，請使用set nvram erase命令；例如：

cbos#set nvram erase
Erasing running configuration.
You must use "write" for changes to be permanent.

cbos#write
NVRAM written.

cbos#reboot

在思科677思科寬頻作業系統(CBOS)上啟用DHCP伺服器功能會自動建立名為「pool0」的池，並分配子網為10.0.0.0，子網掩碼為255.255.255.0。預設情況下，Cisco 677乙太網介面的IP地址分配為10.0.0.1，然後「pool0」可以為本地LAN客戶端/PC租用10.0.0.2到10.0.0.254之間的IP地址。

思科677
!--- This configuration must be done !--- after NVRAM has been erased. set ppp wanipcp 0.0.0.0 set ppp wan0-0 login hisham set ppp wan0-0 passward hisham set dhcp server enabled set nat enabled set int wan0-0 close set int wan0-0 vpi 1 set int wan0-0 vci 60 set int wan0-0 open write reboot

思科677


!--- This configuration must be done !--- after NVRAM has been erased.

set ppp wanipcp 0.0.0.0
set ppp wan0-0 login hisham
set ppp wan0-0 passward hisham
set dhcp server enabled
set nat enabled
set int wan0-0 close
set int wan0-0 vpi 1
set int wan0-0 vci 60
set int wan0-0 open
write
reboot

RADIUS設定檔

以下遠端撥入使用者服務(RADIUS)配置檔案適用於遠端使用者和服務。

遠端使用者hisham的配置檔案
服務組旅行的概況
服務群組城市概況
cairo.com服務的配置檔案
下一跳表的配置檔案

遠端使用者hisham的配置檔案
root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u hisham User Profile Information user = hisham{ profile_id = 119 profile_cycle = 11 member = ayman radius=SSG-6400 { check_items= { 2=hisham } reply_attributes= { 6=2 7=1 9,250="GTravelling" } } }

遠端使用者hisham的配置檔案

root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u hisham 
User Profile Information 
user = hisham{ 
profile_id = 119 
profile_cycle = 11 
member = ayman 
radius=SSG-6400 { 
check_items= { 
2=hisham 
} 
reply_attributes= { 
6=2 
7=1
9,250="GTravelling" 
} 
} 
}

服務組旅行的概況
root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u Travelling User Profile Information user = Travelling{ profile_id = 165 profile_cycle = 3 member = Services radius=SSG-6400 { check_items= { 2=cisco } reply_attributes= { 6=5 9,250="IMiddle East" 9,250="GCities" } } }

服務組旅行的概況

root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u Travelling 
User Profile Information 
user = Travelling{ 
profile_id = 165 
profile_cycle = 3 
member = Services 
radius=SSG-6400 { 
check_items= { 
2=cisco 
} 
reply_attributes= { 
6=5 
9,250="IMiddle East" 
9,250="GCities" 
} 
} 
}

服務群組城市概況
User Profile Information user = Cities{ profile_id = 167 profile_cycle = 3 member = Services radius=SSG-6400 { check_items= { 2=cisco } reply_attributes= { 6=5 9,250="ICairo" 9,250="Ncairo.com" } } }

cairo.com服務的配置檔案
root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u cairo.com User Profile Information user = cairo.com{ profile_id = 144 profile_cycle = 17 member = Services radius=SSG-6400 { check_items= { 2=cisco } reply_attributes= { 6=5 9,1="vpdn:tunnel-id=nap" 9,1="vpdn:l2tp-tunnel-password=CAIRO" 9,1="vpdn:tunnel-type=l2tp" 9,1="vpdn:ip-addresses=15.15.15.5" 9,251="Ocairo.com" 9,251="R15.15.15.4;255.255.255.252" 9,251="TT" 9,251="IEgyptian Capital" 9,251="Gcairo.com_key" } } }

cairo.com服務的配置檔案

root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u cairo.com
User Profile Information
user = cairo.com{
profile_id = 144
profile_cycle = 17
member = Services
radius=SSG-6400 {
check_items= {
2=cisco
}
reply_attributes= {
6=5
9,1="vpdn:tunnel-id=nap"
9,1="vpdn:l2tp-tunnel-password=CAIRO"
9,1="vpdn:tunnel-type=l2tp"
9,1="vpdn:ip-addresses=15.15.15.5"
9,251="Ocairo.com"
9,251="R15.15.15.4;255.255.255.252"
9,251="TT"
9,251="IEgyptian Capital"
9,251="Gcairo.com_key"
}
}
}

下一跳表的配置檔案
root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u nxthoptbl User Profile Information user = nxthoptbl{ profile_id = 168 profile_cycle = 2 member = Services radius=SSG-6400 { check_items= { 2=cisco } reply_attributes= { 6=5 9,253="Gcairo.com_key;14.14.14.5" } } }

下一跳表的配置檔案

root@canonball[/opt/csecure/CLI]ViewProfile -p 9900 -u nxthoptbl
User Profile Information
user = nxthoptbl{
profile_id = 168
profile_cycle = 2
member = Services
radius=SSG-6400 {
check_items= {
2=cisco
}
reply_attributes= {
6=5
9,253="Gcairo.com_key;14.14.14.5"
}
}
}

疑難排解

單一登入SSD 2.5.1功能是什麼？

此功能適用於SSD伺服器。當SSD伺服器在其快取資料庫中找不到傳送HTTP流量的遠端客戶端的主機對象時，它會向SSG傳送訪問請求。如果SSG具有主機對象，則會向SSD傳送訪問接受消息。然後，使用者可以授予對服務的訪問許可權。

如果SSD或SSG上沒有主機物件，則使用者應該使用一般的SSD登入驗證程式在SSD上進行驗證。

配置SSG和SSD之前需要瞭解什麼？

在配置SSD或SSG之前，您必須驗證以下內容：

SSD、SSG以及身份驗證、授權和記帳(AAA)均在運行，並且所有網路實體可以彼此ping通。
遠端使用者可以在登入到SSG伺服器之前，對預設網路(SSG、SSD、AAA)中的任何主機執行ping操作。
網路訪問提供程式(NAP)（在本例中為Cisco 6400 NRP1）可以ping服務目標網路。
遠端客戶端無法ping遠端服務目標網路。

啟動PPPoA會話之後，但在設定SSD登入之前，該怎麼做？

配置完所有SSG命令後，您必須驗證是否已成功下載使用者服務的下一跳表。發出show ssg binding命令。

arielle_nrp3# show ssg binding
cairo.com_key        -> 14.14.14.5 (NHT)

arielle_nrp3# show ssg next-hop
Next hop table loaded from profile nxthoptbl:
cairo.com_key        -> 14.14.14.5
End of next hop table.

檢查所有方向繫結在SSG上是否都處於活動狀態。

arielle_nrp3# show ssg direction
Virtual-Template66: Downlink

!--- You can verify this by enabling debug ssg ctrl-events after the !--- remote user tries to initiate its PPPoA session to access the NRP.

Jun 18 02:13:12.791: SSG-CTL-EVN: Handling PPP logon for user hisham.
Jun 18 02:13:12.791: SSG-CTL-EVN: Locate/create SSG sub-block from/for Virtual-Access3.
Jun 18 02:13:12.791: SSG-CTL-EVN: Checking for old HostObject in the sub-block.
Jun 18 02:13:12.791: SSG-CTL-EVN:  SSG: pppterm: NO extra data for PPP logon
Jun 18 02:13:12.791: SSG-CTL-EVN: Authenticating user hisham for PPP logon.
Jun 18 02:13:12.799: SSG-CTL-EVN: Creating HostObject for the PPP user hisham.
Jun 18 02:13:12.799: SSG-CTL-EVN: Set Host Mac Address .
Jun 18 02:13:12.799: SSG-CTL-EVN: ** attr->type = 6
Jun 18 02:13:12.799: SSG-CTL-EVN: ATTR_LOOP = 1
Jun 18 02:13:12.799: SSG-CTL-EVN: ** attr->type = 7
Jun 18 02:13:12.799: SSG-CTL-EVN: ATTR_LOOP = 2
Jun 18 02:13:12.799: SSG-CTL-EVN: ATTR_LOOP = 3
Jun 18 02:13:12.799: SSG-CTL-EVN: ATTR_LOOP = 4
Jun 18 02:13:12.799: SSG-CTL-EVN: PPP logon for user hisham is accepted.
The link is Virtual-Access3
Jun 18 02:13:12.799: SSG-CTL-EVN: Bind the HostObject to Virtual-Access3.

!--- Downlink binding success.

Jun 18 02:13:12.867: SSG-CTL-EVN: IPCP is up. Locate SSG sub-block from Virtual-Access3.
Jun 18 02:13:12.871: SSG-CTL-EVN: Locate HostObject from the sub-block.
Jun 18 02:13:12.871: SSG-CTL-EVN: Set Host IP 212.93.193.114.

!--- Host object is created.

Jun 18 02:13:12.879: SSG-CTL-EVN: Host Mac Address lookup failed
Jun 18 02:13:12.879: SSG-CTL-EVN: Activate the HostObject.
Link=Virtual-Access3

!--- Host object is active.

Jun 18 02:13:12.879: SSG-CTL-EVN: ##### ssg_l2tp_ip_up:
03:49:01: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access3,
changed state to up

當客戶端向SSD伺服器啟動HTTP會話時，使用者將看到SSD伺服器登入首頁。

注意：請記住發出UNIX shell命令root@crazyball[/export/home/ssd251/ssd]startSSD.sh啟動SSD伺服器操作。

如何測試SSD單一登入功能？

配置dashboard.conf檔案中的引數(REAUTHENTICATE=off)。預設值為REAUTHENTICATE=on。
登入SSD上的任何網頁。例如，當您登入cairo.com服務首頁時，請關閉瀏覽器，然後使用http://10.200.56.40:8080再次開啟瀏覽器。

SSD上的主機物件仍在快取記憶體中，因此您應該能夠再次登入先前登入的SSD服務頁面。預設行為是在SSD上重新進行身份驗證；也就是說，您必須轉到SSD登入首頁。

如何執行SSD偵錯？

在瀏覽器的位址列中鍵入https://10.200.56.40:8443/log。
按一下Set Option。您選取的所有偵錯都會執行，而輸出會記錄在記錄檔中。日誌檔名的格式為yy_mm_dd.request.log。
導航到SSD伺服器上日誌檔案所在的目錄。
使用UNIX編輯器打開檔案/export/home/ssd251/ssd/logs]vi yy_mm_dd.request.log以檢視調試輸出。

範例偵錯輸出

NRP1輸出

arielle_nrp3# show debugging
SSG:
SSG data path packets debugging is on
SSG control path events debugging is on
SSG control path packets debugging is on
SSG packets debugging is on
Radius protocol debugging is on
Just before the SSD logon, the output of these debugs are :
Jun 18 23:30:08.414:
SSG-DATA:CEF-SSGSubBlock=0(AT0/0/0.61:0.0.0.0->0.0.0.0)
Jun 18 23:30:09.530:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 18 23:30:11.142:
SSG-DATA:CEF-SSGSubBlock=0(AT0/0/0.61:0.0.0.0->0.0.0.0)
Jun 18 23:30:11.494:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 18 23:30:12.482:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 18 23:30:13.310:
SSG-DATA:CEF-SSGSubBlock=0(AT0/0/0.61:0.0.0.0->0.0.0.0)
Jun 18 23:30:14.462:

Jun 18 23:39:39.610: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.638:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 18 23:39:39.638:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 18 23:39:39.642: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.642:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 18 23:39:39.646: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.674:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 18 23:39:39.678:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 18 23:39:39.678: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.682:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 18 23:39:39.686:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 18 23:39:39.686: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.698: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.742: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.926: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.926: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.926: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 18 23:39:39.926: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)

Jun 19 00:39:17.477: RADIUS: Initial Transmit  id 18 10.200.56.16:1645,
Access-Request, len 58
Jun 19 00:39:17.477:         Attribute 4 6 D45DC301
Jun 19 00:39:17.477:         Attribute 61 6 00000000
Jun 19 00:39:17.477:         Attribute 1 8 68697368
Jun 19 00:39:17.477:         Attribute 2 18 31B0CDC2
Jun 19 00:39:17.481: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 19 00:39:17.481: RADIUS: Received from id 18 10.200.56.16:1645,
Access-Accept, len 70
Jun 19 00:39:17.481:         Attribute 6 6 00000002
Jun 19 00:39:17.481:         Attribute 7 6 00000001
Jun 19 00:39:17.481:         Attribute 26 20 00000009FA0E4754
Jun 19 00:39:17.481:         Attribute 26 18 00000009FA0C4742
Jun 19 00:39:17.481: RADIUS: saved authorization data for user 61E73934 at
61E72A58
Jun 19 00:39:17.481: SSG-CTL-EVN: Creating HostObject for host
212.93.193.114.
Jun 19 00:39:17.489: SSG-CTL-EVN: Set Host Mac Address .
Jun 19 00:39:17.489: SSG-CTL-EVN: ** attr->type = 6
Jun 19 00:39:17.489: SSG-CTL-EVN: ATTR_LOOP = 1
Jun 19 00:39:17.489: SSG-CTL-EVN: ** attr->type = 7
Jun 19 00:39:17.493: SSG-CTL-EVN: ATTR_LOOP = 2
Jun 19 00:39:17.493: SSG-CTL-EVN: ATTR_LOOP = 3
Jun 19 00:39:17.493: SSG-CTL-EVN: ATTR_LOOP = 4
Jun 19 00:39:17.493: SSG-CTL-EVN: Account logon is accepted
(212.93.193.114,hisham).


arielle_nrp3# show ssg host 212.93.193.114
------------------------ HostObject Content -----------------------
Activated: TRUE
Interface: Virtual-Access3
User Name: hisham
Host IP: 212.93.193.114
Msg IP: 10.200.56.40 (9902)
Host DNS IP: 0.0.0.0
Maximum Session Timeout: 0 seconds
Host Idle Timeout: 0 seconds
Class Attr: NONE
User logged on since: 01:54:33.000 UTC Tue Jun 19 2001
User last activity at: 01:54:33.000 UTC Tue Jun 19 2001
Default Service: NONE
DNS Default Service: NONE
Active Services: NONE

!--- No Services are active yet.

AutoService: NONE
Subscribed Services:

The following output also results from the debug commands that are turned on before the SSD logon. 

Jun 19 02:06:39.529:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 19 02:06:40.789:
SSG-DATA:CEF-MulticastDest=1(AT0/0/0.61:14.14.14.5->224.0.0.10)
Jun 19 02:06:41.581:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 19 02:06:42.509:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 19 02:06:43.313:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 19 02:06:43.313: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 19 02:06:43.349:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 19 02:06:43.353:


arielle_nrp3# show ssg host 212.93.193.114
------------------------ HostObject Content -----------------------
Activated: TRUE
Interface: Virtual-Access3
User Name: hisham
Host IP: 212.93.193.114
Msg IP: 10.200.56.40 (9902)

!--- Message server IP & port adddress, and TCP port used. !--- This is configured in the dashboard.conf file.

Host DNS IP: 0.0.0.0
Maximum Session Timeout: 0 seconds
Host Idle Timeout: 0 seconds
Class Attr: NONE
User logged on since: 01:54:33.000 UTC Tue Jun 19 2001
User last activity at: 01:54:33.000 UTC Tue Jun 19 2001
Default Service: NONE
DNS Default Service: NONE
Active Services: NONE
AutoService: NONE
Subscribed Services:
arielle_nrp3#

此時，使用者尚未登入任何服務。客戶首先在SSD網頁的服務清單中看到MiddleEast、Cairo，然後看到Egetic Capital。使用者端按一下Egypeople Capital後，使用者名稱和密碼欄位就會顯示在頁面上。尚未將任何使用中服務與使用者端關聯。使用者端提供用來存取cairo.com服務的使用者名稱和密碼，必須符合L2TP網路伺服器(LNS)設定的使用者名稱和密碼。在此設定中，LNS在本地對使用者進行身份驗證。使用者名稱是ayman@cairo.com，密碼是ayman。

L2TP訪問集中器(LAC)輸出

arielle_nrp3# show debugging 
SSG:
SSG data path packets debugging is on
SSG control path events debugging is on
SSG control path packets debugging is on
SSG packets debugging is on
VPN:
L2X protocol events debugging is on
L2X data packets debugging is on
L2X control packets debugging is on
L2TP data sequencing debugging is on
Radius protocol debugging is on

Jun 19 02:34:48.121:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 19 02:34:48.157:
SSG-DATA:CEF-FIB_FLAG_RECEIVE=1(Vi3:212.93.193.114->10.200.56.6)
Jun 19 02:34:49.681:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 19 02:34:49.685: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 19 02:34:49.717:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 19 02:34:49.725:
SSG-DATA:CEF-UP-DefaultNetwork=1(Vi3:212.93.193.114->10.200.56.40)
Jun 19 02:34:49.725: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 19 02:34:49.777: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 19 02:34:49.777: SSG-CTL-PAK: Received Packet:
sIP=10.200.56.40 sPort=37638 dIP=10.200.56.6 dPort=1645
Jun 19 02:34:49.777:    header: code=1, id=19, len=102,
auth=3F53BB3F2939DAA1E5D9435792491CD3
Jun 19 02:34:49.777:    attr: type=1, len=17, val=ayman@cairo.com
Jun 19 02:34:49.777:    attr: type=2, len=18, val=(89)(C4)/}(BB)(8F)
Jun 19 02:34:49.777:    attr: type=6, len=6, val=(00)(00)(00)(02)
Jun 19 02:34:49.777:    attr: type=26, len=23,

Jun 19 02:34:49.777: SSG-CTL-EVN: Downloading service profile for service
cairo.com.
Jun 19 02:34:49.777: RADIUS: ustruct sharecount=1
Jun 19 02:34:49.777: RADIUS: Initial Transmit  id 73 10.200.56.16:1645,
Access-Request, len 67
Jun 19 02:34:49.777:         Attribute 4 6 D45DC301
Jun 19 02:34:49.777:         Attribute 61 6 00000000
Jun 19 02:34:49.777:         Attribute 1 11 63616972
Jun 19 02:34:49.777:         Attribute 2 18 51CF64B7
Jun 19 02:34:49.777:         Attribute 6 6 00000005
Jun 19 02:34:49.785: SSG-DATA:CEF-SSGSubBlock=0(Fa0/0/0:0.0.0.0->0.0.0.0)
Jun 19 02:34:49.785: RADIUS: Received from id 73 10.200.56.16:1645,
Access-Accept, len 275
Jun 19 02:34:49.785:         Attribute 6 6 00000005
Jun 19 02:34:49.785:         Attribute 26 27 0000000901157670
Jun 19 02:34:49.785:         Attribute 26 40 0000000901227670
Jun 19 02:34:49.785:         Attribute 26 30 0000000901187670
Jun 19 02:34:49.785:         Attribute 26 37 00000009011F7670

Jun 19 02:34:49.789: SSG-CTL-EVN: ##### ssg_l2tp_disc_cause: termCause=1026
Jun 19 02:34:49.789: SSG-CTL-EVN: ssg_l2tp_disc_routine:
Jun 19 02:34:49.801: SSG-CTL-EVN: Checking service mode.
Jun 19 02:34:49.801: SSG-CTL-EVN: ServiceLogon: Enqueue request of service
cairo.com


arielle_nrp3# show ssg host 212.93.193.114
------------------------ HostObject Content -----------------------
Activated: TRUE
Interface: Virtual-Access3
User Name: hisham
Host IP: 212.93.193.114
Msg IP: 10.200.56.40 (9902)
Host DNS IP: 0.0.0.0
Maximum Session Timeout: 0 seconds
Host Idle Timeout: 0 seconds
Class Attr: NONE
User logged on since: 01:54:33.000 UTC Tue Jun 19 2001
User last activity at: 02:34:49.000 UTC Tue Jun 19 2001
Default Service: NONE
DNS Default Service: NONE
Active Services: cairo.com

!--- A service is active.

AutoService: NONE
Subscribed Services:


arielle_nrp3# show ssg service cairo.com
------------------------ ServiceInfo Content -----------------------
Uplink IDB:
Name: cairo.com
Type: TUNNEL
Mode: CONCURRENT
Service Session Timeout: 0 seconds
Service Idle Timeout: 0 seconds
Authentication Type: CHAP
Next Hop Gateway Key: cairo.com_key
DNS Server(s):
TunnelId: nap
TunnelPassword: CAIRO
HomeGateway Addresses: 15.15.15.5
Included Network Segments:
15.15.15.4/255.255.255.252
Excluded Network Segments:
ConnectionCount 1
Full User Name not used
Domain List: cairo.com;
Active Connections:
1   : RealIP=212.93.197.114, Subscriber=212.93.193.114
------------------------ End of ServiceInfo Content ----------------

在上面的輸出中，RealIP是服務網路給使用者hisham的IP地址。Subscriber欄位顯示SSG NRP訪問網路為使用者hisham指定的IP地址。

arielle_nrp3# show ssg connection 212.93.193.114 cairo.com
------------------------ ConnectionObject Content ----------------------- 
User Name: ayman@cairo.com Owner 
Host: 212.93.193.114 Associated Service: cairo.com Connection State: 0 (UP) Connection 
Started since: 02:34:51.000 UTC Tue Jun 19 2001 User last activity at: 02:34:51.000 
UTC Tue Jun 19 2001 Connection Real IP: 212.93.197.114 L2TP VIDB: Virtual-Access4 
L2TP Session Key: 0 Connection Traffic Statistics: Input Bytes = 0 (HI = 0), Input 
packets = 0 Output Bytes = 0 (HI = 0), Output packets = 0

LNS輸出

ior# show debugging VPN
L2X protocol events debugging is on
L2X data packets debugging is on
L2X control packets debugging is on
L2TP data sequencing debugging is on

*Jun 18 19:27:09.851 PDT: L2X: Parse  AVP 0, len 8, flag 0x8000 (M)
*Jun 18 19:27:09.851 PDT: L2X: Parse SCCRQ
*Jun 18 19:27:09.851 PDT: L2X: Parse  AVP 2, len 8, flag 0x8000 (M)
*Jun 18 19:27:09.851 PDT: L2X: Protocol Ver 256
*Jun 18 19:27:09.851 PDT: L2X: Parse  AVP 3, len 10, flag 0x8000 (M)
*Jun 18 19:27:09.851 PDT: L2X: Framing Cap 0x0
*Jun 18 19:27:09.851 PDT: L2X: Parse  AVP 4, len 10, flag 0x8000 (M)
*Jun 18 19:27:09.851 PDT: L2X: Bearer Cap 0x0
*Jun 18 19:27:09.855 PDT: L2X: Parse  AVP 6, len 8, flag 0x0

*Jun 18 19:27:09.855 PDT: L2X: I SCCRQ, flg TLS, ver 2, len 128, tnl 0, cl 0, ns 0, nr 0
C8 02 00 80 00 00 00 00 00 00 00 00 80 08 00 00
00 00 00 01 80 08 00 00 00 02 01 00 80 0A 00 00
00 03 00 00 00 00 80 0A 00 00 00 04 00 00 00 ...
*Jun 18 19:27:09.855 PDT: L2TP: I SCCRQ from nap tnl 13552
*Jun 18 19:27:09.855 PDT: Tnl 4818 L2TP: Got a challenge in SCCRQ, nap
*Jun 18 19:27:09.855 PDT: Tnl 4818 L2TP: New tunnel created for remote nap,