Private Servers; Radius Attribute Screening; Packet Fragmentation - Cisco 10000-2P2-2DC Software Configuration Manual

L2TP Network Server
To be VRF aware, ISPs must define multiple instances of the same operational parameters and secure
them to the VRF partitions. Securing AAA parameters to a VRF can be accomplished from one or more
of the following sources:
•
•
•
For more information on the per VRF AAA feature, see the
section on page 5-31

Private Servers

Private servers are servers defined within a server group. These servers have private addresses within the
default server group containing all the servers. Private servers remain hidden from other groups. If you
do not specify private server parameters, global configurations are used. If you do not specify global
configurations, default values are used.
You configure all server operational parameters per host, per server group, or globally. Per host
configurations have precedence over per server group configurations. Per server group configurations
have precedence over global configurations.

RADIUS Attribute Screening

The RADIUS Attribute Screening feature allows you to configure a list of "accept" or "reject" RADIUS
attributes on the Cisco 10000 series router for authorization and accounting purposes. Based on the
accept or reject list you configure for a particular purpose, the Cisco 10000 series router:
•
•
Before you configure a RADIUS accept or reject list, you must enable AAA using the aaa new-model
command in global configuration mode. For more information, see the
Accept or Reject Lists" section on page
or see the Cisco IOS Command Summary, Volume 2 of 3, Release 12.2.

Packet Fragmentation

The setting of the Don't Fragment (DF) bit determines if a packet is eligible for fragmentation. If the DF
bit is clear, a packet is fragmented only if it exceeds the maximum transfer unit (MTU) size. If the DF
bit is set, a packet is not fragmented and instead is dropped. For packets entering an L2TP tunnel that
exceed the MTU size, enter the following command in global configuration mode to configure the Cisco
10000 series router to ignore the setting of the DF bit and to fragment the packets:
Router(config)# [no] ip pxf ignore 12tp df-bit
Cisco 10000 Series Router Software Configuration Guide
5-24
Chapter 5
Virtual template—Used as a generic interface configuration.
Service provider AAA server—Used to associate a remote user with a specific VPN based on the
domain name. The server then provides the VPN-specific configuration for the virtual access
interface that includes the IP address and port number of the customer AAA server.
Customer VPN AAA server—Used to authenticate the remote user and to provide user-specific
configurations for the virtual access interface.
and the "RADIUS Attribute Screening" section on page
Accepts and processes all standard RADIUS attributes
Rejects all standard RADIUS attributes
Configuring the Layer 2 Tunnel Protocol Access Concentrator and Network Server
"Configuring per VRF AAA Services"
5-37, the "RADIUS Attribute Screening" section on page
16-39.
"Configuring RADIUS Attribute
OL-2226-23
16-39,