L2TP Profile Configuration
The configuration of the Layer 2 Tunnel Protocol (L2TPv2) profile is optional for subscriber management. It is necessary only if you want to enable L2TP tunneling.
The following diagram illustrates how the L2TP profile configuration is are associated with the other Subscriber Management tasks.
Configuring the L2TP Profile
The following command and options allow you to configure an L2TP profile.
supervisor@switch: cfg> set access l2tp-profile <profile-name> Name of the L2TP profile supervisor@switch: cfg> set access l2tp-profile l2tp-default <cr> client-ipv4 Default value for L2TP tunnel client IPv4 address client-name Default value for L2TP tunnel client name connect-speed-update Enable L2TP Connect-Speed-Update-Notification (CSUN) dead-timeout-interval L2TP tunnel dead timeout interval in seconds hello-interval L2TP tunnel hello interval in seconds hide-authentication Hide L2TP tunnel authentication idle-timeout-interval L2TP tunnel idle timeout interval in seconds inactive-timeout-interval L2TP tunnel inactive timeout interval in seconds instance Instance name pon-access-line-version PON Access Line Information Version pool-name L2TP tunnel pool name receive-window L2TP tunnel receive window request-retries L2TP session request retries request-timeout-interval L2TP session request timeout interval in seconds retransmit-interval L2TP tunnel retransmission interval in seconds selection-algorithm L2TP tunnel selection algorithm service-label MPLS service label session-limit L2TP tunnel session limit
The following example shows a typical L2TPv2 LAC configuration profile. It outlines a typical L2TPv2 LAC profile, defining essential parameters such as session limits, heartbeat intervals, client identification, and security settings.
This configuration example defines an L2TPv2 LAC (L2TP Access Concentrator) profile named 'l2tp-default'. The profile-name is set 'l2tp-default'. This session-limit parameter sets the maximum number of sessions that can be established within this L2TP tunnel. The value '4000' indicates that up to 4000 sessions are allowed. The hello-interval is set to '60' which indicates the interval (in seconds) for sending 'hello' messages to check the status of the L2TP tunnel.
The client-name is specified as 'BNG', which is the name of the client of the L2TP tunnel. The client-ipv4 is set to '198.51.100.200' which is the 'BNG' IP address.
The hide-authentication parameter determines whether the authentication credentials for the L2TP tunnel should be hidden. Setting it to true indicates the credentials are hidden.
The parameter service-label is set to '1234'. It assigns an MPLS service label to the L2TP tunnel. The value '1234' is used as the service label for this tunnel.
supervisor@switch: cfg> show config access l2tp-profile l2tp-default
{
"rtbrick-config:l2tp-profile": {
"profile-name": "l2tp-default",
"session-limit": 4000,
"hello-interval": 60,
"client-name": "BNG",
"client-ipv4": "198.51.100.200",
"hide-authentication": true
"service-label": 1234
}
}
| Attribute | Description | ||
|---|---|---|---|
client-ipv4 |
This is the default IPv4 address for the local L2TP tunnel client (LAC), if no specific address is provided through the L2TP pool or RADIUS configuration. |
||
client-name |
This is the default hostname for the local L2TP tunnel client (LAC) if no specific hostname is provided through the L2TP pool or RADIUS configuration. Default: system hostname |
||
instance |
The routing instance in which the L2TP endpoint (LNS) is reachable. Default: default |
||
service-label |
Define the service label to support L2TP over MPLS. For more details, see Configuring L2TP over MPLS. |
||
selection-algorithm |
It defines how to select a tunnel from a pool of available LNS servers. For more information, see L2TP Tunnel Selection. The RANDOM algorithm selects a tunnel randomly, while the BALANCED algorithm chooses the tunnel with the fewest sessions. Default:: BALANCED Values: BALANCED, RANDOM |
||
session-limit |
This is the default session limit for a tunnel unless otherwise specified. Tunnels that have reached their session limit are not considered for additional sessions. Default: 64000 Range: 1 - 65535 |
||
pool-name |
This allows to assign a default L2TP tunnel pool. For more information, see L2TP Tunnel Pool Configuration. This default can be overwritten by user-defined pool names from the local user profiles (For more information, see User Profile Configuration) or received through RADIUS attribute RtBrick-L2TP-Pool (VSA 26-50058-40). |
||
hello-interval |
Specifies the L2TP tunnel hello interval time, in seconds. '0' indicates disabled. The HELLO keep-alive messages are part of the L2TP control channel. For more information, see L2TP Control Channel. These messages are sent only when the message queue is empty, and no other messages have been transmitted during the hello interval. Default: 30 Range: 0 - 86400 |
||
idle-timeout-interval |
This interval defines the maximum time, in seconds, to keep a tunnel without sessions established. The session will remain forever if this value is set to 0. Default: 600 Range: 0 - 4294966 |
||
dead-timeout-interval |
This interval defines the time, in seconds, This interval defines the time, in seconds, that a tunnel remains in the DEAD state if it becomes unreachable. Once the interval expires, the tunnel transitions back to the DOWN state, making it available for new sessions. Default: 300 Range: 1 - 4294966 |
||
inactive-timeout-interval |
This interval defines the time, in seconds, to keep an inactive tunnel before removal. This interval is reset with every new session request which considers this tunnel as a potential candidate. Default: 900 Range: 1 - 4294966 |
||
receive-window |
Specifies the receive window size offered to the remote peer trough the Receive Window Size AVP (10) in SCCRQ or SCCRP message. For example, if a receive window size of '8' is advertised in the SCCRQ or SCCRP message, the remote peer can send up to 8 unacknowledged control messages. After reaching this limit, it must wait for an acknowledgment to advance the window before sending additional messages. Default: 8 Range: 1 - 256 |
||
request-retries |
Defines the number of times the system attempts to establish a tunnel before considering it unsuccessful. See also the`request-timeout-interval` attribute. Default: 5 Range: 1 - 600 |
||
request-timeout-interval |
This interval, when multiplied by the number of request retries, determines the maximum time (in seconds) to wait for the selected tunnel to establish before selecting to another tunnel from the list. Default: 1 Range: 1 - 30
|
||
retransmit-interval |
This value specifies the interval, in seconds, between retransmissions of a message. Each successive retransmission uses an exponential backoff interval, meaning the interval doubles after each retransmission. For example, if the first retransmission occurs after 1 second, the next will occur after 2 seconds, then 4 seconds, 8 seconds, 16 seconds, 32 seconds, and finally 64 seconds. After a maximum of 6 retransmissions, the interval reaches its maximum value. For a retransmit interval of 1, the total time can reach 64 seconds, and for an interval of 2, it can extend up to 128 seconds and so on. Default: 1 Range: 1 - 30 |
||
hide-authentication |
When enabled, the L2TP proxy will hide the authentication response AVP if the authentication type is PAP, ensuring that the password is not transmitted in plain text. Default: false |
||
pon-access-line-version |
Adding additional PON attributes to the L2TP access line information. (For more information, see L2TP Access Line Information (RFC5515)) as defined in
The value DRAFT-LIHAWI-00 enables PON attributes based on the definition in
Default:: DISABLED Values: DRAFT-LIHAWI-00, DRAFT-LIHAWI-04 |
||
connect-speed-update |
Enable CSUN is an L2TP control message sent by the LAC to the LNS to provide updates on transmit and receive connection speeds for one or more sessions. By default, this feature is disabled but can be enabled using this configuration. Default: false |
Configuring L2TP over MPLS
L2TP over MPLS requires a dedicated L2TP service label which must be defined manually. First, you must assign a specific MPLS label for L2TP services. This is done in the L2TP profile configuration. Next, you must configure BGP to advertise this label. This involves configuring a routing policy that specifies how to handle the L2TP service label in BGP updates.
Following is an example command for L2TP configuration with L2TP service label.
set access l2tp-profile l2tp-default service-label 1234
Advertising this label through BGP must be configured manually as shown in the following example. The exact policy configuration depends on the actual network and existing policy concept.
In the following configuration, the policy named L2TP_MPLS contains rules for traffic related to L2TP over MPLS. The policy consists of multiple rules, each specifying conditions for matching traffic and actions to take.
In the 'Ordinal 1' match rule, it specifies the Type as 'ipv4-prefix', Value-Type as 'discrete', Match-Type as 'exact' and Value is set to '198.51.100.200/24'. This rule matches traffic that has an exact IPv4 prefix of 198.51.100.200/24.
In the Action Rule, it specifies Type as 'label', Operation as 'overwrite' and Value: label is set to '1337,bos:1'. If the traffic matches the IPv4 prefix, the action overwrites the MPLS label with '1337' and sets the BOS bit to '1'.
In the 'Ordinal 2', it defines the action rule. After applying the label overwrite action in 'Ordinal 1', this rule permits the traffic to continue through the network with the updated label.
supervisor@switch: cfg> show config policy
{
"rtbrick-config:policy": {
"statement": [
{
"name": "L2TP_MPLS",
"ordinal": [
{
"ordinal": 1,
"match": {
"rule": [
{
"rule": 1,
"type": "ipv4-prefix",
"value-type": "discrete",
"match-type": "exact",
"value": "198.51.100.200/24"
}
]
},
"action": {
"rule": [
{
"rule": 1,
"type": "label",
"operation": "overwrite",
"value": "label:1337,bos:1"
}
]
}
},
{
"ordinal": 2,
"action": {
"rule": [
{
"rule": 1,
"operation": "return-permit"
}
]
}
}
]
}
]
}
}
In the following configuration, the instance name is set as ‘internet’ and the Address Family is specified as ‘ipv4 and unicast’. The export policy is set to L2TP_MPLS, indicating that the label defined in the L2TP_MPLS policy will be advertised for this instance.
supervisor@switch: cfg> show config instance internet
{
"rtbrick-config:instance": {
"name": "internet",
"address-family": [
{
"afi": "ipv4",
"safi": "unicast",
"policy": {
"export": "L2TP_MPLS"
}
}
]
}
}