topic Re: 2 virtual templates on the same router in Network Access Control

2 virtual templates on the same router

karl.jones — Sun, 10 Mar 2019 14:04:11 GMT

Hi All

I have a NAS which will be using dialler profiles along with a virtual template. What I would ideally like is 2 virtual templates on the same router .... one for spoke routers dialling in for which no per user dialler is available and a seperate one for , perhaps virtual-template 2 for ISDN TA users dialling in. I have seen somewhere that it may be possibe through the cisco secure acs point diallin users through to a specific virtual template.

Any advice would be greatly appreciated.

Re: 2 virtual templates on the same router

4brown — Wed, 04 Dec 2002 16:24:51 GMT

If you want to use 2 separate methods for dialin clients on virtual templates, you can create 2 separate lists for network authorization like:

aaa authorization network SPOKE if-authenticated radius

aaa authorization network TA radius if-authenticated

interface Virtual-Template1

ppp authorization SPOKE

interface Virtual-Template2

ppp authorization TA

If needed, you could do the same for authentication.

There are probably some examples of this if you searched on virtual-template on CCO.

Hope this helps.

Re: 2 virtual templates on the same router

karl.jones — Sat, 07 Dec 2002 19:17:44 GMT

Thanks for reply .... sorry I am quite new to this ... and will check out examples of this on the web.

Just a couple of Q's .... how does the router know whether the call is coming in from a TA or a spoke router, do I need to specify anything on the ACS and also, silly Q but what is the if-authenticated for?

Many thanks for again for reply

Regards

Re: 2 virtual templates on the same router

4brown — Mon, 09 Dec 2002 17:35:15 GMT

This is done through using two separate lists for authentication/authorization like in the example I mentioned earlier. If using v.120 you would use this command:

vty-async virtual-template 2

If your question related to how it determines a call type and where to terminate it, this is all part of the ISDN Q931 bearer cap information.

"if-authenticated" verifies you are succefully authenticated before performing authorization.

Thanks

Re: 2 virtual templates on the same router

karl.jones — Tue, 10 Dec 2002 10:59:02 GMT

Thanks for reply

I will give this a try

Re: 2 virtual templates on the same router

karl.jones — Mon, 16 Dec 2002 20:17:41 GMT

I hope you can help .... I tried your example, spoke were to dial into virtual-template 1 and TA's into virtual-template 2. But what happened is that the TA's alway dialled into template 1. I changed the virtual-profile virtual-template 2 command aswell but no joy.

Any suggestions would be appreciated as I really could do with spoke routers and TA users coming in on seperate templates.

Best regards

Re: 2 virtual templates on the same router

4brown — Mon, 16 Dec 2002 20:30:53 GMT

Are you using V.120?

Re: 2 virtual templates on the same router

4brown — Mon, 16 Dec 2002 21:55:49 GMT

Try this:

aaa authentication ppp AUTHEN if-needed radius

aaa authorization network ISDN radius if-authenticated

vty-async

vty-async ppp authentication chap pap AUTHEN

vty-async virtual-template 2

interface Virtual-Template2

ppp authentication chap pap callin AUTHEN

ppp authorization ISDN

Re: 2 virtual templates on the same router

karl.jones — Mon, 16 Dec 2002 23:36:47 GMT

No v120 just sync ppp on the TA's, authenticating to the Radius server, and spokes will be using a local usernames and passwords on the NAS (shared password).

Thanks for your post

Is your last post still the way to go

Many thanks for your time

Best regards

Re: 2 virtual templates on the same router

4brown — Tue, 17 Dec 2002 00:12:15 GMT

Just disregard the vty async commands, the list method should work.

Thanks