topic Re: ISE Use Case in the L2TP Dial-in in Network Access Control

ISE Use Case in the L2TP Dial-in

Weiborao — Mon, 07 Aug 2017 16:10:00 GMT

Dear Experts,

My customer’s requirement is the L2TP VPDN.

They want to deploy a Radius server behind the LAC (L2TP Access Concentrator), which is used to return the LNS (L2TP Network Server) address to the LAC, when L2TP client initiates the Dial-in process.

I heard that this was a standard Radius behavior, and Cisco ACS works well.

Does ISE work in this use case?

Thank you.

Best regards,

Weibo Rao.

Re: ISE Use Case in the L2TP Dial-in

Craig Hyps — Mon, 07 Aug 2017 20:50:51 GMT

Yes, it should work, but not aware of any specific QA testing on this less common use case. These are standard RADIUS attributes. If the default values do not include the attributes specific to L2TP, then you can use the Advanced Attributes section to add custom value settings. Some example RADIUS attributes shown in example here: Tunnel Authentication via RADIUS on Tunnel Terminator - Cisco

/Craig

Re: ISE Use Case in the L2TP Dial-in

hslai — Mon, 07 Aug 2017 22:08:41 GMT

Adding to Craig.

https://www.cisco.com/c/en/us/td/docs/wireless/asr_5000/20/GGSN/b_20_GGSN_Admin/b_19_GGSN_Admin_chapter_010011.pdf

mentions

The system determines that the egress context is the destination context based on the configuration of either the Default subscriber's ip-context name or from the SN-VPN-NAME or SN1-VPN-NAME attributes that is configured in the subscriber's RADIUS profile.

I found freeradius/dictionary.starent at master · redBorder/freeradius · GitHub and made a minor change so ISE can import it.

Re: ISE Use Case in the L2TP Dial-in

Weiborao — Tue, 08 Aug 2017 13:47:05 GMT

Thank you for your support.

Re: ISE Use Case in the L2TP Dial-in

Weiborao — Tue, 08 Aug 2017 13:47:37 GMT

Thank you for your support and contribution.

Re: ISE Use Case in the L2TP Dial-in

hamidreza.taghipur — Sat, 22 Jun 2019 15:45:30 GMT

I have cisco router for vpdn server and my clients are windows l2tp connection , and i use cisco ise ( join domain) for radius server and router send aaa to ise . Every thing is ok but radius live log is bad , i have not any clients endpoint address,clients mac address and live session in radius live log , it s show just user authenticatin and authorization users . Please help me .