Configuring an LNS

To establish an L2TP tunnel between a LAC and an LNS, you need to configure an L2TP connection and set tunnel parameters and an authentication mode on the LNS.

Usage Scenario

An NetEngine 8000 F functioning as an LNS provides tunnel boards to process the tunnel service, responds to the tunnel setup request from a LAC, authenticates users, and assigns IP addresses to them.

An NetEngine 8000 F manages LNS services using LNS groups. When LNS groups are configured on an NetEngine 8000 F, the device functions like multiple LNSs. You can configure an IP address for each LNS group and specify a tunnel board for it.

When an NetEngine 8000 F functions as an LNS, it is recommended that the IP address of the device's loopback interface be used as the IP address of the LNS.
An LNS cannot use a DHCP server to allocate IP addresses to users because the LNS does not know users' MAC addresses. An LNS can only allocate IP address in its local address pool to users.
When an LNS interconnects with a LAC, the LNS must have a route to the LAC. For example, when an NetEngine 8000 F functioning as a LAC is configured with a source interface on the tunnel, the route to the source interface must be configured on the LNS.

Pre-configuration Task

Before configuring an LNS, complete the following tasks:

Configure AAA schemes.
Configure a local address pool that is used to allocate IP addresses to L2TP users and specify this address pool in the AAA domain.

Enabling the L2TP Function: To set up an L2TP tunnel between a LAC and an LNS, L2TP must be first enabled.

Configuring an L2TP Connection on an LNS: To set up a tunnel, you need to set a virtual template and user authentication domain in the L2TP group view on an LNS.

Configuring L2TP Tunnel Authentication: An L2TP tunnel can be successfully established only after L2TP tunnel authentication succeeds.

(Optional) Configuring User Authentication on the LNS: Generally, access L2TP users are authenticated on a LAC and do not need to be authenticated on an LNS again. However, if the LNS does not trust the LAC, the users need to be authenticated again on the LNS after the connections between the users and the LNS are established.

(Optional) Configuring URPF for L2TP Users: To prevent source address spoofing attacks, enable URPF for L2TP users.

Configuring an LNS Group: Before establishing an L2TP tunnel, create an LNS group and set parameters, such as the source interface, tunnel board, number of tunnels that can be established, and the function of re-marking the packet priorities after performing CAR, for the LNS group.

(Optional) Enabling BGP Route Recursion to UNR Routes: When clients attached to a CPE are connected to an LNS through a LAC and the CPE uses L2TP dial-up to obtain an IP address from the LNS, to allow the clients to properly communicate with the LNS, enable BGP route recursion to UNR routes.

Verifying the LNS Configuration: This section describes how to verify the configurations of the L2TP group, session information, and the tunnel on the LNS after the LNS is configured and users go online.