ISDN 拔入与AAA Date:2001.6.29 Keywords: ISDN AAA Cisco Secure PPP NAS ACL
一台3620上同时配置了8个口BRI和8个内置MODEM用作拔入。因为对公服务，安全性要求比较高，所以使用一台NT 运行 Cisco Secure 2.4 (ACS) 提供AAA服务(Authentication 认证，Authorization 授权，Accounting记帐)。
PSTN 和AAA的集成没有问题，很容易就实现了。
ISDN 拔号要实现授权不同于PSTN，根据CISCO的文档，必须要用Per-User的AAA设置方法（不能通过Group设置用户）和配置Virtual Profile.
由于没有较好的范例可以借鉴，只能通过观察debug ppp negotiation, debug authentication, debug aaa authorization 等命令的输出来摸索配置方法，所以这个配置至少花掉我24个小时，可谓呕心沥血之作。
本例中，当用户user1通过pstn/isdn拔入时，AAA服务器指示（授权）NAS（拔号访问服务器，即3620）对该用户应用access-list 101.
欢迎来信讨论。
! 3620 配置 （摘要）
aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login no_tacacs enable
aaa authentication ppp default group tacacs+
aaa authorization network default group tacacs+
aaa accounting network default start-stop group tacacs+
enable secret 5 $1$FlnA$pGA5cmuIqOOJwFT0iLWdq0
!
username localuser password 0 _password
ip subnet-zero
!
!
no ip finger
no ip domain-lookup
!
virtual-profile virtual-template 1
virtual-profile aaa
isdn switch-type basic-net3
!
!
!
interface FastEthernet0/0
ip address 10.1.10.33 255.255.255.0
duplex auto
speed auto
!
interface BRI1/0
ip unnumbered FastEthernet0/0
encapsulation ppp
no ip route-cache
no ip mroute-cache
no keepalive
dialer-group 1
isdn switch-type basic-net3
peer default ip address pool ip_pool
no fair-queue
ppp authentication chap pap
ppp multilink
!
interface BRI1/1
ip unnumbered FastEthernet0/0
encapsulation ppp
no ip route-cache
no ip mroute-cache
no keepalive
dialer-group 1
isdn switch-type basic-net3
peer default ip address pool ip_pool
no fair-queue
ppp authentication chap pap
ppp multilink
!
...
interface Virtual-Template1
ip unnumbered FastEthernet0/0
peer default ip address pool ip_pool
ppp authentication chap pap
ppp multilink
ppp timeout idle 300
!
interface Group-Async0
ip unnumbered FastEthernet0/0
encapsulation ppp
ip tcp header-compression passive
async dynamic routing
async mode interactive
peer default ip address pool ip_pool
ppp authentication chap pap
group-range 65 80
!
ip local pool ip_pool 10.1.10.1 10.1.10.32
ip classless
ip route 0.0.0.0 0.0.0.0 10.1.10.34
no ip http server
!
access-list 101 deny icmp any host 10.1.11.1 log
access-list 101 permit ip any any
dialer-list 1 protocol ip permit
tacacs-server host 10.1.10.36 single-connection
tacacs-server key _key
!
line con 0
login authentication no_tacacs
transport input none
line 65 80
autoselect during-login
autoselect ppp
modem InOut
modem autoconfigure discovery
transport input all
stopbits 1
flowcontrol hardware
! ACS 配置 （用户）：
设定密码，指定IP分配方法；选中PPP IP, INACL设为101,选中MULTILINK,LCP.