Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Announcement: Try the Ask AI chatbot for answers to your technical questions about Juniper products and solutions.

close
header-navigation
keyboard_arrow_up
close
keyboard_arrow_left
list Table of Contents
file_download PDF
{ "lLangCode": "en", "lName": "English", "lCountryCode": "us", "transcode": "en_US" }
English
keyboard_arrow_right

Configuring L2TP Client Access to Support MLPPP for Static Subscribers

date_range 06-Dec-23

To enable MLPPP over LT2P network server (LNS) support for MX Series, you must indicate whether MLPPP is supported for static subscribers from a particular L2TP client (LAC) by configuring the multilink statement currently supported in access profile. Access profiles define how to validate Layer 2 Tunneling Protocol (L2TP) connections and session requests. Within each L2TP access profile, you configure one or more clients (LACs). You can configure multiple access profiles and multiple clients within each profile.

With mixed mode support, the multilink statement enables MLPPP but does not set it. However, if you do not configure the multilink statement, MLPPP is not supported for static LAC subscribers.

The following two examples show L2TP access profile configurations for an MLPPP-capable static L2TP client and non-multilink (single link) static L2TP client.

To configure an L2TP access profile for MLPPP-capable static L2TP clients:

  1. Create the access profile.
    content_copy zoom_out_map
    [edit access]
    user@host# edit profile access-profile-name
    
  2. Configure characteristics for one or more clients (LACs).
    content_copy zoom_out_map
    [edit access profile access-profile-name]
    user@host# client client-name
    
  3. Associate a group profile containing PPP attributes to apply for the PPP sessions being tunneled from this LAC client.
    content_copy zoom_out_map
    [edit access profile access-profile-name client client-name]
    user@host# set user-group-profile group-profile-name
    
  4. Configure the LNS to renegotiate the link control protocol (LCP) with the PPP client.
    content_copy zoom_out_map
    [edit access profile access-profile-name client client-name]
    user@host# set l2tp lcp-renegotiation
    
  5. Configure the maximum number of sessions allowed in a tunnel from the client (LAC).
    content_copy zoom_out_map
    [edit access profile access-profile-name client client-name]
    user@host# set l2tp maximum-sessions-per-tunnel number
    
  6. Configure the tunnel password used to authenticate the client (LAC).
    content_copy zoom_out_map
    [edit access profile access-profile-name client client-name]
    user@host# set l2tp shared-secret shared-secret
    
  7. (Optional) Specify a local access profile that overrides the global access profile and the tunnel group AAA access profile to configure RADIUS server settings for the client.
    content_copy zoom_out_map
    [edit access profile access-profile-name client client-name]
    user@host# set l2tp aaa-access-profile
    
  8. Specify that the L2TP client is MLPPP-capable for static subscribers.
    content_copy zoom_out_map
    [edit access profile access-profile-name client client-name]
    user@host# set l2tp multilink
    

MLPPP is first negotiated with static subscribers coming from the LAC peer group profile, ce-lac-1-gp, but then switches to PPP if the subscriber rejects MLPPP. The following shows sample output for MLPPP-capable static L2TP client:

content_copy zoom_out_map
access profile {
        ce-l2tp-profile1 {
        client ce-lac-1 {
            user-group-profile ce-lac-1-gp;         
            l2tp {
                interface-id not-used;              
                lcp-renegotiation;                  
                maximum-sessions-per-tunnel 2000;   
                shared-secret "$9$2wgUHQF/9pB";     
                aaa-access-profile ce-aaa-profile;  
                multilink;                          
            }
        }
    }
}

To configure an L2TP access profile for non-MLPPP, or single link static L2TP clients, repeat Step 1 through Step 7 for configuring an L2TP access profile for multilink-capable static L2TP clients. Do not set l2tp multilink.

Only PPP is negotiated with static subscribers from the LAC peer group profile, ce-lac-2-gp, and an LCP configuration request from the customer premises equipment (CPE) with maximum received reconstructed unit (MRRU) option is rejected. The following shows sample output for single link static L2TP client:

content_copy zoom_out_map
access profile {
        ce-l2tp-profile1 {
        client ce-lac-2 {
            user-group-profile ce-lac-1-gp;         
            l2tp {
                interface-id not-used;              
                maximum-sessions-per-tunnel 1000;   
                shared-secret "$9$2aBcXyz/2lP";    
                aaa-access-profile ce-aaa-profile;  
                                                    ## multilink not entered, static subscriber is single link only
            }
        }
    }
}
footer-navigation