2 <!DOCTYPE article PUBLIC
"-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://docbook.org/xml/4.4/docbookx.dtd">
7 <title>L2TPNS Manual
</title>
11 <title>Overview
</title>
13 <command>l2tpns
</command> is half of a complete L2TP
14 implementation. It supports only the LNS side of the
19 L2TP (Layer
2 Tunneling Protocol) is designed to allow any layer
20 2 protocol (e.g. Ethernet, PPP) to be tunneled over an IP
21 connection.
<command>l2tpns
</command> implements PPP over L2TP
26 There are a couple of other L2TP implementations, of which
27 <ulink url=
"http://sourceforge.net/projects/l2tpd">l2tpd
</ulink>
28 is probably the most popular. l2tpd also will handle being
29 either end of a tunnel, and is a lot more configurable than
30 <command>l2tpns
</command>. However, due to the way it works, it
31 is nowhere near as scalable.
35 <command>l2tpns
</command> uses the TUN/TAP interface provided by
36 the Linux kernel to receive and send packets. Using some packet
37 manipulation it doesn't require a single interface per
38 connection, as l2tpd does.
42 This allows it to scale extremely well to very high loads and
43 very high numbers of connections.
47 It also has a plugin architecture which allows custom code to be
48 run during processing. An example of this is in the walled
49 garden module included.
53 <sect1 id=
"installation">
54 <title>Installation
</title>
55 <sect2 id=
"installation-requirements">
56 <title>Requirements
</title>
60 Linux kernel version
2.4 or above, with the Tun/Tap
61 interface either compiled in, or as a module.
67 libcli
1.8.5 or greater. You can get this from
68 <ulink url=
"http://sourceforge.net/projects/libcli">
75 <sect2 id=
"installation-compile">
76 <title>Compiling
</title>
78 You can generally get away with just running
79 <command>make
</command> from the source directory. This will
80 compile the daemon, associated tools and any modules shipped
81 with the distribution.
85 <sect2 id=
"installation-install">
86 <title>Installing
</title>
88 After you have successfully compiled everything, run
89 <userinput>make install
</userinput> to install it. By
90 default, the binaries are installed into
91 <filename>/usr/sbin
</filename>, the configuration into
92 <filename>/etc/l2tpns
</filename>, and the modules into
93 <filename>/usr/lib/l2tpns
</filename>.
97 You will definately need to edit the configuration files
98 before you start. See
<xref linkend=
"configuration"/> for
103 <sect2 id=
"installation-run">
104 <title>Running
</title>
106 You only need to run
<filename>/usr/sbin/l2tpns
</filename> as
107 root to start it. It does not normally detach to a daemon
108 process (see the
<option>-d
</option> option), so you should
109 perhaps run it from
<command>init
</command>.
113 By default there is no log destination set, so all log
114 messages will go to stdout.
119 <sect1 id=
"configuration">
120 <title>Configuration
</title>
122 All configuration of the software is done from the files
123 installed into
<filename>/etc/l2tpns
</filename>.
126 <sect2 id=
"config-startup">
127 <title><filename>startup-config
</filename></title>
129 This is the main configuration file for
130 <command>l2tpns
</command>. The format of the file is a list
131 of commands that can be run through the command-line
132 interface. This file can also be written directly by the
133 <command>l2tpns
</command> process if a user runs the
134 <userinput>write memory
</userinput> command, so any comments
135 will be lost. However if your policy is not to write the
136 config by the program, then feel free to comment the file with
137 a
<literal>#
</literal> or
<literal>!
</literal> at the
138 beginning of the line.
142 A list of the possible configuration directives follows. Each
143 of these should be set by a line like:
145 set configstring
"value"
146 set ipaddress
192.168.1.1
153 <term><literal>debug
</literal> (int)
</term>
156 Sets the level of messages that will be written to the
157 log file. The value should be between
0 and
5, with
0
158 being no debugging, and
5 being the highest. A rough
159 description of the levels is:
163 <term><constant>0</constant>: Critical Errors
</term>
165 <para>Things are probably broken
</para>
170 <term><constant>1</constant>: Errors
</term>
173 Things might have gone wrong, but probably will
180 <term><constant>2</constant>: Warnings
</term>
183 Just in case you care what is not quite perfect
189 <term><constant>3</constant>: Information
</term>
191 <para>Parameters of control packets
</para>
196 <term><constant>4</constant>: Calls
</term>
198 <para>For tracing the execution of the code
</para>
203 <term><constant>5</constant>: Packets
</term>
206 Everything, including a hex dump of all packets
207 processed... probably twice
215 Note that the higher you set the debugging level, the
216 slower the program will run. Also, at level
5 a
217 <emphasis>lot
</emphasis> of information will be logged.
218 This should only ever be used for working out why it
225 <term><literal>log_file
</literal> (string)
</term>
228 This will be where all logging and debugging information
229 is written to. This may be either a filename, such as
230 <filename>/var/log/l2tpns
</filename>, or the special
232 <literal>syslog:
</literal><replaceable>facility
</replaceable>,
233 where
<replaceable>facility
</replaceable> is any one of
234 the syslog logging facilities, such as
235 <literal>local5
</literal>.
241 <term><literal>pid_file
</literal> (string)
</term>
244 If set, the process id will be written to the specified
245 file. The value must be an absolute path.
251 <term><literal>random_device
</literal> (string)
</term>
254 Path to random data source (default
255 <filename>/dev/urandom
</filename>). Use
"" to use the
256 rand() library function.
262 <term><literal>l2tp_secret
</literal> (string)
</term>
265 The secret used by
<command>l2tpns
</command> for
266 authenticating tunnel request. Must be the same as the
267 LAC, or authentication will fail. Only actually be used
268 if the LAC requests authentication.
274 <term><literal>l2tp_mtu
</literal> (int)
</term>
277 MTU of interface for L2TP traffic (default:
278 <literal>1500</literal>). Used to set link MRU and
285 <term><literal>ppp_restart_time
</literal> (int)
</term>
286 <term><literal>ppp_max_configure
</literal> (int)
</term>
287 <term><literal>ppp_max_failure
</literal> (int)
</term>
290 PPP counter and timer values, as described in
§4.1
291 of
<ulink url=
"ftp://ftp.rfc-editor.org/in-notes/rfc1661.txt">
298 <term><literal>primary_dns
</literal> (ip address)
</term>
299 <term><literal>econdary_dns
</literal> (ip address)
</term>
302 Whenever a PPP connection is established, DNS servers
303 will be sent to the user, both a primary and a
304 secondary. If either is set to
0.0.0.0, then that one
311 <term><literal>primary_radius
</literal> (ip address)
</term>
312 <term><literal>secondary_radius
</literal> (ip address)
</term>
315 Sets the RADIUS servers used for both authentication and
316 accounting. If the primary server does not respond,
317 then the secondary RADIUS server will be tried.
321 In addition to the source IP address and identifier,
322 the RADIUS server
<emphasis>must
</emphasis> include
323 the source port when detecting duplicates to supress
324 (in order to cope with a large number of sessions
325 comming on-line simultaneously
326 <command>l2tpns
</command> uses a set of udp sockets,
327 each with a seperate identifier).
335 <term><literal>primary_radius_port
</literal> (short)
</term>
336 <term><literal>secondary_radius_port
</literal> (short)
</term>
339 Sets the authentication ports for the primary and
340 secondary RADIUS servers. The accounting port is one
341 more than the authentication port. If no RADIUS ports
342 are given, the authentication port defaults to
1645, and
343 the accounting port to
1646.
349 <term><literal>radius_accounting
</literal> (boolean)
</term>
352 If set to true, then RADIUS accounting packets will be
353 sent. This means that a Start record will be sent when
354 the session is successfully authenticated, and a Stop
355 record will be sent when the session is closed.
361 <term><literal>radius_interim
</literal> (int)
</term>
364 If
<literal>radius_accounting
</literal> is on, defines
365 the interval between sending of RADIUS interim
366 accounting records (in seconds).
372 <term><literal>radius_secret
</literal> (string)
</term>
375 This secret will be used in all RADIUS queries. If this
376 is not set then RADIUS queries will fail.
382 <term><literal>radius_authtypes
</literal> (string)
</term>
385 A comma separated list of supported RADIUS
386 authentication methods (
<literal>pap
</literal> or
387 <literal>chap
</literal>), in order of preference
388 (default
<literal>pap
</literal>).
394 <term><literal>radius_dae_port
</literal> (short)
</term>
397 Port for DAE RADIUS (Packet of Death/Disconnect, Change
398 of Authorization) requests (default:
399 <literal>3799</literal>).
405 <term><literal>allow_duplicate_users
</literal> (boolean)
</term>
408 Allow multiple logins with the same username. If false
409 (the default), any prior session with the same username
410 will be dropped when a new session is established.
416 <term><literal>guest_account
</literal> (string)
</term>
419 Allow multiple logins matching this specific username.
425 <term><literal>bind_address
</literal> (ip address)
</term>
428 When the tun interface is created, it is assigned the
429 address specified here. If no address is given,
1.1.1.1
430 is used. Packets containing user traffic should be
431 routed via this address if given, otherwise the primary
432 address of the machine.
438 <term><literal>peer_address
</literal> (ip address)
</term>
440 <para>Address to send to clients as the default gateway.
</para>
445 <term><literal>send_garp
</literal> (boolean)
</term>
448 Determines whether or not to send a gratuitous ARP for
449 the bind_address when the server is ready to handle
450 traffic (default:
<literal>true
</literal>). This value
451 is ignored if BGP is configured.
457 <term><literal>throttle_speed
</literal> (int)
</term>
460 Sets the default speed (in kbits/s) which sessions will
461 be limited to. If this is set to
0, then throttling
462 will not be used at all. Note: You can set this by the
463 CLI, but changes will not affect currently connected
470 <term><literal>throttle_buckets
</literal> (int)
</term>
473 Number of token buckets to allocate for throttling.
474 Each throttled session requires two buckets (in and
481 <term><literal>accounting_dir
</literal> (string)
</term>
484 If set to a directory, then every
5 minutes the current
485 usage for every connected use will be dumped to a file
486 in this directory. Each file dumped begins with a
487 header, where each line is prefixed by
<code>#
</code>.
488 Following the header is a single line for every
489 connected user, fields separated by a space.
493 The fields are username, ip, qos, uptxoctets,
494 downrxoctets. The qos field is
1 if a standard user,
495 and
2 if the user is throttled.
501 <term><literal>dump_speed
</literal> (boolean)
</term>
504 If set to true, then the current bandwidth utilization
505 will be logged every second. Even if this is disabled,
506 you can see this information by running the
507 <userinput>uptime
</userinput> command on the CLI.
513 <term><literal>multi_read_count
</literal> (int)
</term>
516 Number of packets to read off each of the UDP and TUN
517 fds when returned as readable by select (default:
10).
518 Avoids incurring the unnecessary system call overhead of
519 select on busy servers.
525 <term><literal>scheduler_fifo
</literal> (boolean)
</term>
528 Sets the scheduling policy for the
529 <command>l2tpns
</command> process to
530 <constant>SCHED_FIFO
</constant>. This causes the kernel
531 to immediately preempt any currently running
532 <constant>SCHED_OTHER
</constant> (normal) process in
533 favour of
<command>l2tpns
</command> when it becomes
534 runnable. Ignored on uniprocessor systems.
540 <term><literal>lock_pages
</literal> (boolean)
</term>
543 Keep all pages mapped by the
<command>l2tpns
</command>
550 <term><literal>icmp_rate
</literal> (int)
</term>
553 Maximum number of host unreachable ICMP packets to send
560 <term><literal>packet_limit
</literal> (int)
</term>
563 Maximum number of packets of downstream traffic to be
564 handled each tenth of a second per session. If zero, no
565 limit is applied (default:
0). Intended as a DoS
566 prevention mechanism and not a general throttling
567 control (packets are dropped, not queued).
573 <term><literal>cluster_address
</literal> (ip address)
</term>
576 Multicast cluster address (default:
239.192.13.13).
577 See
<xref linkend=
"clustering"/> for more information.
583 <term><literal>cluster_interface
</literal> (string)
</term>
585 <para>Interface for cluster packets (default: eth0)
</para>
590 <term><literal>cluster_mcast_ttl
</literal> (int)
</term>
592 <para>TTL for multicast packets (default:
1).
</para>
597 <term><literal>cluster_hb_interval
</literal> (int)
</term>
600 Interval in tenths of a second between cluster
607 <term><literal>cluster_hb_timeout
</literal> (int)
</term>
610 Cluster heartbeat timeout in tenths of a second. A new
611 master will be elected when this interval has been
612 passed without seeing a heartbeat from the master.
618 <term><literal>cluster_master_min_adv
</literal> (int)
</term>
621 Determines the minumum number of up to date slaves
622 required before the master will drop routes (default:
1).
628 <term><literal>ipv6_prefix
</literal> (ipv6 address)
</term>
631 Enable negotiation of IPv6. This forms the the first
64
632 bits of the client allocated address. The remaining
64
633 come from the allocated IPv4 address and
4 bytes of
0s.
639 <sect3 id=
"config-startup-bgp">
642 BGP routing configuration is entered by the command:
643 <synopsis>router bgp
<replaceable>as
</replaceable></synopsis>
644 where
<replaceable>as
</replaceable> specifies the local AS
649 Subsequent lines prefixed with
650 <synopsis>neighbour
<replaceable>peer
</replaceable></synopsis>
651 define the attributes of BGP neighhbours. Valid commands
654 neighbour
<replaceable>peer
</replaceable> remote-as
<replaceable>as
</replaceable>
655 neighbour
<replaceable>peer
</replaceable> timers
<replaceable>keepalive hold
</replaceable>
660 Where
<replaceable>peer
</replaceable> specifies the BGP
661 neighbour as either a hostname or IP address,
662 <replaceable>as
</replaceable> is the remote AS number and
663 <replaceable>keepalive
</replaceable>,
664 <replaceable>hold
</replaceable> are the timer values in
669 <sect3 id=
"config-startup-acl">
670 <title>Access Lists
</title>
672 Named access-lists are configured using one of the commands:
674 ip access-list standard
<replaceable>name
</replaceable>
675 ip access-list extended
<replaceable>name
</replaceable>
680 Subsequent lines prefixed with
<literal>permit
</literal> or
681 <literal>deny
</literal> define the body of the access-list.
682 Standard access-list syntax:
685 <para role=
"hanging-indent">
686 {
<literal>permit
</literal>|
<literal>deny
</literal>}
687 {
<replaceable>host
</replaceable>|
<replaceable>source
688 source-wildcard
</replaceable>|
<literal>any
</literal>}
689 [{
<replaceable>host
</replaceable>|
<replaceable>destination
690 destination-wildcard
</replaceable>|
<literal>any
</literal>}]
693 <para>Extended access-lists:
</para>
694 <para role=
"hanging-indent">
695 {
<literal>permit
</literal>|
<literal>deny
</literal>}
696 <literal>ip
</literal>
697 {
<replaceable>host
</replaceable>|
<replaceable>source
698 source-wildcard
</replaceable>|
<literal>any
</literal>}
699 {
<replaceable>host
</replaceable>|
<replaceable>destination
700 destination-wildcard
</replaceable>|
<literal>any
</literal>}
701 [
<literal>fragments
</literal>]
704 <para role=
"hanging-indent">
705 {
<literal>permit
</literal>|
<literal>deny
</literal>}
706 <literal>udp
</literal>
707 {
<replaceable>host
</replaceable>|
<replaceable>source
708 source-wildcard
</replaceable>|
<literal>any
</literal>}
709 [{
<literal>eq
</literal>|
<literal>neq
</literal>|
<literal>gt
</literal>|
<literal>lt
</literal>}
710 <replaceable>port
</replaceable>|
<literal>range
</literal>
711 <replaceable>from
</replaceable>
712 <replaceable>to
</replaceable>]
713 {
<replaceable>host
</replaceable>|
<replaceable>destination
714 destination-wildcard
</replaceable>|
<literal>any
</literal>}
715 [{
<literal>eq
</literal>|
<literal>neq
</literal>|
<literal>gt
</literal>|
<literal>lt
</literal>}
716 <replaceable>port
</replaceable>|
<literal>range
</literal>
717 <replaceable>from
</replaceable>
718 <replaceable>to
</replaceable>]
719 [
<literal>fragments
</literal>]
722 <para role=
"hanging-indent">
723 {
<literal>permit
</literal>|
<literal>deny
</literal>}
724 <literal>tcp
</literal>
725 {
<replaceable>host
</replaceable>|
<replaceable>source
726 source-wildcard
</replaceable>|
<literal>any
</literal>}
727 [{
<literal>eq
</literal>|
<literal>neq
</literal>|
<literal>gt
</literal>|
<literal>lt
</literal>}
728 <replaceable>port
</replaceable>|
<literal>range
</literal>
729 <replaceable>from
</replaceable>
730 <replaceable>to
</replaceable>]
731 {
<replaceable>host
</replaceable>|
<replaceable>destination
732 destination-wildcard
</replaceable>|
<literal>any
</literal>}
733 [{
<literal>eq
</literal>|
<literal>neq
</literal>|
<literal>gt
</literal>|
<literal>lt
</literal>}
734 <replaceable>port
</replaceable>|
<literal>range
</literal>
735 <replaceable>from
</replaceable>
736 <replaceable>to
</replaceable>]
737 [{
<literal>established
</literal>|{
<literal>match-any
</literal>|
<literal>match-all
</literal>}
738 {
<literal>+
</literal>|
<literal>-
</literal>}{
<literal>fin
</literal>|
<literal>syn
</literal>|
<literal>rst
</literal>|
<literal>psh
</literal>|
<literal>ack
</literal>|
<literal>urg
</literal>}
739 ...|
<literal>fragments
</literal>]
744 <sect2 id=
"config-users">
745 <title><filename>users
</filename></title>
747 Usernames and passwords for the command-line interface are
748 stored in this file. The format is
750 <replaceable>username
</replaceable>:
<replaceable>password
</replaceable>
752 where
<replaceable>password
</replaceable> may either by plain
753 text, an MD5 digest (prefixed by
754 <literal>$
1</literal><replaceable>salt
</replaceable><literal>$
</literal>)
755 or a DES password, distinguished from plain text by the prefix
756 <literal>{crypt}
</literal>.
760 The username
<literal>enable
</literal> has a special meaning
761 and is used to set the enable password.
766 If this file doesn't exist, then anyone who can get to port
767 23 will be allowed access without a username or password.
772 <sect2 id=
"config-ip-pool">
773 <title><filename>ip_pool
</filename></title>
775 This file is used to configure the IP address pool which user
776 addresses are assigned from. This file should contain either
777 an IP address or a CIDR network per line. e.g.:
790 Keep in mind that
<command>l2tpns
</command> can only handle
791 65535 connections per process, so don't put more than
65535 IP
792 addresses in the configuration file. They will be
797 <sect2 id=
"config-build-garden" xreflabel=
"build-garden">
798 <title><filename>build-garden
</filename></title>
800 The garden plugin on startup creates a NAT table called
801 "garden" then sources the
<filename>build-garden
</filename>
802 script to populate that table. All packets from gardened
803 users will be sent through this table. Example:
806 iptables -t nat -A garden -p tcp -m tcp --dport
25 -j DNAT --to
192.168.1.1
807 iptables -t nat -A garden -p udp -m udp --dport
53 -j DNAT --to
192.168.1.1
808 iptables -t nat -A garden -p tcp -m tcp --dport
53 -j DNAT --to
192.168.1.1
809 iptables -t nat -A garden -p tcp -m tcp --dport
80 -j DNAT --to
192.168.1.1
810 iptables -t nat -A garden -p tcp -m tcp --dport
110 -j DNAT --to
192.168.1.1
811 iptables -t nat -A garden -p tcp -m tcp --dport
443 -j DNAT --to
192.168.1.1
812 iptables -t nat -A garden -p icmp -m icmp --icmp-type echo-request -j DNAT --to
192.168.1.1
813 iptables -t nat -A garden -p icmp -j ACCEPT
814 iptables -t nat -A garden -j DROP
820 <sect1 id=
"operation">
821 <title>Operation
</title>
823 A running l2tpns process can be controlled in a number of ways.
824 The primary method of control is by the Command-Line Interface
829 You can also remotely send commands to modules via the
830 <command>nsctl
</command> client provided.
834 There are also a number of signals that l2tpns understands and
835 takes action when it receives them.
838 <sect2 id=
"operation-cli">
839 <title>Command-Line Interface
</title>
841 You can access the command line interface by telneting to port
842 23. There is no IP address restriction, so it's a good idea
843 to firewall this port off from anyone who doesn't need access
844 to it. See
<xref linkend=
"config-users"/> for information on
845 restricting access based on a username and password.
849 The CLI gives you real-time control over almost everything in
850 the process. The interface is designed to look like a Cisco
851 device, and supports things like command history, line editing
852 and context sensitive help. This is provided by linking with
853 the
<ulink url=
"http://sourceforge.net/projects/libcli">
854 libcli
</ulink> library. Some general documentation of the
856 url=
"http://sourceforge.net/docman/display_doc.php?docid=20501&group_id=79019">
861 After you have connected to the telnet port (and perhaps
862 logged in), you will be presented with a
863 <prompt><replaceable>hostname
</replaceable>></prompt>
868 Enter
<userinput>help
</userinput> to get a list of possible
869 commands, or press
<userinput>?
</userinput> for
870 context-specific help.
874 A brief overview of the more important commands
878 <varlistentry id=
"operation-cli-show-session"
879 xreflabel=
"show session">
881 <userinput>show session [
<replaceable>ID
</replaceable>]
887 Detailed information for a specific session is
888 presented if you specify a session
889 <replaceable>ID
</replaceable> argument.
893 If no
<replaceable>ID
</replaceable> is given, a
894 summary of all connected sessions is produced. Note
895 that this summary list can be around
185 columns wide,
896 so you should probably use a wide
901 The columns listed in the summary are:
905 <colspec colname=
"col"/>
906 <colspec colname=
"desc"/>
907 <colspec colname=
"extra"/>
910 <entry><literal>SID
</literal></entry>
911 <entry namest=
"desc" nameend=
"extra">Session ID
</entry>
914 <entry><literal>TID
</literal></entry>
915 <entry>Tunnel ID
</entry>
918 linkend=
"operation-cli-show-tunnel"/> CLI
923 <entry><literal>Username
</literal></entry>
925 The username given in the PPP authentication.
928 If this is *, then LCP authentication has
933 <entry><literal>IP
</literal></entry>
934 <entry>The IP address given to the session.
</entry>
936 If this is
0.0.0.0, IPCP negotiation has not
941 <entry><literal>I
</literal></entry>
942 <entry>Intercept
</entry>
944 Y or N: indicates whether the session is
945 being snooped. See also the
946 <xref linkend=
"operation-cli-snoop"/>
951 <entry><literal>T
</literal></entry>
952 <entry>Throttled
</entry>
954 Y or N: indicates whether the session is
955 currently throttled. See also the
956 <xref linkend=
"operation-cli-throttle"/>
961 <entry><literal>G
</literal></entry>
962 <entry>Walled Garden
</entry>
964 Y or N: indicates whether the user is
965 trapped in the walled garden. This field is
966 present even if the garden module is not
971 <entry><literal>6</literal></entry>
974 Y or N: indicates whether the session has
975 IPv6 active (IPV6CP open)
979 <entry><literal>opened
</literal></entry>
980 <entry namest=
"desc" nameend=
"extra">
981 The number of seconds since the
986 <entry><literal>downloaded
</literal></entry>
987 <entry namest=
"desc" nameend=
"extra">
988 Number of bytes downloaded by the user
992 <entry><literal>uploaded
</literal></entry>
993 <entry namest=
"desc" nameend=
"extra">
994 Number of bytes uploaded by the user
998 <entry><literal>idle
</literal></entry>
999 <entry namest=
"desc" nameend=
"extra">
1000 The number of seconds since traffic was
1001 detected on the session
1005 <entry><literal>LAC
</literal></entry>
1006 <entry namest=
"desc" nameend=
"extra">
1007 The IP address of the LAC the session is
1012 <entry><literal>CLI
</literal></entry>
1013 <entry namest=
"desc" nameend=
"extra">
1014 The Calling-Line-Identification field
1015 provided during the session setup. This
1016 field is generated by the LAC.
1026 <varlistentry id=
"operation-cli-show-user" xreflabel=
"show user">
1028 <userinput>show users
</userinput>
1031 <userinput>show user
<replaceable>username
</replaceable>
1037 With no arguments, display a list of currently
1038 connected users. If an argument is given, the session
1039 details for the given
1040 <replaceable>username
</replaceable> are displayed.
1045 <varlistentry id=
"operation-cli-show-tunnel" xreflabel=
"show tunnel">
1047 <userinput>show tunnel [
<replaceable>ID
</replaceable>]
</userinput>
1052 Produce a summary list of all open tunnels, or detail
1053 on a specific tunnel
<replaceable>ID
</replaceable>.
1057 The columns listed in the summary are:
1064 <entry>Tunnel ID
</entry>
1067 <entry>Hostname
</entry>
1069 The hostname for the tunnel as provided by
1070 the LAC. This has no relation to DNS, it is
1076 <entry>The IP address of the LAC
</entry>
1079 <entry>State
</entry>
1081 Tunnel state: Free, Open, Dieing, Opening
1085 <entry>Sessions
</entry>
1086 <entry>The number of open sessions on the tunnel
</entry>
1095 <varlistentry id=
"operation-cli-show-pool" xreflabel=
"show pool">
1096 <term><userinput>show pool
</userinput></term>
1099 Displays the current IP address pool allocation. This
1100 will only display addresses that are in use, or are
1101 reserved for re-allocation to a disconnected user.
1105 If an address is not currently in use, but has been
1106 used, then in the User column the username will be
1107 shown in square brackets, followed by the time since
1108 the address was used:
1111 IP Address Used Session User
1112 192.168.100.6 N [joe.user]
1548s
1118 <varlistentry id=
"operation-cli-show-radius" xreflabel=
"show radius">
1119 <term><userinput>show radius
</userinput></term>
1122 Show a summary of the in-use RADIUS sessions. This
1123 list should not be very long, as RADIUS sessions
1124 should be cleaned up as soon as they are used. The
1131 <entry>Radius
</entry>
1133 The ID of the RADIUS request. This is sent
1134 in the packet to the RADIUS server for
1139 <entry>State
</entry>
1141 The state of the request: WAIT, CHAP, AUTH,
1142 IPCP, START, STOP or NULL
1146 <entry>Session
</entry>
1148 The session ID that this RADIUS request is
1153 <entry>Retry
</entry>
1155 If a response does not appear to the
1156 request, it will retry at this time. This
1163 Retry count. The RADIUS request is
1164 discarded after
3 retries
1174 <varlistentry id=
"operation-cli-show-run" xreflabel=
"show run">
1175 <term><userinput>show running-config
</userinput></term>
1178 This will list the current running configuration.
1179 This is in a format that can either be pasted into the
1180 configuration file, or run directly at the command
1186 <varlistentry id=
"operation-cli-show-counters"
1187 xreflabel=
"show counters">
1188 <term><userinput>show counters
</userinput></term>
1191 Internally, counters are kept of key values, such as
1192 bytes and packets transferred, as well as function
1193 call counters. This function displays all these
1194 counters, and is probably only useful for debugging.
1198 You can reset these counters by running
1199 <userinput>clear counters
</userinput>.
1204 <varlistentry id=
"operation-cli-show-cluster"
1205 xreflabel=
"show cluster">
1206 <term><userinput>show cluster
</userinput></term>
1209 Show cluster status. Shows the cluster state for this
1210 server (Master/Slave), information about known peers
1211 and (for slaves) the master IP address, last packet
1212 seen and up-to-date status. See
1213 <xref linkend=
"clustering"/> for more information.
1218 <varlistentry id=
"operation-cli-write-mem" xreflabel=
"write memory">
1219 <term><userinput>write memory
</userinput></term>
1222 This will write the current running configuration to
1223 the config file
<filename>startup-config
</filename>,
1224 which will be run on a restart.
1229 <varlistentry id=
"operation-cli-snoop" xreflabel=
"snoop">
1231 <userinput>snoop
<replaceable>user
</replaceable>
1232 <replaceable>IP
</replaceable>
1233 <replaceable>port
</replaceable></userinput>
1237 You must specify a username, IP address and port. All
1238 packets for the current session for that username will
1239 be forwarded to the given host/port. Specify
1241 <replaceable>username
</replaceable></userinput> to
1242 disable interception for the session.
1246 If you want interception to be permanent, you will
1247 have to modify the RADIUS response for the user. See
1248 <xref linkend=
"interception"/>.
1253 <varlistentry id=
"operation-cli-throttle" xreflabel=
"throttle">
1255 <userinput>throttle
<replaceable>user
</replaceable>
1256 [in|out]
<replaceable>rate
</replaceable></userinput>
1260 You must specify a username, which will be throttled
1261 for the current session to
1262 <replaceable>rate
</replaceable> Kbps. Prefix
1263 <replaceable>rate
</replaceable> with
1264 <userinput>in
</userinput> or
1265 <userinput>out
</userinput> to set different upstream
1266 and downstream rates.
1270 Specify
<userinput>no throttle
1271 <replaceable>username
</replaceable></userinput> to
1272 disable throttling for the current session.
1276 If you want throttling to be permanent, you will have
1277 to modify the RADIUS response for the user. See
<xref
1278 linkend=
"throttling"/>.
1283 <varlistentry id=
"operation-cli-drop-session"
1284 xreflabel=
"drop session">
1286 <userinput>drop
<replaceable>session
</replaceable></userinput>
1290 This will cleanly disconnect the session specified by
1291 <replaceable>session
</replaceable> ID.
1296 <varlistentry id=
"operation-cli-drop-tunnel" xreflabel=
"drop tunnel">
1298 <userinput>drop
<replaceable>tunnel
</replaceable></userinput>
1302 This will cleanly disconnect the tunnel specified by
1303 <replaceable>tunnel
</replaceable> ID, as well as all
1304 sessions on that tunnel.
1309 <varlistentry id=
"operation-cli-uptime" xreflabel=
"uptime">
1310 <term><userinput>uptime
</userinput></term>
1313 This will show how long the
<command>l2tpns
</command>
1314 process has been running, and the current bandwidth
1318 17:
10:
35 up
8 days,
2212 users, load average:
0.21,
0.17,
0.16
1319 Bandwidth: UDP-ETH:
6/
6 ETH-UDP:
13/
13 TOTAL:
37.6 IN:
3033 OUT:
2569
1322 The bandwidth line contains
4 sets of values:
1328 <entry>UDP-ETH
</entry>
1330 The current bandwidth going from the LAC to
1331 the ethernet (user uploads), in mbits/sec.
1335 <entry>ETH-UDP
</entry>
1337 The current bandwidth going from ethernet to
1338 the LAC (user downloads).
1342 <entry>TOTAL
</entry>
1343 <entry>The total aggregate bandwidth in mbits/s.
</entry>
1346 <entry>IN and OUT
</entry>
1348 Packets/per-second going between UDP-ETH and
1356 These counters are updated every second.
1361 <varlistentry id=
"operation-cli-configure" xreflabel=
"configure">
1362 <term><userinput>configure terminal
</userinput></term>
1365 Enter configuration mode. Use
1366 <userinput>exit
</userinput> or
1367 <userinput>^Z
</userinput> to exit this mode.
1371 The following commands are valid in this mode:
1374 <varlistentry id=
"operation-cli-conf-load">
1376 <userinput>load plugin
1377 <replaceable>name
</replaceable></userinput>
1381 Load a plugin. You must specify the plugin
1382 name, and it will search in
1383 <filename>/usr/lib/l2tpns
</filename> for
1384 <filename><replaceable>name
</replaceable>.so
</filename>.
1385 You can unload a loaded plugin with
1386 <userinput>remove plugin
1387 <replaceable>name
</replaceable></userinput>.
1392 <varlistentry id=
"operation-cli-conf-set">
1393 <term><userinput>set
</userinput> ...
</term>
1396 Set a configuration variable. You must specify
1397 the variable name, and the value. If the value
1398 contains any spaces, you should quote the value
1399 with double (
") or single (') quotes.
1403 You can set any configuration value in this
1404 way, although some may require a restart to
1405 take effect. See <xref
1406 linkend="config-startup
"/>.
1411 <varlistentry id="operation-cli-conf-router
">
1412 <term><userinput>router bgp</userinput> ...</term>
1415 Configure BGP. See <xref
1416 linkend="config-startup-bgp
"/>.
1421 <varlistentry id="operation-cli-conf-acl
">
1422 <term><userinput>ip access-list</userinput> ...</term>
1425 Configure a named access list. See <xref
1426 linkend="config-startup-acl
"/>.
1438 <sect2 id="operation-nsctl
">
1439 <title>nsctl</title>
1441 <command>nsctl</command> sends messages to a running
1442 <command>l2tpns</command> instance to be control plugins.
1446 Arguments are <userinput>command</userinput> and optional
1447 <replaceable>args</replaceable>. See
1448 <literal>nsctl(8)</literal>.
1452 Built-in command are <userinput>load_plugin</userinput>,
1453 <userinput>unload_plugin</userinput> and
1454 <userinput>help</userinput>. Any other commands are passed to
1455 plugins for processing by the
1456 <literal>plugin_control</literal> function.
1460 <sect2 id="operation-signals
">
1461 <title>Signals</title>
1463 While the process is running, you can send it a few different
1464 signals, using the <command>kill</command> command.
1470 The signals understood are:
1476 <para>Reload the config from disk and re-open log file.</para>
1481 <term>SIGTERM</term>
1485 Stop process. Tunnels and sessions are not
1486 terminated. This signal should be used to stop
1487 <command>l2tpns</command> on a cluster node where
1488 there are other machines to continue handling traffic.
1489 See <xref linkend="clustering
"/>
1495 <term>SIGQUIT</term>
1498 Shut down tunnels and sessions, exit process when
1508 <sect1 id="throttling
">
1509 <title>Throttling</title>
1511 <command>l2tpns</command> contains support for slowing down user
1512 sessions to whatever speed you desire. The global setting
1513 <literal>throttle_speed</literal> defines the default throttle
1518 To throttle a sesion permanently, add a
1519 <literal>Cisco-AVPair</literal> RADIUS attribute. The
1520 <filename>autothrotle</filename> module interprets the following
1527 <entry><literal>throttle=yes</literal></entry>
1529 Throttle upstream/downstream traffic to the configured
1530 <literal>throttle_speed</literal>.
1536 <literal>throttle=<replaceable>rate</replaceable></literal>
1539 Throttle upstream/downstream traffic to the specified
1540 <replaceable>rate</replaceable> Kbps.
1546 <literal>lcp:interface-config#1=service-policy input
1547 <replaceable>rate</replaceable></literal>
1550 <entry morerows="1">
1551 Alternate (Cisco) format: throttle
1552 upstream/downstream to specified
1553 <replaceable>rate</replaceable> Kbps.
1559 <literal>lcp:interface-config#2=service-policy output
1560 <replaceable>rate</replaceable></literal>
1569 You can also enable and disable throttling an active session
1570 using the <xref linkend="operation-cli-throttle
"/> CLI command.
1574 <sect1 id="interception
">
1575 <title>Interception</title>
1577 You may have to deal with legal requirements to be able to
1578 intercept a user's traffic at any time.
1579 <command>l2tpns</command> allows you to begin and end
1580 interception on the fly, as well as at authentication time.
1584 When a user is being intercepted, a copy of every packet they
1585 send and receive will be sent wrapped in a UDP packet to a
1590 The UDP packet contains just the raw IP frame, with no extra
1591 headers. The script <filename>scripts/l2tpns-capture</filename>
1592 may be used as the end-point for such intercepts, writing the
1593 data in PCAP format (suitable for inspection with
1594 <command>tcpdump</command>).
1598 To enable or disable interception of a connected user, use the
1599 <xref linkend="operation-cli-snoop
"/> and <userinput>no
1600 snoop</userinput> CLI commands. These will enable interception
1605 If you wish the user to be intercepted whenever they reconnect,
1606 you will need to modify the RADIUS response to include the
1607 Vendor-Specific value
1608 <literal>Cisco-AVPair="intercept=
<replaceable>ip
</replaceable>:
<replaceable>port
</replaceable>"</literal>.
1609 For this feature to be enabled, you need to have the
1610 <filename>autosnoop</filename> module loaded.
1614 <sect1 id="plugins
">
1615 <title>Plugins</title>
1617 So as to make <command>l2tpns</command> as flexible as possible,
1618 a plugin API is include which you can use to hook into certain
1623 There are a some standard modules included which may be used as
1624 examples: <filename>autosnoop</filename>,
1625 <filename>autothrottle</filename>, <filename>garden</filename>,
1626 <filename>sessionctl</filename>,
1627 <filename>setrxspeed</filename>, <filename>snoopctl</filename>,
1628 <filename>stripdomain</filename> and
1629 <filename>throttlectl</filename>.
1633 When an event occurs that has a hook, <command>l2tpns</command>
1634 looks for a predefined function name in every loaded module, and
1635 runs them in the order the modules were loaded.
1639 The function should return <code>PLUGIN_RET_OK</code> if it is
1640 all OK. If it returns <code>PLUGIN_RET_STOP</code>, then it is
1641 assumed to have worked, but that no further modules should be
1646 A return of <code>PLUGIN_RET_ERROR</code> means that this module
1647 failed, and no further processing should be done for this event.
1648 <note><para>Use this with care.</para></note>
1652 Most event functions take a specific structure named
1653 <code>param_<replaceable>event</replaceable></code>, which
1654 varies in content with each event. The function name for each
1656 <code>plugin_<replaceable>event</replaceable></code>, so for the
1657 event <replaceable>timer</replaceable>, the function declaration
1661 int plugin_timer(struct param_timer *data);
1664 A list of the available events follows, with a list of all the
1665 fields in the supplied structure:
1669 <colspec colname="event
"/>
1670 <colspec colname="event_desc
"/>
1671 <colspec colname="member
"/>
1672 <colspec colname="member_desc
"/>
1673 <spanspec spanname="args
" namest="member
" nameend="member_desc
"/>
1676 <entry>Event</entry>
1677 <entry>Description</entry>
1678 <entry spanname="args
">Arguments</entry>
1684 <entry morerows="1"><code>plugin_init</code></entry>
1685 <entry morerows="1">
1687 Called when the plugin is loaded. A pointer to a
1688 struct containing function pointers is passed as the
1689 only argument, allowing the plugin to call back into
1693 Prior to loading the plugin, <command>l2tpns</command>
1694 checks the API version the plugin was compiled
1695 against. All plugins should contain:
1697 int plugin_api_version = PLUGIN_API_VERSION;
1701 <entry spanname="args
"><code>struct pluginfuncs *</code></entry>
1704 <entry spanname="args
">
1705 See <code>pluginfuncs</code> structure in
1706 <code>plugin.h</code> for available functions.
1711 <entry morerows="1"><code>plugin_done</code></entry>
1712 <entry morerows="1">
1713 Called when the plugin is unloaded or
1714 <command>l2tpns</command> is shutdown.
1716 <entry spanname="args
"><code>void</code></entry>
1719 <entry spanname="args
">No arguments.</entry>
1723 <entry morerows="6"><code>plugin_pre_auth</code></entry>
1724 <entry morerows="6">
1725 Called after a RADIUS response has been received, but
1726 before it has been processed by the code. This will
1727 allow you to modify the response in some way.
1729 <entry spanname="args
">
1730 <code>struct plugin param_pre_auth *</code>
1734 <entry><code>tunnelt *t</code></entry>
1735 <entry>Tunnel.</entry>
1738 <entry><code>sessiont *s</code></entry>
1739 <entry>Session.</entry>
1742 <entry><code>char *username</code></entry>
1743 <entry>User name.</entry>
1746 <entry><code>char *password</code></entry>
1747 <entry>Password.</entry>
1750 <entry><code>int protocol</code></entry>
1752 Authentication protocol: <literal>0xC023</literal> for PAP,
1753 <literal>0xC223</literal> for CHAP.
1757 <entry><code>int continue_auth</code></entry>
1758 <entry>Set to 0 to stop processing authentication modules.</entry>
1762 <entry morerows="5"><code>plugin_post_auth</code></entry>
1763 <entry morerows="5">
1764 Called after a RADIUS response has been received, and
1765 the basic checks have been performed. This is what
1766 the <filename>garden</filename> module uses to force
1767 authentication to be accepted.
1769 <entry spanname="args
">
1770 <code>struct plugin param_post_auth *</code>
1774 <entry><code>tunnelt *t</code></entry>
1775 <entry>Tunnel.</entry>
1778 <entry><code>sessiont *s</code></entry>
1779 <entry>Session.</entry>
1782 <entry><code>char *username</code></entry>
1783 <entry>User name.</entry>
1786 <entry><code>short auth_allowed</code></entry>
1788 Initially true or false depending on whether
1789 authentication has been allowed so far. You can
1790 set this to 1 or 0 to force authentication to be
1791 accepted or rejected.
1795 <entry><code>int protocol</code></entry>
1797 Authentication protocol: <literal>0xC023</literal> for PAP,
1798 <literal>0xC223</literal> for CHAP.
1803 <entry morerows="1"><code>plugin_timer</code></entry>
1804 <entry morerows="1">
1805 Run once per second.
1807 <entry spanname="args
">
1808 <code>struct plugin param_timer *</code>
1812 <entry><code>time_t time_now</code></entry>
1813 <entry>The current unix timestamp.</entry>
1817 <entry morerows="2"><code>plugin_new_session</code></entry>
1818 <entry morerows="2">
1819 Called after a session is fully set up. The session
1820 is now ready to handle traffic.
1822 <entry spanname="args
">
1823 <code>struct plugin param_new_session *</code>
1827 <entry><code>tunnelt *t</code></entry>
1828 <entry>Tunnel.</entry>
1831 <entry><code>sessiont *s</code></entry>
1832 <entry>Session.</entry>
1836 <entry morerows="2"><code>plugin_kill_session</code></entry>
1837 <entry morerows="2">
1838 Called when a session is about to be shut down. This
1839 may be called multiple times for the same session.
1841 <entry spanname="args
">
1842 <code>struct plugin param_kill_session *</code>
1846 <entry><code>tunnelt *t</code></entry>
1847 <entry>Tunnel.</entry>
1850 <entry><code>sessiont *s</code></entry>
1851 <entry>Session.</entry>
1855 <entry morerows="5"><code>plugin_control</code></entry>
1856 <entry morerows="5">
1858 Called in whenever a <command>nsctl</command> packet
1859 is received. This should handle the packet and form a
1860 response if required.
1863 Plugin-specific help strings may be included in the
1864 output of <userinput>nsctl help</userinput> by
1865 defining a <code>NULL</code> terminated list of
1868 char *plugin_control_help[] = { <replaceable>...</replaceable>, NULL };
1872 <entry spanname="args
">
1873 <code>struct plugin param_control *</code>
1877 <entry><code>int iam_master</code></entry>
1878 <entry>If true, this node is the cluster master.</entry>
1881 <entry><code>int argc</code></entry>
1882 <entry morerows="1"><command>nsctl</command> arguments.</entry>
1885 <entry><code>char **argc</code></entry>
1888 <entry><code>int reponse</code></entry>
1890 Response from control message (if handled): should be
1891 either <code>NSCTL_RES_OK</code> or
1892 <code>NSCTL_RES_ERR</code>.
1896 <entry><code>char *additional</code></entry>
1898 Additional information, output by
1899 <command>nsctl</command> on receiving the response.
1904 <entry morerows="4"><code>plugin_radius_response</code></entry>
1905 <entry morerows="4">
1906 Called whenever a RADIUS response includes a
1907 <literal>Cisco-AVPair</literal> value. The value is
1909 <replaceable>key</replaceable><literal>=</literal><replaceable>value</replaceable>
1910 pairs. Will be called once for each pair in the
1913 <entry spanname="args
">
1914 <code>struct plugin param_radius_response *</code>
1918 <entry><code>tunnelt *t</code></entry>
1919 <entry>Tunnel.</entry>
1922 <entry><code>sessiont *s</code></entry>
1923 <entry>Session.</entry>
1926 <entry><code>char *key</code></entry>
1927 <entry morerows="1">Key and value.</entry>
1930 <entry><code>char *value</code></entry>
1934 <entry morerows="2"><code>plugin_radius_reset</code></entry>
1935 <entry morerows="2">
1936 Called whenever a RADIUS CoA request is received to
1937 reset any options to default values before the new
1940 <entry spanname="args
">
1941 <code>struct param_radius_reset *</code>
1945 <entry><code>tunnelt *t</code></entry>
1946 <entry>Tunnel.</entry>
1949 <entry><code>sessiont *s</code></entry>
1950 <entry>Session.</entry>
1954 <entry morerows="3"><code>plugin_radius_account</code></entry>
1955 <entry morerows="3">
1956 Called when preparing a RADIUS accounting record to
1957 allow additional data to be added to the packet.
1959 <entry spanname="args
">
1960 <code>struct param_radius_account *</code>
1964 <entry><code>tunnelt *t</code></entry>
1965 <entry>Tunnel.</entry>
1968 <entry><code>sessiont *s</code></entry>
1969 <entry>Session.</entry>
1972 <entry><code>uint8_t **packet</code></entry>
1974 Pointer to the end of the currently assembled
1975 packet buffer. The value should be incremented by the
1976 length of any data added.
1981 <entry morerows="1"><code>plugin_become_master</code></entry>
1982 <entry morerows="1">
1983 Called when a node elects itself cluster master.
1985 <entry spanname="args
"><code>void</code></entry>
1988 <entry spanname="args
">No arguments.</entry>
1992 <entry morerows="1"><code>plugin_new_session_master</code></entry>
1993 <entry morerows="1">
1994 Called once for each open session on becoming cluster
1997 <entry spanname="args
"><code>sessiont *</code></entry>
2000 <entry spanname="args
">
2010 <sect1 id="walled-garden
">
2011 <title>Walled Garden</title>
2013 A "Walled Garden
" is implemented so that you can provide perhaps
2014 limited service to sessions that incorrectly authenticate.
2018 Whenever a session provides incorrect authentication, and the
2019 RADIUS server responds with Auth-Reject, the walled garden
2020 module (if loaded) will force authentication to succeed, but set
2021 the <literal>walled_garden</literal> flag in the session
2022 structure, and adds an <command>iptables</command> rule to the
2023 <literal>garden_users</literal> chain to cause all packets for
2024 the session to traverse the <literal>garden</literal> chain.
2028 This doesn't <emphasis>just work</emphasis>. To set this all
2029 up, you will to setup the <literal>garden</literal> nat table
2030 with the <xref linkend="config-build-garden
"/> script with rules
2031 to limit user's traffic.
2035 For example, to force all traffic except DNS to be forwarded to
2036 192.168.1.1, add these entries to your
2037 <filename>build-garden</filename> script:
2040 iptables -t nat -A garden -p tcp --dport ! 53 -j DNAT --to 192.168.1.1
2041 iptables -t nat -A garden -p udp --dport ! 53 -j DNAT --to 192.168.1.1
2046 <command>l2tpns</command> will add entries to the
2047 <literal>garden_users</literal> chain as appropriate.
2051 You can check the amount of traffic being captured using the
2055 iptables -t nat -L garden -nvx
2060 <sect1 id="filtering
">
2061 <title>Filtering</title>
2063 Sessions may be filtered by specifying
2064 <literal>Filter-Id</literal> attributes in the RADIUS reply.
2065 <replaceable>filter</replaceable>.<literal>in</literal>
2066 specifies that the named access-list
2067 <replaceable>filter</replaceable> should be applied to traffic
2069 <replaceable>filter</replaceable>.<literal>out</literal>
2070 specifies a list for traffic to the customer.
2074 <sect1 id="clustering
">
2075 <title>Clustering</title>
2077 An <command>l2tpns</command> cluster consists of one* or more
2078 servers configured with the same configuration, notably the
2079 multicast <literal>cluster_address</literal>.
2082 <para>*A stand-alone server is simply a degraded cluster.</para>
2085 Initially servers come up as cluster slaves, and periodically
2086 (every <literal>cluster_hb_interval</literal>/10 seconds) send
2087 out ping packets containing the start time of the process to the
2088 multicast <literal>cluster_address</literal>.
2092 A cluster master sends heartbeat rather than ping packets, which
2093 contain those session and tunnel changes since the last
2098 When a slave has not seen a heartbeat within
2099 <literal>cluster_hb_timeout</literal>/10 seconds it "elects
" a
2100 new master by examining the list of peers it has seen pings from
2101 and determines which of these and itself is the "best
" candidate
2102 to be master. "Best
" in this context means the server with the
2103 highest uptime (the highest IP address is used as a tie-breaker
2104 in the case of equal uptimes).
2108 After discovering a master, and determining that it is
2109 up-to-date (has seen an update for all in-use sessions and
2110 tunnels from heartbeat packets) will raise a route (see <xref
2111 linkend="routing
"/>) for the <literal>bind_address</literal> and
2112 for all addresses/networks in <filename>ip_pool</filename>.
2116 Any packets recieved by the slave which would alter the session
2117 state, as well as packets for throttled or gardened sessions are
2118 forwarded to the master for handling. In addition, byte
2119 counters for session traffic are periodically forwarded.
2123 The master, when determining that it has at least one* up-to-date
2124 slave will drop all routes (raising them again if all slaves
2125 disappear) and subsequently handle only packets forwarded to it
2129 <para>*Configurable with <literal>cluster_master_min_adv</literal></para>
2132 <sect1 id="routing
">
2133 <title>Routing</title>
2135 If you are running a single instance, you may simply statically
2136 route the IP pools to the <literal>bind_address</literal>
2137 (<command>l2tpns</command> will send a gratuitous arp).
2141 For a cluster, configure the members as BGP neighbours on your
2142 router and configure multi-path load-balancing. Cisco uses
2143 <userinput>maximum-paths ibgp</userinput> for IBGP. If this is
2144 not supported by your IOS revision, you can use
2145 <userinput>maximum-paths</userinput> (which works for EBGP) and
2146 set <literal>as_number</literal> to a private value such as
projects / l2tpns.git / blob