3620上同时配置了8个口BRI和8个内置MODEM

fghhbbb

一台3620上同时配置了8个口BRI和8个内置MODEM用作拔入。由于对公服务，安全性要求比较高，所以使用一台NT 运行 Cisco Secure 2.4 (ACS) 提供AAA服务(Authentication 认证，Authorization 授权，Accounting记帐)。  PSTN 和AAA的集成没有题目，很轻易就实现了。  ISDN 拔号要实现授权不同于PSTN，根据CISCO的文档，必须要用Per-User的AAA设置方法（不能通过Group设置用户）和配置Virtual Profile.  由于没有较好的范例可以鉴戒，只能通过观察 debug ppp negotiation, debug authentication, debug aaa authorization 等命令的输出来摸索配置方法，所以这个配置至少花掉我24个小时，可谓呕心沥血之作。  曾经在这发过贴子问，没人回答，现在解决方法贴出来，供大家参考。  本例中，当用户user1通过pstn/isdn拔入时，AAA服务器指示（授权）NAS（拔号访问服务器，即3620）对该用户应用access-list 101. ! 3620 配置 （摘要） aaa new-model aaa authentication login default group tacacs+ local aaa authentication login no_tacacs enable aaa authentication ppp default group tacacs+ aaa authorization network default group tacacs+ aaa accounting network default start-stop group tacacs+ enable secret 5 $1$FdxlnA$pGA5cPuIqOOJwFT0iLWq0 ! username localuser password 0 _password ip subnet-zero ! ! no ip finger no ip domain-lookup ! virtual-profile virtual-template 1 virtual-profile aaa isdn switch-type basic-net3 ! ! ! inte***ce FastEthernet0/0 ip address 10.1.10.33 255.255.255.0 duplex auto speed auto ! inte***ce BRI1/0 ip unnumbered FastEthernet0/0 encapsulation ppp no ip route-cache no ip mroute-cache no keepalive dialer-group 1 isdn switch-type basic-net3 peer default ip address pool ip_pool no fair-queue ppp authentication chap pap ppp multilink ! inte***ce BRI1/1 ip unnumbered FastEthernet0/0 encapsulation ppp no ip route-cache no ip mroute-cache no keepalive dialer-group 1 isdn switch-type basic-net3 peer default ip address pool ip_pool no fair-queue ppp authentication chap pap ppp multilink ! ... inte***ce Virtual-Template1 ip unnumbered FastEthernet0/0 peer default ip address pool ip_pool ppp authentication chap pap ppp multilink ppp timeout idle 300 ! inte***ce Group-Async0 ip unnumbered FastEthernet0/0 encapsulation ppp ip tcp header-compression passive async dynamic routing async mode interactive peer default ip address pool ip_pool ppp authentication chap pap group-range 65 80 ! ip local pool ip_pool 10.1.10.1 10.1.10.32 ip classless ip route 0.0.0.0 0.0.0.0 10.1.10.34 no ip http server ! access-list 101 deny icmp any host 10.1.11.1 log access-list 101 permit ip       1/2 12下一页尾页