论坛徽章:: 1

电梯直达

1楼 [收藏(0)] [报告]

发表于 2002-10-03 09:38 |只看该作者 |倒序浏览

过节没有什么可以送的送给大家一点文章吧！希望能够对大家有用。

Introduction
This Tech Note describes a scalable ISDN backup strategy for large OSPF networks. Previously, it was necessary to dedicate one ISDN interface on a OSPF area border router (ABR) for each area that required backing up. This meant if you had 50 OSPF areas that needed backing up, you would require 50 ISDN interfaces that could span across multiple backup ABRs. For the purpose of our discussion, the backup ABR is the ABR that terminates ISDN links that are established when the primary link fails. Let's look at why it's necessary for each area to have a dedicated ISDN interface on the backup ABR.

This restriction was brought on by the fact that an interface can only belong to one area at a time. Since ISDN traditionally uses the legacy Dial-On Demand Routing (DDR) code, and all B-channels on a physical ISDN circuit are tied to one single network layer point-to-multipoint entity called a dialer interface. Thus, even though a Primary Rate Interface (PRI) has 23 B-channels, all channels on this physical ISDN circuit belong to the same network layer interface, SerialX:23, and this interface can only belong to one OSPF area. The fact that we can physically terminate calls from 23 separate sites on this PRI is wasted since all channels must share the same network layer configuration. Thus, we have the restriction that each area that requires backing up has to have one dedicated ISDN interface on the backup ABR.

Cisco IOS &reg; version 11.2 introduced a feature called dialer profiles. One of the fundamental differences between legacy DDR and dialer profiles is the fact that the physical ISDN circuits are no longer conjoined to the same network layer interface. Instead, we have the capability to define multiple dialer profiles that are network layer entities with some associated DDR parameters as well. When an incoming call arrives on an ISDN circuit, we'll dynamically bind the call to the appropriate dialer profile based on the authenticated username or caller-id. You can define many more dialer profiles than you have physical ISDN circuits, thereby allowing you to over-subscribe and, in essence, rely on statistical multiplexing of your ISDN calls.

This seems to be a breakthrough for our OSPF backup strategy. Since each dialer profile has its own associated IP address (and therefore OSPF area), if we had 50 OSPF areas to backup, we can configure 50 different dialer profiles on the backup ABR. We don't need 50 different ISDN interfaces anymore, we can use far fewer, depending on the level of over-subscription we can handle in our backup network. When an incoming call arrives on the backup ABR, we bind the call from the area that went down to the appropriate dialer profile in the same area.

Unfortunately, there are a few problems with dialer profiles. Pre-configuration of the dialer profiles places each dialer profile within the respective area that the backed up area belongs to. This causes:

Extra LSAs to be generated, one for each dialer profiles.

Areas automatically become discontiguous, since the dialer profile becomes a stub link into an area. (Dialer interfaces never go down so OSPF creates a stub link for every dialer interface configured on a router).

Each dialer profile introduces one additional route into the area, which may be undesirable when doing summarization.

Any change in the LSA database (link flap anywhere in the network) causes an ISDN call to be generated.

Since area LSAs are flooded every 30 minutes to ensure synchronization of LSA databases across the autonomous system, an ISDN call is generated to each area when the flooding occurs.

Note It is possible to avoid the last scenario if you use the OSPF On-Demand feature in IOS 11.2. However, every backup router in every area has to be upgraded to 11.2 to understand the Demand Circuit (DC) option during adjacency formation.

The Virtual Profiles feature in Cisco 11.3 solves all of the above problems. Virtual profiles is based on dialer profiles, so again, we have the separation of the network layer interface from the physical ISDN circuit. However, virtual profiles extends dialer profiles by allowing dynamic interface configuration when an inbound call is made. The interface configuration is stored on a central server (in our scenario, an AAA server supporting either the TACACS+ or RADIUS protocol) and downloaded to the router on demand. When the area dials back into the ABR, the physical ISDN circuit is bound to a dynamic interface called a virtual-access interface. The configuration of the virtual-access interface is sourced from a virtual-template and, most importantly, from the AAA server. We store the IP address of the virtual profile on the AAA server, and it's applied to the virtual-access interface that the physical ISDN circuit has been bound to. When the ISDN link is disconnected, the virtual profile (or virtual-access interface that the area was connected to) is destroyed, the ISDN link is ready for the next ISDN call.

With a PRI, we have the capability of supporting up to 23 calls at once from the same or different sites. With PPP multilink enabled on the backup ABR, when a new call arrives, we compare the authenticated username with that of existing virtual profiles. If a match is found (the call originated from the same area), we bundle the links together into a multilink bundle that allows physical ISDN circuits that originate from the same place to share the same network layer interface (virtual profile). Physical ISDN circuits that originate from different areas (whose authenticated username differs from the virtual profiles already created) are bound to new virtual profiles and new virtual-access interfaces are created with their configurations downloaded from the AAA server.

Since we're no longer pre-configuring the dialer profiles on the backup ABR, we don't encounter the dialer profile problems listed above. The absence of pre-configuration also allows the backup ABRs to scale effortlessly across multiple chassis, and eliminates redundant management overhead.

On the backup ABR(s), you do, however, need to pre-configure the OSPF network statements that associate a subnet with a particular area.

In the example shown below, we have two routers in area 0, isdn2-1 and isdn2-2. isdn2-2 has the primary link to isdn1-7, which is in area 100. isdn1-5 is the ABR for area 100 and dials into isdn2-2, which is the backup aggregation router. isdn1-4 is another router in area 100 from which we can run traceroutes to monitor the path of IP traffic. isdn1-5 has OSPF on-demand running; it initially syncs up to isdn2-2 and thus has full knowledge of inter-area routes, including the summary route. However, the cost is higher on the backup interface, thus the preferred path is still through isdn1-7.

Configurations
Let's look at the current configurations of the routers in the example above.

  isdn2-1
interface Loopback0
  ip address 10.0.1.1 255.255.255.0
!
interface Loopback1
  ip address 10.0.2.2 255.255.255.0
!
interface Loopback2
  ip address 10.0.3.3 255.255.255.0
!
interface Tunnel0
  ip address 10.100.100.2 255.255.255.0
  ip ospf cost 100
  tunnel source Ethernet2/0
  tunnel destination 172.16.25.9
  tunnel key 1234
!
interface Ethernet2/0
  ip address 172.16.25.51 255.255.255.240
!
router ospf 10
  redistribute static subnets route-map cisco_summary
  network 10.0.0.0 0.0.255.255 area 0
  network 172.16.25.48 0.0.0.15 area 0
  network 10.100.100.0 0.0.0.255 area 100
  default-metric 100
!
ip default-gateway 172.16.25.49
ip classless
ip route 171.68.0.0 255.254.0.0 172.16.25.49
ip route 172.16.25.9 255.255.255.255 172.16.25.49
no logging buffered
access-list 101 permit ip 171.68.0.0 0.0.255.255 255.254.0.0 0.0.255.255
route-map cisco_summary permit 10
  match ip address 101
  set metric 200

isdn2-2
aaa new-model
aaa authentication login default none
aaa authentication ppp default if-needed tacacs+
aaa authorization network tacacs+
aaa accounting network start-stop tacacs
!
interface Ethernet0
ip address 172.16.25.52 255.255.255.240
!
interface Virtual-Template1
no ip address
ppp authentication chap
!
interface Serial0:23
no ip address
encapsulation ppp
dialer-group 1
isdn incoming-voice modem
no peer default ip address
ppp authentication chap
!
interface Group-Async1
ip unnumbered Ethernet0
ip tcp header-compression passive
encapsulation ppp
async mode interactive
peer default ip address pool default
ppp authentication chap
group-range 1 24
!
router ospf 10
network 10.0.0.0 0.0.255.255 area 0
network 10.200.0.0 0.0.255.255 area 200
network 172.16.25.48 0.0.0.15 area 0
network 10.100.200.0 0.0.0.255 area 100
!
ip local pool default 172.16.25.59 172.16.25.62
virtual-profile virtual-template 1
virtual-profile aaa
dialer-list 1 protocol ip permit
tacacs-server host 171.68.207.32
tacacs-server key cisco

isdn1-5
interface Ethernet0
  ip address 172.16.25.5 255.255.255.240
!
interface BRI0
  ip address 10.100.200.1 255.255.255.0
  encapsulation ppp
  ip ospf cost 1500
  ip ospf demand-circuit
  no peer default ip address
  dialer map ip 10.100.200.2 name isdn2-2 broadcast 4327528
  dialer-group 1
  ppp authentication chap
  ppp chap hostname ospf_backup1
!
router ospf 10
  network 0.0.0.0 255.255.255.255 area 100
!
dialer-list 1 protocol ip permit

isdn1-7
interface Tunnel0
ip address 10.100.100.1 255.255.255.0
ip ospf cost 100
tunnel source Ethernet0
tunnel destination 172.16.25.51
tunnel key 1234
!
interface Ethernet0
ip address 172.16.25.9 255.255.255.240
media-type 10BaseT
!
router ospf 10
redistribute static
network 0.0.0.0 255.255.255.255 area 100
!
ip classless
ip route 172.16.25.51 255.255.255.255 172.16.25.1

isdn1-4
interface Ethernet0
  ip address 172.16.25.4 255.255.255.240
!
router ospf 10
  network 0.0.0.0 255.255.255.255 area 100

show Commands
Let's look at the show command output for the routers above.

isdn2-1 show Commands
isdn2-1#show ip ospf
Routing Process "ospf 10" with ID 10.0.2.2
Supports only single TOS(TOS0) routes
It is an area border and autonomous system boundary router
Summary Link update interval is 00:30:00 and the update due in 00:00:06
External Link update interval is 00:30:00 and the update due in 00:27:25
Redistributing External Routes from,
static with metric mapped to 100, includes subnets in redistribution
SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
Number of DCbitless external LSA 0
Number of DoNotAge external LSA 0
Number of areas in this router is 2. 2 normal 0 stub 0 nssa
Area BACKBONE(0)
      Number of interfaces in this area is 4
      Area has no authentication
      SPF algorithm executed 38 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:29:21
      Link State Age Interval is 00:20:00 and due in 00:06:06
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 0
Area 100
      Number of interfaces in this area is 1
      Area has no authentication
      SPF algorithm executed 35 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:00:37
      Link State Age Interval is 00:20:00 and due in 00:00:05
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 6

isdn2-1#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
   U - per-user static route, o - ODR

Gateway of last resort is 172.16.25.49 to network 0.0.0.0

   10.0.0.0/24 is subnetted, 4 subnets
C    10.0.2.0 is directly connected, Loopback1
C    10.0.3.0 is directly connected, Loopback2
C    10.100.100.0 is directly connected, Tunnel0
C    10.0.1.0 is directly connected, Loopback0
   172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C    172.16.25.48/28 is directly connected, Ethernet2/0
S    172.16.25.9/32 [1/0] via 172.16.25.49
S 171.68.0.0/15 [1/0] via 172.16.25.49

isdn2-2 show Commands
isdn2-2#show ip ospf
Routing Process "ospf 10" with ID 172.16.25.52
Supports only single TOS(TOS0) routes
It is an area border router
Summary Link update interval is 00:30:00 and the update due in 00:03:21
SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
Number of DCbitless external LSA 0
Number of DoNotAge external LSA 0
Number of areas in this router is 3. 3 normal 0 stub 0 nssa
Area BACKBONE(0)
      Number of interfaces in this area is 26
      Area has no authentication
      SPF algorithm executed 9 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:03:20
      Link State Age Interval is 00:20:00 and due in 00:03:19
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 0
Area 100
      Number of interfaces in this area is 0
      Area has no authentication
      SPF algorithm executed 34 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:00:00
      Link State Age Interval is 00:20:00 and due in 00:03:19
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 10
Area 200
      Number of interfaces in this area is 0
      Area has no authentication
      SPF algorithm executed 1 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:00:00
      Link State Age Interval is 00:20:00 and due in 00:03:19
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 0

isdn2-2#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
   U - per-user static route, o - ODR

Gateway of last resort is 172.16.25.49 to network 0.0.0.0

   172.16.0.0/28 is subnetted, 1 subnets
C    172.16.25.48 is directly connected, Ethernet0
   10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
O IA 10.100.100.0/24 [110/110] via 172.16.25.51, 00:07:07, Ethernet0
O    10.0.3.3/32 [110/11] via 172.16.25.51, 00:09:40, Ethernet0
O    10.0.2.2/32 [110/11] via 172.16.25.51, 00:09:40, Ethernet0
O    10.0.1.1/32 [110/11] via 172.16.25.51, 00:09:40, Ethernet0
O E2 171.68.0.0/15 [110/200] via 172.16.25.49, 00:07:07, Ethernet0

isdn2-2#show ip ospf interface virtual-template 1
Virtual-Template1 is down, line protocol is down
OSPF not enabled on this interface

isdn1-7 show Commands
isdn1-7#show ip ospf
Routing Process "ospf 10" with ID 172.16.25.9
Supports only single TOS(TOS0) routes
It is an autonomous system boundary router
External Link update interval is 00:30:00 and the update due in 00:03:54
Redistributing External Routes from,
static
SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
Number of DCbitless external LSA 0
Number of DoNotAge external LSA 0
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Area 100
      Number of interfaces in this area is 3
      Area has no authentication
      SPF algorithm executed 32 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:10:38
      Link State Age Interval is 00:20:00 and due in 00:10:38
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 6

isdn1-7#show ip ospf neighbor details
Neighbor 172.16.25.5, interface address 172.16.25.5
In the area 100 via interface Ethernet0
Neighbor priority is 1, State is FULL
DR is 172.16.25.5 BDR is 172.16.25.4
Options 2
Dead timer due in 00:00:32
Neighbor 172.16.25.4, interface address 172.16.25.4
In the area 100 via interface Ethernet0
Neighbor priority is 1, State is FULL
DR is 172.16.25.5 BDR is 172.16.25.4
Options 2
Dead timer due in 00:00:39
Neighbor 10.0.2.2, interface address 10.100.100.2
In the area 100 via interface Tunnel0
Neighbor priority is 1, State is FULL
DR is 0.0.0.0 BDR is 0.0.0.0
Options 2
Dead timer due in 00:00:37

isdn1-7#show ip ospf interface tunnel0
Tunnel0 is up, line protocol is up
  Internet Address 10.100.100.1/24, Area 100
  Process ID 10, Router ID 172.16.25.9, Network Type POINT_TO_POINT, Cost: 100
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:04
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)

isdn1-7#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
   U - per-user static route, o - ODR

Gateway of last resort is 172.16.25.1 to network 0.0.0.0

   172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks
O IA 172.16.25.48/28 [110/1520] via 172.16.25.5, 00:10:33, Ethernet0
S    172.16.25.51/32 [1/0] via 172.16.25.1
C    172.16.25.0/28 is directly connected, Ethernet0
C    172.16.25.3/32 is directly connected, Virtual-Access1
   10.0.0.0/8 is variably subnetted, 9 subnets, 2 masks
O IA 10.0.3.3/32 [110/1521] via 172.16.25.5, 00:10:33, Ethernet0
O IA 10.0.2.2/32 [110/1521] via 172.16.25.5, 00:10:33, Ethernet0
O IA 10.0.1.1/32 [110/1521] via 172.16.25.5, 00:10:33, Ethernet0
C    10.100.100.0/24 is directly connected, Tunnel0
O    10.100.65.1/32 [110/11] via 172.16.25.5, 00:10:33, Ethernet0
O    10.100.60.1/32 [110/11] via 172.16.25.5, 00:10:33, Ethernet0
O    10.100.55.1/32 [110/11] via 172.16.25.5, 00:10:33, Ethernet0
O    10.100.50.1/32 [110/11] via 172.16.25.5, 00:10:33, Ethernet0
O    10.100.200.0/24 [110/1510] via 172.16.25.5, 00:10:33, Ethernet0
O E2 171.68.0.0/15 [110/200] via 172.16.25.5, 00:10:33, Ethernet0

isdn1-5 show Commands
isdn1-5#show ip ospf
Routing Process "ospf 10" with ID 172.16.25.5
Supports only single TOS(TOS0) routes
SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
Number of DCbitless external LSA 0
Number of DoNotAge external LSA 3
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Area 100
      Number of interfaces in this area is 6
      Area has no authentication
      SPF algorithm executed 45 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:05:12
      Link State Age Interval is 00:20:00 and due in 00:05:11
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 7

isdn1-5#show ip ospf neighbor details
Neighbor 172.16.25.52, interface address 10.100.200.2
In the area 100 via interface BRI0
Neighbor priority is 1, State is FULL
Options 34
Dead timer due in 00:00:34
Neighbor 172.16.25.9, interface address 172.16.25.9
In the area 100 via interface Ethernet0
Neighbor priority is 1, State is FULL
Options 2
Dead timer due in 00:00:36
Neighbor 172.16.25.4, interface address 172.16.25.4
In the area 100 via interface Ethernet0
Neighbor priority is 1, State is FULL
Options 2
Dead timer due in 00:00:36

isdn1-5#show ip ospf interface bri0
BRI0 is up, line protocol is up (spoofing)
  Internet Address 10.100.200.1/24, Area 100
  Process ID 10, Router ID 172.16.25.5, Network Type POINT_TO_POINT, Cost: 1500
  Configured as demand circuit.
  Run as demand circuit.
  DoNotAge LSA allowed.
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
Hello due in 00:00:02
  Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 172.16.25.52  (Hello suppressed)
  Suppress hello for 1 neighbor(s)

isdn1-5#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
   U - per-user static route, o - ODR

Gateway of last resort is not set

   10.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
O IA 10.0.3.3/32 [110/111] via 172.16.25.9, 00:00:56, Ethernet0
O IA 10.0.2.2/32 [110/111] via 172.16.25.9, 00:00:56, Ethernet0
O IA 10.0.1.1/32 [110/111] via 172.16.25.9, 00:00:56, Ethernet0
O    10.100.100.0/24 [110/110] via 172.16.25.9, 00:00:56, Ethernet0
C    10.100.65.0/24 is directly connected, Loopback3
C    10.100.60.0/24 is directly connected, Loopback2
C    10.100.55.0/24 is directly connected, Loopback1
C    10.100.50.0/24 is directly connected, Loopback0
C    10.100.200.2/32 is directly connected, BRI0
C    10.100.200.0/24 is directly connected, BRI0
   172.16.0.0/28 is subnetted, 2 subnets
O IA 172.16.25.48 [110/120] via 172.16.25.9, 00:00:57, Ethernet0
C    172.16.25.0 is directly connected, Ethernet0
O E2 171.68.0.0/15 [110/200] via 172.16.25.9, 00:00:58, Ethernet0

isdn1-4 show Commands
isdn1-4#show ip ospf
Routing Process "ospf 10" with ID 172.16.25.4
Supports only single TOS(TOS0) routes
SPF schedule delay 5 secs, Hold time between two SPFs 10 secs
Number of DCbitless external LSA 0
Number of DoNotAge external LSA 3
Number of areas in this router is 1. 1 normal 0 stub 0 nssa
Area 100
      Number of interfaces in this area is 1
      Area has no authentication
      SPF algorithm executed 27 times
      Area ranges are
      Link State Update Interval is 00:30:00 and due in 00:20:41
      Link State Age Interval is 00:20:00 and due in 00:00:40
      Number of DCbitless LSA 0
      Number of indication LSA 0
      Number of DoNotAge LSA 6

isdn1-4#show ip ospf neighbor details
Neighbor 172.16.25.9, interface address 172.16.25.9
In the area 100 via interface Ethernet0
Neighbor priority is 1, State is FULL
Options 2
Dead timer due in 00:00:35
Neighbor 172.16.25.5, interface address 172.16.25.5
In the area 100 via interface Ethernet0
Neighbor priority is 1, State is FULL
Options 2
Dead timer due in 00:00:30

isdn1-4#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
   U - per-user static route, o - ODR

Gateway of last resort is not set

   10.0.0.0/8 is variably subnetted, 9 subnets, 2 masks
O IA 10.0.3.3/32 [110/111] via 172.16.25.9, 00:02:00, Ethernet0
O IA 10.0.2.2/32 [110/111] via 172.16.25.9, 00:02:01, Ethernet0
O IA 10.0.1.1/32 [110/111] via 172.16.25.9, 00:02:01, Ethernet0
O    10.100.100.0/24 [110/110] via 172.16.25.9, 00:02:11, Ethernet0
O    10.100.65.1/32 [110/11] via 172.16.25.5, 00:02:11, Ethernet0
O    10.100.60.1/32 [110/11] via 172.16.25.5, 00:02:11, Ethernet0
O    10.100.55.1/32 [110/11] via 172.16.25.5, 00:02:11, Ethernet0
O    10.100.50.1/32 [110/11] via 172.16.25.5, 00:02:11, Ethernet0
O    10.100.200.0/24 [110/1510] via 172.16.25.5, 00:02:11, Ethernet0
   172.16.0.0/28 is subnetted, 2 subnets
O IA 172.16.25.48 [110/120] via 172.16.25.9, 00:02:01, Ethernet0
C    172.16.25.0 is directly connected, Ethernet0
O E2 171.68.0.0/15 [110/200] via 172.16.25.9, 00:02:01, Ethernet0

Debugs and Verification
The current route from isdn1-4 to 171.68.191.1 is through isdn1-7, over the tunnel interface to isdn2-1, and on through 172.16.25.49.

isdn1-4#show ip route 171.68.0.0
Routing entry for 171.68.0.0/15, supernet
  Known via "ospf 10", distance 110, metric 200, type extern 2, forward metric 120
  Redistributing via ospf 10
  Last update from 172.16.25.9 on Ethernet0, 00:00:04 ago
  Routing Descriptor Blocks:
  * 172.16.25.9, from 10.0.2.2, 00:00:04 ago, via Ethernet0
   Route metric is 200, traffic share count is 1

We can see this route using the traceroute command on a host in the Cisco internal network. How the packet gets back to us is irrelevant in this scenario.

isdn1-4#traceroute 171.68.191.1

Type escape sequence to abort.
Tracing the route to dpeng-sun.cisco.com (171.68.200.127)

  1 172.16.25.9 4 msec 4 msec 4 msec    (isdn1-7)
  2 10.100.100.2 4 msec 8 msec 8 msec    (isdn2-1)
  3 172.16.25.49 4 msec 4 msec 4 msec
  4 171.68.191.1 8 msec 8 msec 4 msec

Let's change the tunnel key on isdn1-7 to cause the tunnel interface to go down. If we wait a full dead interval (40 seconds is the default dead interval), the peer is detected as down and our backup begins.

isdn1-7#
*Mar  1 02:31:17.916: OSPF: 10.0.2.2 address 10.100.100.2 on Tunnel0 is dead

The area backup router is isdn1-5. It's running OSPF on-demand, so it has full knowledge of intra-area routes through the backup aggregation router. However, the OSPF cost through the backup link is higher, thus when primary link between area 100 and the backbone is up, packets still flow through isdn1-7. Since we've broken the primary link on isdn1-7, isdn1-5's route is now better, and the change in the OSPF database triggers a call to the backup aggregation router.

isdn1-5#
*Mar  7 04:58:09.955: ISDN BR0: TX ->;  SETUP pd = 8  callref = 0x05
*Mar  7 04:58:09.959:       Bearer Capability i = 0x8890
*Mar  7 04:58:09.959:       Channel ID i = 0x83
*Mar  7 04:58:09.963:       Keypad Facility i = '4327528'
*Mar  7 04:58:10.103: ISDN BR0: RX <-  CALL_PROC pd = 8  callref = 0x85
*Mar  7 04:58:10.107:       Channel ID i = 0x89
*Mar  7 04:58:10.963: ISDN BR0: RX <-  CONNECT pd = 8  callref = 0x85
*Mar  7 04:58:10.975: %LINK-3-UPDOWN: Interface BRI0:1, changed state to up
*Mar  7 04:58:11.007: ISDN BR0: TX ->;  CONNECT_ACK pd = 8  callref = 0x05
*Mar  7 04:58:12.019: %LINEPROTO-5-UPDOWN:
Line protocol on Interface BRI0:1, changed state to up
*Mar  7 04:58:17.131: %ISDN-6-CONNECT:
Interface BRI0:1 is now connected to 4327528 isdn2-2
*Mar  7 04:58:24.159: OSPF:
Cannot see ourself in hello from 172.16.25.52 on BRI0, state INIT
*Mar  7 04:58:27.867: OSPF: Rcv DBD from 172.16.25.52 on BRI0 seq 0x6FE
opt 0x22 flag 0x7 len 32 state INIT
*Mar  7 04:58:27.871: OSPF: 2 Way Communication to 172.16.25.52
on BRI0, state 2WAY
*Mar  7 04:58:27.875: OSPF: Send DBD to 172.16.25.52 on BRI0 seq
0xEBC opt 0x22 flag 0x7 len 32
*Mar  7 04:58:27.879: OSPF: NBR Negotiation Done. We are the SLAVE
*Mar  7 04:58:27.879: OSPF: Send DBD to 172.16.25.52 on BRI0 seq
0x6FE opt 0x22 flag 0x2 len 432
*Mar  7 04:58:28.031: OSPF: Rcv DBD from 172.16.25.52 on BRI0 seq
0x6FF opt 0x22 flag 0x3 len 432 state EXCHANGE
*Mar  7 04:58:28.035: OSPF: Send DBD to 172.16.25.52 on BRI0 seq
0x6FF opt 0x22 flag 0x0 len 32
*Mar  7 04:58:28.043: OSPF: Database request to 172.16.25.52
*Mar  7 04:58:28.043: OSPF: sent LS REQ packet to 10.100.200.2,
length 24
*Mar  7 04:58:28.079: OSPF: Rcv DBD from 172.16.25.52 on BRI0 seq
0x700 opt 0x22 flag 0x1 len 32 state EXCHANGE
*Mar  7 04:58:28.079: OSPF: Exchange Done with 172.16.25.52 on BRI0
*Mar  7 04:58:28.083: OSPF: Send DBD to 172.16.25.52 on BRI0 seq
0x700 opt 0x22 flag 0x0 len 32
*Mar  7 04:58:28.099: OSPF: Synchronized with 172.16.25.52 on BRI0,
state FULL
*Mar  7 04:58:28.099: OSPF: Tried to build Router LSA within
MinLSInterval

The backup procedure on isdn1-5 is complete, and the ISDN interface is now the link between area 100 and the backbone area.

isdn1-5#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
   U - per-user static route, o - ODR

Gateway of last resort is not set

   10.0.0.0/8 is variably subnetted, 10 subnets, 2 masks
O IA 10.0.3.3/32 [110/1511] via 10.100.200.2, 00:00:35, BRI0
O IA 10.0.2.2/32 [110/1511] via 10.100.200.2, 00:00:35, BRI0
O IA 10.0.1.1/32 [110/1511] via 10.100.200.2, 00:00:35, BRI0
O    10.100.100.0/24 [110/110] via 172.16.25.9, 00:00:35, Ethernet0
C    10.100.65.0/24 is directly connected, Loopback3
C    10.100.60.0/24 is directly connected, Loopback2
C    10.100.55.0/24 is directly connected, Loopback1
C    10.100.50.0/24 is directly connected, Loopback0
C    10.100.200.2/32 is directly connected, BRI0
C    10.100.200.0/24 is directly connected, BRI0
   172.16.0.0/28 is subnetted, 2 subnets
O IA 172.16.25.48 [110/1510] via 10.100.200.2, 00:00:36, BRI0
C    172.16.25.0 is directly connected, Ethernet0
O E2 171.68.0.0/15 [110/200] via 10.100.200.2, 00:00:37, BRI0

isdn1-5#show ip route 171.68.0.0
Routing entry for 171.68.0.0/15, supernet
  Known via "ospf 10", distance 110, metric 200, type extern 2, forward metric 1510
  Redistributing via ospf 10
  Last update from 10.100.200.2 on BRI0, 00:09:33 ago
  Routing Descriptor Blocks:
  * 10.100.200.2, from 10.0.2.2, 00:09:33 ago, via BRI0
   Route metric is 200, traffic share count is 1

Looking on isdn1-4 now, we see that the summary route for the Cisco internal network now has a next hop of isdn1-5.

isdn1-4#show ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, * - candidate default
   U - per-user static route, o - ODR

Gateway of last resort is not set

   10.0.0.0/8 is variably subnetted, 9 subnets, 2 masks
O IA 10.0.3.3/32 [110/1521] via 172.16.25.5, 00:01:49, Ethernet0
O IA 10.0.2.2/32 [110/1521] via 172.16.25.5, 00:01:49, Ethernet0
O IA 10.0.1.1/32 [110/1521] via 172.16.25.5, 00:01:49, Ethernet0
O    10.100.100.0/24 [110/110] via 172.16.25.9, 00:01:49, Ethernet0
O    10.100.65.1/32 [110/11] via 172.16.25.5, 00:01:49, Ethernet0
O    10.100.60.1/32 [110/11] via 172.16.25.5, 00:01:49, Ethernet0
O    10.100.55.1/32 [110/11] via 172.16.25.5, 00:01:49, Ethernet0
O    10.100.50.1/32 [110/11] via 172.16.25.5, 00:01:49, Ethernet0
O    10.100.200.0/24 [110/1510] via 172.16.25.5, 00:01:49, Ethernet0
   172.16.0.0/28 is subnetted, 2 subnets
O IA 172.16.25.48 [110/1520] via 172.16.25.5, 00:01:49, Ethernet0
C    172.16.25.0 is directly connected, Ethernet0
O E2 171.68.0.0/15 [110/200] via 172.16.25.5, 00:01:49, Ethernet0

isdn1-4#show ip route 171.68.0.0
Routing entry for 171.68.0.0/15, supernet
  Known via "ospf 10", distance 110, metric 200, type extern 2,
  forward metric 1520
  Redistributing via ospf 10
  Last update from 172.16.25.5 on Ethernet0, 00:02:04 ago
  Routing Descriptor Blocks:
  * 172.16.25.5, from 10.0.2.2, 00:02:04 ago, via Ethernet0
   Route metric is 200, traffic share count is 1

The traceroute command demonstrates the path has changed.

isdn1-4#traceroute 171.68.191.1

   Type escape sequence to abort.
   Tracing the route to dpeng-sun.cisco.com (171.68.200.127)

   1 172.16.25.5 4 msec 4 msec 4 msec       (isdn1-5)
   2 10.100.200.2 16 msec 16 msec 16 msec    (isdn2-2)
   3 172.16.25.49 28 msec 16 msec 72 msec
   4 171.68.191.1 16 msec 16 msec 16 msec

Let's look at what happens on the backup aggregation router when the primary link (the tunnel interface) is down and the area backup router dials in. First, the backup aggregation router receives the call from the area backup router:

*Mar  1 01:12:20.587: ISDN Se0:23: RX <-  SETUP pd = 8  callref = 0x1B
*Mar  1 01:12:20.591:       Bearer Capability i = 0x8890
*Mar  1 01:12:20.595:       Channel ID i = 0xA98393
*Mar  1 01:12:20.599:       Calling Party Number i = '!', 0x83, '4082322044'
*Mar  1 01:12:20.603:       Called Party Number i = 0xC1, '4084327528'
*Mar  1 01:12:20.691: %LINK-3-UPDOWN: Interface Serial0:18, changed state to up
*Mar  1 01:12:20.727: Se0:18 PPP: Treating connection as a callin
*Mar  1 01:12:20.731: Se0:18 PPP: Phase is ESTABLISHING, Passive Open
*Mar  1 01:12:20.735: Se0:18 LCP: State is Listen
*Mar  1 01:12:20.755: ISDN Se0:23: TX ->;  CALL_PROC pd = 8  callref = 0x801B
*Mar  1 01:12:20.759:       Channel ID i = 0xA98393
*Mar  1 01:12:20.791: ISDN Se0:23: TX ->;  CONNECT pd = 8  callref = 0x801B
*Mar  1 01:12:20.791:       Channel ID i = 0xA98393
*Mar  1 01:12:20.863: ISDN Se0:23: RX <-  CONNECT_ACK pd = 8  callref = 0x1B

PPP negotiation begins:

*Mar  1 01:12:20.995: Se0:18 LCP: I CONFREQ [Listen] id 166 len 34
*Mar  1 01:12:20.999: Se0:18 LCP: AuthProto CHAP
(0x0305C22305)
*Mar  1 01:12:21.003: Se0:18 LCP: MagicNumber 0x20039D53
(0x050620039D53)
*Mar  1 01:12:21.003: Se0:18 LCP: MRRU 1524 (0x110405F4)
*Mar  1 01:12:21.007: Se0:18 LCP: EndpointDisc 1 Local
(0x130F016F7370665F6261636B757031)
*Mar  1 01:12:21.015: Se0:18 LCP: O CONFREQ [Listen] id 9 len 15
*Mar  1 01:12:21.015: Se0:18 LCP: AuthProto CHAP
(0x0305C22305)
*Mar  1 01:12:21.019: Se0:18 LCP: MagicNumber 0x60812EEF
(0x050660812EEF)
*Mar  1 01:12:21.023: Se0:18 LCP: O CONFREJ [Listen] id 166 len 23
*Mar  1 01:12:21.027: Se0:18 LCP: MRRU 1524 (0x110405F4)
*Mar  1 01:12:21.027: Se0:18 LCP: EndpointDisc 1 Local
(0x130F016F7370665F6261636B757031)
*Mar  1 01:12:21.043: Se0:18 LCP: I CONFACK [REQsent] id 9 len 15
*Mar  1 01:12:21.047: Se0:18 LCP: AuthProto CHAP
(0x0305C22305)
*Mar  1 01:12:21.051: Se0:18 LCP: MagicNumber 0x60812EEF
(0x050660812EEF)
*Mar  1 01:12:21.055: Se0:18 LCP: I CONFREQ [ACKrcvd] id 167 len 15
*Mar  1 01:12:21.055: Se0:18 LCP: AuthProto CHAP
(0x0305C22305)
*Mar  1 01:12:21.059: Se0:18 LCP: MagicNumber 0x20039D53
(0x050620039D53)
*Mar  1 01:12:21.063: Se0:18 LCP: O CONFACK [ACKrcvd] id 167 len 15
*Mar  1 01:12:21.063: Se0:18 LCP: AuthProto CHAP
(0x0305C22305)
*Mar  1 01:12:21.067: Se0:18 LCP: MagicNumber 0x20039D53
(0x050620039D53)
*Mar  1 01:12:21.071: Se0:18 LCP: State is Open

Once LCP finishes negotiating, we proceed to authentication:

*Mar  1 01:12:21.071: Se0:18 PPP: Phase is AUTHENTICATING,
by both
*Mar  1 01:12:21.075: Se0:18 CHAP: O CHALLENGE id 9 len 28
from "isdn2-2"
*Mar  1 01:12:21.155: Se0:18 CHAP: I CHALLENGE id 61 len 33
from "ospf_backup1"
*Mar  1 01:12:21.159: Se0:18 CHAP: I RESPONSE id 9 len 33
from "ospf_backup1"

We sent our Challenge Handshake Authentication Protocol (CHAP) challenge and received a response from the peer. Note that the backup area router claims to be "ospf_backup1", instead of the actual hostname of the router "isdn1-5". This happens because we used the ppp chap hostname command to override the default.

Since we authenticated this user using TACACS+, next we contact the TACACS+ server.

*Mar  1 01:12:21.167: AAA/AUTHEN: create_user (0x35F5BC)
user='ospf_backup1' ruser='' port='Serial0:18'
rem_addr='4082322044/4084327528' authen_type=CHAP service=PPP priv=1
*Mar  1 01:12:21.171: AAA/AUTHEN/START (1579536474):
port='Serial0:18' list='' action=SENDAUTH service=PPP
*Mar  1 01:12:21.175: AAA/AUTHEN/START (1579536474):
using "default" list
*Mar  1 01:12:21.179: AAA/AUTHEN (1579536474):
status = UNKNOWN
*Mar  1 01:12:21.179: AAA/AUTHEN/START (1579536474):
Method=TACACS+
*Mar  1 01:12:21.183: TAC+: send AUTHEN/START packet
ver=193 id=1579536474
*Mar  1 01:12:21.403: TAC+: ver=193 id=1579536474
received AUTHEN status = PASS
*Mar  1 01:12:21.403: AAA/AUTHEN (1579536474):
status = PASS
*Mar  1 01:12:21.411: AAA/AUTHEN: free_user (0x35F5BC)
user='ospf_backup1' ruser='' port='Serial0:18'
rem_addr='4082322044/4084327528' authen_type=CHAP service=PPP priv=1
*Mar  1 01:12:21.415: Se0:18 CHAP: Waiting for peer
to authenticate first
*Mar  1 01:12:21.419: AAA/AUTHEN: create_user (0x35F5BC)
user='ospf_backup1' ruser='' port='Serial0:18'
rem_addr='4082322044/4084327528' authen_type=CHAP service=PPP priv=1
*Mar  1 01:12:21.423: AAA/AUTHEN/START (3035786780):
port='Serial0:18' list='' action=LOGIN service=PPP
*Mar  1 01:12:21.427: AAA/AUTHEN/START (3035786780):
using "default" list
*Mar  1 01:12:21.427: AAA/AUTHEN (3035786780):
status = UNKNOWN
*Mar  1 01:12:21.431: AAA/AUTHEN/START (3035786780):
Method=TACACS+
*Mar  1 01:12:21.431: TAC+: send AUTHEN/START packet
ver=193 id=3035786780
*Mar  1 01:12:21.655: TAC+: ver=193 id=3035786780
received AUTHEN status = PASS
*Mar  1 01:12:21.659: AAA/AUTHEN (3035786780):
status = PASS

Since the password is correct, and the backup area router is authenticated, we now proceed to the authorization stage.

*Mar  1 01:12:21.663: AAA/AUTHOR/LCP Se0:18:
Authorize LCP
*Mar  1 01:12:21.667: AAA/AUTHOR/LCP: Serial0:18:
(221407121): user='ospf_backup1'
*Mar  1 01:12:21.667: AAA/AUTHOR/LCP: Serial0:18:
(221407121): send AV service=ppp
*Mar  1 01:12:21.671: AAA/AUTHOR/LCP: Serial0:18:
(221407121): send AV protocol=lcp
*Mar  1 01:12:21.671: AAA/AUTHOR/LCP: Serial0:18:
(221407121): Method=TACACS+
*Mar  1 01:12:21.675: AAA/AUTHOR/TAC+: (221407121):
user=ospf_backup1
*Mar  1 01:12:21.679: AAA/AUTHOR/TAC+: (221407121):
send AV service=ppp
*Mar  1 01:12:21.679: AAA/AUTHOR/TAC+: (221407121):
send AV protocol=lcp
*Mar  1 01:12:21.903: TAC+: (221407121): received
author response status = PASS_ADD
*Mar  1 01:12:21.911: AAA/AUTHOR (221407121):
Post authorization status = PASS_ADD
*Mar  1 01:12:21.911: AAA/AUTHOR/LCP Se0:18:
Processing AV service=ppp
*Mar  1 01:12:21.915: AAA/AUTHOR/LCP Se0:18:
Processing AV protocol=lcp
*Mar  1 01:12:21.915: AAA/AUTHOR/LCP Se0:18:
Processing AV interface-config=ip address
10.100.200.2 255.255.255.0\nip ospf cost 1500

Authorization is complete. We get an attribute-value pair (AVP) indicating certain configurations must be on the interface we're creating.

Now that authentication and authorization for LCP is complete, we let the peer know they're allowed in.

*Mar  1 01:12:21.927: Se0:18 CHAP: O SUCCESS id 9 len 4
*Mar  1 01:12:21.927: Se0:18 CHAP: O RESPONSE id 61
len 28 from "isdn2-2"
*Mar  1 01:12:21.951: Se0:18 CHAP: I SUCCESS id 61 len 4

The LCP process is complete, and now Network Control Protocol (NCP) will be built, which means we need an interface. We have enabled the virtual profiles feature, so we clone a virtual-access interface from the virtual-template interface, then customize the configuration using the AVPs received from AAA.

Let's look at how we create the virtual-access interface.

*Mar  1 01:12:21.955: Vi1 VTEMPLATE: Reuse Vi1,
recycle queue size 0
*Mar  1 01:12:21.955: Vi1 VTEMPLATE: Set default
settings with no ip address
*Mar  1 01:12:22.363: Vi1 VTEMPLATE: Hardware address
0060.3ef1.6f74
*Mar  1 01:12:22.391: %LINEPROTO-5-UPDOWN:
Line protocol on Interface Serial0:18, changed state to up
*Mar  1 01:12:22.399: %LINEPROTO-5-UPDOWN:
Line protocol on Interface Virtual-Access1, changed state to up
*Mar  1 01:12:22.451: %LINK-3-UPDOWN:
Interface Virtual-Access1, changed state to up
*Mar  1 01:12:22.455: Vi1 PPP: Treating connection
as a dedicated line
*Mar  1 01:12:22.459: Vi1 PPP: Phase is ESTABLISHING,
Active Open
*Mar  1 01:12:22.463: Vi1 LCP: O CONFREQ [Closed]
id 33 len 10
*Mar  1 01:12:22.467: Vi1 LCP: MagicNumber 0x60813499
(0x050660813499)

The basic configuration of the virtual-access interface comes from virtual-template interface 1, as specified in the configuration.

*Mar  1 01:12:22.483: Vi1 VTEMPLATE:
Has a new cloneblk vtemplate, now it has vtemplate
*Mar  1 01:12:22.487: Vi1 VTEMPLATE:
Undo default settings
*Mar  1 01:12:22.899: Vi1 VTEMPLATE:
************* CLONE VACCESS1 *****************
*Mar  1 01:12:22.899: Vi1 VTEMPLATE:
Clone from vtemplate1
interface Virtual-Access1
no ip address
encap ppp
no ip address
no ip mroute-cache
ppp authentication chap
ppp multilink
end

The virtual access interface is starting up.

*Mar  1 01:12:23.671: Vi1 PPP:
Phase is TERMINATING
*Mar  1 01:12:23.671: Vi1 PPP:
Phase is ESTABLISHING, Active Open
*Mar  1 01:12:23.679: Vi1 LCP:
O CONFREQ [Closed] id 34 len 15
*Mar  1 01:12:23.679: Vi1 LCP:
AuthProto CHAP (0x0305C22305)
*Mar  1 01:12:23.683: Vi1 LCP:
MagicNumber 0x6081395A (0x05066081395A)
*Mar  1 01:12:23.743: Vi1 PPP:
Phase is TERMINATING
*Mar  1 01:12:23.747: Vi1 PPP:
Phase is ESTABLISHING, Active Open
*Mar  1 01:12:23.751: Vi1 LCP:
O CONFREQ [Closed] id 35 len 29
*Mar  1 01:12:23.755: Vi1 LCP:
AuthProto CHAP (0x0305C22305)
*Mar  1 01:12:23.759: Vi1 LCP:
MagicNumber 0x608139A3 (0x0506608139A3)
*Mar  1 01:12:23.759: Vi1 LCP:
MRRU 1524 (0x110405F4)
*Mar  1 01:12:23.763: Vi1 LCP:
EndpointDisc 1 Local (0x130A016973646E322D32)
*Mar  1 01:12:23.847: Vi1 AAA/AUTHOR: LCP_DOWN
*Mar  1 01:12:23.847: Vi1 AAA/AUTHOR: LCP_DOWN

Now let's download the configuration AVP that we got from the AAA server. It specifies the IP address for the interface and also modifies the default OSPF cost.

*Mar  1 01:12:23.947: Vi1 VTEMPLATE:
Has a new cloneblk AAA, now it has vtemplate/AAA
*Mar  1 01:12:23.951: Vi1 VTEMPLATE:
************* CLONE VACCESS1 *****************
*Mar  1 01:12:23.955: Vi1 VTEMPLATE:
Clone from AAA
interface Virtual-Access1
ip address 10.100.200.2 255.255.255.0
ip ospf cost 1500
end

*Mar  1 01:12:24.123: OSPF:
Interface Virtual-Access1 going Up
*Mar  1 01:12:24.127: Vi1 PPP:
Unsupported or un-negotiated protocol. Link ip
*Mar  1 01:12:24.235:
AAA/AUTHEN: dup_user (0x35DEA0) user='ospf_backup1'
ruser='' port='Serial0:18' rem_addr='4082322044/4084327528'
authen_type=CHAP service=PPP priv=1 source='AAA dup vp_create'

A bit of chicanery allows us to force the negotiated LCP state.

*Mar  1 01:12:24.239: Vi1 LCP:
I FORCED CONFREQ len 11
*Mar  1 01:12:24.243: Vi1 LCP:
AuthProto CHAP (0x0305C22305)
*Mar  1 01:12:24.247: Vi1 LCP:
MagicNumber 0x60812EEF (0x050660812EEF)
*Mar  1 01:12:24.247: Vi1 PPP:
Phase is UP

We are now ready to negotiate the NCPs.

*Mar  1 01:12:24.251: AAA/AUTHOR/FSM Vi1: (0):
Can we start IPCP?
*Mar  1 01:12:24.263: AAA/AUTHOR/FSM: Virtual-Access1:
(2432251470): user='ospf_backup1'
*Mar  1 01:12:24.263: AAA/AUTHOR/FSM: Virtual-Access1:
(2432251470): send AV service=ppp
*Mar  1 01:12:24.267: AAA/AUTHOR/FSM: Virtual-Access1:
(2432251470): send AV protocol=ip
*Mar  1 01:12:24.271: AAA/AUTHOR/FSM: Virtual-Access1:
(2432251470): Method=TACACS+
*Mar  1 01:12:24.275: AAA/AUTHOR/TAC+: (2432251470):
user=ospf_backup1
*Mar  1 01:12:24.275: AAA/AUTHOR/TAC+: (2432251470):
send AV service=ppp
*Mar  1 01:12:24.279: AAA/AUTHOR/TAC+: (2432251470):
send AV protocol=ip
*Mar  1 01:12:24.503: TAC+: (2432251470): received
author response status = PASS_ADD
*Mar  1 01:12:24.507: AAA/AUTHOR (2432251470): Post
authorization status = PASS_ADD
*Mar  1 01:12:24.515: AAA/AUTHOR/FSM Vi1: We can
start IPCP
*Mar  1 01:12:24.519: Vi1 IPCP: O CONFREQ [Closed]
id 17 len 10
*Mar  1 01:12:24.523: Vi1 IPCP:
Address 10.100.200.2 (0x03060A64C802)
*Mar  1 01:12:24.523: Se0:18 PPP: Phase is FORWARDED
*Mar  1 01:12:24.527: Se0:18 IPCP: PPP phase is FORWARDED,
discarding packet
*Mar  1 01:12:24.531: Se0:18 IPCP: PPP phase is FORWARDED,
discarding packet
*Mar  1 01:12:25.851: Vi1 LCP: TIMEout: Time 0x424F98
State Open

Peer wants to assign 10.100.200.1 on its interface.

*Mar  1 01:12:26.031: Vi1 IPCP: I CONFREQ [REQsent]
id 56 len 10
*Mar  1 01:12:26.035: Vi1 IPCP: Address 10.100.200.1
(0x03060A64C801)
*Mar  1 01:12:26.035: AAA/AUTHOR/IPCP Vi1: Start.
Her address 10.100.200.1, we want 0.0.0.0

We query the TACACS+ server to authorize the IP address.

*Mar  1 01:12:26.039: AAA/AUTHOR/IPCP Vi1:
Processing AV service=ppp
*Mar  1 01:12:26.043: AAA/AUTHOR/IPCP Vi1:
Processing AV protocol=ip
*Mar  1 01:12:26.043: AAA/AUTHOR/IPCP Vi1:
Processing AV addr=10.100.200.1
*Mar  1 01:12:26.047: AAA/AUTHOR/IPCP Vi1:
Authorization succeeded

Authorization is granted.

*Mar  1 01:12:26.047: AAA/AUTHOR/IPCP Vi1: Done.
Her address 10.100.200.1, we want 10.100.200.1

We acknowledge their requested IP address.

*Mar  1 01:12:26.051: Vi1 IPCP:
O CONFACK [REQsent] id 56 len 10
*Mar  1 01:12:26.059: Vi1 IPCP:
Address 10.100.200.1 (0x03060A64C801)
*Mar  1 01:12:26.067: Vi1 LCP:
O PROTREJ [Open] id 36 len 10 protocol CDPCP (0x820701350004)
*Mar  1 01:12:26.727: %ISDN-6-CONNECT:
Interface Serial0:18 is now connected to 4082322044 ospf_backup1
*Mar  1 01:12:26.875: Vi1 IPCP:
TIMEout: Time 0x425294 State ACKsent
*Mar  1 01:12:26.879: Vi1 IPCP:
O CONFREQ [ACKsent] id 18 len 10
*Mar  1 01:12:26.879: Vi1 IPCP:
Address 10.100.200.2 (0x03060A64C802)

Peer acknowledges our IP address.

*Mar  1 01:12:26.899: Vi1 IPCP:
I CONFACK [ACKsent] id 18 len 10
*Mar  1 01:12:26.903: Vi1 IPCP:
Address 10.100.200.2 (0x03060A64C802)
*Mar  1 01:12:26.903: Vi1 IPCP:
State is Open
*Mar  1 01:12:26.911: Vi1 AAA/AUTHOR:
IP_UP
*Mar  1 01:12:26.911: Vi1 AAA/PER-USER:
processing author params.
*Mar  1 01:12:26.919: Vi1 IPCP:
Install route to 10.100.200.1

Since IP is fully up on this interface, OSPF synchronizes and establishes adjacency.

*Mar  1 01:12:29.427: OSPF: Rcv hello from 10.0.2.2 area 0
from Ethernet0 172.16.25.51
*Mar  1 01:12:29.427: OSPF: End of hello processing
*Mar  1 01:12:35.295: OSPF: service_maxage: Trying to
delete MAXAGE LSA
*Mar  1 01:12:37.823: OSPF: Rcv hello from 172.16.25.5
area 100 from Virtual-Access1 10.100.200.1
*Mar  1 01:12:37.823: OSPF: 2 Way Communication to
172.16.25.5 on Virtual-Access1, state 2WAY
*Mar  1 01:12:37.827: OSPF: Send DBD to 172.16.25.5 on
Virtual-Access1 seq 0x6FE opt 0x22 flag 0x7 len 32
*Mar  1 01:12:37.831: OSPF: End of hello processing
*Mar  1 01:12:37.871: OSPF: Rcv DBD from 172.16.25.5 on
Virtual-Access1 seq 0xEBC opt 0x22 flag 0x7 len 32 state EXSTART
*Mar  1 01:12:37.875: OSPF: First DBD and we are not SLAVE
*Mar  1 01:12:37.927: OSPF: Rcv DBD from 172.16.25.5 on
Virtual-Access1 seq 0x6FE opt 0x22 flag 0x2 len 432 state EXSTART
*Mar  1 01:12:37.931: OSPF: NBR Negotiation Done.
We are the MASTER
*Mar  1 01:12:37.939: OSPF: Send DBD to 172.16.25.5 on
Virtual-Access1 seq 0x6FF opt 0x22 flag 0x3 len 432
*Mar  1 01:12:37.943: OSPF: Database request to 172.16.25.5
*Mar  1 01:12:37.947: OSPF: sent LS REQ packet to 10.100.200.1,
length 96
*Mar  1 01:12:38.031: OSPF: Rcv DBD from 172.16.25.5 on
Virtual-Access1 seq 0x6FF opt 0x22 flag 0x0 len 32 state EXCHANGE
*Mar  1 01:12:38.035: OSPF: Send DBD to 172.16.25.5 on
Virtual-Access1 seq 0x700 opt 0x22 flag 0x1 len 32
*Mar  1 01:12:38.115: OSPF: Rcv DBD from 172.16.25.5 on
Virtual-Access1 seq 0x700 opt 0x22 flag 0x0 len 32 state EXCHANGE
*Mar  1 01:12:38.119: OSPF: Exchange Done with 172.16.25.5
on Virtual-Access1
*Mar  1 01:12:38.119: OSPF: Synchronized with 172.16.25.5
on Virtual-Access1, state FULL

OSPF synchronization is complete between the area backup router and the backup aggregation router. OSPF on-demand is negotiated so the ISDN link is up only when there is data traffic flowing.

isdn2-2#show ip ospf interface virtual-access 1
Virtual-Access1 is up, line protocol is up
  Internet Address 10.100.200.2/24, Area 100
  Process ID 10, Router ID 172.16.25.52,
  Network Type POINT_TO_POINT, Cost: 1500
  Run as demand circuit.
  DoNotAge LSA allowed.
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40,
  Wait 40, Retransmit 5
Hello due in 00:00:05
  Neighbor Count is 1, Adjacent neighbor count is 1
Adjacent with neighbor 172.16.25.5
(Hello suppressed)
  Suppress hello for 1 neighbor(s)

isdn2-2#show interface virtual-access 1 config
Virtual-Access1 is a Virtual Profile interface

Building configuration...

interface Virtual-Access1 configuration...
ip address 10.100.200.2 255.255.255.0
ip ospf cost 1500
no ip mroute-cache
ppp authentication chap

Here's the TACACS+ profile of isdn1-5:

user = ospf_backup1 {
      chap = cleartext "cisco"

      service = ppp protocol = lcp {
            interface-config = "ip address 10.100.200.2 255.255.255.0\nip ospf cost 1500"
      }

      service = ppp protocol = ip {
            addr = 10.100.200.1
      }
}

And the RADIUS profile:

ospf_backkup1 Password = "cisco"
      Service-Type = Framed,
      Framed-Protocol = PPP,
      Framed-IP-Address = 10.100.200.1
      cisco-avpair = "interface-config=ip address 10.100.200.2 255.255.255.0\nip ospf cost 1