Configuring user authentication on an LNS

An LNS can be configured to authenticate a user that has passed authentication on the LAC to increase security. In this case, the user is authenticated once on the LAC and once on the LNS. An L2TP tunnel can be established only when both authentications succeed.

An LNS provides the following authentication methods in ascending order of priority:

Proxy authentication—The LNS uses the LAC as an authentication proxy. The LAC sends the LNS all user authentication information from users and the authentication method configured on the LAC itself. The LNS then checks the user validity according to the received information and the locally configured authentication method.
Mandatory CHAP authentication—The LNS uses CHAP authentication to reauthenticate users who have passed authentication on the LAC.
LCP renegotiation—The LNS ignores the LAC proxy authentication information and performs a new round of LCP negotiation with the user.

The LNS chooses an authentication method depending on your configuration.

If you configure both LCP renegotiation and mandatory CHAP authentication, the LNS uses LCP renegotiation.
If you configure only mandatory CHAP authentication, the LNS performs CHAP authentication for users after proxy authentication succeeds.
If you configure neither LCP renegotiation nor mandatory CHAP authentication, the LNS uses the LAC for proxy authentication.

Configuring mandatory CHAP authentication

When mandatory CHAP authentication is configured, a user who uses an LAC to initiate tunneling requests is authenticated by both the LAC and the LNS. Some users might not support the authentication on the LNS. In this situation, do not enable this feature, because CHAP authentication on the LNS will fail.

For this feature to take effect, you must also configure CHAP authentication for the PPP user on the VT interface of the LNS.

To configure mandatory CHAP authentication:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter L2TP group view in LNS mode.	l2tp-group group-number [ mode lns ]	N/A
3. Configure mandatory CHAP authentication.	mandatory-chap	By default, CHAP authentication is not performed on an LNS. This command is effective only on NAS-initiated L2TP tunnels.

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Enter L2TP group view in LNS mode.

l2tp-group group-number [ mode lns ]

N/A

3. Configure mandatory CHAP authentication.

mandatory-chap

By default, CHAP authentication is not performed on an LNS.

This command is effective only on NAS-initiated L2TP tunnels.

Configuring LCP renegotiation

To establish a NAS-initiated L2TP tunnel, a user first negotiates with the LAC at the start of a PPP session. If the negotiation succeeds, the LAC initiates an L2TP tunneling request and sends user information to the LNS. The LNS then authenticates the user according to the proxy authentication information received.

For the LNS not to accept LCP negotiation parameters, configure this feature to perform a new round of LCP negotiation between the LNS and the user. In this case, the LNS authenticates the user by using the authentication method configured on the corresponding VT interface.

If you enable LCP renegotiation but configure no authentication for the corresponding VT interface, the LNS does not perform an additional authentication for users.

To configure the LNS to perform LCP renegotiation with users:

Step	Command	Remarks
1. Enter system view.	system-view	N/A
2. Enter L2TP group view in LNS mode.	l2tp-group group-number [ mode lns ]	N/A
3. Configure the LNS to perform LCP renegotiation with users.	mandatory-lcp	By default, an LNS does not perform LCP renegotiation with users. This command is effective only on NAS-initiated L2TP tunnels.