Cisco AS5300 - Universal Access Server User manual

CHAPTER
2-1
Cisco IOS Dial Services Quick Configuration Guide
2
Configuring the Cisco AS5300 Network Access
Server
This chapter describes how to configure the Cisco AS5300 network access server (NAS) to receive calls
from the Cisco 1604, Cisco 766, and remote modem users as presented in Chapter 1, “Dial Case Study
Overview”.
Network Topology, Hardware, and Software Parameters
In the network topology shown in Figure 2-1, the PRI telephone number assigned to the Cisco AS5300
at the central headquarters site (hq-sanjose) is 4085551234. This number is often called the hunt group
number, which distributes calls among the available B channels. All four PRI trunks on the Cisco
AS5300 are assigned to this number by the PRI provider. The directory numbers for the remote devices
are configured on the Cisco AS5300 and then, subsequently configured on the remote devices
themselves.
The subnet 10.1.2.0 255.255.255.0 is configured on the Cisco AS5300 and is used for the loopback
interface and the local IP address pools as described in Chapter 1, “Dial Case Study Overview”.
Figure 2-1 Case Study Scenario Network Topology from the Perspective of the Cisco AS5300
Table 2-1 provides detailed information about each end of the connection. This is the network
administrator’s top-level design table and is used in conjunction with the network topology diagram
shown in Figure 2-1 for planning and organizing the network.
IP network
Backhaul
router
DNS
server
10.2.2.3
Cisco
AS5300
PSTN
15580
10.1.1.10
255.255.255.0
Interface dialer
10.1.254.1
255.255.255.0
Cisco 766
remote LAN
Cisco 1604
remote LAN
Modem
client
Four T1 PRI lines

2-2
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Overview of Tasks
Table 2-1 Case Study Network Device Characteristics
Note Be sure to use your own host names and passwords. For example, hq-sanjose, soho-tahoe,
and tahoe-pw are for this case study only.
Overview of Tasks
Do the following tasks to configure the Cisco AS5300 network access server (NAS):
Task 1—Setting Up Basic Configuration Parameters:
Step 1—Verifying the Startup Configuration
Step 2—Configuring the Host Name, Password, and Time Stamps
Step 3—Configuring Local AAA Security
Task 2—Setting Up Asynchronous Shell Services:
Step 1—Configuring the Fast Ethernet 100BaseT Interface
Step 2—Configuring the T1 Controllers
Step 3—Configuring the Serial Channels to Let Modem Calls Come In
Step 4—Configuring the Modems and Lines
Step 5—Testing Async Shell Connections
Task 3—Setting Up Asynchronous PPP services:
Step 1—Setting Up IP Address Pools
Step 2—Configuring the Group-Async Interface
Step 3—Testing Async PPP Connections
Task 4—Setting Up Synchronous PPP Services:
Step 1—Configuring Dial-on-Demand Routing
Step 2—Configuring Parameters for Remote LAN Sites
Step 3—Configuring a Default Gateway (Backhaul) Routing Protocol
Step 4—Confirming the Final Running Configuration
Site Hardware WAN IP Address
Ethernet IP
Address Assigned Phone Number
Host Name/
User Name
Username
Password
Cisco AS5300 10.1.254.1
255.255.255.0
Dialer Interface
10.1.1.10
255.255.255.0
4085551234 hq-sanjose hq-sanjose-pw
Cisco AS5300 10.1.2.0
255.255.255.0
Loopback Interface
Cisco 1604 10.1.254.4
255.255.255.0
10.1.4.1
255.255.255.0
Directory number =
5125554433
robo-austin austin-pw
Cisco 766 10.1.254.3
255.255.255.0
10.1.3.1
255.255.255.0
Directory number =
5305558084
soho-tahoe tahoe-pw

2-3
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 1—Setting Up Basic Configuration Parameters
Step 5—Saving the Configuration
Step 6—Testing Sync PPP Connections to Remote LANs
Step 7—Adding More Remote LAN Sites as Needed
Task 1—Setting Up Basic Configuration Parameters
When you first power up the Cisco AS5300, it will have to be configured to your particular needs. Verify
that you have a blank startup configuration, and configure it to your particular site needs by doing the
following steps:
Step 1—Verifying the Startup Configuration
If the startup configuration running inside the Cisco AS5300 is blank, the following screen appears at
bootup. The automatic setup script is engaged.
Copyright (c) 1994-1999 by cisco Systems, Inc.
AS5300 processor with 32768 Kbytes of main memory
program load complete, entry point: 0x80008000, size: 0xf4b10
Self decompressing the image : #################################################
################################################################################
################################################################################
################################################################################
################################################################################
################## [OK]
Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706
Cisco Internetwork Operating System Software
IOS (tm) 5300 Software (C5300-JS-M), Version 12.0(5)
Copyright (c) 1986-1999 by cisco Systems, Inc.
Compiled Tue 07-Nov-99 15:26 by xxxx
Image text-base: 0x600088E8, data-base: 0x608F4000
cisco AS5300 (R4K) processor (revision A.04) with 32768K/8192K bytes of memory.
Processor board ID 04614948
R4700 processor, Implementation 33, Revision 1.0 (512KB Level 2 Cache)
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software copyright 1996 by Meridian Technology Corp).
TN3270 Emulation software.
Primary Rate ISDN software, Version 1.1.
Backplane revision 1
Manufacture Cookie is not programmed.
1 Ethernet/IEEE 802.3 interface(s)
1 FastEthernet/IEEE 802.3 interface(s)
96 terminal line(s)

2-4
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 1—Setting Up Basic Configuration Parameters
4 Channelized T1/PRI port(s)
128K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read/Write)
4096K bytes of processor board Boot flash (Read/Write)
Cisco Internetwork Operating System Software
IOS (tm) 5300 Software (C5300-JS-M), Version 12.0(5),
Copyright (c) 1986-1999 by cisco Systems, Inc.
Compiled Tue 07-Nov-99 15:26 by xxx
00:00:50: %MICA-5-BOARDWARE_RUNNING: Slot 2 is running boardware version 2.5.0.8
--- System Configuration Dialog ---
At any point you may enter a question mark '?' for help.
Use ctrl-c to abort configuration dialog at any prompt.
Default settings are in square brackets '[]'.
Would you like to enter the initial configuration dialog? [yes]: no
Press RETURN to get started!
Router>
Enter no when you are asked the question, “Would you like to enter the initial configuration dialog?
[yes]: ”
Would you like to enter the initial configuration dialog? [yes]: no
Press RETURN to get started!
Router>
In this case study, the Cisco AS5300 is manually configured by using the Cisco IOS software.
The automatic setup script is not used.
Note Enter the show version command to see if the access server is recognizing all its modem
cards. For example, the output field “96 terminal line(s)” indicates that the chassis can find
all 96 integrated modems.
Step 2—Configuring the Host Name, Password, and Time Stamps
Assign a host name to the Cisco AS5300, enable basic security, and turn on timestamping.
•Assigning a host name helps you to distinguish between different network devices.
•Enabling passwords helps you to prevent unauthorized configuration changes.
•Setting time stamps helps you to trace debug output for testing connections. Not knowing exactly
when an event occurs hinders you from examining background processes.
To configure the host name, enable password, and time stamps, use the following steps beginning in
user EXEC mode:
Step 1 Enter privileged EXEC mode.
Router> enable

2-5
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 1—Setting Up Basic Configuration Parameters
Step 2 Enter global configuration mode. If the logging output generated by the access server interferes with
your terminal screen, redisplay your current command line by using the Tab key.
Router# configure terminal
Enter configuration commands, one per line. End
with CNTL/Z.
Step 3 Assign a host name to the access server. The router prompt changes from Router(config)# to
hq-sanjose(config)#. This host name is typically used during authentication with PPP peers.
Router(config)# hostname hq-sanjose
Step 4 Enter a secret enable password that secures privileged EXEC mode. Make sure to change “letmein” to
your own secret password.
hq-sanjose(config)# enable secret letmein
Step 5 Encrypt passwords in the configuration file for greater security.
hq-sanjose(config)# service password-encryption
Step 6 Enable millisecond time stamping on debug and logging output. Time stamps are useful for detailed
access troubleshooting.
hq-sanjose(config)# service timestamps debug datetime msec
hq-sanjose(config)# service timestamps log datetime msec
Verifying the Host Name, Password, and Time Stamp Configuration
Log in with your new enable password.
Step 1 Exit out of privileged EXEC mode by using the disable command. The prompt changes from
hq-sanjose# to hq-sanjose>.
Step 2 Enter the enable command followed by your password.
Step 3 Enter the show privilege command to show the current security privilege level:
hq-sanjose# disable
hq-sanjose> enable
Password: letmein
hq-sanjose# show privilege
Current privilege level is 15
hq-sanjose#

2-6
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 1—Setting Up Basic Configuration Parameters
Step 4 Enter the show running command to show the current running configuration:
hq-sanjose# show running
Building configuration...
Current configuration:
!
version 12.0(5)
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname hq-sanjose
!
enable secret 5 $1$.voA$9/8.Zoil3jeWJMP6hEE6U0
!
----- snip ----
Tips
If you have trouble:
•Make sure the Caps Lock key is off.
•Make sure you have entered the correct passwords. Passwords are case sensitive.
•Password protection is very important. Enter the show tech-support command to report system
configuration information to Cisco TAC:
hq-sanjose# show tech-support ?
ipmulticast IP multicast related information
page Page through output
password Include passwords
rsvp IP RSVP related information
<cr>
Step 3—Configuring Local AAA Security
The Cisco IOS security model to use on all Cisco devices is authentication, authorization, and
accounting (AAA). AAA provides the primary framework through which you set up access control on
the access server.
•Authentication—Who are you?
•Authorization—What can you do?
•Accounting—What did you do?
In this case study, the same authentication method is used on all interfaces. AAA is set up to use the
local database configured on the Cisco AS5300. This local database is created with the username
configuration commands.
Note Although configuring your local AAA is not required here, it is considered “best
practices” to do so when first setting up your router. Setting up this local AAA prevents
unauthorized access and configuration changes.

2-7
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 1—Setting Up Basic Configuration Parameters
To configure local AAA security, enter the following commands beginning in global configuration
mode:
Note Make sure to change “joe-admin” to your own username and “joe-password” to your own
password.
Step 1 Create a local login database and username for yourself. This step also prevents you from getting locked
out of the access server.
hq-sanjose(config)# username joe-admin password joe-password
Step 2 Initiate the AAA access control system. This step immediately locks down login and PPP
authentication.
hq-sanjose(config)# aaa new-model
Step 3 Configure AAA to perform login authentication by using the local username database. The login
keyword authenticates shell/EXEC users.
hq-sanjose(config)# aaa authentication login default local
Step 4 Configure PPP authentication to use the local database if the session was not already authenticated by
login.
hq-sanjose(config)# aaa authentication ppp default if-needed local
Note After you finish setting up basic security, you can enhance the security solution by
extending it to an external TACACS+ or RADIUS server. This case study describes only
local AAA security.
Verifying Local AAA Security Configuration
Step 1 Log in with your username:password.
Step 2 Enter the login command at the EXEC shell prompt. If you get in, the login authentication is working
with your local username. Do not disconnect your access server session until you can log in
successfully. (If you get locked out, recover your password by rebooting the access server.)
hq-sanjose# login
User Access Verification
Username: joe-admin
Password: joe-password
hq-sanjose#

2-8
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 2—Setting Up Asynchronous Shell Services
Step 3 Enter the show running command to view the current configuration of the AAA parameters:
hq-sanjose# show running
Building configuration...
Current configuration:
!
version 12.0(5)
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname hq-sanjose
!
aaa new-model
aaa authentication login default local
aaa authentication ppp default if-needed local
enable secret 5 $1$.voA$9/8.Zoil3jeWJMP6hEE6U0
!
username joe-admin password 7 <removed>
!
----- snip ----
Task 2—Setting Up Asynchronous Shell Services
When you have configured the preliminary parameters such as your host name, password, timestamps
and local AAA security on the Cisco AS5300, you can then move on to setting up the asynchronous
shell services, which provide access through the Cisco IOS CLI EXEC shell to terminal services (no
PPP) for the following tasks:
•Changing passwords
•Accessing menus
•Troubleshooting modem connections
•Accessing other network resources with Telnet
Step 1—Configuring the Fast Ethernet 100BaseT Interface
Assign an IP address, line speed, and duplex mode to the Cisco AS5300’s Fast Ethernet interface, which
supports 10- and 100-Mbps speeds.
The default priority search order for autonegotiating the line speed is as follows:
1. 100Base-TX full duplex
2. 100Base-TX half duplex
3. 10Base-T full duplex
4. 10Base-T half duplex
To configure the Fast Ethernet 100Base-TX interface, enter the following commands beginning in
global configuration mode:

2-9
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 2—Setting Up Asynchronous Shell Services
Step 1 Configure the IP address and subnet mask on the Fast Ethernet interface.
hq-sanjose(config)# interface fastethernet 0
hq-sanjose(config-if)# ip address 10.1.1.10 255.255.255.0
Step 2 Set autonegotiation for the line speed based on the peer routers, hubs, and switch media.
hq-sanjose(config-if)# speed auto
Step 3 Set autonegotiation for duplex mode.
hq-sanjose(config-if)# duplex auto
Step 4 Bring up the interface. This command changes the state of the interface from administratively down to
up.
hq-sanjose(config-if)# no shutdown
%LINK-3-UPDOWN: Interface FastEthernet0, changed state to up
Verifying the Fast Ethernet 100BaseT Interface
Step 1 Enter the show ip interface brief command to view the interface’s status. The “up” field appears under
the Status and Protocol columns in the displayed output. The fields “down” or “administratively down”
indicate a connection problem:
hq-sanjose# show ip interface brief fastethernet 0
Interface IP-Address OK? Method Status Protocol
FastEthernet0 10.1.1.10 YES manual up up
Step 2 Ping a device in your network, such as a default gateway (backhaul router) or the backbone gateway:
hq-sanjose# ping 10.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/5/8 ms
Step 3 Enter the show interface fastethernet 0 command to see detailed interface information. Look for the
display field “FastEthernet 0 is up, line protocol is up.” This means that the access server sees
its own sent and received keepalives.
hq-sanjose# show interface fastethernet 0
FastEthernet0 is up, line protocol is up
Hardware is DEC21140AE, address is 00e0.1e6b.2ffb (bia 00e0.1e6b.2ffb)
Internet address is 10.1.1.10 /24
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, rely 255/255, load 1/255
Encapsulation ARPA, loopback not set, keepalive set (10 sec), auto duplex,
100BaseTX/FX, auto speed
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:05, output 00:00:05, output hang never
Last clearing of "show interface" counters never
Queueing strategy: fifo
Output queue 0/40, 0 drops; input queue 0/120, 0 drops
5 minute input rate 0 bits/sec, 0 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
282 packets input, 68476 bytes, 0 no buffer
Received 282 broadcasts, 0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

2-10
Cisco IOS Dial Services Quick Configuration Guide
Chapter 2 Configuring the Cisco AS5300 Network Access Server
Task 2—Setting Up Asynchronous Shell Services
0 watchdog, 0 multicast
0 input packets with dribble condition detected
176 packets output, 16936 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier
0 output buffer failures, 0 output buffers swapped out
Step 4 Enter the show running command to view the current configuration of the FastEthernet 100BaseT
interface:
hq-sanjose# show running
Building configuration...
Current configuration:
!
----- snip ----
!
interface FastEthernet0
ip address 10.1.1.10 255.255.255.0
no ip directed-broadcast
no ip route-cache
no ip mroute-cache
duplex auto
speed auto
!
----- snip ----
Tips
If you have trouble:
•Make sure the cable connections are not loose or disconnected.
•Make sure you are using the correct IP address.
•An auto-configuration of the Fast Ethernet interface may not work as expected if the Cisco device
is connected to a third-party switch. Using the step-by-step configuration described above may be
a good work-around if you have problems getting the interface to work.
Step 2—Configuring the T1 Controllers
Configure the Cisco AS5300’s T1 controllers to allow calls to come into the NAS from the public
switched telephone network (PSTN) cloud. You must specify the following information for each
controller:
•Framing type
•Line code type
•Clock source
•Timeslot assignments
To configure the controllers, enter the following commands beginning in global configuration mode:
Step 1 Enter your telephone company’s switch type. This example uses primary national ISDN 1.
hq-sanjose(config)# isdn switch-type primary-ni