Subject: RE: (usr-tc) Restricting MPPP

From: Scott Trautman <[email-masked]>
Date: Wed, 19 Jan 2000 19:27:55 +0000

-----Original Message-----
From: Jeff Mcadams [mailto:[email-masked]]
Sent: Wednesday, January 19, 2000 10:53 AM
To: [email-masked]
Subject: Re: (usr-tc) Restricting MPPP

Thus spake Scott Trautman
>Same problem as I figured out last time--- multiple users, one of them
>is setup (client) for MPPP, any connections afterwards will get dropped
>as they definately won't be able to bond to the other connection.

>IS there a way to limit MPPP with a RADIUS attribute? (using livingston
>2.01).  Seems like I ought to be able to <not allow> MPPP, but not as a
>check event as in IF you want MPPP, but we say no, drop the connection
>(pain in the butt), but more like So you want MPPP, fine, we're not
>going to allow it but you think what you want to think.

>Make sense?

Not really.

>Port-Limit attibute wouldn't do it.
>Not seeing any other attributes that really do it either. I did look
through
>the usr-tc archive.

>Anyone know? I would really think this'd be something I ought to be
>able to control.  I can't even filter for it either, now can I? It's
>grabbing the username at the HiperARC upon login.

So...what exactly is your problem here...I didn't follow.  You have
multiple people logging in with the same userid?  You limit that with

YES.

Simultaneous-Use (non-reliably as far as I'm concerned), or with a
script that goes in and checks for duplicate logins (I recommend SNMP
for this).  Port-Limit will limit the number of channels allowed in a
multi-link bundle.  These really shouldn't interact.

There is no way really to enable or disable multi-link on a per-user
basis...you can disable it on the whole Arc with "disable ppp
multilink_ppp", but then you won't let *anyone* use MP...not what you
want I suspect.  Port-Limit can be set to 1, which would allow them to
run MP, but only allow one link in the bundle...essentially, they get no
benefit from MP at that point, but technically they can still run the MP
protocol.

Okay, I'll try Port-Limit, but doubt that's going to work.

If you're running into multiple users running multi-link logging in
seperately, but your Arcs are trying to bundle the links together, then
you need to get a log of the LCP negotiation of the connections...it
sounds like they're not sending a Multi-Link endpoint discriminator, or
the Arc is handing it incorrectly.  If they're logging in from seperate

Separate locations not a problem. It's only within 1 unit for multiple
people using the SAME
userid. If the client is broken, okay so it is, I don't have much control
over that; just
seems to me that the Arc ought be able to limit this, or time-out the
endpoint thing. Dunno.

locations, they should have seperate EDO's, and the Arc should (and I
haven't seen any problems with this) handle the connections as totally
seperate sessions, Port-Limit wouldn't apply, Multi-Link is a moot
point.

Anyway...maybe you can give a better description of what you're
seeing...and the behavior you'd like to see...there should be a way of
doing what you want without actually disabling MP for the user.  There's
really very little reason to need to actually disable MP for a user.
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

-
 To unsubscribe to usr-tc, send an email to "[email-masked]"
 with "unsubscribe usr-tc" in the body of the message.
 For information on digests or retrieving files and old messages send
 "help" to the same address.  Do not use quotes in your message.

---

From: Jeff Mcadams <[email-masked]>
Date: Wed, 19 Jan 2000 19:55:50 +0000

>people using the SAME userid. If the client is broken, okay so it is, I
>don't have much control over that; just seems to me that the Arc ought
>be able to limit this, or time-out the endpoint thing. Dunno.

OK...I'm still confused...you're dealing with one Arc...I got that.  You
have multiple people logging in with the same userid...got that.  Are
the people logging in from different locations?  If so, they should have
different EDO's, and the Arc shouldn't be trying to bundle them
together.  Its possible that the clients aren't sending EDO's, and then,
if they're using the same userid, then the Arc is trying to bundle them
together, as it should according to the spec (RFC1990).

Can you get a log of the LCP negotiations here so we can see what's
really going on?  If they're using the same EDO, or no EDO, then the Arc
is trying to bundle them together, as it should...if they're using
different EDO's, and the Arc is trying to bundle them together, then
there's a bug in the Arc.

What you need to set to prevent this situation is dependant upon what's
happening...if they're trying to get bundled together, then you need to
set Port-Limit...if they're not getting bundled together then you need
to use Simultaneous-Use, or an SNMP script to boot off duplicates (or
whatever).
-- 
Jeff McAdams                            Email: [email-masked]
Head Network Administrator              Voice: (502) 966-3848
IgLou Internet Services                        (800) 436-4456

-