Bay Networks Bay Dial VPN, Configuration And Troubleshooting Manual

Page: 116 / 186

Configuring and Troubleshooting Bay Dial VPN Services
10-2 BayStream Multiservice Software Version 7.2 115623B Rev. 00
You must also ensure that remote users have the information they need to dial in to
the network and that the RADIUS server on the destination network has the
proper authentication information for those users. To do this, you must
communicate with the remote users and the network administrator for the
destination network.
Enabling and Activating Dial VPN
When you have enabled all the components of your configured network, you have
enabled Dial VPN. The actual network activation takes place when a remote node
dials in to the NAS that serves as the network access device.
What Happens When a User Dials In to a Dial VPN Network
The actual operation of the Dial VPN network is transparent to the remote user.
The following sequence outlines the events that occur in establishing the
connection:
1. An authorized user with a PC and a PPP connection dial in to a network
access server (NAS) at the edge of the Dial VPN network.
2. The NAS sends a TMS lookup request to the TMS server, asking whether this
is an authorized tunnel user.
3. The Tunnel Manager sends a TMS lookup reply to the NAS. Assuming that
this is a legitimate tunnel user, the authentication process continues.
Otherwise, the NAS may apply local authentication procedures or terminate
the call, as appropriate.
4. The NAS sends a Mobile IP authentication request to the RADIUS client.
5. The RADIUS client sends an authentication request over a frame relay
connection to the RADIUS server. If dynamic IP address management is
enabled, the RADIUS client also requests the server to assign an IP address
for the user.
6. The RADIUS server authenticates the user and sends an authentication reply
to the RADIUS client. If dynamic IP address management is enabled, the
RADIUS server also assigns an IP address for the user.
7. The RADIUS client sends a Mobile IP authentication reply to the NAS.
Assuming that this is a legitimate tunnel user, the authentication process
continues. Otherwise, the connection terminates.