Juniper JUNOSE 11.1.X - LINK LAYER CONFIGURATION 4-7-2010, Configuration Manual

Page: 612 / 774

with the same name is added, the interface cannot authenticate until the AAA
profile is reassigned.
NOTE: Although an AAA profile and an interface profile have similar functionality,
they are not related and you need to treat them differently.
■
Example
host1(config-profile)# ppp aaa-profile westford24
■
Use the no version to remove the AAA profile assignment.
NOTE: For more information about AAA profiles, see JUNOSe Broadband Access
Configuration Guide .
■
See ppp aaa-profile.
ppp authentication
■
Use to require authentication from the PPP peer.
■
To specify the name of a virtual router (VR) to be used as the authentication VR
context, use the
virtual-router keyword. Keep the following points in mind when
you use the ppp authentication virtual-router command:
■
When you specify a VR in the ppp authentication command, AAA does not
query the domain map for the assigned VR context. Instead, AAA uses the
VR specified in the
ppp authentication command as the authentication VR
context and issues the authentication request to the authentication server
in the assigned VR context.
■
If you specify the default VR as the authentication VR context, AAA loosely
binds the user to the default VR. This means that RADIUS
can override the
default VR context with a new VR context during the authentication process.
When the
ppp authentication virtual-router command specifies the default
VR, AAA returns either the default VR or the VR specified by RADIUS.
■
If you specify a VR other than the default VR as the authentication VR, AAA
tightly binds the user to the specified VR. This means that RADIUS
cannot
override the specified VR context with a new VR context during the
authentication process. When the ppp authentication virtual-router
command specifies a nondefault VR, AAA returns the specified VR.
■
If the VR specified in a profile with the ip virtual-router command differs
from the VR provided by AAA, IP uses the VR provided by AAA when the
dynamic IP upper-layer interface is created. For more information about
using the
ip virtual-router command, see “ip virtual-router” on page 575.
■
The router supports the MD5 authentication algorithm for CHAP authentication.
■
Example 1—Specifies PAP or CHAP as the primary authentication protocol, and
the other authentication protocol as the alternative. For example, the following
580 ■
Configuring a Dynamic Interface from a Profile
JUNOSe 11.1.x Link Layer Configuration Guide