Setting up global PPTP parameters Setting up a port for PPTP

82 4. Finally, reset the port with the following command to make the changes take effect: reset port 5. Use the Save All command to save the changes to the hubs memory.

5.4.1.3 Setting up a user for PPTP

Configuring a remote access switch with PPTP on a per-user basis is the ideal method for an ISP wishing to provide the service. This configuration will allow each individual user to connect via a different PPTP host. As with ports, each user can have a sequence of seven RAS hosts with which to attempt connections. The following are the steps for setting up a user for PPTP on the hub: 1. Add a PPTP user with the following command: add netuser username password clear-text password protocol pptp username is the eight-character login name of the user, password is the optional password parameter, and clear-text password is the users chosen eight-character password entered in clear text. [2] In the case of our example, we would enter: add netuser saran password catFLAM protocol pptp You can add the RAS hosts with which the user should attempt to authenticate. If this option is omitted, the global PPTP hosts will be used. This command is similar to assigning PPTP hosts to ports, except that the netuser parameter is used: set netuser username pptphost number hostname | ipaddress For our example, we would use: set netuser saran pptphost 1 2.1.1.60 2. Enter the Save All command to enter the changes into the hubs memory. The Show Netuser command on saran will give you the following output: Command show netuser saran Username: saran Type: Dial-in Network User Protocol: PPTP Options: PPTP hosts: 2.1.1.60 2.1.1.33 2 The password is said to be in clear text because anyone staring over your shoulder can see what password youre entering with this command. It doesnt mean that the password is stored in clear text or delivered in clear text at login time. 83

5.4.2 Configuring PPTP on an Ascend MAX 4004

On the Ascend MAX 4000 line, PPTP was first released on the firmware revision 4.6Bi12. The typical Ascend MAX 4004 configuration supports four T1 or PRI lines and 48 digital modems. Unlike the U.S. Robotics switch, the only way to specify PPTP servers is on a per- line basis, where each line is a WAN interface. On a MAX 1800, these will be BRI ISDN lines, while on a MAX 4004, theyll be T1 or PRI lines. This can be a serious limitation for ISPs that want to provide PPTP services to clients from various companies, all of whom will have different RAS servers. We expect Ascend to change this in the future to support these ISPs. For a company providing dial-up services to a single NT domain, however, this should pose no problem. Note that the MAX forwards all authentication on a PPTP-configured line to the RAS server, so a PPTP user wont have to be entered in a configuration profile or RADIUS profile on a MAX. Here are the steps for configuring PPTP on the Ascend MAX 4004: 1. From the main Edit menu, select Ethernet Mod Config PPTP options. 2. Under the PPTP options menu, turn PPTP on by changing the PPTP Enable option to Yes with the Enter key. Enter a PPTP host for at least one of the Route line parameters. If you only want a certain line to handle PPTP calls, just enter an IP address for that line. The other lines, left as the default of 0.0.0.0, will handle calls normally. However, if you enable PPTP and leave all lines at 0.0.0.0, the MAX will treat all calls as PPTP calls and the MAX will no longer accept any incoming calls—it will stop routing and be functionally disabled. For our example, all four of our PRI lines will use the same PPTP host of 1.1.1.60 see Figure 5-11 . Figure 5-11. The PPTP line configuration screen on an Ascend MAX 4004 3. Press the Escape key and select to accept the changes and exit in order to save the new PPTP information to the MAXs nonvolatile RAM.

5.5 Making the Calls

When calling into an ISP that supports PPTP, all of the VPN work is done for you by the ISP on their remote access switch. You just have to configure your client as if youre dialing directly into your RAS server; the ISPs switch will pass all the authentication information to that RAS server.