Cisco IOS Wide-Area Networking Configuration Guide - Free Books

Step 5Step 6Command or Actionpassword [0 | 7] passwordExample:Router(config-l2tp-class)# password ciscohostname nameExample:Router(config-l2tp-class)# hostname yb2Purpose(Optional) Configures the password used for controlchannel authentication.• [0 | 7]—(Optional) Specifies the input format of theshared secret. The default value is 0.– 0—Specifies that a plain-text secret is entered.– 7—Specifies that an encrypted secret is entered.• password—Defines the shared password between peerrouters.(Optional) Specifies a hostname used to identify the routerduring L2TP control channel authentication.• If you do not use this command, the default hostnameof the router is used.Configuring L2TPv3 Control Message HashingSUMMARY STEPSThe L2TPv3 Control Message Hashing feature introduced in Cisco IOS Release 12.0(29)S andCisco IOS Release 12.2(27)SBC is a new authentication system that is more secure than the CHAP-styleL2TP control channel method of authentication. L2TPv3 Control Message Hashing incorporates anoptional authentication or integrity check for all control messages. This per-message authentication isdesigned to guard against control message spoofing and replay attacks that would otherwise be trivial tomount against the network.Enabling the L2TPv3Control Message Hashing feature will impact performance during control channeland session establishment because additional digest calculation of the full message content is requiredfor each sent and received control message. This is an expected trade-off for the additional securityafforded by this feature. In addition, network congestion may occur if the receive window size is toosmall. If the L2TPv3 Control Message Hashing feature is enabled, message digest validation must beenabled. Message digest validation deactivates the data path received sequence number update andrestricts the minimum local receive window size to 35.You may choose to configure control channel authentication or control message integrity checking.Control channel authentication requires participation by both peers, and a shared secret must beconfigured on both routers. Control message integrity check is unidirectional, and requires configurationon only one of the peers.This task configures L2TPv3 Control Message Hashing feature for an L2TP class.1. enable2. configure terminal3. l2tp-class [l2tp-class-name]4. digest [secret [0 | 7] password] [hash {md5 | sha}]5. digest check6. hidden53