Configuring L2TP Control-Channel Parameters
L2TPv3 control-channel authentication occurs using a password that is configured on all participating peer
PE routers. The L2TPv3 Digest Secret Graceful Switchover feature allows a transition from an old
control-channel authentication password to a new control-channel authentication password without disrupting
established L2TPv3 tunnels.
Before performing this task, you must enable control-channel authentication (see Configuring L2TPv3 Control
Message Hashing).
Note
During the period when both a new and an old password are configured, authentication can occur only
with the new password if the attempt to authenticate using the old password fails.
SUMMARY STEPS
1. configure
2. l2tp-class word
3. digest {check disable | hash {MD5 | SHA1} ] | secret {0 | 7} password]
4. Use the commit or end command.
5. show l2tp tunnel brief
6. configure
7. l2tp-class word
8. no digest [ secret [ 0 | 7 ] password [ hash { md5 | sha } ]
9. Use the commit or end command.
10. show l2tp tunnel brief
DETAILED STEPS
Step 1
configure
Example:
RP/0/RP0/CPU0:router# configure
Enters the Global Configuration mode.
Step 2
l2tp-class word
Example:
RP/0/RP0/CPU0:router(config)# l2tp-class class1
Specifies the L2TP class name and enters L2TP class configuration mode.
Step 3
digest {check disable | hash {MD5 | SHA1} ] | secret {0 | 7} password]
Example:
RP/0/RP0/CPU0:router(config-l2tp-class)# digest secret cisco hash sha
Enables L2TPv3 control-channel authentication or integrity checking.
Cisco IOS XR Virtual Private Network Configuration Guide for the Cisco CRS Router, Release 6.1.x
160
Implementing Layer 2 Tunnel Protocol Version 3