Configuring ISDN on Cisco Routers
Accessing ISDN with a Cisco router means that you will need to purchase either a Cisco router with a built-in NT1 (U reference point) or an ISDN modem (called a TA). If your router has a BRI interface (called a TE1), you only need attach an NT1 device to connect to the services. If your router doesn't have a BRI interface (called a TE2), you need to attach a TA and a NT1 to connect to ISDN services.
ISDN supports virtually every upper layer protocol (IP, IPX, AppleTalk), and you can choose PPP, HDLC, or X.25 as the encapsulation protocol.
ISDN Switch Types
To configure a router for the variety of switches it's going to connect to, use the command:
Router(config)#isdn switch-type [identifier]
Supported Switch Types |
Identifier | Description |
basic-nil | AT&T basic rate switches |
basic-5ess | AT&T 5ESS basic rate switches |
basic-dms100 | Nortel DMS-100 basic rate switches |
basic-4ess | AT&T 4ESS primary rate switches |
primary-5ess | AT&T 5ESS primary rate switches |
primary-dms100 | Nortel DMS-100 primary rate switches |
vn2 | French VN2 ISDN switches |
vn3 | French VN3 ISDN switches |
ntt | Japanese NTT ISDN switches |
basic-1tr6 | German 1TR6 ISDN switches |
Service Profile Identifiers (SPIDs)
A service profile identifier (SPID) is a number provided by the ISDN carrier to identify the line configuration of the BRI service. SPIDs allow multiple ISDN devices, such as voice and data, to share the local loop. Each SPID points to line setup and configuration information. SPIDs are frequently referred to as ISDN phone numbers because their functions are the same. An ISDN device can access each ISDN channel via its SPID number. You can configure the router to utilize a single or multiple SPIDs when making a connection to the ISDN provider.
When a device attempts to connect to the ISDN network, it performs a D channel Layer 2 initialization process that causes a TEI to be assigned to the device. The device then attempts D channel Layer 3 initialization. If SPIDs are necessary but not configured or configured incorrectly on the device, the Layer 3 initialization fails, and the ISDN services cannot be used.
The ISDN provider must assign the SPID numbers for each channel, which is usually an 8 to 14 digit number. There is no standard format for SPID numbers. As a result, SPID numbers vary depending on the switch vendor and the carrier. You can then use those numbers to configure your ISDN dialer connections. You must also identify the type of switch that is used at the CO to which you are connecting. The following commands show an ISDN BRI connection (two SPIDS for 2 B-channels):
Router3(config)#isdn switch-type dms-100
Router3(config)#interface bri 0
Router3(config-if)#isdn spid1 52069145231010
Router3(config-if)#isdn spid2 52069145241010
If you want your Cisco router to answer incoming calls over your ISDN line, you can configure an ISDN subaddress by specifying the local directory number (LDN), which is the seven-digit number assigned by the service provider and used for call routing. The LDN is not necessary for establishing ISDN-based connections, but it must be specified if you want to receive incoming calls on B channel 2. The LDN is required only when two SPIDs are configured (for example, when connecting to a DMS or NI1 switch). Each SPID is associated with an LDN. Configuring the LDN causes incoming calls to B channel 2 to be answered properly. If the LDN is not configured, incoming calls to B channel 2 may fail. The following commands configure LDNs for an ISDN BRI link:
Router3(config)#interface bri0
Router3(config-if)#isdn spid1 0835866201 8358662
Router3(config-if)#isdn spid2 0835866401 8358664
Configure Called Party Number Verification
When multiple devices are attached to an ISDN BRI, you can ensure that only a single device answers an incoming call by verifying the number or subaddress in the incoming call against the device's configured number or subaddress or both. You can specify that the router verify a called-party number or subaddress number in the incoming setup message for ISDN BRI calls, if the number is delivered by the switch. You can do so by configuring the number that is allowed. To configure verification, use the following command in interface configuration mode:
isdn answer1 [called-party-number][:subaddress]
Verifying the called-party number ensures that only the desired router responds to an incoming call. If you want to allow an additional number for the router, you can configure it, too. To configure a second number to be allowed, use the following command in interface configuration mode:
isdn answer2 [called-party-number][:subaddress]
Dial on Demand Routing (DDR)
Dial-on-demand routing (DDR), is used to allow two or more Cisco routers to dial an ISDN dial-up connection on an as-needed basis. DDR is only used for low-volume, periodic network connections using either a PSTN or ISDN. This was designed to reduce WAN cost if you have to pay on a per-minute or per-packet basis. DDR configuration commands define host and ISDN connection information. An access list and DDR dialer group define what kind of traffic should initiate an ISDN call. You can configure multiple access lists to look for different types of interesting traffic. Interesting traffic is traffic that (when it arrives at the router) triggers the router to initiate the ISDN connection.
When a router notices interesting traffic, it refers to its ISDN information and initiates setup of the ISDN call through its BRI or PRI and NT1 devices. When a connection is established, normal routing occurs between the two end devices. After interesting traffic stops being transmitted over the ISDN connection, the connection idle timer begins. When the idle timer expires, the connection is terminated.
Steps of how DDR works
- Route to the destination network is determined.
- Interesting packet dictates a DDR call.
- Dialer information is looked up and connection is made.
- Traffic is transmitted.
- Call is terminated when no more traffic is being transmitted over a link and the idle-timeout period ends.
Configuring a DDR connection
Router3(config-if)#dial wait-for-carrier time 15
Router3(config-if)#dialer idle-timeout 300
Router3(config-if)#dialer load-threshold 50 either
Router3(config-if)#dialer map ip 192.168.52.1 name CORP speed 56 5205551212
The first command tells the dialer to wait no longer that 15 seconds for the ISDN provider to answer during a DDR connection attempt. The second command tells the dialer to hang-up the connection if the connection does not pass any interesting information for 300 seconds (default is 120 seconds). The third command tells the dialer to only dial additional lines (assuming you have configured multiple ISDN channels for the connection) when any channel is transferring at 50% of the available bandwidth, either inbound or outbound. The fourth command maps the dialer to a specific hostname (CORP), IP address (192.168.52.1), speed (56Kbps, default is 64Kbps if not specified), and phone number (5205551212).
Dialer Map Entries
Dialer map statements relate upper layer addresses to their associated phone numbers.
Specifying Interesting Traffic
In order to define what type of traffic is considered interesting and will in turn bring up the ISDN line, you must use dialer group commands. The following commands show how to use a dialer group and access lists to permit IP traffic on your link, but deny IGRP traffic. The dialer list global configuration command defines the interesting packets, and the dialer group command sets the access list on the BRI interface.
Router3(config)#dialer-list 1 protocol ip list 110
Router3(config)#access-list 110 deny igrp any any
Router3(config)#access-list 110 permit ip any any
Router3(config)#int bri0
Router3(config-if)#dialer-group 1
Access lists are used in ISDN connections to prevent specified traffic from initiating a connection. To control connections, traffic that is desired on the ISDN connection is allowed while everything else is denied.
Encapsulation Methods
When a clear Data Link is established between two DDR peers, internetworking datagrams must be encapsulated and framed for transport across the Dialer media. The encapsulation methods available depend on the physical interface being used. Cisco supports the following encapsulations for DDR:
- PPP -- is the recommended encapsulation method because it supports multiple protocols and is used for synchronous, asynchronous, or ISDN connections. In addition, PPP performs address negotiation and authentication and is supported by multiple vendors.
- HDLC -- is supported on synchronous serial lines and ISDN connections only. HDLC supports multiple protocols, but it doesn't provide authentication.
- SLIP -- works on asynchronous interfaces only, and is supported by IP only. Addresses must be configured manually, it doesn't provide authentication, and is interoperable only with other vendors that use SLIP.
- X.25 -- is supported on synchronous serial lines and a single ISDN B channel.
PPP Authentication
- Password Authentication Protocol (PAP)
PAP provides a simple method for a remote node to establish its identity using a two-way handshake. This is done only upon initial link establishment. After the PPP link establishment phase is complete, a username/password pair is repeatedly sent by the remote node until authentication is acknowledged, or the connection is terminated.
Passwords are sent across the link in plain text and there is no protection from playback or trail-and-error attacks. The remote node is in control of the frequency and timing of the login attempts. If the local host rejects the username/password, the connection is terminated.
- Challenge and Handshake Protocol (CHAP)
CHAP is used to periodically verify the identity of the remote node using a 3-way handshake. This is done upon initial link establishment and can be repeated any time after the link has been established. After the PPP link establishment phase is complete, the host sends a challenge messages to the remote node. The remote node responds with a value calculated using a one-way hash function (typically MD5). The host checks the response against its own calculation of the expected hash value. If the values match, the authentication is acknowledged. Otherwise, the connection is terminated.
CHAP provides protection against playback attack through the use of a variable challenge value that is unique and unpredictable. The use of repeated challenges is intended to limit the time of exposure to any single attack. The host is in control of the frequency and timing of the challenges.
ISDN Configuration Example
This is an example of a connection between a corporate headquarters and a remote site over a BRI ISDN link.
Remote Network |
Router Configuration:
Name:REMOTE
E0 IP address:192.168.24.1
Local Network:192.168.24.0
BRI 0 IP address:192.168.49.2 |
REMOTE(config)#hostname corp password 123pass332 REMOTE(config)#isdn switch-type dms-100 REMOTE(config)#interface bri 0 REMOTE(config-if)#encapsulation ppp REMOTE(config-if)#ppp authentication chap REMOTE(config-if)#spid1 5208881111 5270936 REMOTE(config-if)#spid2 5208881212 5270956 REMOTE(config-if)#ip address 192.168.49.2 255.255.255.0 REMOTE(config-if)#dialer idle-timeout 600 REMOTE(config-if)#dialer map ip 192.168.49.1 name corp 7045551212 REMOTE(config-if)#dialer load-threshold 125 either REMOTE(config-if)#ppp multilink REMOTE(config-if)#dialer-group 1 REMOTE(config-if)#exit REMOTE(config)#dialer-list 1 protocol ip permit REMOTE(config)#ip route 0.0.0.0 0.0.0.0 192.168.49.1 REMOTE(config)#ip route 192.168.49.0 255.255.255.0 192.168.49.1 |
Corporate network |
Router Configuration:
Name:CORP
BRI 1 IP address:192.168.49.1 |
CORP(config)#hostname remote password 123pass332 CORP(config)#isdn switch-type dms-100 CORP(config)#interface bri 1 CORP(config-if)#encapsulation ppp CORP(config-if)#ppp authentication chap CORP(config-if)#spid1 7047773333 5265933 CORP(config-if)#spid2 7047774444 5265944 CORP(config-if)#ip address 192.168.49.1 255.255.255.0 CORP(config-if)#dialer idle-timeout 600 CORP(config-if)#dialer map ip 192.168.49.2 name remote 5205551212 CORP(config-if)#dialer load-threshold 125 either CORP(config-if)#ppp multilink CORP(config-if)#dialer-group 1 CORP(config-if)#exit CORP(config)#ip route 192.168.24.0 255.255.255.0 192.168.49.2 CORP(config)#dialer-list 1 protocol ip list 110 CORP(config)#access-list 110 deny igrp any any CORP(config)#access-list 110 permit ip any any |
The routers are both using PPP encapsulation and CHAP authentication. The username has been set for the opposite router in each configuration and the password is the same on both. Each router has the ability to dial the other. The CORP router is located at the corporate network, which has other connections and uses IGRP to transfer routing tables on the corporate network. However, IGRP is not desired on the ISDN connection, so the CORP router has an access list specifically denying IGRP on the ISDN link. Both routers permit all IP traffic on the ISDN link and all IP traffic will be considered interesting or worth activating the ISDN link for. Multilink is enabled on both routers, and they will dial their additional lines when there is 50% (load-threshold uses a number between 1 and 255, with 255 being 100%) or more utilization on the first channel. The link will be terminated if there is no interesting traffic for 600 seconds (10 minutes). The IP routes are configured such that all traffic destined from the corporate network to 192.168.24.0 will be sent to the REMOTE router. Since the REMOTE router is a remote branch with no other connections, all traffic that is not specifically destined for 192.168.24.0 will be sent to the CORP router. Note that each router has its dialer mapped to the IP address of the other router.
Monitoring ISDN
All commands are available via privileged EXEC mode prompt (enable mode)
- clear interface bri [#] --- Resets the counters and terminates the connection.
- show dialer --- Reports information regarding the DDR connection including the number dialed, the success of the connection, the idle timers, and the number of calls that were rejected due to administrative policy.
- show ip route --- Show all routes the router knows about.
- show isdn active --- Displays the status of the ISDN connection while the call is in progress.
- show isdn status --- Gives status information for ISDN connections.
- show interface bri 0 --- Shows you the configuration statistics and speed of your ISDN BRI interface.
- show controllers bri 0 --- Shows detailed information about the B and D channels.
- debug dialer --- Shows information regarding the cause of a dialing connection and the status of the connection.
- debug bri --- Provides information about the B channels of the BRI.
- debug isdn q921 --- Used to see layer-2 information. Shows information regarding the D-channel interface. The D-channel is always connected. Connections over the B-channel can't occur without signaling over the D-channel.
- debug isdn q931 --- Shows the call setup and teardown. Output can be used to verify acknowledgments and messages. [layer 3 on D-channel]
- no debug all --- Use to turn off all debugging.
