Здравствуйте много уважаемые, есть тривиальная задача ограничить количество впн сессий от клиента до маршрутизатора, который является пптп севером. Другими словами нужно разрешить каждому пользователю только одну сессию. При создание новой сессии с такими же крединталами первая сессия должна разрываться.

Что имею
cisco_1721#sh ver
Cisco IOS Software, C1700 Software (C1700-ADVENTERPRISEK9-M), Version 12.4(25d), RELEASE SOFTWARE (fc1)

cisco_1721#sh running-config
Building configuration...
…
aaa authentication login default local
aaa authentication ppp default local
aaa authorization network default local
aaa accounting delay-start
…
aaa attribute list user-user2
attribute type addr 192.168.16.60 service ppp protocol ip
attribute type interface-config "rate-limit output 1000000 300000 600000 conform-action transmit exceed-action drop"
attribute type interface-config "rate-limit input 1000000 300000 600000 conform-action transmit exceed-action drop"
….
aaa session-id common
….
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1

….

username user2 password 0 12345
username user2 aaa attribute list user-user2

….
interface Virtual-Template1
ip unnumbered Vlan1
ip access-group 100 in
ip wccp web-cache redirect in
ip flow egress
ip nat inside
ip virtual-reassembly
ip route-cache policy
ip route-cache flow
no peer default ip address
ppp authentication pap chap ms-chap



Методом тыка нашел следующую комманду

aaa attribute list user-user2
attribute type vpdn-active-sessions The number of vpdn active sessions

написал
aaa attribute list user-user2
attribute type vpdn-active-sessions 1


но к сожалению результатов это не дало

cisco_1721#sh vpdn

%No active L2F tunnels

%No active L2TP tunnels

PPTP Tunnel and Session Information Total tunnels 2 sessions 2

LocID Remote Name State Remote Address Port Sessions VPDN Group
43 estabd 10.0.0.50 2310 1 1

LocID RemID TunID Intf Username State Last Chg Uniq ID
45 16384 43 Vi3 user2 estabd 00:00:47 44

LocID Remote Name State Remote Address Port Sessions VPDN Group
44 estabd 10.0.0.6 51311 1 1

LocID RemID TunID Intf Username State Last Chg Uniq ID
46 2964 44 Vi4 user2 estabd 00:00:11 45


Подскажите как быть?

Идеи 2:

во-первых есть команда для пользователя
user {NAME} user-maxlinks

во-вторых можно попробовать добавить слово mandatory с attribute map

Ну и перед тестом рекомендую всех принудительно из туннелей выкинуть и shut|no shut на виртуальном темплейте сделать.

Спасибо за участие, но к сожалению не помогает
.....
aaa attribute list user-andrew
attribute type addr 192.168.16.50 service ppp protocol ip mandatory
attribute type interface-config "rate-limit output 1000000 300000 600000 conform-action transmit exceed-action drop"
attribute type interface-config "rate-limit input 1000000 300000 600000 conform-action transmit exceed-action drop"
attribute type user-maxlinks 1 mandatory
....
username andrew user-maxlinks 1 password 0 12345
username andrew aaa attribute list user-andrew
.....

cisco_1721(config)#do sh vpdn

%No active L2F tunnels

%No active L2TP tunnels

PPTP Tunnel and Session Information Total tunnels 2 sessions 2

LocID Remote Name State Remote Address Port Sessions VPDN Group
71 estabd 10.0.0.30 4441 1 1

LocID RemID TunID Intf Username State Last Chg Uniq ID
70 16384 71 Vi3 andrew estabd 00:00:13 69

LocID Remote Name State Remote Address Port Sessions VPDN Group
72 estabd 10.0.0.6 51568 1 1

LocID RemID TunID Intf Username State Last Chg Uniq ID
71 3356 72 Vi4 andrew estabd 00:00:09 70
cisco_1721(config)#

Как же всетаки быть? Мне кажется это достаточно злободневный вопрос!?

Надо подебажить ААА - может всплывет чего. Вообще не вижу причин, по которым не должно работать

Вот собственно дебаг, незнаю что в нем смотреть, подскажите

Соединяемся с первого пк


cisco_1721#debug aaa accounting
AAA Accounting debugging is on
cisco_1721#debug aaa authentication
AAA Authentication debugging is on
cisco_1721#debug aaa authorization
AAA Authorization debugging is on
cisco_1721#
Jun 24 09:08:59.515: AAA/BIND(00000058): Bind i/f
Jun 24 09:08:59.515: AAA/ACCT/HC(00000058): Register VPDN/FB0000E5 0bit/s, assuming 100Mbit/s, poll every 5m 0s
Jun 24 09:08:59.519: AAA/ACCT/HC(00000058): Update VPDN/FB0000E5
Jun 24 09:08:59.519: AAA/ACCT/HC(00000058): VPDN/FB0000E5 [init-sess] (rx/tx) base 0/0 pre 0/0 call 0/0
Jun 24 09:08:59.519: AAA/ACCT/HC(00000058): VPDN/FB0000E5 [init-sess] (rx/tx) adjusted, pre 0/0 call 0/0
Jun 24 09:08:59.519: AAA/ACCT/EVENT/(00000058): CALL START
Jun 24 09:08:59.519: Getting session id for NET(00000058) : db=8472D158
Jun 24 09:08:59.519: AAA/ACCT(00000000): add node, session 297
Jun 24 09:08:59.523: AAA/ACCT/NET(00000058): add, count 1
Jun 24 09:08:59.523: AAA/ACCT/EVENT/(00000058): ATTR ADD
Jun 24 09:08:59.523: AAA/ACCT(00000058): Send NEWINFO accounting notification to EM successfully
Jun 24 09:08:59.523: AAA/BIND(00000058): Bind i/f Virtual-Template1
Jun 24 09:08:59.523: AAA/ACCT/NET(00000058): Pick method list 'default'
cisco_1721#
Jun 24 09:08:59.527: AAA/ACCT/SETMLIST(00000058): Handle 0, mlist 84041D48, Name default
Jun 24 09:08:59.527: AAA/ACCT/NET(00000058): Pick method list 'default'
Jun 24 09:08:59.527: AAA/ACCT/SETMLIST(00000058): Handle 0, mlist 84041D48, Name default
Jun 24 09:08:59.679: AAA/ACCT/NET(00000058): Pick method list 'default'
Jun 24 09:08:59.683: AAA/ACCT/SETMLIST(00000058): Handle 0, mlist 84041D48, Name default
Jun 24 09:08:59.807: AAA/AUTHEN/PPP (00000058): Pick method list 'default'
Jun 24 09:09:00.083: AAA/BIND(00000058): Bind i/f Virtual-Access4
Jun 24 09:09:00.087: %LINK-3-UPDOWN: Interface Virtual-Access4, changed state to up
Jun 24 09:09:00.091: AAA/AUTHOR (0x58): Pick method list 'default'
Jun 24 09:09:00.091: AAA/AUTHOR (0x58): Pick method list 'default'
Jun 24 09:09:00.095: Vi4 PPP/AAA: Check Attr: Framed-Protocol
Jun 24 09:09:00.095: Vi4 PPP/AAA: Check Attr: username
Jun 24 09:09:00.095: Vi4 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:00.095: Vi4 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:00.095: Vi4 PPP/AAA: Check Attr: addr
Jun 24 09:09:00.099: Vi4 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:00.099: Vi4 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:00.099: Vi4 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:00.099: Vi4 AAA/AUTHOR/FSM: We can start LCP
Jun 24 09:09:00.099: Vi4 PPP/AAA: Check Attr: Framed-Protocol
Jun 24 09:09:00.099: Vi4 PPP/AAA: Check Attr: username
Jun 24 09:09:00.099: Vi4 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:00.103: Vi4 PPP/AAA: Check Attr: addr
Jun 24 09:09:00.103: Vi4 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:00.103: Vi4 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:00.103: Vi4 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:00.103: Vi4 AAA/AUTHOR/FSM: We can start IPCP
Jun 24 09:09:00.103: Vi4 AAA/AUTHOR/LCP: Process Author
Jun 24 09:09:00.103: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.103: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.107: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.107: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.107: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.107: Vi4 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:00.111: Vi4 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:00.111: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.111: Vi4 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:00.111: Vi4 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:00.111: Vi4 AAA/AUTHOR/LCP: IF_config:
rate-limit output 1000000 300000 600000 conform-action transmit exceed-action drop
rate-limit input 1000000 300000 600000 conform-action transmit exceed-action drop
rate-limit output 1000000 300000 600000 conform-action transmit exceed-action drop
rate-limit input 1000000 300000 600000 conform-action transmit exceed-action drop
Jun 24 09:09:00.115: AAA/ACCT/NET(00000058): Pick method list 'default'
Jun 24 09:09:00.115: AAA/ACCT/SETMLIST(00000058): Handle 0, mlist 84041D48, Name default
Jun 24 09:09:00.115: AAA/ACCT/EVENT/(00000058): NET UP
Jun 24 09:09:00.115: AAA/ACCT/HC(00000058): Update VPDN/FB0000E5
Jun 24 09:09:00.115: AAA/ACCT/HC(00000058): VPDN/FB0000E5 [pre-sess] (rx/tx) base 0/0 pre 0/54 call 0/54
Jun 24 09:09:00.115: AAA/ACCT/HC(00000058): VPDN/FB0000E5 [pre-sess] (rx/tx) adjusted, pre 0/54 call 0/0
Jun 24 09:09:00.203: Vi4 AAA/AUTHOR/IPCP: Already authorized
Jun 24 09:09:00.203: Vi4 AAA/AUTHOR/FSM: We can start IPCP
Jun 24 09:09:00.203: Vi4 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, we want 0.0.0.0
Jun 24 09:09:00.203: Vi4 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:00.203: Vi4 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:00.203: Vi4 AAA/AUTHOR/IPCP: Processing AV addr
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: Processing AV addr
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: Authorization succeeded
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, we want 192.168.16.50
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: no author-info for primary dns
Jun 24 09:09:00.207: Vi4 AAA/AUTHOR/IPCP: no author-info for seconday dns
Jun 24 09:09:00.235: Vi4 AAA/AUTHOR/IPCP: no author-info for primary dns
Jun 24 09:09:00.243: Vi4 AAA/AUTHOR/IPCP: no author-info for primary dns
Jun 24 09:09:00.247: AAA/ACCT/EVENT/(00000058): IPCP_PASS
Jun 24 09:09:00.247: AAA/ACCT/NET(00000058): Queueing record is START
Jun 24 09:09:00.251: AAA/ACCT(00000058): Accouting method=BILLING (RADIUS)
Jun 24 09:09:00.259: AAA/ACCT/NET(00000058): START protocol reply PASS
Jun 24 09:09:00.263: AAA/ACCT(00000058): Send START accounting notification to EM successfully
Jun 24 09:09:01.087: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access4, changed state to upcisco_1721#

Теперь со второго


isco_1721#
Jun 24 09:09:30.880: AAA/BIND(00000059): Bind i/f
Jun 24 09:09:30.884: AAA/ACCT/HC(00000059): Register VPDN/9E0000E8 0bit/s, assuming 100Mbit/s, poll every 5m 0s
Jun 24 09:09:30.884: AAA/ACCT/HC(00000059): Update VPDN/9E0000E8
Jun 24 09:09:30.884: AAA/ACCT/HC(00000059): VPDN/9E0000E8 [init-sess] (rx/tx) base 0/0 pre 0/0 call 0/0
Jun 24 09:09:30.884: AAA/ACCT/HC(00000059): VPDN/9E0000E8 [init-sess] (rx/tx) adjusted, pre 0/0 call 0/0
Jun 24 09:09:30.884: AAA/ACCT/EVENT/(00000059): CALL START
Jun 24 09:09:30.884: Getting session id for NET(00000059) : db=8470764C
Jun 24 09:09:30.888: AAA/ACCT(00000000): add node, session 298
Jun 24 09:09:30.888: AAA/ACCT/NET(00000059): add, count 1
Jun 24 09:09:30.888: AAA/ACCT/EVENT/(00000059): ATTR ADD
Jun 24 09:09:30.888: AAA/ACCT(00000059): Send NEWINFO accounting notification to EM successfully
Jun 24 09:09:30.888: AAA/BIND(00000059): Bind i/f Virtual-Template1
Jun 24 09:09:30.892: AAA/ACCT/NET(00000059): Pick method list 'default'
cisco_1721#
Jun 24 09:09:30.892: AAA/ACCT/SETMLIST(00000059): Handle 0, mlist 84041D48, Name default
Jun 24 09:09:30.892: AAA/ACCT/NET(00000059): Pick method list 'default'
Jun 24 09:09:30.892: AAA/ACCT/SETMLIST(00000059): Handle 0, mlist 84041D48, Name default
Jun 24 09:09:30.908: AAA/ACCT/NET(00000059): Pick method list 'default'
Jun 24 09:09:30.908: AAA/ACCT/SETMLIST(00000059): Handle 0, mlist 84041D48, Name default
Jun 24 09:09:30.924: AAA/AUTHEN/PPP (00000059): Pick method list 'default'
Jun 24 09:09:30.960: AAA/BIND(00000059): Bind i/f Virtual-Access3
Jun 24 09:09:30.964: %LINK-3-UPDOWN: Interface Virtual-Access3, changed state to up
Jun 24 09:09:30.968: AAA/AUTHOR (0x59): Pick method list 'default'
Jun 24 09:09:30.968: AAA/AUTHOR (0x59): Pick method list 'default'
Jun 24 09:09:30.972: Vi3 PPP/AAA: Check Attr: Framed-Protocol
Jun 24 09:09:30.972: Vi3 PPP/AAA: Check Attr: username
Jun 24 09:09:30.972: Vi3 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:30.972: Vi3 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:30.972: Vi3 PPP/AAA: Check Attr: addr
Jun 24 09:09:30.972: Vi3 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:30.972: Vi3 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:30.976: Vi3 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:30.976: Vi3 AAA/AUTHOR/FSM: We can start LCP
Jun 24 09:09:30.976: Vi3 PPP/AAA: Check Attr: Framed-Protocol
Jun 24 09:09:30.976: Vi3 PPP/AAA: Check Attr: username
Jun 24 09:09:30.976: Vi3 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:30.976: Vi3 PPP/AAA: Check Attr: addr
Jun 24 09:09:30.976: Vi3 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:30.980: Vi3 PPP/AAA: Check Attr: interface-config: Peruser I/F
Jun 24 09:09:30.980: Vi3 PPP/AAA: Check Attr: user-maxlinks
Jun 24 09:09:30.980: Vi3 AAA/AUTHOR/FSM: We can start IPCP
Jun 24 09:09:30.980: Vi3 AAA/AUTHOR/LCP: Process Author
Jun 24 09:09:30.980: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.980: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:30.980: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.980: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:30.980: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.984: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.984: AAA/AUTHOR: Processing PerUser AV interface-config
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.988: Vi3 AAA/AUTHOR/LCP: Process Attr: interface-config
Jun 24 09:09:30.988: Vi3 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:30.988: Vi3 AAA/AUTHOR/LCP: IF_config:
rate-limit output 1000000 300000 600000 conform-action transmit exceed-action drop
rate-limit input 1000000 300000 600000 conform-action transmit exceed-action drop
rate-limit output 1000000 300000 600000 conform-action transmit exceed-action drop
rate-limit input 1000000 300000 600000 conform-action transmit exceed-action drop
Jun 24 09:09:30.988: AAA/ACCT/NET(00000059): Pick method list 'default'
Jun 24 09:09:30.992: AAA/ACCT/SETMLIST(00000059): Handle 0, mlist 84041D48, Name default
Jun 24 09:09:30.992: AAA/ACCT/EVENT/(00000059): NET UP
Jun 24 09:09:30.992: AAA/ACCT/HC(00000059): Update VPDN/9E0000E8
Jun 24 09:09:30.992: AAA/ACCT/HC(00000059): VPDN/9E0000E8 [pre-sess] (rx/tx) base 0/0 pre 0/129 call 0/129
Jun 24 09:09:30.992: AAA/ACCT/HC(00000059): VPDN/9E0000E8 [pre-sess] (rx/tx) adjusted, pre 0/129 call 0/0
Jun 24 09:09:31.024: Vi3 AAA/AUTHOR/IPCP: Already authorized
Jun 24 09:09:31.024: Vi3 AAA/AUTHOR/FSM: We can start IPCP
Jun 24 09:09:31.024: Vi3 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, we want 0.0.0.0
Jun 24 09:09:31.024: Vi3 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:31.024: Vi3 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: Processing AV addr
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: Processing AV addr
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: Processing AV user-maxlinks
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: Authorization succeeded
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, we want 192.168.16.50
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: no author-info for primary dns
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: no author-info for primary wins
Jun 24 09:09:31.028: Vi3 AAA/AUTHOR/IPCP: no author-info for seconday dns
Jun 24 09:09:31.032: Vi3 AAA/AUTHOR/IPCP: no author-info for seconday wins
Jun 24 09:09:31.036: Vi3 AAA/AUTHOR/IPCP: no author-info for primary dns
Jun 24 09:09:31.040: Vi3 AAA/AUTHOR/IPCP: no author-info for primary dns
Jun 24 09:09:31.044: AAA/ACCT/EVENT/(00000059): IPCP_PASS
Jun 24 09:09:31.044: AAA/ACCT/NET(00000059): Queueing record is START
Jun 24 09:09:31.056: AAA/ACCT(00000059): Accouting method=BILLING (RADIUS)
Jun 24 09:09:31.064: AAA/ACCT/NET(00000059): START protocol reply PASS
Jun 24 09:09:31.064: AAA/ACCT(00000059): Send START accounting notification to EM successfully
Jun 24 09:09:31.964: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access3, changed state to upcisco_1721#
cisco_1721#


тоесть видно что идет проверка юзерс макс линк
un 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: user-maxlinks
Jun 24 09:09:30.984: Vi3 AAA/AUTHOR/LCP: Process Attr: user-maxlinks

но у меня в конфиге прописано

aaa attribute list user-andrew
attribute type addr 192.168.16.50 service ppp protocol ip mandatory
attribute type interface-config "rate-limit output 1000000 300000 600000 conform-action transmit exceed-action drop"
attribute type interface-config "rate-limit input 1000000 300000 600000 conform-action transmit exceed-action drop"
attribute type user-maxlinks 1 mandatory

username andrew user-maxlinks 1 password 0 12345
username andrew aaa attribute list user-andrew

Может быть это нужно как-то по другому указать?

Насколько я вижу (или догадываюсь) получается, что max-links проверяется, но для конкретного интерфейса!

У вас в выводе sh vpdn
один раз пользователь примаплен к Vi3, а второй раз - к Vi4

Думаю, в этом засада, т.к. судя по дебагу атрибут проверяется (бывает, что атрибут есть, но не проверяется в силу каких-либо ограничений)

Ну а что поменять?

Вот бы узнать... Сам в тупике. Знал бы - сказал бы.

Ладно - в любом случае спасибо за внимание - если этот вопрос как-то прояснится - пишите.

Попробуйте внешний фришный ТАКАКС или РАДИУС.

Не, тут задача решить все именно на циске, без внешних средств.

Здравствуйте,
встал такой же вопрос с небольшим отличием: у меня l2tp.

Почему не срабатывает "attribute type vpdn-active-sessions 1", при этом срабатывает следующий "attribute type addr 192.168.30.3...", подключаюсь с двух компов без проблем и обоим выдаётся один и тот же IP?
Попробовал добавить следующее:
aaa authorization network VPDN local
vpdn authen-before-forward
ppp authorization VPDN
эффекта нет
Неужели нужно vpdn-group для каждого пользователя создавать, должно же как-то проще решаться?
Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.7(3)M8, RELEASE SOFTWARE (fc1)