bionic (5) startup-config.5.gz

Provided by: l2tpns_2.2.1-2_amd64 bug

NAME

       startup-config - configuration file for l2tpns

SYNOPSIS

       /etc/l2tpns/startup-config

DESCRIPTION

       startup-config is the configuration file for l2tpns.

       The  format  is  plain  text, in the same format as accepted by the configuration mode of l2tpns's telnet
       administrative interface.  Comments are indicated by either the character # or !.

   SETTINGS
       Settings are specified with

              set variable value

       The following variables may be set:

              debug  Set the level of debugging messages written to the log file.  The value should be between 0
                     and 5, with 0 being no debugging, and 5 being the highest.

              log_file
                     This will be where all logging and debugging information is written to.  This may be either
                     a filename, such as /var/log/l2tpns, or the string syslog:facility, where facility  is  any
                     one of the syslog logging facilities, such as local5.

              pid_file
                     If  set,  the  process  id  will  be  written  to the specified file.  The value must be an
                     absolute path.

              random_device
                     Path to random data source (default /dev/urandom).   Use  ""  to  use  the  rand()  library
                     function.

              l2tp_secret
                     The  secret used by l2tpns for authenticating tunnel request.  Must be the same as the LAC,
                     or authentication will fail.  Only actually be used if the LAC requests authentication.

              l2tp_mtu
                     MTU of interface for L2TP traffic (default: 1500).  Used to set link  MRU  and  adjust  TCP
                     MSS.

              ppp_restart_time
                     Restart timer for PPP protocol negotiation in seconds (default: 3).

              ppp_max_configure
                     Number of configure requests to send before giving up (default: 10).

              ppp_max_failure
                     Number of Configure-Nak requests to send before sending a Configure-Reject (default: 5).

              primary_dns, secondary_dns
                     Whenever  a  PPP  connection  is  established, DNS servers will be sent to the user, both a
                     primary and a secondary.  If either is set to 0.0.0.0, then that one will not be sent.

              primary_radius, secondary_radius
                     Sets the RADIUS servers used for both authentication and accounting.  If the primary server
                     does not respond, then the secondary RADIUS server will be tried.

              primary_radius_port, secondary_radius_port
                     Sets the authentication ports for the primary and secondary RADIUS servers.  The accounting
                     port is one more than the authentication port.   If  no  ports  are  given,  authentication
                     defaults to 1645, and accounting to 1646.

              radius_accounting
                     If  set  to true, then RADIUS accounting packets will be sent.  A Start record will be sent
                     when the session is successfully authenticated, and a  Stop  record  when  the  session  is
                     closed.

              radius_interim
                     If  radius_accounting  is  on,  defines  the  interval  between  sending  of RADIUS interim
                     accounting records (in seconds).

              radius_secret
                     Secret to be used in RADIUS packets.

              radius_authtypes
                     A comma separated list of supported RADIUS authentication methods  ("pap"  or  "chap"),  in
                     order of preference (default "pap").

              radius_dae_port
                     Port  for  DAE  RADIUS  (Packet  of  Death/Disconnect,  Change  of  Authorization) requests
                     (default: 3799).

              radius_bind_min, radius_bind_max
                     Define a port range in which to bind sockets used to send and receive RADIUS packets.  Must
                     be  at  least  RADIUS_FDS  (64)  wide.   Simplifies  firewalling  of RADIUS ports (default:
                     dynamically assigned).

              allow_duplicate_users
                     Allow multiple logins with the same username.  If false (the default),  any  prior  session
                     with the same username will be dropped when a new session is established.

              guest_account
                     Allow multiple logins matching this specific username.

              bind_address
                     When  the  tun  interface  is  created,  it  is assigned the address specified here.  If no
                     address is given, 1.1.1.1 is used.  Packets containing user traffic should  be  routed  via
                     this address if given, otherwise the primary address of the machine.

              peer_address
                     Address to send to clients as the default gateway.

              send_garp
                     Determines  whether or not to send a gratuitous ARP for the bind_address when the server is
                     ready to handle traffic (default: true).  This setting is ignored if BGP is configured.

              throttle_speed
                     Sets the default speed (in kbits/s) which sessions will be limited to.

              throttle_buckets
                     Number of token buckets to allocate for throttling.  Each throttled  session  requires  two
                     buckets (in and out).

              accounting_dir
                     If  set to a directory, then every 5 minutes the current usage for every connected use will
                     be dumped to a file in this directory.

              dump_speed
                     If set to true, then the current bandwidth utilization will be logged every  second.   Even
                     if this is disabled, you can see this information by running the uptime command on the CLI.

              multi_read_count
                     Number  of  packets  to  read  off each of the UDP and TUN fds when returned as readable by
                     select (default: 10).  Avoids incurring the unnecessary system call overhead of  select  on
                     busy servers.

              scheduler_fifo
                     Sets the scheduling policy for the l2tpns process to SCHED_FIFO.  This causes the kernel to
                     immediately preempt any currently running SCHED_OTHER (normal) process in favour of  l2tpns
                     when it becomes runnable.
                     Ignored on uniprocessor systems.

              lock_pages
                     Keep all pages mapped by the l2tpns process in memory.

              icmp_rate
                     Maximum number of host unreachable ICMP packets to send per second.

              packet_limit
                     Maximum  number  of  packets of downstream traffic to be handled each tenth of a second per
                     session.  If zero, no limit  is  applied  (default:  0).   Intended  as  a  DoS  prevention
                     mechanism and not a general throttling control (packets are dropped, not queued).

              cluster_address
                     Multicast cluster address (default: 239.192.13.13).

              cluster_interface
                     Interface for cluster packets (default: eth0).

              cluster_mcast_ttl
                     TTL for multicast packets (default: 1).

              cluster_hb_interval
                     Interval in tenths of a second between cluster heartbeat/pings.

              cluster_hb_timeout
                     Cluster  heartbeat  timeout  in tenths of a second.  A new master will be elected when this
                     interval has been passed without seeing a heartbeat from the master.

              cluster_master_min_adv
                     Determines the minumum number of up to date slaves required before  the  master  will  drop
                     routes (default: 1).

              ipv6_prefix
                     Enable  negotiation  of  IPv6.   This  forms  the the first 64 bits of the client allocated
                     address.  The remaining 64 come from the allocated IPv4 address and 4 bytes of 0s.

   BGP ROUTING
       The routing configuration section is entered by the command

              router bgp as

       where as specifies the local AS number.

       Subsequent lines prefixed with neighbour peer define the attributes of BGP neighhbours.   Valid  commands
       are:

              neighbour peer remote-as as
              neighbour peer timers keepalive hold

       Where peer specifies the BGP neighbour as either a hostname or IP address, as is the remote AS number and
       keepalive, hold are the timer values in seconds.

   NAMED ACCESS LISTS
       Named access lists may be defined with either of

              ip access-list standard name
              ip access-list extended name

       Subsequent lines starting with permit or deny define the body of the access-list.

       Standard Access Lists
           Standard access lists are defined with:

                  {permit|deny} source [dest]

           Where source and dest specify IP matches using one of:

                  address wildard
                  host address
                  any

           address and wildard are in dotted-quad notation, bits in the wildard indicate which address  bits  in
           address are relevant to the match (0 = exact match; 1 = don't care).

           The shorthand 'host address' is equivalent to 'address 0.0.0.0'; 'any' to '0.0.0.0 255.255.255.255'.

       Extended Access Lists
           Extended access lists are defined with:

                  {permit|deny} proto source [ports] dest [ports] [flags]

           Where proto is one of ip, tcp or udp, and source and dest are as described above for standard lists.

           For TCP and UDP matches, source and destination may be optionally followed by a ports specification:

                  {eq|neq|gt|lt} port
                  range from to

           flags may be one of:

                  {match-any|match-all} {+|-}{fin|syn|rst|psh|ack|urg} ...
                         Match packets with any or all of the tcp flags set (+) or clear (-).

                  established
                         Match "established" TCP connections:  packets with RST or ACK set, and SYN clear.

                  fragments
                         Match IP fragments.  May not be specified on rules with layer 4 matches.

SEE ALSO

       l2tpns(8)