DDR and Dialer Profiles

written by: Leon Tufallo; article published: year 2007, month 07;


In: Categories » Electronics and communication » Network security » DDR and Dialer Profiles

DDR consists of two portions: logical and physical. Network layer address, encapsulation, and dialer parameters are part of the logical portion of DDR. The interface that places and receives calls is the physical portion. When dialer profiles are implemented, the physical interfaces comprise a dialer pool and are allocated from this pool on an as-needed basis. A physical interface is borrowed from the dialer pool when a call is made. It is returned to the pool when the call is complete. Dialer profiles dynamically bind logical and physical configurations for each call. This allows the physical interface to take on different characteristics according to the requirements of an incoming or outgoing call. Remember that the combination of physical and logical characteristics is only temporary and lasts as long as the call.

Advantages of Dialer Profiles

Dialer Profiles Versus Legacy DDR
Legacy DDR Dialer Profiles
All ISDN B channels have the same configuration as the physical interface. There is one configured logical interface per ISDN B channel.
One dialer map is required for every dialer for every protocol, which makes multiprotocol configurations very complex. The dialer profile is a point-to-point interface that negates the requirement for a Layer 3-to-Layer 2 mapping and the subsequent complexities of managing multiple maps.
Dial backup is restricted because when a BRI or PRI is used to back up an interface, all the B channels go down, and the whole interface is idle. Dialer profiles save the ISDN B channels by permitting the ISDN BRI interfaces to belong to multiple dialer pools. This allows a backup interface to be nondedicated and useable when the primary interface is still up.


In addition to the aforementioned perks, dialer profiles provide the ability to separate the logical portion of DDR from the physical interface, allowing you to

  • Enable concurrent bridging over DDR interfaces to multiple sites

  • Limit the number of minimum or maximum connections taking place on a DDR interface

  • Assign different Layer 3 network addresses to different members of a physical interface

  • Specify different encapsulations for different B channels

  • Configure different members of a DDR interface with different DDR parameters

Dialer profiles support only PPP or HDLC encapsulation. PPP encapsulation is the most popular choice because it's nonproprietary and offers authentication options.

Dialer Profile Components

A dialer profile is a combination of the following components:

  • Dialer interface A logical portion of a dialer profile. The dialer interface governs all configuration settings for a destination. Each dialer interface can contain multiple dialer maps. Furthermore, different per-call parameters can be assigned to each dialer map defined in a dialer map class. The dialer interface defines the destination network protocol address, encapsulation type, type of PPP authentication, and dialer remote name for PPP PAP or CHAP. Other specified parameters include the dialer string/map, dialer pool number, interesting traffic lists, Multilink PPP, and optional timeouts.

  • Dialer map class An optional portion of a dialer profile that defines call characteristics for a specified destination. Map classes are designed to avoid having to identify the same call characteristics repeatedly for multiple interfaces. If a map class isn't used, a separate call characteristics definition is required for each dialer interface, even if those characteristics are identical for several dialer interfaces. The information included in a map class is tuned for each destination. This information can specify an ISDN speed of 56 kbps, whether it is a semipermanent connection, optional dialer timers such as dialer fast idle, dialer idle timeout, and dialer wait-for-carrier time.

  • Dialer pool A group of one or more physical interfaces of which each dialer interface is a member. Each dialer interface is associated with a dialer pool. A physical interface can be part of more than one dialer pool. You can also configure an optional priority, which determines outbound dialing contention for specific physical interfaces in the pool.

  • Physical interfaces Members of one or more pools. The configuration of a physical interface is limited to the encapsulation parameters. If required, Multilink PPP and PPP authentication are specified to enable identification of the dialer pools to which the interface belongs. The encapsulation method of the physical interface must match that of the dialer interface, which belongs to the same pool as the physical interface.

Dialer Profile Binding Sequence

As you know, dialer profiles specify the technique of dynamically binding the logical and physical configuration. It is the job of the NAS to associate dialer information with a physical port to accommodate the needs of a particular user dialing in to or out of the NAS. When multiple dialer profiles are configured on the NAS, it must determine which profile to bind for every call. The following two sections describe the binding sequence for dialing out and dialing in.

Dialing Out

The binding process for the outgoing calls works as follows:

  1. When an outgoing packet arrives at the NAS, a route table lookup is performed, and the incoming packet from the network arrives. A route table lookup points to the destination via the dialer interface.

  2. When it is noted that the dialer interface is a dialer profile, the IOS determines whether an existing connection for this profile exists. If there is none, the software identifies the pool to which the dialer interface belongs.

  3. The NAS searches for the first available physical interface of the pool that has the highest pool priority. When it is located, this interface is identified for use in dialing. It is then bound to the dialer interface, taking on the configuration of that dialer interface.

  4. The telephone number for the dialer profile is dialed, and the regular DDR process takes place.

Dialing In

What makes the incoming call-binding process more complex than that for the outgoing calls is the fact that the called physical interface may be a member of multiple pools, and the pools, in turn, may be associated with multiple dialer profiles. The incoming call-binding process is as follows:

  • If the physical interface belongs to only one pool, which is associated with one dialer profile, the bind occurs between the physical interface and this dialer profile. If this isn't possible, the next step is a further attempt at binding known as an approximate match.

  • This attempt looks for a match of the Call Line ID (CLID) from the call with the dialer number from a dialer profile. However, the search involves only the profiles associated with the pool to which the dialed physical interface belongs. If there is a match, the physical interface is bound to the dialer profile that returned a match. If this step fails as well, proceed with the further binding attempt known as a complete match.

  • If PPP authentication is configured on the physical interface, the call is answered, and the caller is authenticated. In this case, the authenticated name is used to match the dialer profile that contains the same name in its configuration. Again, the only profiles that are checked are those that are associated with the same pools of which the called physical interface is a member. If the check returns a match, the physical interface is bound to the found dialer interface. If the complete match fails, the binding cannot occur, and the call is disconnected.

You might have realized that for the last binding attempt to be successful, the physical interface needs to have PPP encapsulation and PPP authentication enabled. Also, the physical interface engages in PPP Link Control Protocol (LCP) layer negotiations before binding to a profile. This means that if a dialer profile is using Multilink PPP, the physical interface must be configured for Multilink PPP as well because LCP negotiations might take place before the dialer profile is located.

After the bind has occurred, this does not mean that the connection has occurred as well. Just because the physical interface found the logical configuration to use, this does not imply that the call cannot be disconnected for other reasons. One such reason can be the maximum threshold configured for inbound calls. When the NAS locates an appropriate profile for an incoming call, it checks whether the profile has reached its maximum connection limit. If the current incoming call puts the profile's connection limit over its configured maximum, the call is disconnected.

Dialer Profile Limitations

Dialer profiles have certain limitations:

  • Dialer profiles do not support dynamic encapsulation.

  • The only supported encapsulation types are PPP and HDLC. X.25 and Frame Relay are not currently supported.

  • The physical and dialer interfaces both require PPP authentication to be enabled.

  • The maximum threshold for incoming calls is checked only after the call has been answered, so the charge applies regardless of whether the call is later disconnected because of the exceeded limit.

  • Each dialer interface takes up an interface description block (IDB). IDB is an internal structure that manages an interface. Because a limited number of IDBs are available (the exact number depends on the hardware platform), dialer profiles might have certain scalability constraints.

legal disclaimer

1) Our website is not responsible for the information contained by this article as well for any and all copyright infringements by authors and writers. E-articles is a free information resource. If you suspect this article for any copyright infringements, please read the Terms of service and contact us to investigate the problem.
2) The E-articles directory team is not responsible for inaccuracies, falsehoods, or any other types of misinformation this tutorial may contain and will not be liable for any loss or damage suffered by a user through the user's reliance on the information gained here. Please read the Terms of service

Useful tools and features

Translate this article to...    Send this article to you or to a friend

Link to this article from your page   
If you like this article (tutorial), please link to it from your web page using the information above. Linking to this page, this is the only way to help us improve our service, the same time providing your visitors with a way to improve their online experience.

related articles

1. 802.11i Wireless Security Standard and WPA
Thus, the main hope of the international 802.11 community and network administrators lies with the 802.11i standard development. Sometimes 802.11i is referred to as the Robust Security Network (RSN) as compared to traditional security network (TSN). The "i" IEEE task group was supposed to produce a new wireless security standard that should have completely replaced legacy WEP by the end of 2003. In the meantime, some bits and pieces of the incoming 802.11i standard have been implemented by wireless equipment and software vendor...

2. Proprietary Improvements to WEP and WEP Usage
The article devoted to the proprietary and standards-based improvements for currently vulnerable 802.11 safeguards. The most publicized 802.11 vulnerability is the insecurity of WEP. We have already reviewed the cryptographic weaknesses of WEP linked to the key IV space reuse and insecure key-from-string generation algorithm. There are also well-known WEP key management issues: All symmetric cipher implementations suffer secure key distribution problems. WEP is no exception. In the original design,...

3. Penetration Testing as Your First Line of Defense
It is hard to overemphasize the importance of penetration testing in the overall information security structure and the value of viewing your network through the cracker's eyes prior to further hardening procedures. There are a variety of issues specific to penetration testing on wireless networks. First of all, the penetration tester should be very familiar with RF theory and specific RF security problems (i.e., signal leak and detectability, legal regulations pertaining to the transmitter power output, and characteris...

4. Asymmetric Cryptography
Message authentication using HMACs works just fine, but how do we distribute symmetric cipher keys among the users? We can pass them around on floppies or fancy USB pen-drives with encrypted partitions on them, but what if many users live all over the world? What if the physical key distribution method takes time and the keys must be frequently changed? This is the case with the traditional WEP, which should be rotated every few minutes. Key-encrypting keys (KEKs) were offered as symmetric cipher keys used only to encrypt...

5. Examples and Analysis of Common Wireless Attack Signatures
The best way of knowing these signatures is trying out the tools in question and sniffing out their output: "Attack through defending, defend through attacking" (Dr. Mudge). The best source on wireless network intrusion tool detection and attack signatures we are aware of is Joshua Wright's "Layer 2 Analysis of WLAN Discovery Applications for Intrusion Detection" and "Detecting Wireless LAN MAC Address Spoofing" papers. A large part of this tutorial is inspired by these brilliant articles and our experience of analyzing WLAN tr...

6. Deploying a Wireless IDS Solution for Your WLAN
How many IDS solutions that implement the recommendations and follow the guidelines we have already discussed are present on the modern wireless market? The answer is none. There are many wireless IDS solutions that look for illicit MAC addresses and ESSIDs on the monitored WLAN. Some of these solutions are even implemented as specialized hardware devices. Although something is better than nothing, in our opinion such "solutions" are a waste of both money and time. They might also give you a false sense of security. Let's...

7. Hash Functions Their Performance and HMACs
Other widely used hash functions include 128-bit MD5 from RSA Data Security, Inc., which is a very fast and commonly implemented hash. MD5 is traditionally used to encrypt Linux user passwords (hashes start with the "$1$" character), authenticate routing protocols like RIPv2 and OSPF, create checksums of binaries in RPMs, and verify the integrity of Free/OpenBSD ports files. The specifications of MD5 are available in RFC 1321. Host intrusion detection tools like Tripwire (http://www.tripwire.com) use MD5 to take snapshots of a syst...

8. Introduction to Applied Cryptography and Steganography
One can set up a reasonably secure wireless or wired network without knowing which ciphers are used and how the passwords are encrypted. This, however, is not an approach endorsed by us and discussed here. Hacking is about understanding, not blindly following instructions; pressing the buttons without knowing what goes on behind the scenes is a path that leads nowhere. Besides, security and quality of service are tightly interwoven, incorrect selection of the cipher and its implementation method can lead to a secure but sluggish...

9. Streaming Ciphers and Wireless Security
Streaming algorithms were designed to avoid speed and throughput penalties due to the implementation of block symmetric ciphers in CFB and OFB modes when bit-by-bit data encryption is required. Streaming ciphers are based on generating identical keystreams on both encrypting and decrypting sides. The plaintext is XORed with these keystreams to encrypt and decrypt data. To generate the keystream, pseudo-random generators (PRNGs) are used, thus placing stream algorithms somewhere between easy-to-break simple XORing with a predefi...