help with config. authentication probs

lee — Fri, 21 Feb 2020 18:00:07 GMT

hi everyone.

im doing a cisco 1720 site to site vpn using 3 des

i am unable to get to pipex site and am being blocked for some reason.

within the config you will see three usernames

the pipex is the one id like to connect to. the other two are made up based upon the authentication problems im receiving. i tried to put a user in to try and get through.

in the interface dialer0 i put no ip access-group 150 in and then seemed to get challenge and response (part 3) but no success although this is not the id i wish to use. i run a dsl modem at home and have tried to connect from site using this and the pipex log in details and had no problems getting authenticated and int access.

please help

00:51:33: Vi1 CHAP: Unable to authenticate for peer

00:51:37: Vi1 CHAP: O CHALLENGE id 3 len 29 from "hertford"

00:51:37: Vi1 CHAP: I CHALLENGE id 119 len 39 from "sms1.dsl.pipex.net"

00:51:37: Vi1 CHAP: Username sms1.dsl.pipex.net not found

00:51:37: Vi1 CHAP: Unable to authenticate for peer

00:51:41: Vi1 CHAP: O CHALLENGE id 4 len 29 from "hertford"

00:51:41: Vi1 CHAP: I CHALLENGE id 120 len 39 from "sms1.dsl.pipex.net"

00:51:41: Vi1 CHAP: Username sms1.dsl.pipex.net not found

00:51:41: Vi1 CHAP: Unable to authenticate for peer

00:51:45: Vi1 CHAP: O CHALLENGE id 5 len 29 from "hertford"

00:51:45: Vi1 CHAP: I CHALLENGE id 121 len 39 from "sms1.dsl.pipex.net"

00:51:45: Vi1 CHAP: Username sms1.dsl.pipex.net not found

00:51:45: Vi1 CHAP: Unable to authenticate for peer

00:51:49: Vi1 CHAP: O CHALLENGE id 6 len 29 from "hertford"

00:51:49: Vi1 CHAP: I CHALLENGE id 122 len 39 from "sms1.dsl.pipex.net"

00:51:49: Vi1 CHAP: Username sms1.dsl.pipex.net not found

00:51:49: Vi1 CHAP: Unable to authenticate for peer

00:51:53: Vi1 CHAP: O CHALLENGE id 7 len 29 from "hertford"

00:51:53: Vi1 CHAP: I CHALLENGE id 123 len 39 from "sms1.dsl.pipex.net"

00:51:53: Vi1 CHAP: Username sms1.dsl.pipex.net not found

00:51:53: Vi1 CHAP: Unable to authenticate for peer

Current configuration : 2576 bytes

version 12.1

no service single-slot-reload-enable

service timestamps debug uptime

service timestamps log uptime

service password-encryption

hostname hertford

logging rate-limit console 10 except errors

enable secret 5 $1$d6OJ$JU.yzY/g6lGebq0i.gD5H0

username ******@xtreme.pipex.net password 7 0200014F020F172456

username sms1.dsl.pipex.net password 7 0115031052021E0A3B

username RASB4NRP3.Ealing password 7 07092458470001000D

memory-size iomem 25

ip subnet-zero

no ip source-route

no ip finger

ip dhcp excluded-address 192.168.1.2

ip dhcp excluded-address 192.168.1.1

ip dhcp excluded-address 192.168.1.254

ip dhcp excluded-address 192.168.1.3

ip dhcp excluded-address 192.168.1.4

ip dhcp excluded-address 192.168.1.5

ip dhcp excluded-address 192.168.1.6

ip dhcp excluded-address 192.168.1.7

ip dhcp excluded-address 192.168.1.8

ip dhcp excluded-address 192.168.1.9

ip dhcp pool hertford

network 192.168.1.0 255.255.255.0

dns-server 158.43.240.4 158.43.240.3

default-router 192.168.1.254

no ip dhcp-client network-discovery

crypto isakmp policy 10

encr 3des

authentication pre-share

group 2

crypto isakmp key ********** address 52.168.35.118

crypto ipsec transform-set strong esp-3des esp-sha-hmac

crypto map vpn 10 ipsec-isakmp

set peer 52.168.35.118

set transform-set strong

match address 101

interface ATM0

no ip address

ip nat outside

atm vc-per-vp 256

no atm ilmi-keepalive

pvc 0/38

encapsulation aal5mux ppp dialer

dialer pool-member 1

dsl operating-mode auto

no fair-queue

crypto map vpn

interface FastEthernet0

ip address 192.168.1.254 255.255.255.0

ip nat inside

speed auto

no cdp enable

interface Dialer0

ip address 52.168.35.126 255.255.255.248

ip access-group 150 in

ip nat outside

encapsulation ppp

dialer pool 1

no cdp enable

ppp authentication chap

crypto map vpn

ip nat pool vpn 52.168.35.121 52.168.35.121 prefix-length 29

ip nat inside source list 10 pool vpn overload

ip nat inside source static 192.168.1.2 52.168.35.122

ip nat outside source static 52.168.35.122 192.168.1.2

ip classless

ip route 0.0.0.0 0.0.0.0 Dialer0

no ip http server

access-list 10 deny 192.168.1.2

access-list 10 permit 192.168.1.0 0.0.0.255

access-list 101 permit ip host 52.168.35.122 host 52.168.35.113

access-list 150 permit ip 52.168.35.112 0.0.0.7 52.168.35.120 0.0.0.7

access-list 150 permit tcp any any established

no cdp run

line con 0

password 7 045219561E34495A01

transport input none

line aux 0

password 7 020F160B1A130A3544

line vty 0 4

end

--------------------------------------------------------------------------------

Part: 3

05:53:40: Vi1 CHAP: O CHALLENGE id 45 len 29 from "hertford"

05:53:40: Vi1 CHAP: I CHALLENGE id 150 len 37 from "RASB4NRP3.Ealing"

05:53:40: Vi1 CHAP: O RESPONSE id 150 len 29 from "hertford"

05:53:42: Vi1 CHAP: O CHALLENGE id 46 len 29 from "hertford"

05:53:42: Vi1 CHAP: I CHALLENGE id 151 len 37 from "RASB4NRP3.Ealing"

05:53:42: Vi1 CHAP: O RESPONSE id 151 len 29 from "hertford"

05:53:44: Vi1 CHAP: O CHALLENGE id 47 len 29 from "hertford"

05:53:44: Vi1 CHAP: I CHALLENGE id 152 len 37 from "RASB4NRP3.Ealing"

05:53:44: Vi1 CHAP: O RESPONSE id 152 len 29 from "hertford"no debug

05:53:46: Vi1 CHAP: O CHALLENGE id 48 len 29 from "hertford"

05:53:46: Vi1 CHAP: I CHALLENGE id 153 len 37 from "RASB4NRP3.Ealing"

05:53:46: Vi1 CHAP: O RESPONSE id 153 len 29 from "hertford"all

All possible debugging has been turned off

hertford#

05:53:48: Vi1 CHAP: O CHALLENGE id 49 len 29 from "hertford"

05:53:48: Vi1 CHAP: I CHALLENGE id 154 len 37 from "RASB4NRP3.Ealing"

05:53:48: Vi1 CHAP: O RESPONSE id 154 len 29 from "hertford"

hertford#ping 80.193.223.56

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 80.193.223.56, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

hertford#

Re: help with config. authentication probs

ali-franks — Thu, 23 May 2002 12:06:58 GMT

Hi Lee,

Try this

1. under crypto map vpn 10 ipsec-isakmp

match address 101 should refer to your LAN addresses and not your Public IP's.

2. take off NAT if your not having web access as well

3. Your inbound ACL on dialer0 should allow esp, ahp and isakmp from the far end address to the near-end dialer int address.

Issue the commands

debug crypto isakmp

debug crypto ipsec

give it a go and then issue:

sh crypto engine connections active:

HTH

Ali

topic Re: help with config. authentication probs in Network Access Control

help with config. authentication probs

Re: help with config. authentication probs