Hi,
I am testing IPSEC/L2TP from a windows client to a PIX 501.
The IPSEC portion is working fine on phase 1 and 2 and the PIX is seeing and decrypting IPSEC traffic.
However its not allowing the L2TP bit and hence user authentication to happen and i can see the following from the logs.
710005: UDP request discarded from *.*.*.*/1701 to outside:*.*.*.*/1
701
I've currently got an access-list on the outside interface to permit ip any any
From the cisco site, it indicates this message means that the PIX is not listening on UDP 1701 and hence not responding.
Does anyone know if i have to enable L2TP in some way, i though this had allready been covered in my config:
sysopt connection permit-l2tp
sysopt connection permit-ipsec
!
access-list l2tp_acl line 1 permit ip any any
!
crypto ipsec transform-set l2tp_tran esp-des esp-md5-hmac
crypto ipsec transform-set l2tp_tran mode transport
!
crypto ipsec security-association lifetime seconds 3600
crypto dynamic-map dyna 20 match address l2tp_acl
crypto dynamic-map dyna 20 set transform-set l2tp_tran
crypto map mymap 10 ipsec-isakmp dynamic dyna
crypto map mymap client authentication LOCAL
crypto map mymap interface outside
!
isakmp enable outside
!
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 1
isakmp policy 20 lifetime 3600
!
ip local pool l2tp_pool 10.1.1.1-10.1.1.5
!
vpdn group l2tpipsec accept dialin l2tp
vpdn group l2tpipsec ppp authentication chap
vpdn group l2tpipsec ppp authentication mschap
vpdn group l2tpipsec client configuration address local l2tp_pool
vpdn group l2tpipsec client configuration dns *.*.*.*
vpdn group l2tpipsec client authentication local
vpdn group l2tpipsec client accounting RADIUS
vpdn group l2tpipsec l2tp tunnel hello 60
vpdn enable outside
!
Any help would be appreciated.
ta
Paddy
