ASR1K - L2TP tunnels not working and no debug logs

therebel22 · ‎05-21-2013

Hello,

please we need help :

we have made migration from CISCO 2821 to ASR1002-X.

Cisco router is used as LNS for our ADSL links, using L2TP protocol. On 2821, everything worked fine. Migrating with same config on ASR1002-X, everything worked except L2P sessions.

We wanted to debug but no debug is displayed about L2TP or PPP in console with commands :

- debug aaa authentication

- debug aaa authorization

- debug radius

- debus vpdn l2x-events

- debus vpdn l2x-errors

- debus vpdn l2x-packet

- debug ppp negotiation

- debug ppp authentication

We don't understand why no debug log ??? Is it a bug in IOS XE ?

show vpdn session all and show vpdn tunnel all gave "%No active L2TP tunnels"

Thanks a lot for help !!

----------------------------------

Here our configuration :

sh ver

Cisco IOS Software, IOS-XE Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 1

5.2(4)S1, RELEASE SOFTWARE (fc3)

Technical Support: http://www.cisco.com/techsupport

Compiled Sat 06-Oct-12 13:03 by mcpre

IOS XE Version: 03.07.01.S

License Level: ipbase

License Type: Permanent

Next reload license Level: ipbase

cisco ASR1002-X (2RU-X) processor with 1156257K/6147K bytes of memory.

Processor board ID SSI16450ENF

6 Gigabit Ethernet interfaces

32768K bytes of non-volatile configuration memory.

4194304K bytes of physical memory.

6684671K bytes of eUSB flash at bootflash:.

Here our LNS/L2TP configuration :

aaa new-model

!

aaa group server radius Telco-RADIUS

server-private x.x.x.x auth-port 1812 acct-port 1813 key secret

server-private y.y.y.y auth-port 1812 acct-port 1813 key secret

!

aaa authentication ppp Telco-DSL-AAA group Telco-RADIUS

aaa authorization network Telco-DSL-AAA group Telco-RADIUS

aaa accounting network Telco-DSL-AAA

action-type start-stop

group Telco-RADIUS

!

aaa session-id common

!

vpdn enable

vpdn history failure table-size 50

vpdn search-order multihop-hostname domain dnis

!

vpdn-group ADSL

accept-dialin

protocol l2tp

virtual-template 2

terminate-from hostname bas1

local name LNS1

lcp renegotiation always

no l2tp tunnel authentication

ip mtu adjust

!

interface Virtual-Template1 type serial

description VT1

mtu 1460

ip unnumbered Loopback0

ip nat inside

ip virtual-reassembly

ip tcp adjust-mss 1420

ip policy route-map INTERNET_VT1

timeout absolute 1800 0

no peer default ip address

ppp authentication chap pap Telco-DSL-AAA

ppp authorization Telco-DSL-AAA

ppp accounting Telco-DSL-AAA

ppp ipcp address required

ppp ipcp address accept

Subeh Sharma · ‎05-21-2013

Hi,

I can see you've configured Virtual-template 1 but under vpdn-group, virtual-template 2 is called:

!

vpdn-group ADSL

accept-dialin

protocol l2tp

virtual-template 2

Do you have a virtual-template 2 configured?

Also, can you run 'debug vpdn l2x-event' on the LAC and see if LAC is initiating a L2TP tunnel to the LNS?

Regards,

Subeh

therebel22 · ‎05-21-2013

Sorry,

it's a typo error. Yes we have a virtual-template 2 :

interface Virtual-Template2 type serial

description VT2

mtu 1460

ip unnumbered Loopback1

ip nat inside

ip virtual-reassembly

ip tcp adjust-mss 1420

ip policy route-map INTERNET_VT2

timeout absolute 1800 0

no peer default ip address

ppp authentication chap pap Telco-DSL-AAA

ppp authorization Telco-DSL-AAA

ppp accounting Telco-DSL-AAA

ppp ipcp address required

ppp ipcp address accept

!

Subeh Sharma · ‎05-21-2013

Also, can you run 'debug vpdn l2x-event' on the LAC and see if LAC is initiating a L2TP tunnel to the LNS?

Regards,

Subeh

therebel22 · ‎05-21-2013

When i launch that command :

debug vpdn l2x-event'

And all others command, i hav no debug log on console about vpdn or ppp. I don't understand why. debug log worked well on 2821..

therebel22 · ‎05-21-2013

And Loopback interfaces :

interface Loopback0

ip address a.b.c.d 255.255.255.255

!

interface Loopback1

ip address e.f.g.h 255.255.255.255

!

interface Loopback2

ip address i.j.k.l 255.255.255.255

!

Subeh Sharma · ‎05-21-2013

The debug i suggested was to be run on the LAC and not on LNS which you're ASR is configured as.

Regards,

Subeh

therebel22 · ‎05-21-2013

The LAC is owned by another provider, we can't acces it... Do you know an issue on ASR1K whereno debug log is produced about aaa or vpnd ?

Subeh Sharma · ‎05-21-2013

No, there is no such bug that i know of. Where are you checking the logs i.e. in the logging buffer(show log) or on router's console or in SYSLOG? Also what have you configured for logging on the ASR?

Regards,

Subeh

therebel22 · ‎05-21-2013

thanks for reply.

Router console with serial link or syslog on another server. We only see log about enter configure terminal or command typed but absolutly no log about aaa or vpdn whereas debug log are enabled

Subeh Sharma · ‎05-21-2013

So, you've configured for SYSLOG? Can you paste the logging commands you've on ASR, here?

Logs will be shown when ASR receives a L2TP tunnel request from the LAC. Are you able to ping the LAC's IP?

Regards

Subeh

therebel22 · ‎05-21-2013

I'm looking for logs on our syslog server. I'll give you soon. Thanks.

therebel22 · ‎05-21-2013

Sorry for delay. Here the log that was repeated when config was modified :

May 19 09:33:40 X.Y.Z.1 510: May 19 08:33:42.502: VT[Vt1]:Subinterfaces may be created using this config

May 19 09:33:40 X.Y.Z.1 511: May 19 08:33:42.502: VT[Vt1]:Generated an interface command list

May 19 09:33:40 X.Y.Z.1 512: May 19 08:33:42.502: VT[Vt1]:Generated a subinterface command list

May 19 09:33:40 X.Y.Z.1 513: May 19 08:33:42.502: VT[Vt1]:Generated a ppp_only interface command list

May 19 09:33:40 X.Y.Z.1 514: May 19 08:33:42.502: VT[Vt1]:Generated a ppp_only subinterface command list

May 19 09:33:40 X.Y.Z.1 515: May 19 08:33:42.502: VT:Clean up dirty vaccess queue, size 1

May 19 09:33:40 X.Y.Z.1 516: May 19 08:33:42.503: RADIUS: Removing all radius source-int. pointing to Virtual-Access1.1

May 19 09:33:43 X.Y.Z.1 517: May 19 08:33:44.884: AAA/AUTHOR: auth_need : user= 'root' ruser= 'LNS1'rem_addr= 'X.Y.Z.13' priv= 0 list= '' AUTHOR-TYPE= 'commands'

May 19 09:34:32 X.Y.Z.1 518: May 19 08:34:35.190: AAA/AUTHOR: auth_need : user= 'root' ruser= 'LNS1'rem_addr= 'X.Y.Z.13' priv= 0 list= '' AUTHOR-TYPE= 'commands'

May 19 09:34:33 X.Y.Z.1 519: May 19 08:34:35.190: %SYS-5-CONFIG_I: Configured from console by root on vty0 (X.Y.Z.13)

therebel22 · ‎05-22-2013

Any idea ?

What do you think of configuration ? Does it seems good for you ?

Thanks.

Subeh Sharma · ‎05-22-2013

Sorry, was busy in the day so didn't get a time to check this. So, i see alot of mesages now in your last output. Anything changed? I'd say your configuration is complete and contains all the commands required. Since you're able to see debugs now, can you check show l2tp tunnel all?

Regards,

Subeh