cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
1276
Views
0
Helpful
0
Replies
Highlighted
Beginner

L2TP tunnel - traffic only between routers not host

Hi,

I am in dire need of asssistance.

I have set up a L2TP between 2 887va routers to pass layer 2 traffic from a remote site. My problem is that the traffic from my layer 2 device is entering the router through the Fastethernet 0 but doesn't go anywhere.

I am getting the "Hello" over the L2TP so the tunnel is up and working. When I attach a laptop to the layer 2 device end I can ping between that and the host at the other end, however, no layer 2 traffic is being passed over the tunnel.

I am using wireshark on the host at the far end and this sees no layer 2 traffic not even the "Hello" so I checked the ACL's but can find no reason why thes traffic shouldn't pass through.

Please can someone help. I have inluded the config files from both routers.

Thanks.

Router 1

Building configuration...

Current configuration : 3973 bytes

!

! Last configuration change at 13:03:15 UTC Thu May 2 2013

! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013

! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013

version 15.1

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname XXX

!

boot-start-marker

boot-end-marker

!

enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2

!

no aaa new-model

memory-size iomem 10

crypto pki token default removal timeout 0

!       

ip source-route

!       

ip cef

no ipv6 cef

l2tp-class l2tpclass2

authentication

password xxx

!       

l2tp-class l

!       

vpdn enable

!       

vpdn-group vpdngroup1

accept-dialin

  protocol l2tp

  virtual-template 1

terminate-from hostname peer1

!       

license udi pid CISCO887VA-K9 sn FCZ1706908Q

!       

controller VDSL 0

!

pseudowire-class pwclass2

encapsulation l2tpv3

sequencing both

ip local interface Dialer0

ip pmtu

ip tos reflect

ip ttl 100

!

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key XXXX address xxx.xxx.xxx.xxx

crypto isakmp keepalive 30 5

!    

crypto ipsec transform-set XXXX esp-3des esp-md5-hmac

!       

crypto map cMap 10 ipsec-isakmp

set peer xxx.xxx.xxx.xxx

set transform-set XXXX

match address 101

!

bridge irb

!       

interface Loopback1

no ip address

!

interface Ethernet0

no ip address

shutdown

no fair-queue

!       

interface ATM0

no ip address

ip nat outside

ip virtual-reassembly in

no atm ilmi-keepalive

pvc 0/38

  encapsulation aal5mux ppp dialer

  dialer pool-member 1

!       

interface FastEthernet0

switchport access vlan 2

no ip address

!       

!

interface Virtual-Template1

ip unnumbered Loopback1

ppp authentication chap

ppp chap hostname peer2

!       

interface Virtual-PPP2

ip unnumbered Loopback1

ppp authentication chap

ppp chap hostname peer2

pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2

!       

!       

interface Vlan2

no ip address

bridge-group 1

bridge-group 1 input-address-list 700

bridge-group 1 output-address-list 700

!       

interface Dialer0

ip address XXX.XXX.XXX.XXX 255.255.255.0

no ip redirects

no ip unreachables

ip mtu 1492

ip nat outside

ip virtual-reassembly in

encapsulation ppp

dialer pool 1

ppp authentication chap callin

ppp chap hostname xxxxxx

ppp chap password 0 xxxxxx

ppp ipcp route default

ppp ipcp address accept

no cdp enable

crypto map cMap

!

interface BVI1

ip address 192.168.1.1 255.255.255.0

!

ip forward-protocol nd

no ip http server

no ip http secure-server

!

ip nat inside source list 100 interface Dialer0 overload

ip route 0.0.0.0 0.0.0.0 Dialer0

ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0

ip route 192.168.1.0 255.255.255.0 Virtual-PPP2

!       

access-list 50 deny   any log

access-list 100 deny   ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 100 permit ip 192.168.1.0 0.0.0.255 any

access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 deny   ip any any

access-list 101 deny   tcp any any

access-list 101 deny   udp any any

access-list 101 deny   icmp any any

access-list 111 deny   tcp any any eq telnet

access-list 111 permit ip any any

access-list 700 permit 0000.0000.0000   ffff.ffff.ffff

dialer-list 1 protocol ip permit

!       

bridge 1 protocol ieee

bridge 1 route ip

!       

line con 0

line aux 0

line vty 0 4

access-class 50 in

exec-timeout 0 0

no login

transport input none

transport output none

!

end     

Router 1

Building configuration...

Current configuration : 3629 bytes

!

! Last configuration change at 13:03:49 UTC Thu May 2 2013

! NVRAM config last updated at 13:04:07 UTC Thu May 2 2013

! NVRAM config last updated at 13:04:07 UTC Thu May 2 2013

version 15.1

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname XXXX

!

boot-start-marker

boot-end-marker

!

enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2

!

no aaa new-model

memory-size iomem 10                                                                                                                                                                                                                                                      

!       

ip source-route

!       

ip cef

no ipv6 cef

l2tp-class l2tpclass2

!       

license udi pid CISCO887VA-K9 sn FCZ170690A2    

!

controller VDSL 0

!

pseudowire-class pwclass2

encapsulation l2tpv3

sequencing both

ip local interface Dialer0

ip pmtu

ip ttl 100

!       

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key XXXX address xxx.xxx.xxx.xxx

crypto isakmp keepalive 30 5

!       

!

crypto ipsec transform-set XXXX esp-3des esp-md5-hmac

!

crypto map cMap 10 ipsec-isakmp

set peer xxx.xxx.xxx.xxx

set transform-set XXXX

match address 101

!       

bridge irb

!

interface Loopback1

no ip address

!       

interface Ethernet0

no ip address

shutdown

no fair-queue

!

interface ATM0

no ip address

ip virtual-reassembly in

no atm ilmi-keepalive

pvc 0/38

  encapsulation aal5mux ppp dialer

  dialer pool-member 1

!

interface FastEthernet0

switchport access vlan 2

no ip address

!       

interface Virtual-PPP2

ip unnumbered Loopback1

ppp authentication chap

ppp chap hostname peer2

pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2

!

interface Vlan2

no ip address

bridge-group 1

bridge-group 1 input-address-list 700

bridge-group 1 output-address-list 700

!

interface Dialer0

ip address xxx.xxx.xxx.xxx 255.255.255.0

no ip redirects

no ip unreachables

ip mtu 1492

ip nat outside

ip virtual-reassembly in

encapsulation ppp

dialer pool 1

ppp authentication chap callin

ppp chap hostname xxxxxx

ppp chap password 0 xxxxxx

ppp ipcp route default

ppp ipcp address accept

no cdp enable

crypto map cMap

!       

interface BVI1

ip address 192.168.2.1 255.255.255.0

ip access-group 101 in

no ip unreachables

!

ip forward-protocol nd

no ip http server

no ip http secure-server

!

ip nat inside source list 100 interface Dialer0 overload

ip route 0.0.0.0 0.0.0.0 Dialer0

ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0

ip route 192.168.2.0 255.255.255.0 Virtual-PPP2

!       

access-list 50 deny   any log

access-list 100 deny   ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

access-list 100 permit ip 192.168.2.0 0.0.0.255 any

access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255

access-list 101 deny   ip any any

access-list 101 deny   tcp any any

access-list 101 deny   udp any any

access-list 101 deny   icmp any any

access-list 111 deny   tcp any any eq telnet

access-list 111 permit ip any any

access-list 700 permit 0000.0000.0000   ffff.ffff.ffff

dialer-list 1 protocol ip permit

!       

bridge 1 protocol ieee

bridge 1 route ip

!       

line con 0

line aux 0

line vty 0 4

access-class 50 in

exec-timeout 0 0

no login

transport input none

transport output none

!

end      

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards