VPDN (PPP) routes traffic until RADIUS is enabled (Cisco 2851)

wallyhall · ‎06-03-2016

Hi all,
Please be gentle - I've been googling and reading up everything I can for the past 2 weeks without any progress. I've also had to rewrite this question 4 times to get past the anti-spam check... meaning there's less detail now than I wanted to share.

Also I was 50/50 as whether to post under Routing/Switching or Security ... it feels like I'm missing something to do with routing, although it seems triggered by altering AAA. Apologies if I've misfiled it.

In short:

I have a working VPN. What I believe is the "relevant" configuration is shown below:

aaa new-model
aaa authentication ppp default local
aaa authorization exec default local 
aaa authorization network default local
aaa accounting delay-start
aaa session-id common

l2tp congestion-control

vpdn enable

vpdn-group 1
 ! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1
 l2tp tunnel timeout no-session 15

username xxxxx password zz yyyyyyyyy

interface Virtual-Template1
 bandwidth inherit
 ip unnumbered Dialer1
 ip nat inside
 ip virtual-reassembly
 peer default ip address pool vpn_pool
 no keepalive
 ppp encrypt mppe auto
 ppp authentication pap chap ms-chap

It's a minimal configuration - (I've been trying to rule everything out!) - and it works from my OSX client using local authentication.

However upon enabling RADIUS authentication like so:

conf t
aaa authentication ppp default group radius
aaa authorization network default group radius

... I can continue to connect (all authentication passes etc) but packets don't flow.

Route table looks sane on my client. Routes on the Cisco look sane:

...
C        10.0.90.228/32 is directly connected, Virtual-Access6
...

Cisco can't ping client. Client can't ping Cisco. No traffic seems to flow.

I've got a ton of debug I'm happy to post here - but at the moment I feel like I'm not seeing the forest for the trees (so to speak). Any advice as to what specific debug to post? (Also the "anti-spam" feature on this forum keeps preventing me from posting the bits I want to share.)

I'm all out of ideas. All the debug I've tried looks identical (except where authentication is involved) as far as I can tell.
Thanks in advance.

wallyhall · ‎06-03-2016

I'm going to try and combat the anti-spam filter!

This is the caller detail while connected with RADIUS:

  User: ******************, line Vi6, service PPPoVPDN
        Connected for 00:00:58, Idle for 00:00:18
  Timeouts:    Limit     Remaining Timer Type
               -         -         -         
  PPP: LCP Open, MS CHAP (<-), IPCP, CCP
  NCP: Open IPCP, CCP

Vi6 LCP: [Open] 
Our Negotiated Options
Vi6 LCP:    AuthProto MS-CHAP (0x0305C22380)
Vi6 LCP:    MagicNumber 0x45DF39FE (0x050645DF39FE)
Peer's Negotiated Options
Vi6 LCP:    ACCM 0x00000000 (0x020600000000)
Vi6 LCP:    MagicNumber 0x0066ABB7 (0x05060066ABB7)
Vi6 LCP:    PFC (0x0702)
Vi6 LCP:    ACFC (0x0802)

Vi6 IPCP: [Open] 
Our Negotiated Options
Vi6 IPCP:    Address 212.159.119.145 (0x0306D49F7791)
Peer's Negotiated Options
Vi6 IPCP:    Address 10.0.90.228 (0x03060A005AE4)
Vi6 IPCP:    PrimaryDNS 10.0.40.10 (0x81060A00280A)
Peer's Rejected options
  SecondaryDNS

Vi6 CCP: [Open] 
Our Negotiated Options
Vi6 CCP:    MS-PPC supported bits 0x01000040 (0x120601000040)
Peer's Negotiated Options
Vi6 CCP:    MS-PPC supported bits 0x01000040 (0x120601000040)
  IP: Local 212.159.119.145, remote 10.0.90.228
  Counts: 41 packets input, 3260 bytes, 0 no buffer
          0 input errors, 0 CRC, 0 frame, 0 overrun
          12 packets output, 180 bytes, 0 underruns
          0 output errors, 0 collisions, 0 interface resets

wallyhall · ‎06-03-2016

And here's a tcpdump of the RADIUS conversation (it's FreeRADIUS with an ldap backend):

21:31:41.645834 IP (tos 0x0, ttl 254, id 61079, offset 0, flags [none], proto UDP (17), length 182)
    10.0.30.1.datametrics > sirius.ad.plfc.org.uk.radius: [udp sum ok] RADIUS, length: 154
 Access Request (1), id: 0x54, Authenticator: 8f1b0b4e3054e4e30000000000000000
   Framed Protocol Attribute (7), length: 6, Value: PPP
     0x0000:  0000 0001
   Username Attribute (1), length: 13, Value: **********
     0x0000:  6d61 7474 6865 7768 616c 6c
   Vendor Specific Attribute (26), length: 16, Value: Vendor: Microsoft (311)
     Vendor Attribute: 11, Length: 8, Value: ...N0T..
     0x0000:  0000 0137 0b0a 8f1b 0b4e 3054 e4e3
   Vendor Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
     Vendor Attribute: 1, Length: 50, Value: ..........................T..u....z.....u?=# .&.?.
     0x0000:  0000 0137 0134 0101 0000 0000 0000 0000
     0x0010:  0000 0000 0000 0000 0000 0000 0000 0000
     0x0020:  5405 d575 8c87 edbe 7adc 9b14 b2e6 753f
     0x0030:  3d23 20fc 26f6 8094
   NAS Port Type Attribute (61), length: 6, Value: Virtual
     0x0000:  0000 0005
   NAS Port Attribute (5), length: 6, Value: 286
     0x0000:  0000 011e
   NAS Port ID Attribute (87), length: 17, Value: Uniq-Sess-ID286
     0x0000:  556e 6971 2d53 6573 732d 4944 3238 36
   Service Type Attribute (6), length: 6, Value: Framed
     0x0000:  0000 0002
   NAS IP Address Attribute (4), length: 6, Value: 10.0.30.1
     0x0000:  0a00 1e01
21:31:41.793107 IP (tos 0x0, ttl 64, id 41574, offset 0, flags [none], proto UDP (17), length 124)
    sirius.ad.plfc.org.uk.radius > 10.0.30.1.datametrics: [bad udp cksum 0x5a85 -> 0xe26b!] RADIUS, length: 96
 Access Accept (2), id: 0x54, Authenticator: dff324dc434fb85e03fd402ed4645530
   Framed Protocol Attribute (7), length: 6, Value: PPP
     0x0000:  0000 0001
   Framed Compression Attribute (13), length: 6, Value: VJ TCP/IP
     0x0000:  0000 0001
   Vendor Specific Attribute (26), length: 40, Value: Vendor: Microsoft (311)
     Vendor Attribute: 12, Length: 32, Value: W...-..wu...i....H;. .R"....M.R"
     0x0000:  0000 0137 0c22 57f8 f2af 2dfa 0177 7585
     0x0010:  e6ff 69a8 0a03 cf48 3ba0 20e1 5222 b79e
     0x0020:  a31d 4df5 5222
   Vendor Specific Attribute (26), length: 12, Value: Vendor: Microsoft (311)
     Vendor Attribute: 7, Length: 4, Value: ....
     0x0000:  0000 0137 0706 0000 0001
   Vendor Specific Attribute (26), length: 12, Value: Vendor: Microsoft (311)
     Vendor Attribute: 8, Length: 4, Value: ....
     0x0000:  0000 0137 0806 0000 0006