Approximately following this example (am hoping this is sufficient without me pasting everything in here):
http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/14122-24.html
I have been attempting to configure a IOS Router (which has a dynamic IP address) to be a client on an L2TP/IPSec VPN. When I follow the above example, everything works fine. Problem is when the WAN address of the LNS changes, it's all over.
Dynamic IP L2TP/IPSec clients (Android/Windows) work just fine on my setup, but quite exactly how this is done on an IOS Router I cannot figure out for the life of me.
The deal breaker seems to be this line of configuration - which is used on the crypto map match statement:
access-list 101 permit udp host 20.1.1.2 eq 1701 host 20.1.1.1 eq 1701
Because the LNS's IP would no longer be 20.1.1.2, that statement becomes useless. I attempted to change it to:
access-list 101 permit udp any host 20.1.1.1 eq 1701
But that results in the IPSec failing to negotiate - specifically this message is seen on the LAC:
IPSEC(process_kmi_proxy): rejected peer's request of supporting wildcard remote proxy (addr/mask=0.0.0.0/0.0.0.0) while we have acl-less dynamic map
Which is fair enough I suppose. Question is, how do I get around this problem without removing L2TP from the picture?
