Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About dannymcca
08-18-2017
dannymcca
Member since
04-25-2013
Beginner
06-13-2013
01:26 AM
Hi, Is it possible to pass 802.3 packets over a L2TP? If so, how would the tunnel differ from a normal L2TP? Thanks,
... View more
Labels:
05-16-2013
06:30 AM
Hi, I am using 2 887va routers and it is ios 15.1. The xconnect is not available on the vlan interface. the F0 port does give the option for xconnect i.e. it auto completes and prompts for the ip address. Thanks, Danny
... View more
05-16-2013
05:05 AM
Hi Giuseppe, The tunnel is now up and running with the xconnect applied to the F0 interface. Unfortunately the traffic is still not passing out of the interface. As the router has layer 2 fastethernet interfaces do these need to be configured to pass the packets out to the network/web ranger? Thanks again for your help.
... View more
05-16-2013
03:07 AM
Hi Giuseppe, I have moved the pseudowire line, but this cannot be added to the vlan so I have added to F0 - these are layer 2. I have also had to use xconnect rather than pseudowire. Unforunately the tunnel is now shut down and will not come up. the ip address that is used with the xconnect command, is this the outside static ip address or the internal ip address? Thanks again, Danny
... View more
05-16-2013
01:34 AM
Hi, Thanks for your help. Could htis be causing my problem with not seeing the frames on the web ranger router i.e. they are not exiting the F0 port? how can I change my config to bridge ethernet frames. Your help with this is greatly appreciated as this is turning into a bigger job than I expected or wanted. Danny
... View more
05-16-2013
12:13 AM
Hi,. the xconnect is done within the pseudowire on the virtual-ppp by pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 this seems to work - other than the errors. my config is: Router1 Building configuration... Current configuration : 4044 bytes ! ! Last configuration change at 14:50:54 UTC Wed May 15 2013 ! NVRAM config last updated at 14:39:00 UTC Wed May 15 2013 ! NVRAM config last updated at 14:39:00 UTC Wed May 15 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname xxxx ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 crypto pki token default removal timeout 0 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 authentication digest secret 0 xxxx hash SHA1 hello 10 ! l2tp-class l ! vpdn enable ! vpdn-group vpdngroup1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname peer1 ! license udi pid CISCO887VA-K9 sn FCZ1706908Q ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 protocol l2tpv3 l2tpclass2 ip local interface Dialer0 ! crypto isakmp policy 1 authentication pre-share group 2 crypto isakmp key KEY address 78.105.250.120 crypto isakmp keepalive 30 5 ! crypto ipsec transform-set SET esp-des ! crypto map cmap 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set SET match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip nat outside ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 switchport access vlan 2 no ip address ! interface FastEthernet1 switchport access vlan 2 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Virtual-Template1 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname peer2 ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname xxxx ppp chap password 0 xxx pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! interface Vlan1 no ip address ip nat inside ip virtual-reassembly in shutdown ! interface Vlan2 no ip address ! interface Vlan200 no ip address ! interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxxx ppp chap password 0 xxxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map cmap ! interface Dialer1 no ip address ! interface Dialer9 no ip address shutdown ! interface BVI1 no ip address no ip unreachables ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Virtual-PPP2 ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0 ip route 192.6.3.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.6.3.0 0.0.0.255 192.6.4.0 0.0.0.255 access-list 100 permit ip 192.6.3.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any dialer-list 1 protocol ip permit mac-address-table static 0020.d239.9cde interface FastEthernet0 vlan 2 mac-address-table static 00eb.9000.0000 interface FastEthernet0 vlan 2 mac-address-table static e0cb.4e1f.34cf interface FastEthernet0 vlan 2 ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end Router 2 Building configuration... Current configuration : 3692 bytes ! ! Last configuration change at 14:36:00 UTC Wed May 15 2013 ! NVRAM config last updated at 14:18:20 UTC Wed May 15 2013 ! NVRAM config last updated at 14:18:20 UTC Wed May 15 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname xxxx ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 crypto pki token default removal timeout 0 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 authentication hello 10 ! vpdn enable ! vpdn-group vpdngroup1 request-dialin protocol l2tp initiate-to ip xxx.xxx.xxx.xxx ! license udi pid CISCO887VA-K9 sn FCZ170690A2 ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 protocol l2tpv3 l2tpclass2 ip local interface Dialer0 ! ! ! crypto isakmp policy 1 authentication pre-share group 2 crypto isakmp key KEY address xxx.xxx.xxx.xxx crypto isakmp keepalive 30 5 ! ! crypto ipsec transform-set SET esp-des ! crypto map xxxx 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set SET match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 switchport access vlan 2 no ip address no keepalive ! interface FastEthernet1 switchport access vlan 200 switchport mode trunk no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname XXXX ppp chap password 0 xxx pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! interface Vlan1 no ip address ip nat inside ip virtual-reassembly in shutdown ! interface Vlan2 ip address 192.6.3.10 255.255.255.0 ! interface Vlan200 no ip address ! interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxxx ppp chap password 0 xxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map xxxx ! interface BVI1 no ip address no ip unreachables ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Virtual-PPP2 ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0 ip route 192.6.4.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.6.4.0 0.0.0.255 192.6.3.0 0.0.0.255 access-list 100 permit ip 192.6.4.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any dialer-list 1 protocol ip permit mac-address-table aging-time 16 ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end
... View more
05-15-2013
05:14 AM
Hi Giuseppe, Thanks for your reply. My tunnel is now passing data, my problem was that the routers were configured the wrong way round ie server was client and vice versa. My problem is now that the data, although it is going accross the tunnel it is not passing out of the fast ethernet port. to the Web Ranger (which is a router using layer 2). The fast ethernet port i am using is F0 via vlan2. Please can you help. Thanks, Danny I have run debug on the tunnel and below is a portion of the output. Are the errors stopping the trafic exiting the F0 interface? Please can you advise how to resolve these errors. Thanks. May 15 14:59:18.154: L2TP tnl 08657:08558753: I SCCRP from ROUTER May 15 14:59:18.154: L2TP tnl 08657:08558753: Auth Nonce AVP Ignored, 451 May 15 14:59:18.154: L2TP tnl 08657:08558753: Auth glob Challenge AVP Generate response fail, 330 May 15 14:59:18.154: L2TP tnl 08657:08558753: ERROR: Auth cc Overall Failed, 1 May 15 14:59:18.154: L2TP tnl 08657:08558753: ERROR: Auth glob Overall Failed, 449 May 15 14:59:18.154: L2TP 00012:08657:0826942C: May 15 14:59:18.154: L2TP tnl 08657:08558753: O StopCCN to wtn-40acre tnl 1233748470 May 15 14:59:18.154: L2TP tnl 08657:08558753: IETF v2: May 15 14:59:18.154: L2TP tnl 08657:08558753: Result Code May 15 14:59:18.154: L2TP tnl 08657:08558753: Requester is not authorized to establish a control channel(4) May 15 14:59:18.154: L2TP tnl 08657:08558753: Error code May 15 14:59:18.154: L2TP tnl 08657:08558753: No error(0) May 15 14:59:18.154: L2TP tnl 08657:08558753: Optional msg May 15 14:59:18.154: L2TP tnl 08657:08558753: "process challenge failed " May 15 14:59:18.158: L2TP tnl 08657:08558753: Cisco v3: May 15 14:59:18.158: L2TP tnl 08657:08558753: Assigned Control 0x08558753 (139822931) May 15 14:59:18.158: L2TP tnl 08657:08558753: IETF v3: May 15 14:59:18.158: L2TP tnl 08657:08558753: Assigned Control 0x08558753 (139822931) May 15 14:59:18.158: L2TP tnl 08657:08558753: May 15 14:59:18.158: L2TP tnl 08657:08558753: O StopCCN, flg TLS, ver 3, len 75 May 15 14:59:18.158: L2TP tnl 08657:08558753: tnl 1233748470, ns 1, nr 1 May 15 14:59:18.158: contiguous pak, size 79 00 00 00 00 C8 03 00 4B 49 89 81 F6 00 01 00 01 80 08 00 00 00 00 00 04 80 23 00 00 00 01 00 04 00 00 70 72 6F 63 65 73 73 20 63 68 61 6C 6C 65 6E 67 65 20 40acre-wtn66 61 69 6C 65 64 20 00 0A 00 00 00 3D 08 55 87 53 80 0A 00 09 00 01 08 55 87 53 May 15 14:59:18.218: L2TP tnl 08657:08558753: CiscoACK: Perform early message digest validation May 15 14:59:18.218: L2TP tnl 08657:08558753: L2TP: Parse Cisco AVP 12, len 27, flag 0x0 May 15 14:59:18.218: L2TP tnl 08657:08558753: Auth Nonce AVP Ignored, 452 May 15 14:59:18.218: L2TP tnl 08657:08558753: ERROR: No authen methods passed May 15 14:59:18.218: L2TP tnl 08657:08558753: ERROR: Auth cc Overall Failed, 2 May 15 14:59:18.218: L2TP tnl 08657:08558753: ERROR: Auth glob Overall Failed, 450 May 15 14:59:18.218: L2TP tnl 08657:08558753: ERROR: Can't authenticate message May 15 14:59:18.218: L2TP tnl 08657:08558753: L2TP: Parse Cisco AVP 12, len 27, flag 0x0 May 15 14:59:18.218: L2TP tnl 08657:08558753: No missing AVPs in CiscoACK May 15 14:59:18.218: L2TP tnl 08657:08558753: CiscoACK: dropping packet May 15 14:59:18.218: contiguous pak, size 47
... View more
05-14-2013
01:11 PM
Hi, I have made the changes, however, my traffic still will not go down the tunnel. Is there any debug statements that will show me layer 2/ethernet traffic entering the router and if it is being filtered? I think the tunnel is working but my traffic is not getting that far. Please can you advise whether there is a debug statement that shows layer 2 traffic within the router not the tunnel. Below is the output from she show L2TP command - I am correct in assuming that this is working aren't I? Thanks, Danny The debug L2TP gives the following output: L2TP Tunnel and Session Information Total tunnels 1 sessions 1 LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ Count VPDN Group 2429948526 1313898432 routername est xxx.xxx.xxx.xxx 1 l2tp_default_cl LocID RemID TunID Username, Intf/ State Last Chg Uniq ID Vcid, Circuit 2707157308 3583248854 2429948526 10, Vp2 est 06:41:26 1
... View more
05-14-2013
08:04 AM
Hi, I have set up my network to pass ethernet (layer 2) traffic accross an adsl connection to another 887va router. this link is set up as a L2TP. I have a PC at one end of the tunnel and a web ranger that operates at layer 2 level. I can see the layer 2 traffic entering the router from the PC however it does not seem to go over the L2 tunnel to the other router. Please can someone help? (Config files are attached) I also need to know what debug codes I can enter to see if the data is being filtered and if so why? the debug L2TP gives the following output: L2TP Tunnel and Session Information Total tunnels 1 sessions 1 LocTunID RemTunID Remote Name State Remote Address Sessn L2TP Class/ Count VPDN Group 2429948526 1313898432 routername est xxx.xxx.xxx.xxx 1 l2tp_default_cl LocID RemID TunID Username, Intf/ State Last Chg Uniq ID Vcid, Circuit 2707157308 3583248854 2429948526 10, Vp2 est 06:41:26 1 Many thanks, Danny
... View more
Labels:
05-13-2013
07:41 AM
Hi, I have setup my L2TPv3 and this is communicating (I think) as I am getting the "Hello", however, I cannot send any layer 2 traffic. Is the "Hello" sent as layer 2? how can I debug as I believe the traffic is entering the router through the F0 port and is then being dropped. I currently am using debug l2tp all but I am not convinced this is correct. My config is below, please can you take a look and possibly advise what I am doing wrong. Do I need to set up a mac address table or mac route somehow. Thanks for your help. Danny Router 1 Building configuration... Current configuration : 3629 bytes ! ! Last configuration change at 13:03:49 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:07 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:07 UTC Thu May 2 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname XXXX ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 ! license udi pid CISCO887VA-K9 sn FCZ170690A2 ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 sequencing both ip local interface Dialer0 ip pmtu ip ttl 100 ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key XXXX address xxx.xxx.xxx.xxx crypto isakmp keepalive 30 5 ! ! crypto ipsec transform-set XXXX esp-3des esp-md5-hmac ! crypto map cMap 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set XXXX match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! interface FastEthernet0 switchport access vlan 2 no ip address ! ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname peer2 pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! ! interface Vlan2 no ip address bridge-group 1 bridge-group 1 input-address-list 700 bridge-group 1 output-address-list 700 ! interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxxxx ppp chap password 0 xxxxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map cMap ! interface BVI1 ip address 192.168.2.1 255.255.255.0 ip access-group 101 in no ip unreachables ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0 ip route 192.168.2.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 access-list 100 permit ip 192.168.2.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any access-list 111 deny tcp any any eq telnet access-list 111 permit ip any any access-list 700 permit 0000.0000.0000 ffff.ffff.ffff dialer-list 1 protocol ip permit ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end Router 2 Building configuration... Current configuration : 3973 bytes ! ! Last configuration change at 13:03:15 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname XXX ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 crypto pki token default removal timeout 0 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 authentication password xxx ! l2tp-class l ! vpdn enable ! vpdn-group vpdngroup1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname peer1 ! license udi pid CISCO887VA-K9 sn FCZ1706908Q ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 sequencing both ip local interface Dialer0 ip pmtu ip tos reflect ip ttl 100 ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key XXXX address xxx.xxx.xxx.xxx crypto isakmp keepalive 30 5 ! crypto ipsec transform-set XXXX esp-3des esp-md5-hmac ! crypto map cMap 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set XXXX match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip nat outside ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! interface FastEthernet0 switchport access vlan 2 no ip address ! ! interface Virtual-Template1 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname peer2 ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname peer2 pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! ! interface Vlan2 no ip address bridge-group 1 bridge-group 1 input-address-list 700 bridge-group 1 output-address-list 700 ! interface Dialer0 ip address XXX.XXX.XXX.XXX 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxxxx ppp chap password 0 xxxxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map cMap ! interface BVI1 ip address 192.168.1.1 255.255.255.0 ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0 ip route 192.168.1.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 100 permit ip 192.168.1.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any access-list 111 deny tcp any any eq telnet access-list 111 permit ip any any access-list 700 permit 0000.0000.0000 ffff.ffff.ffff dialer-list 1 protocol ip permit ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end
... View more
05-13-2013
12:04 AM
Hi, I have a Web Ranger which only ouputs the data in layer 2 format. Thanks..
... View more
05-08-2013
08:09 AM
Hi, I am in dire need of asssistance. I have set up a L2TP between 2 887va routers to pass layer 2 traffic from a remote site. My problem is that the traffic from my layer 2 device is entering the router through the Fastethernet 0 but doesn't go anywhere. I am getting the "Hello" over the L2TP so the tunnel is up and working. When I attach a laptop to the layer 2 device end I can ping between that and the host at the other end, however, no layer 2 traffic is being passed over the tunnel. I am using wireshark on the host at the far end and this sees no layer 2 traffic not even the "Hello" so I checked the ACL's but can find no reason why thes traffic shouldn't pass through. Please can someone help. I have inluded the config files from both routers. Thanks. Router 1 Building configuration... Current configuration : 3973 bytes ! ! Last configuration change at 13:03:15 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname XXX ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 crypto pki token default removal timeout 0 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 authentication password xxx ! l2tp-class l ! vpdn enable ! vpdn-group vpdngroup1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname peer1 ! license udi pid CISCO887VA-K9 sn FCZ1706908Q ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 sequencing both ip local interface Dialer0 ip pmtu ip tos reflect ip ttl 100 ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key XXXX address xxx.xxx.xxx.xxx crypto isakmp keepalive 30 5 ! crypto ipsec transform-set XXXX esp-3des esp-md5-hmac ! crypto map cMap 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set XXXX match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip nat outside ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! interface FastEthernet0 switchport access vlan 2 no ip address ! ! interface Virtual-Template1 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname peer2 ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname peer2 pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! ! interface Vlan2 no ip address bridge-group 1 bridge-group 1 input-address-list 700 bridge-group 1 output-address-list 700 ! interface Dialer0 ip address XXX.XXX.XXX.XXX 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxxxx ppp chap password 0 xxxxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map cMap ! interface BVI1 ip address 192.168.1.1 255.255.255.0 ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0 ip route 192.168.1.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 100 permit ip 192.168.1.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any access-list 111 deny tcp any any eq telnet access-list 111 permit ip any any access-list 700 permit 0000.0000.0000 ffff.ffff.ffff dialer-list 1 protocol ip permit ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end Router 1 Building configuration... Current configuration : 3629 bytes ! ! Last configuration change at 13:03:49 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:07 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:07 UTC Thu May 2 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname XXXX ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 ! license udi pid CISCO887VA-K9 sn FCZ170690A2 ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 sequencing both ip local interface Dialer0 ip pmtu ip ttl 100 ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key XXXX address xxx.xxx.xxx.xxx crypto isakmp keepalive 30 5 ! ! crypto ipsec transform-set XXXX esp-3des esp-md5-hmac ! crypto map cMap 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set XXXX match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! interface FastEthernet0 switchport access vlan 2 no ip address ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname peer2 pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! interface Vlan2 no ip address bridge-group 1 bridge-group 1 input-address-list 700 bridge-group 1 output-address-list 700 ! interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxxxx ppp chap password 0 xxxxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map cMap ! interface BVI1 ip address 192.168.2.1 255.255.255.0 ip access-group 101 in no ip unreachables ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer0 ip route 192.168.2.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255 access-list 100 permit ip 192.168.2.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any access-list 111 deny tcp any any eq telnet access-list 111 permit ip any any access-list 700 permit 0000.0000.0000 ffff.ffff.ffff dialer-list 1 protocol ip permit ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end
... View more
Labels:
05-07-2013
01:56 AM
Hi, i have set up a layer 2 tunnel on my 887va router and the traffic transmits accross this to my second 887va. unfortunately, I do not seem able to get the layer 2 traffic from my host PC and down the tunnel. I believe the problem to be the router settings for the fastethernet aqnd forwarding this data out of the dialer port. I am now desperate to resolve this as all of my attempts have failed, I believe this is something very simple I am missing. PLEASE HELP. Here is my config: Building configuration... Current configuration : 3973 bytes ! ! Last configuration change at 13:03:15 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname XXX ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 crypto pki token default removal timeout 0 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 authentication password xxx ! l2tp-class l ! vpdn enable ! vpdn-group vpdngroup1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname xxxxx ! license udi pid CISCO887VA-K9 sn FCZ1706908Q ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 sequencing both ip local interface Dialer0 ip pmtu ip tos reflect ip ttl 100 ! ! ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key xxxx address xxx.xxx.xxx.xxx crypto isakmp keepalive 30 5 ! ! crypto ipsec transform-set XXX esp-3des esp-md5-hmac ! crypto map Cmap 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set XXX match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip nat outside ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 switchport access vlan 2 no ip address ! interface FastEthernet1 switchport access vlan 200 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Virtual-Template1 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname xxxxx ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname xxxxx pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! interface Vlan1 no ip address ip nat inside ip virtual-reassembly in shutdown ! interface Vlan2 no ip address bridge-group 1 bridge-group 1 input-address-list 700 bridge-group 1 output-address-list 700 ! interface Vlan200 no ip address ! interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxx ppp chap password 0 xxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map Cmap ! interface Dialer1 no ip address ! interface Dialer9 no ip address shutdown ! interface BVI1 ip address 192.168.1.1 255.255.255.0 ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ip route 78.105.250.120 255.255.255.255 Dialer0 ip route 192.168.1.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 100 permit ip 192.168.1.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any access-list 111 deny tcp any any eq telnet access-list 111 permit ip any any access-list 700 permit 0000.0000.0000 ffff.ffff.ffff dialer-list 1 protocol ip permit ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end
... View more
Labels:
05-03-2013
01:55 AM
hi, PLEASE HELP, I am getting desperate to resolve this. Thanks I have 2 887va routers which are both connected to an ADSL line and I have set them up to pass layer 2 traffic via L2TP. I am injecting layer 2 traffic into one of the routers using Colasoft and the PC at the other end os monitoring the traffic with wireshark. My problem is nothing is coming accross the tunnel, in fact I believe thast the traffic is not even getting to the tunnel as the ports are not set up crrectly. I have configured the F1 with # Switchport Access Vlan 200 # no shutdoen I then connect the ethernet cable to port F1 from the PC and with Debug enabled for L2TP All only the hello traffic is shown. Please can someone help as I think I am missing something simple. Thanks. Building configuration... Current configuration : 3973 bytes ! ! Last configuration change at 13:03:15 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 ! NVRAM config last updated at 13:04:17 UTC Thu May 2 2013 version 15.1 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname XXX ! boot-start-marker boot-end-marker ! enable secret 4 pozkvcqXiM/f4AVrqz8PjSI9KxXYqhSXdmI.1yi0uD2 ! no aaa new-model memory-size iomem 10 crypto pki token default removal timeout 0 ! ip source-route ! ip cef no ipv6 cef l2tp-class l2tpclass2 authentication password xxx ! l2tp-class l ! vpdn enable ! vpdn-group vpdngroup1 accept-dialin protocol l2tp virtual-template 1 terminate-from hostname xxxxx ! license udi pid CISCO887VA-K9 sn FCZ1706908Q ! controller VDSL 0 ! pseudowire-class pwclass2 encapsulation l2tpv3 sequencing both ip local interface Dialer0 ip pmtu ip tos reflect ip ttl 100 ! ! ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key xxxx address xxx.xxx.xxx.xxx crypto isakmp keepalive 30 5 ! ! crypto ipsec transform-set XXX esp-3des esp-md5-hmac ! crypto map Cmap 10 ipsec-isakmp set peer xxx.xxx.xxx.xxx set transform-set XXX match address 101 ! bridge irb ! interface Loopback1 no ip address ! interface Ethernet0 no ip address shutdown no fair-queue ! interface ATM0 no ip address ip nat outside ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 ! ! interface FastEthernet0 switchport access vlan 2 no ip address ! interface FastEthernet1 switchport access vlan 200 no ip address ! interface FastEthernet2 no ip address ! interface FastEthernet3 no ip address ! interface Virtual-Template1 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname xxxxx ! interface Virtual-PPP2 ip unnumbered Loopback1 ppp authentication chap ppp chap hostname xxxxx pseudowire xxx.xxx.xxx.xxx 10 pw-class pwclass2 ! interface Vlan1 no ip address ip nat inside ip virtual-reassembly in shutdown ! interface Vlan2 no ip address bridge-group 1 bridge-group 1 input-address-list 700 bridge-group 1 output-address-list 700 ! interface Vlan200 no ip address ! interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname xxxx ppp chap password 0 xxxx ppp ipcp route default ppp ipcp address accept no cdp enable crypto map Cmap ! interface Dialer1 no ip address ! interface Dialer9 no ip address shutdown ! interface BVI1 ip address 192.168.1.1 255.255.255.0 ! ip forward-protocol nd no ip http server no ip http secure-server ! ip nat inside source list 100 interface Dialer0 overload ip route 0.0.0.0 0.0.0.0 Dialer0 ip route 78.105.250.120 255.255.255.255 Dialer0 ip route 192.168.1.0 255.255.255.0 Virtual-PPP2 ! access-list 50 deny any log access-list 100 deny ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 100 permit ip 192.168.1.0 0.0.0.255 any access-list 101 permit ip 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit tcp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit udp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 permit icmp 192.0.0.0 0.255.255.255 192.0.0.0 0.255.255.255 access-list 101 deny ip any any access-list 101 deny tcp any any access-list 101 deny udp any any access-list 101 deny icmp any any access-list 111 deny tcp any any eq telnet access-list 111 permit ip any any access-list 700 permit 0000.0000.0000 ffff.ffff.ffff dialer-list 1 protocol ip permit ! bridge 1 protocol ieee bridge 1 route ip ! line con 0 line aux 0 line vty 0 4 access-class 50 in exec-timeout 0 0 no login transport input none transport output none ! end
... View more
Labels:
05-02-2013
05:17 AM
if your isp gives PPPoA then you dont use the ethernet interface but ATM and Dialer. ATM needs to be: interface ATM0 no ip address ip nat outside ip virtual-reassembly in no atm ilmi-keepalive pvc 0/38 encapsulation aal5mux ppp dialer dialer pool-member 1 PVC you will need to get from your ISP. The Dialer needs to be: interface Dialer0 ip address xxx.xxx.xxx.xxx 255.255.255.0 no ip redirects no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly in encapsulation ppp dialer pool 1 ppp authentication chap callin ppp chap hostname XXX ppp chap password 0 XXX ppp ipcp route default ppp ipcp address accept no cdp enable crypto map xxx The IP Address is your static IP and chap hostame is the ISP username and Password is the passeord for the internet. You will also need to find out what the MTU value is from your ISP. Sorry but haven't configured a PPPoE connection so cannot help with that. Hope this helps.
... View more
06-13-2013 01:26 AM
Hi, Is it possible to pass 802.3 packets over a L2TP?If so, how would
the tunnel differ from a norma...
05-16-2013 06:30 AM
Hi,I am using 2 887va routers and it is ios 15.1. The xconnect is not
available on the vlan interfac...
05-16-2013 05:05 AM
Hi Giuseppe,The tunnel is now up and running with the xconnect applied
to the F0 interface. Unfortun...
05-16-2013 03:07 AM
Hi Giuseppe,I have moved the pseudowire line, but this cannot be added
to the vlan so I have added t...
05-16-2013 01:34 AM
Hi,Thanks for your help. Could htis be causing my problem with not
seeing the frames on the web rang...
05-16-2013 12:13 AM
Hi,.the xconnect is done within the pseudowire on the virtual-ppp by
pseudowire xxx.xxx.xxx.xxx 10 p...
05-15-2013 05:14 AM
Hi Giuseppe,Thanks for your reply. My tunnel is now passing data, my
problem was that the routers we...
05-14-2013 01:11 PM
Hi,I have made the changes, however, my traffic still will not go down
the tunnel. Is there any debu...
05-14-2013 08:04 AM
Hi,I have set up my network to pass ethernet (layer 2) traffic accross
an adsl connection to another...
05-13-2013 07:41 AM
Hi,I have setup my L2TPv3 and this is communicating (I think) as I am
getting the "Hello", however, ...
05-07-2013 01:56 AM
Hi,i have set up a layer 2 tunnel on my 887va router and the traffic
transmits accross this to my se...
05-03-2013 01:55 AM
hi,PLEASE HELP, I am getting desperate to resolve this. ThanksI have 2
887va routers which are both ...
Public Statistics
| Date Registered | 04-25-2013 08:30 AM |
| Date Last Visited | 08-18-2017 04:01 AM |
| Total Messages Posted | 22 |
