Hi,      I have been struggling to find a solution as to why my L2TP tunnel comes up, but, no ip through IPCP is working.  I have a few third party VPN providers that I can connect to with no problem.  My config is solid as far as the Virtual-PPP interface is concerned.  So, as far as the AAA is concerned, here are a few commands that I have used: aaa new-model aaa authentication login local_auth local aaa authentication ppp default none   So, here is the revelant debugs: 008940: *Jan  7 15:08:05.543 MDT: Vp1 LCP: Timeout: State Listen 008941: *Jan  7 15:08:05.543 MDT: AAA/AUTHOR (00000007): Method list id=0 not configured. Skip author 008942: *Jan  7 15:08:05.543 MDT: Vp1 PPP: Authorization NOT required 008943: *Jan  7 15:08:05.543 MDT: Vp1 PPP: No remote authentication for call-out 008944: *Jan  7 15:08:05.543 MDT: Vp1 AAA/AUTHOR/LCP: Authorization succeeds trivially 008945: *Jan  7 15:08:05.543 MDT: Vp1 LCP: O CONFREQ [Listen] id 142 len 10 008946: *Jan  7 15:08:05.543 MDT: Vp1 LCP:    MagicNumber 0x1A220FED (0x05061A220FED) Cisco3825# 008947: *Jan  7 15:08:07.559 MDT: Vp1 LCP: Timeout: State REQsent 008948: *Jan  7 15:08:07.559 MDT: Vp1 LCP: O CONFREQ [REQsent] id 143 len 10 008949: *Jan  7 15:08:07.559 MDT: Vp1 LCP:    MagicNumber 0x1A220FED (0x05061A220FED) Cisco3825# 008950: *Jan  7 15:08:09.575 MDT: Vp1 LCP: Timeout: State REQsent 008951: *Jan  7 15:08:09.575 MDT: Vp1 LCP: O CONFREQ [REQsent] id 144 len 10 008952: *Jan  7 15:08:09.575 MDT: Vp1 LCP:    MagicNumber 0x1A220FED (0x05061A220FED) Cisco3825# 008953: *Jan  7 15:08:11.591 MDT: Vp1 LCP: Timeout: State REQsent 008954: *Jan  7 15:08:11.591 MDT: Vp1 LCP: O CONFREQ [REQsent] id 145 len 10 008955: *Jan  7 15:08:11.591 MDT: Vp1 LCP:    MagicNumber 0x1A220FED (0x05061A220FED) Cisco3825# 008956: *Jan  7 15:08:13.607 MDT: Vp1 LCP: Timeout: State REQsent 008957: *Jan  7 15:08:13.607 MDT: Vp1 LCP: O CONFREQ [REQsent] id 146 len 10 008958: *Jan  7 15:08:13.607 MDT: Vp1 LCP:    MagicNumber 0x1A220FED (0x05061A220FED) 008959: *Jan  7 15:08:13.691 MDT: Vp1 LCP: I CONFREQ [REQsent] id 0 len 8 008960: *Jan  7 15:08:13.691 MDT: Vp1 LCP:    AuthProto PAP (0x0304C023) 008961: *Jan  7 15:08:13.691 MDT: Vp1 LCP: O CONFACK [REQsent] id 0 len 8 008962: *Jan  7 15:08:13.691 MDT: Vp1 LCP:    AuthProto PAP (0x0304C023) 008963: *Jan  7 15:08:13.691 MDT: Vp1 LCP: State is Open 008964: *Jan  7 15:08:13.691 MDT: Vp1 PPP: Phase is AUTHENTICATING, by the peer Cisco3825# 008965: *Jan  7 15:08:13.691 MDT: AAA/AUTHEN/PPP (00000007): Pick method list 'default' 008966: *Jan  7 15:08:13.691 MDT: Vp1 LCP: I CONFREJ [Open] id 146 len 10 008967: *Jan  7 15:08:13.691 MDT: Vp1 LCP:    MagicNumber 0x1A220FED (0x05061A220FED) 008968: *Jan  7 15:08:13.691 MDT: Vp1 LCP: O CONFREQ [ACKsent] id 147 len 4 008969: *Jan  7 15:08:13.775 MDT: Vp1 LCP: I CONFACK [ACKsent] id 147 len 4 008970: *Jan  7 15:08:13.775 MDT: Vp1 LCP: State is Open 008971: *Jan  7 15:08:13.775 MDT: AAA/AUTHEN/PPP (00000007): Pick method list 'default' Cisco3825# 008972: *Jan  7 15:08:23.783 MDT: Vp1 AUTH: Timeout 1 Cisco3825# 008973: *Jan  7 15:08:33.799 MDT: Vp1 AUTH: Timeout 2 Cisco3825# 008974: *Jan  7 15:08:43.815 MDT: Vp1 AUTH: Timeout 3 Cisco3825# 008975: *Jan  7 15:08:53.831 MDT: Vp1 AUTH: Timeout 4 Cisco3825# 008976: *Jan  7 15:09:03.847 MDT: Vp1 AUTH: Timeout 5 Cisco3825# 008977: *Jan  7 15:09:07.356 MDT: Vp1 PPP: Outbound ip packet dropped Cisco3825# 008978: *Jan  7 15:09:13.864 MDT: Vp1 AUTH: Timeout 6 Cisco3825# 008979: *Jan  7 15:09:17.356 MDT: Vp1 PPP: Outbound ip packet dropped Cisco3825# 008980: *Jan  7 15:09:23.880 MDT: Vp1 AUTH: Timeout 7 Cisco3825# 008981: *Jan  7 15:09:27.356 MDT: Vp1 PPP: Outbound ip packet dropped Cisco3825# 008982: *Jan  7 15:09:33.896 MDT: Vp1 AUTH: Timeout 8 Cisco3825# 008983: *Jan  7 15:09:37.356 MDT: Vp1 PPP: Outbound ip packet dropped Cisco3825# 008984: *Jan  7 15:09:43.912 MDT: Vp1 AUTH: Timeout 9 Cisco3825# 008985: *Jan  7 15:09:47.356 MDT: Vp1 PPP: Outbound ip packet dropped Cisco3825# 008986: *Jan  7 15:09:53.928 MDT: Vp1 AUTH: Timeout 10 Cisco3825# 008987: *Jan  7 15:09:57.356 MDT: Vp1 PPP: Outbound ip packet dropped Cisco3825# 008988: *Jan  7 15:10:03.944 MDT: Vp1 AUTH: Timeout 11 008989: *Jan  7 15:10:03.944 MDT: Vp1 PPP: Sending Acct Event[Down] id[7] 008990: *Jan  7 15:10:03.944 MDT: AAA/ACCT/EVENT/(00000007): NET DOWN 008991: *Jan  7 15:10:03.944 MDT: AAA/ACCT/NET(00000007): Method list not found 008992: *Jan  7 15:10:03.944 MDT: AAA/ACCT(00000007): del node, session 4 008993: *Jan  7 15:10:03.944 MDT: AAA/ACCT/NET(00000007): free_rec, count 0 008994: *Jan  7 15:10:03.944 MDT: AAA/ACCT/NET(00000007) reccnt 0, csr FALSE, osr 0 008995: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Update Vp1 008996: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Vp1 [pre-sess] (rx/tx) base 2114/15028 pre 15468/32490 call 15468/32490 008997: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Vp1 [pre-sess] (rx/tx) adjusted, pre 13354/17462 call 0/0 008998: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Update Vp1 008999: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Vp1 [sess] (rx/tx) base 2114/15028 Cisco3825# pre 15468/32490 call 15468/32490 009000: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Vp1 [sess] (rx/tx) adjusted, pre 13354/17462 call 0/0 009001: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Deregister Vp1 009002: *Jan  7 15:10:03.944 MDT: Vp1 PPP: Phase is TERMINATING 009003: *Jan  7 15:10:03.944 MDT: Vp1 LCP: O TERMREQ [Open] id 148 len 4 009004: *Jan  7 15:10:03.944 MDT: AAA/ACCT/EVENT/(00000007): CALL STOP 009005: *Jan  7 15:10:03.944 MDT: AAA/ACCT(00000007) reccnt 0, osr 0 009006: *Jan  7 15:10:04.028 MDT: Vp1 LCP: I TERMACK [TERMsent] id 148 len 4 009007: *Jan  7 15:10:04.028 MDT: Vp1 LCP: State is Closed 009008: *Jan  7 15:10:04.028 MDT: Vp1 PPP: Phase is DOWN 009009: *Jan  7 15:10:04.028 MDT: Vp1 PPP: Phase is ESTABLISHING, Passive Open 009010: *Jan  7 15:10:04.028 MDT: Vp1 LCP: State is Listen Cisco3825# 009011: *Jan  7 15:10:06.024 MDT: Vp1 LCP: Timeout: State Listen 009012: *Jan  7 15:10:06.024 MDT: AAA/BIND(00000009): Bind i/f Virtual-PPP1 009013: *Jan  7 15:10:06.024 MDT: AAA/ACCT/HC(00000009): Register Vp1 100Mbit/s, poll every 5m 0s 009014: *Jan  7 15:10:06.024 MDT: AAA/ACCT/HC(00000009): Update Vp1 009015: *Jan  7 15:10:06.024 MDT: AAA/ACCT/HC(00000009): Vp1 [init-sess] (rx/tx) base 15474/32498 pre 15474/32498 call 15474/32498 009016: *Jan  7 15:10:06.024 MDT: AAA/ACCT/HC(00000009): Vp1 [init-sess] (rx/tx) adjusted, pre 0/0 call 0/0 009017: *Jan  7 15:10:06.024 MDT: AAA/ACCT/EVENT/(00000009): CALL START 009018: *Jan  7 15:10:06.024 MDT: Getting session id for NET(00000009) : db=6902396C 009019: *Jan  7 15:10:06.024 MDT: AAA/ACCT(00000000): add node, session 6 009020: *Jan  7 15:10:06.024 MDT: AAA/ACCT/NET(00000009): add, count 1 009021: *Jan  7 15:10:06.024 MDT: Getting session id for NONE(00000009) : db=6902396C 009022: *Jan  7 15:10:06.024 MDT: AAA/AUTHOR (0000 Cisco3825#0009): Method list id=0 not configured. Skip author 009023: *Jan  7 15:10:06.024 MDT: Vp1 PPP: Authorization NOT required 009024: *Jan  7 15:10:06.024 MDT: Vp1 PPP: No remote authentication for call-out 009025: *Jan  7 15:10:06.024 MDT: Vp1 AAA/AUTHOR/LCP: Authorization succeeds trivially 009026: *Jan  7 15:10:06.024 MDT: Vp1 LCP: O CONFREQ [Listen] id 149 len 10 009027: *Jan  7 15:10:06.024 MDT: Vp1 LCP:    MagicNumber 0x1A23E698 (0x05061A23E698) 009028: *Jan  7 15:10:06.108 MDT: Vp1 LCP: I CONFREJ [REQsent] id 149 len 10 009029: *Jan  7 15:10:06.108 MDT: Vp1 LCP:    MagicNumber 0x1A23E698 (0x05061A23E698) 009030: *Jan  7 15:10:06.108 MDT: Vp1 LCP: O CONFREQ [REQsent] id 150 len 4 009031: *Jan  7 15:10:06.192 MDT: Vp1 LCP: I CONFACK [REQsent] id 150 len 4 Cisco3825# 009032: *Jan  7 15:10:07.356 MDT: Vp1 PPP: Outbound ip packet dropped 009033: *Jan  7 15:10:08.104 MDT: Vp1 LCP: Timeout: State ACKrcvd 009034: *Jan  7 15:10:08.104 MDT: Vp1 LCP: O CONFREQ [ACKrcvd] id 151 len 4 009035: *Jan  7 15:10:08.188 MDT: Vp1 LCP: I CONFACK [REQsent] id 151 len 4 Cisco3825# 009036: *Jan  7 15:10:10.120 MDT: Vp1 LCP: Timeout: State ACKrcvd 009037: *Jan  7 15:10:10.120 MDT: Vp1 LCP: O CONFREQ [ACKrcvd] id 152 len 4 009038: *Jan  7 15:10:10.204 MDT: Vp1 LCP: I CONFACK [REQsent] id 152 len 4 Cisco3825#show 009039: *Jan  7 15:10:12.136 MDT: Vp1 LCP: Timeout: State ACKrcvd 009040: *Jan  7 15:10:12.136 MDT: Vp1 LCP: O CONFREQ [ACKrcvd] id 153 len 4 009041: *Jan  7 15:10:12.216 MDT: Vp1 LCP: I CONFACK [REQsent] id 153 len 4 Cisco3825#show l2tp 009042: *Jan  7 15:10:14.152 MDT: Vp1 LCP: Timeout: State ACKrcvd 009043: *Jan  7 15:10:14.152 MDT: Vp1 LCP: O CONFREQ [ACKrcvd] id 154 len 4 009044: *Jan  7 15:10:14.232 MDT: Vp1 LCP: I CONFACK [REQsent] id 154 len 4 Cisco3825#show l2tp L2TP Tunnel and Session Information Total tunnels 1 sessions 1 LocTunID   RemTunID   Remote Name   State  Remote Address  Sessn L2TP Class/                                                            Count VPDN Group 37822      1          xxxxxxxxxxxx est    xxx.xxx.xxx.xxx  1     l2tp_default_cl LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID                                  Vcid, Circuit 124        1          37822      1, Vp1               est    00:02:03 1 Here are a couple things I noticed:   009001: *Jan  7 15:10:03.944 MDT: AAA/ACCT/HC(00000007): Deregister Vp1 008990: *Jan  7 15:10:03.944 MDT: AAA/ACCT/EVENT/(00000007): NET DOWN   I don't have this issue with other providers.  I don't have the whole radius / tacacs things setup as it's not necessary for our needs.   Ideas?   Thanks for the help. Jason   ... View more

Hi,      As mentioned, I am running IOS 12.4(22)T C3825-ADVENTERPRISEK9-M.  Here is a simple vpdn-group setup that doesn't allow the "pool-member" command using "request-dialin"?   vpdn-group TEST request-dialin protocol l2tp pool-member 2 initiate-to ip xxx.xxx.xxx.xxx no l2tp tunnel authentication   This is the sample and a no go on using the "pool-member" with "request-dialin".  It must be an IOS change as this was posted and was working on another router.  However, I don't know the version they used... Ideas? Thanks for everyone's help. Jason ... View more

Hi,      Just a little confused here.....  I can do the exact commands in the EEM script directly and it does what I need it to do.  However, the script, when triggered, with the "EXACT" same commands sometimes works / sometimes not.  Arrrgghhh!  So, here is the script:   event manager applet Virtual-PPP1_Ping  event syslog pattern "TRACKING-5-STATE: 1 ip sla 1 reachability Up->Down"  action 010 cli command "enable"  action 011 cli command "clear vpdn tunnel l2tp all" pattern "[confirm]"  action 012 cli command "confirm"  action 020 cli command "conf t"  action 030 cli command "int Virtual-PPP1"  action 040 cli command "shut"  action 045 wait 3  action 050 cli command "no shut"  action 060 cli command "end" Basically what happens is that the Virtual-PPP1 interface sometimes loses it's ip address through IPCP.  So, the L2TP tunnel is still up, BUT, the Virtual-PPP1 interface loses it's assigned IP when I check the interface as it shows "unassigned". Ideas?   Thanks for the help.   Jason   ... View more

Hi,        I am struggling / looking for a solution to have 2 different subnets on different frequency bands.  For example:  Is there a way to assign a subnet to the 2.4 band and a different subnet to the 5.0 band?  Maybe someone can give me an example to follow.  Currently, both bands are on the same subnet.   Thanks for everyone's help.   Jason   ... View more

Hi,        I am struggling to find a solution to do the following:  Permanently block an ip after X amount of login failures?  I know it sounds simple, but, maybe someone can give me an example.  I don't want to block a range of ip's, just a specific one after X amount of login failures.  I wasn't sure if this is an EEM script that has to be created or something else?  Also, this can be a login that was tried after X amount of tries OR a login failure using different key words.  Basically, I am trying to keep out some of the crap coming from China and so on......   Thanks for everyone's help.   Cheers.   Jason     ... View more

Hi,      I have been looking around to find some debug/syslog data to create an EEM script to monitor when an L2TPv2 goes from "est" to "nosess".  I have posted a question on the EEM script forum for some input on the script.  However, I am curious if anyone has looked or found a way to monitor the "state" of an L2TPv2 tunnel.  That way, I can possibly add it to my EEM script to re-establish the tunnel when it goes down.  For example, here is a sample of a "debug l2tp all" when the tunnel is up:   *Nov  3 21:25:36.064: L2TP tnl   01005:000005F0: I HELLO, flg TLS, ver 2, len 20 *Nov  3 21:25:36.064: L2TP tnl   01005:000005F0: *Nov  3 21:25:36.064: L2TP tnl   01005:000005F0: O ZLB ACK to vpn-si1.reliablehosting.com tnl 1829 *Nov  3 21:25:36.064: L2TP tnl   01005:000005F0:   Thanks.   Jason   ... View more

Hi,      I didn't see an option to delete the contents of a voicemail box in the cca gui.  Maybe a command line option?   Thanks.   ... View more