Hi there,
I have a requirement to build a VPN tunnel to a network on a Windows XP box. There is no option to use a newer Windows because the app only works on the Windows PC. I can't find any VPN client that would still support the XP so I researched and tried this L2TP IPSec thing. First of all, it works fine on my Windows 10 box. Here is my config
aaa authentication ppp VPDN_AUTH local
!
vpdn enable
!
vpdn-group L2TP
! Default L2TP VPDN group
accept-dialin
protocol l2tp
virtual-template 1
no l2tp tunnel authentication
!
username test password 0 test
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 14
!
crypto isakmp key cisco123 address 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set L2TP-transform-XP esp-3des esp-md5-hmac
mode transport
!
crypto dynamic-map L2TP-map 10
set nat demux
set transform-set L2TP-transform-XP
set pfs group14
!
!
crypto map L2TP 10 ipsec-isakmp dynamic L2TP-map
!
interface GigabitEthernet0/0/0
ip address <public Internet IP>
negotiation auto
crypto map L2TP
!
ip route 0.0.0.0 0.0.0.0 <gw>
On the Windows XP, it just says no response. On the IOS router (2921), when I compare the debug between a working Win10 with it, the difference is that right after the ISAKMP/IPSec stuff, there are L2TP activity (with the debug l2tp all) for the Win10, but nothing for the WinXP. Here is the last few lines of the debug isakmp and IPsec. I also verified that there is isakmp and ipsec SA both established.
*Jan 6 23:10:52.894: ISAKMP-ERROR: (0):Failed to find peer index node to update peer_info_list
*Jan 6 23:10:52.894: ISAKMP: (1034):Received IPSec Install callback... proceeding with the negotiation
*Jan 6 23:10:52.894: ISAKMP: (1034):Successfully installed IPSEC SA (SPI:0x9BD9B713) on GigabitEthernet0/0/0
*Jan 6 23:10:52.895: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP . Peer 69.58.16.68:64916 f_vrf: Internet Id: 192.168.237.188
*Jan 6 23:10:52.895: ISAKMP-PAK: (1034):sending packet to 69.58.16.68 my_port 4500 peer_port 64916 (R) QM_IDLE
*Jan 6 23:10:52.895: ISAKMP: (1034):Sending an IKE IPv4 Packet.
*Jan 6 23:10:52.895: ISAKMP: (1034):Node 1, Input = IKE_MESG_FROM_IPSEC, IPSEC_INSTALL_DONE
*Jan 6 23:10:52.896: ISAKMP: (1034):Old State = IKE_QM_IPSEC_INSTALL_AWAIT New State = IKE_QM_R_QM2
*Jan 6 23:10:52.901: ISAKMP-PAK: (1034):received packet from 69.58.16.68 dport 4500 sport 64916 Internet (R) QM_IDLE
*Jan 6 23:10:52.901: ISAKMP: (1034):deleting node 1 error FALSE reason "QM done (await)"
*Jan 6 23:10:52.901: ISAKMP: (1034):Node 1, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
L2TP#
*Jan 6 23:10:52.901: ISAKMP: (1034):Old State = IKE_QM_R_QM2 New State = IKE_QM_PHASE2_COMPLETE
*Jan 6 23:10:52.901: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Jan 6 23:10:52.901: IPSEC(key_engine_enable_outbound): rec'd enable notify from ISAKMP
<<< For the Win10, the L2TP messages would start >>>
Any ideas where it went wrong? Thanks!
