Showing results for 
Search instead for 
Did you mean: 

L2TP IPSec tunnel from WinXP to IOS router

Hi there,

I have a requirement to build a VPN tunnel to a network on a Windows XP box. There is no option to use a newer Windows because the app only works on the Windows PC. I can't find any VPN client that would still support the XP so I researched and tried this L2TP IPSec thing. First of all, it works fine on my Windows 10 box. Here is my config

aaa authentication ppp VPDN_AUTH local
vpdn enable
vpdn-group L2TP
 ! Default L2TP VPDN group
  protocol l2tp
  virtual-template 1
 no l2tp tunnel authentication
 username test password 0 test
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 14
crypto isakmp key cisco123 address         no-xauth
crypto ipsec transform-set L2TP-transform-XP esp-3des esp-md5-hmac
 mode transport
crypto dynamic-map L2TP-map 10
 set nat demux
 set transform-set L2TP-transform-XP
 set pfs group14
crypto map L2TP 10 ipsec-isakmp dynamic L2TP-map
interface GigabitEthernet0/0/0
 ip address <public Internet IP>
 negotiation auto
 crypto map L2TP
ip route <gw>

On the Windows XP, it just says no response. On the IOS router (2921), when I compare the debug between a working Win10 with it, the difference is that right after the ISAKMP/IPSec stuff, there are L2TP activity (with the debug l2tp all) for the Win10, but nothing for the WinXP. Here is the last few lines of the debug isakmp and IPsec. I also verified that there is isakmp and ipsec SA both established. 

*Jan  6 23:10:52.894: ISAKMP-ERROR: (0):Failed to find peer index node to update peer_info_list
*Jan  6 23:10:52.894: ISAKMP: (1034):Received IPSec Install callback... proceeding with the negotiation
*Jan  6 23:10:52.894: ISAKMP: (1034):Successfully installed IPSEC SA (SPI:0x9BD9B713) on GigabitEthernet0/0/0
*Jan  6 23:10:52.895: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP  .  Peer f_vrf:  Internet     Id:
*Jan  6 23:10:52.895: ISAKMP-PAK: (1034):sending packet to my_port 4500 peer_port 64916 (R) QM_IDLE
*Jan  6 23:10:52.895: ISAKMP: (1034):Sending an IKE IPv4 Packet.
*Jan  6 23:10:52.895: ISAKMP: (1034):Node 1, Input = IKE_MESG_FROM_IPSEC, IPSEC_INSTALL_DONE
*Jan  6 23:10:52.896: ISAKMP: (1034):Old State = IKE_QM_IPSEC_INSTALL_AWAIT  New State = IKE_QM_R_QM2
*Jan  6 23:10:52.901: ISAKMP-PAK: (1034):received packet from dport 4500 sport 64916 Internet (R) QM_IDLE
*Jan  6 23:10:52.901: ISAKMP: (1034):deleting node 1 error FALSE reason "QM done (await)"
*Jan  6 23:10:52.901: ISAKMP: (1034):Node 1, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
*Jan  6 23:10:52.901: ISAKMP: (1034):Old State = IKE_QM_R_QM2  New State = IKE_QM_PHASE2_COMPLETE
*Jan  6 23:10:52.901: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Jan  6 23:10:52.901: IPSEC(key_engine_enable_outbound): rec'd enable notify from ISAKMP
<<< For the Win10, the L2TP messages would start >>>

Any ideas where it went wrong? Thanks!