L2TP VPDN with windows 7

[rapportit]

I'm having trouble getting VPDN working on an 887 router. My windows 7 client just gives a server not responding error.

I'm using the follwoing config.

aaa new-model
!
aaa authentication login default local
aaa authentication ppp default local
aaa authorization network default local if-authenticated
!
vpdn enable
!
vpdn-group L2TP
 ! Default L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 10
!
username vpnuser password 0 xxxxxxxxxx
!
crypto isakmp policy 20
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key xxxxxxx address 0.0.0.0         no-xauth
!
crypto ipsec transform-set L2TP-TRANSFORM-SET esp-3des esp-sha-hmac
 mode transport
!
crypto dynamic-map L2TP-TRANSFORM-SET-MAP 10
 set transform-set L2TP-TRANSFORM-SET
!
crypto map L2TP-MAP 10 ipsec-isakmp dynamic L2TP-TRANSFORM-SET-MAP
!
interface Virtual-Template10
 ip unnumbered Vlan1
 peer default ip address pool L2TP-VPN-POOL
 ppp mtu adaptive
 ppp authentication ms-chap ms-chap-v2
!
interface Dialer0
 crypto map L2TP-MAP
!
ip local pool L2TP-VPN-POOL 192.168.0.101 192.168.0.110
!

What am I missing?

I attached a log that shows something is going wrong at the end...

[Philip D'Ath]

Check out this reference document.  It has quite a few differences between your config and its example.

https://supportforums.cisco.com/document/9878401/l2tp-over-ipsec-cisco-ios-router-using-windows-8

[rapportit]

I actually read that before creating my config. I didn't really get the loopback part though (also suggested by the other responder), so I went with what I thought was a little simpler just slapping the virt-temp onto the vlan (which I goofed, but corrected with no difference).

[Masoud Pourshabanian]

Hello,

I do not see any log file. I do not see any IP in the subnet of your local pool. Create an interface loopback or use your lan interface under the interface Virtual-Template10 with an ip in the range your pool.

Please share the log file.

Masoud

[rapportit]

Yea, looks like I goofed the virtual-template... I corrected it to Vlan1 and attached the log (for real this time). Looks like pretty much the same thing happening though.

[Masoud Pourshabanian]

Does it get connected? What is the IP of int vlan? edited.

[rapportit]

interface Vlan1
 ip address 192.168.0.1 255.255.255.0
 ip nat inside
 ip nat enable
 ip virtual-reassembly in

It's doing something, but not connecting when I try...

[Masoud Pourshabanian]

edited

[Masoud Pourshabanian]

Are you trying to connect by computer with ip of 192.168.0.26 ?

Are you trying to connect from inside the network?

If yes. You need to do some changes.

int dialer 0

no  crypto map L2TP-MAP

int vlan 1

  crypto map L2TP-MAP

ip local pool L2TP-VPN-POOL 192.168.10.101 192.168.10.110

int loopback 10

ip address 192.168.10.1 255.255.255.0

interface Virtual-Template10

 ip unnumbered loopback 10

ip nat inside

Add 192.168.10.X to your nat list

[rapportit]

I was trying to connect from 192.168.0.26, and I am inside the network trying to connect to the internet facing dialer IP for testing... althought the purpose is to be able to connect via the internet from an outside network.

Is the loopback neccessary to acheive what I'm trying? I can see why it might be preferred in some situations, but I'd rather just dump the vpn user directly onto my subnet.

Is "ip nat inside" supposed to go in the vitual-template?

[Masoud Pourshabanian]

Hello, Actually loopback is not necessary, but you can seperate VPN user from internel user.

If you are connecting from inside, crypto map L2TP-MAP must be set on int vlan 1.

If you are connecting from outside, crypto map L2TP-MAP must be set on int Dialer.

"ip nat inside" must be set on int vitual-template if users are going to access the internet Because VPN users are coming from this interface.

If you do not want to use loopback and try connecting from inside use this.

int dialer 0

no  crypto map L2TP-MAP

int vlan 1

  crypto map L2TP-MAP

ip local pool L2TP-VPN-POOL 192.168.0.101 192.168.0.110

interface Virtual-Template10

 ip unnumbered Vlan1

ip nat inside

Masoud

[rapportit]

Still not working, no connection established.

The windows client is returning 809, server not responding. Wireshark shows that I'm getting StopCCN traffic back, so obviously the router is responding.

Here's a new debug log, it looks a little different, still can't tell what's going on though.

[Masoud Pourshabanian · Accepted solution]

Hello,

I implemented your configurations. I made two changes(Bold). Please try this configuration and give your feedback. It is for connection from inside the network.

aaa new-model
!

aaa authentication login default local
aaa authentication ppp default local
aaa authorization network default local if-authenticated
!

vpdn enable

vpdn-group L2TP
! Default L2TP VPDN group
accept-dialin
protocol l2tp
virtual-template 10
no l2tp tunnel authentication
!


username cisco password 0 cisco [ use your own password]
!

!
crypto isakmp policy 20
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 no-xauth
!
!
crypto ipsec transform-set L2TP-TRANSFORM-SET esp-3des esp-sha-hmac
mode transport
!
crypto dynamic-map L2TP-TRANSFORM-SET-MAP 10
set transform-set L2TP-TRANSFORM-SET
!
!
crypto map L2TP-MAP 10 ipsec-isakmp dynamic L2TP-TRANSFORM-SET-MAP


interface vlan1
ip address 192.168.0.1 255.255.255.0
crypto map L2TP-MAP
!
interface Virtual-Template10
ip unnumbered vlan1
peer default ip address pool L2TP-VPN-POOL
ppp mtu adaptive
ppp authentication ms-chap ms-chap-v2
!
ip local pool L2TP-VPN-POOL 192.168.0.101 192.168.0.110

Masoud

[rapportit]

Regarding the line

crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 no-xauth

That is how I entered it, the subnet 0.0.0.0 does not show up though, it just shows a big blank gap between the ip 0.0.0.0 and no-xauth. I re-did it anyway, same thing, not sure if its a problem or not.

I added the no l2tp tunnel authentication but still not getting a connection.

Getting a slightly different debug, attached.

[rapportit]

When I applied the crypto map to the dialer, this config works over the internet, since that was it's intended purpose I don't care that it's not working internally for my test.

Cheers.