hello,
I have done a VPN using L2TP, the remote access from a windows 2000
client to a cisco router IOS3640 is working well.
Now i want to do L2TP/IPSec but i'm in trouble with it.
You can find in this message a topology of my network, a config of
windows2000 and a config sample of cisco3640
when i use debug with cisco 3640, i have no error (no messages about
IPSec ISAKMP....)
Can someone help me?
I have as server cisco 3640 router with (C3640-JK8O3S-M), Version
12.2(10a)RELEASE SOFTWARE (fc1)
And a client microsoft windows 2000.
Here the TOPOLOGY:
Win2000---------------internet------------------router3640----------LAN
<---------------Tunnel L2TP/IPSec-------------->
Here what i did in windows 2000 client:
1)add the correct value in the registery
2)i have created IPSec Policy for use with L2TP/IPSec using a preshare
key
3)Assign it (OK it is running)
-->First, by using the Cisco VPN client
Version:3.5(Rel)
Client Type:Windows,WinNT
when i try to connect, i have an error message "remote pair is no longer responding" and the following debug
1 09:30:41.315 07/23/02 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to 164.128.74.150
2 09:30:46.322 07/23/02 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to 164.128.74.150
3 09:30:51.329 07/23/02 Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK AG (Retransmission) to 164.128.74.150
4 09:30:56.336 07/23/02 Sev=Warning/2 IKE/0xE300007B
Exceeded 3 IKE SA negotiation retransmits... peer is not responding
5 09:30:56.336 07/23/02 Sev=Info/4 CM/0x63100014
Unable to establish Phase 1 SA with server "164.128.74.150" because of "DEL_REASON_PEER_NOT_RESPONDING"
6 09:30:56.336 07/23/02 Sev=Info/5 CM/0x63100029
Initializing CVPNDrv
7 09:30:56.386 07/23/02 Sev=Warning/3 DIALER/0xE3300015
GI VPN start callback failed "CM_PEER_NOT_RESPONDING" (16h).
8 09:30:57.388 07/23/02 Sev=Info/4 IPSEC/0x63700014
Deleted all keys
-->secondly, i have used the client included in microsoft windows 2000pro.
If i use L2TP only, it work
If if i enable the policy that i have created for IPsec, it doesn't work (but no message error, just saying cannot reach the host)
The configuration sample of cisco 3640:
sh run
!
hostname DGE_Router
!
username xxxxxxxx password 0 xxxxxxxx
vpdn enable
!
vpdn-group TT
! Default L2TP VPDN group
accept-dialin
protocol l2tp
virtual-template 1
no l2tp tunnel authentication
!
!
crypto isakmp policy 1
hash md5
authentication pre-share
lifetime 500
crypto isakmp key ciscokey address 164.128.78.10
!
!
crypto ipsec transform-set myset esp-des ah-md5-hmac
!
crypto map mymap local-address serial1/0
crypto map mymap 10 ipsec-isakmp
set peer 164.128.78.10
!where 164.128.78.10is the address of the microsoft 2000 client
set transform-set myset
match address 110
!
interface Ethernet0/1
description LAN
ip address 10.10.4.1 255.255.0.0
ip accounting output-packets
ip nat inside
ip pim dense-mode
full-duplex
ipx encapsulation SAP
ipx network 10000010
!
interface Serial1/0
description Permanent Internet access
ip address 164.128.70.150 255.255.255.252
ip access-group IAIN in
ip access-group IAOUT out
ip nat outside
ip inspect INTERNET out
ip audit AUDITIE in
no cdp enable
crypto map mymap
!
interface Virtual-Template1
ip unnumbered Serial1/0
peer default ip address pool vpn
ppp authentication chap
!
interface Ethernet1/1
ip address 195.65.xxx.xxx 255.255.255.240
ip nat outside
half-duplex
!
ip local pool vpn 192.168.2.1 192.168.2.10
ip nat translation timeout 1200
ip nat inside source list IANAT interface Loopback0 overload
ip nat inside source static 10.10.10.171 195.65.xx.xxx
ip nat inside source static 10.10.10.128 195.65.xxx.xxx
ip nat inside source static 172.20.2.1 195.65.xxx.xxx
ip nat inside source static 10.10.2.2 195.65.xxx.xxx
ip nat inside source static 10.10.2.3 195.65.xxx.xxx
ip nat inside source static 164.128.74.150 164.128.70.150
ip classless
ip route 0.0.0.0 0.0.0.0 Serial1/0
ip route 10.20.0.0 255.255.0.0 Serial0/0
ip route 10.30.0.0 255.255.0.0 Serial0/0
ip route 164.128.0.0 255.255.255.252 Virtual-Template1
ip route 172.16.6.0 255.255.255.0 Serial0/0
ip route 192.168.1.0 255.255.255.0 Ethernet0/0
no ip http server
ip pim bidir-enable
!
!
ip access-list extended IAIN
remark Control Access from Internet (input)
permit icmp any host 164.128.70.150
permit icmp any any echo-reply
permit icmp any any ttl-exceeded
permit icmp any any host-unreachable
permit icmp any any host-unknown
permit icmp any any time-exceeded
permit udp any any eq ntp log
permit tcp any host 195.65.xx.xx eq smtp
---
---
etc
---
---
permit udp any host 164.128.70.150 eq 1701
permit udp any eq isakmp host 164.128.70.150
deny ip any any log
!
ip access-list extended IANAT
remark Control NAT for Internet Access
deny ip 195.65.xxx.xxx 0.0.0.31 any---
---
etc
---
---
deny ip any any log
ip access-list extended IAOUT
remark Control Access to Internet (output)
deny ip 10.0.0.0 0.255.255.255 any
permit icmp 195.65.xxx.xxx 0.0.0.31 any---
---
etc
---
---
permit udp host 164.128.70.150 any eq 1701
permit udp host 164.128.70.150 any eq isakmp
deny ip any any log
access-list 110 permit ip host 164.128.70.150 host 164.128.78.10
thanks by advance for your help.
Nicolas
