Cisco IOS - PPPoE, L2TP not staging
First post, but I've searched the forums and the wider internet in search of an answer.
I live in Australia, running an NBN connection via a Cisco 1841 router. It's running a Dialer interface using NAT.
I've found one guide that goes through setting up a l2tp tunnel however the guides config is slightly different than mine for the underlying internet connection and that's where I'm having issues.
My main issue is that I can get ISAKMP to accept an SA but IPSEC wont. The debug errors don't seem to help at all and no terminal messages are of any use.
I'm using the traffic from 192.168.0.102 as interesting traffic for the tunnel but it never seems to stage. I'm open to any suggestions.
Config listed below...
Current configuration : 3567 bytes
!
! Last configuration change at 14:39:54 syd Sat Mar 5 2016 by ***********
! NVRAM config last updated at 15:41:57 syd Fri Mar 4 2016 by ***********
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ***********
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
enable secret 5 ***********************************
!
aaa new-model
!
!
!
!
aaa session-id common
clock timezone syd 11
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.0.100 192.168.0.110
ip dhcp excluded-address 192.168.0.1 192.168.0.10
!
ip dhcp pool ***********
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 8.8.8.8
!
!
ip cef
ip domain name ***********
ip name-server ***********
!
no ipv6 cef
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group NBN
request-dialin
protocol pppoe
!
!
!
!
!
username ********USERNAME****** privilege 15 secret 5 *********PW***********
archive
log config
hidekeys
!
!
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 5
crypto isakmp key mysafety address 168.1.75.47
!
!
crypto ipsec transform-set ESP-AES256-SHA1 esp-aes 256 esp-sha-hmac
mode transport
!
crypto map PIA_VPN 10 ipsec-isakmp
set peer 168.1.75.47
set transform-set ESP-AES256-SHA1
match address PIA_DISTA
!
!
!
ip ssh version 2
pseudowire-class PIA_L2TP
encapsulation l2tpv2
ip local interface Dialer1
!
!
!
!
interface FastEthernet0/0
description WAN Interface
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
no cdp enable
!
interface FastEthernet0/1
description LAN Interface
ip address 192.168.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
duplex auto
speed auto
!
interface Virtual-PPP1
description Tunnel to PIA
ip address negotiated
ip virtual-reassembly
no cdp enable
ppp eap refuse
ppp chap hostname x6322287
ppp chap password 7 10183A16042F281B1D1702
ppp ipcp address accept
pseudowire 168.1.75.62 1 pw-class PIA_L2TP
crypto map PIA_VPN
!
interface Dialer1
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
no cdp enable
ppp chap hostname ********nbn username**************
ppp chap password 7 **********nbn password***************
ppp pap sent-username ********nbn username************** password 7 **********nbn password***************
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1
no ip http server
no ip http secure-server
!
!
ip nat source static tcp 192.168.0.102 60276 interface Virtual-PPP1 60276
ip nat source static tcp 192.168.0.102 9091 interface Virtual-PPP1 9091
ip nat source static tcp 192.168.0.102 64108 interface Virtual-PPP1 64108
ip nat inside source list NATTRAFFIC interface Dialer1 overload
!
ip access-list standard NATTRAFFIC
permit 192.168.0.0 0.0.0.255
!
ip access-list extended PIA_DISTA
permit ip any any
ip access-list extended TRANSMISSION
permit ip host 192.168.0.102 any
!
access-list 1 permit 0.0.0.0 255.255.255.0
!
!
!
!
route-map TRANSMISSION_PIA permit 10
match ip address TRANSMISSION
set interface Virtual-PPP1
!
!
!
!
control-plane
!
!
!
!
scheduler allocate 20000 1000
ntp server au.pool.ntp.org
end
Comments