Subject: L2TP between W2K & cisco 3620

From: "Enno Rey" <[email-masked]>
Date: Thu, 15 Mar 2001 23:26:33 +0100

Hi,

I'm trying to implement L2TP over IPsec in a test environment between W2K
boxes and a cisco 3620, running
c3620-is56i-mz.121-5.T.bin.

After successful creation of the SAs and initial setup of the tunnel I get
this (see below for a debug output from the cisco and it's config.. don't
blame it for being unstructured... test lab...).
Seems to be an authentication error. I'm not sure why... there's a user
defined on the cisco ['zeus' with pw 'blubs'] and with exactly these
credentials I try to initialize the L2TP session from the W2K box...
I thought there's no tunnel authentication on the cisco...

So where's my problem... what am I missing??

Any hints will greatly be appreciated.

Thanks a lot in advance & regards,

Enno Rey

[email-masked]
PGP 74C0 C7E1 3875 E4EB 9B75  8B9D 5E2D 3178 685B F222

Debug:

Mar 15 23:00:09: IPSEC(initialize_sas): ,
  (key eng. msg.) dest= 192.168.96.4, src= 192.168.96.113,
    dest_proxy= 192.168.96.4/0.0.0.0/17/0 (type=1),
    src_proxy= 192.168.96.113/0.0.0.0/17/1701 (type=1),
    protocol= ESP, transform= esp-des esp-md5-hmac ,
    lifedur= 3600s and 250000kb,
    spi= 0x136E59AD(325999021), conn_id= 2002, keysize= 0, flags= 0x0
Mar 15 23:00:09: IPSEC(initialize_sas): ,
  (key eng. msg.) src= 192.168.96.4, dest= 192.168.96.113,
    src_proxy= 192.168.96.4/0.0.0.0/17/0 (type=1),
    dest_proxy= 192.168.96.113/0.0.0.0/17/1701 (type=1),
    protocol= ESP, transform= esp-des esp-md5-hmac ,
    lifedur= 3600s and 250000kb,
    spi= 0x85217191(2233561489), conn_id= 2003, keysize= 0, flags= 0x0
Mar 15 23:00:09: IPSEC(create_sa): sa created,
  (sa) sa_dest= 192.168.96.4, sa_prot= 50,
    sa_spi= 0x136E59AD(325999021),
    sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2002
Mar 15 23:00:09: IPSEC(create_sa): sa created,
  (sa) sa_dest= 192.168.96.113, sa_prot= 50,
    sa_spi= 0x85217191(2233561489),
    sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2003
Mar 15 23:00:10: L2X: Parse  AVP 0, len 8, flag 0x8000 (M)
Mar 15 23:00:10: L2X: Parse SCCRQ
Mar 15 23:00:10: L2X: Parse  AVP 2, len 8, flag 0x8000 (M)
Mar 15 23:00:10: L2X: Protocol Ver 256
Mar 15 23:00:10: L2X: Parse  AVP 3, len 10, flag 0x8000 (M)
Mar 15 23:00:10: L2X: Framing Cap 0x1
Mar 15 23:00:10: L2X: Parse  AVP 4, len 10, flag 0x8000 (M)
Mar 15 23:00:10: L2X: Bearer Cap 0x0
Mar 15 23:00:10: L2X: Parse  AVP 6, len 8, flag 0x0
Mar 15 23:00:10: L2X: Firmware Ver 0x500
Mar 15 23:00:10: L2X: Parse  AVP 7, len 34, flag 0x8000 (M)
Mar 15 23:00:10: L2X: Hostname caintern.security-academy.de
Mar 15 23:00:10: L2X: Parse  AVP 8, len 15, flag 0x0
Mar 15 23:00:10: L2X: Vendor Name Microsoft
Mar 15 23:00:10: L2X: Parse  AVP 9, len 8, flag 0x8000 (M)
Mar 15 23:00:10: L2X: Assigned Tunnel ID 4
Mar 15 23:00:10: L2X: Parse  AVP 10, len 8, flag 0x8000 (M)
Mar 15 23:00:10: L2X: Rx Window Size 8
Mar 15 23:00:10: L2X: No missing AVPs in SCCRQ
Mar 15 23:00:10: L2X: I SCCRQ, flg TLS, ver 2, len 121, tnl 0, cl 0, ns 0,
nr 0
         C8 02 00 79 00 00 00 00 00 00 00 00 80 08 00 00
         00 00 00 01 80 08 00 00 00 02 01 00 80 0A 00 00
         00 03 00 00 00 01 80 0A 00 00 00 04 00 00 00 ...
Mar 15 23:00:10: L2TP: I SCCRQ from caintern.security-academy.de tnl 4
Mar 15 23:00:10: Tnl 15368 L2TP: New tunnel created for remote
caintern.security
-academy.de, address 192.168.96.113
Mar 15 23:00:10: Tnl 15368 L2TP: O SCCRP  to caintern.security-academy.de
tnlid
4
Mar 15 23:00:10: Tnl 15368 L2TP: O SCCRP, flg TLS, ver 2, len 128, tnl 4, cl
0,
ns 0, nr 1
         C8 02 00 80 00 04 00 00 00 00 00 01 80 08 00 00
         00 00 00 02 80 08 00 00 00 02 01 00 80 0A 00 00
         00 03 00 00 00 00 80 0A 00 00 00 04 00 00 00 ...
Mar 15 23:00:10: Tnl 15368 L2TP: Tunnel state change from idle to
wait-ctl-reply
Mar 15 23:00:10: Tnl 15368 L2TP: Clean Queue packet 0
Mar 15 23:00:10: Tnl 15368 L2TP: Parse  AVP 0, len 8, flag 0x8000 (M)
Mar 15 23:00:10: Tnl 15368 L2TP: Parse SCCCN
Mar 15 23:00:10: Tnl 15368 L2TP: Parse  AVP 13, len 22, flag 0x8000 (M)
Mar 15 23:00:10: Tnl 15368 L2TP: Chlng Resp 608A2B6CD1CCE829676DC718F8EB8AEF
Mar 15 23:00:10: Tnl 15368 L2TP: No missing AVPs in SCCCN
Mar 15 23:00:10: Tnl 15368 L2TP: I SCCCN, flg TLS, ver 2, len 42, tnl 15368,
cl
0, ns 1, nr 1
         C8 02 00 2A 3C 08 00 00 00 01 00 01 80 08 00 00
         00 00 00 03 80 16 00 00 00 0D 60 8A 2B 6C D1 CC
         E8 29 67 6D C7 18 F8 EB 8A EF
Mar 15 23:00:10: Tnl 15368 L2TP: O ZLB ctrl ack, flg TLS, ver 2, len 12, tnl
4,
cl 0, ns 1, nr 2
         C8 02 00 0C 00 04 00 00 00 01 00 02
Mar 15 23:00:10: Tnl 15368 L2TP: I SCCCN from caintern.security-academy.de
tnl 4
Mar 15 23:00:10: Tnl 15368 L2TP: Got a Challenge Response in SCCCN from
caintern
.security-academy.de
Mar 15 23:00:10: VPDN: authentication failed, couldn't find user information
for
 LNS
Mar 15 23:00:10: Tnl 15368 L2TP: O StopCCN  to caintern.security-academy.de
tnli
d 4

Config:

version 12.1
no service single-slot-reload-enable
no service pad
service timestamps debug datetime localtime
service timestamps log datetime localtime
service password-encryption
no service dhcp
!
hostname router
!
boot system flash slot0:1:c3620-is56i-mz.121-5.T.bin
logging buffered 65535 debugging
logging rate-limit console 10 except errors
aaa new-model
aaa authentication login default local
aaa authentication enable default enable
aaa authentication ppp default local
enable secret 5
!
username zeus password 7 0306571E041C
username erey privilege 15 password 7
clock timezone berlin 1
clock summer-time berlin recurring
ip subnet-zero
no ip source-route
!
!
no ip finger
ip domain-name security-academy.de
ip name-server 192.168.96.113
!
no ip bootp server
ip ssh time-out 120
ip ssh authentication-retries 3
vpdn enable
no vpdn logging
!
vpdn-group 1
! Default L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 1
 local name LNS
!
!
!
crypto ca identity aca
 enrollment mode ra
 enrollment url http://192.168.96.113:80/certsrv/mscep/mscep.dll
 crl optional

...
[snip... certificates...]
...
   27E34F01 2FD572E5 4AF21BB5 34D592
  quit
!
crypto isakmp policy 2
 group 2
crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0
!
crypto ipsec security-association lifetime kilobytes 100000
crypto ipsec security-association lifetime seconds 900
!
crypto ipsec transform-set trans1 esp-des esp-md5-hmac
 mode transport
!
crypto dynamic-map dynmap 1
 set transform-set trans1
 match address 117
!
!
crypto map vpntraffic 1 ipsec-isakmp dynamic dynmap
!
isdn switch-type basic-net3
isdn voice-call-failure 0
call rsvp-sync

[snip... interfaces...]

interface Virtual-Template1
 ip unnumbered Ethernet1/0
 peer default ip address pool default
 ppp authentication ms-chap
!

[snip... interfaces...]

ip local pool default 172.16.1.10 172.16.1.20
ip nat inside source list 1 interface Dialer1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
no ip http server
!
access-list 1 permit 192.168.96.0 0.0.0.255

[snip... the rest... access-lists & ttys]