Акадо и cisco 1841

Question

Добрый день!
Никак не удается подключиться по l2tp к серверу Акадо. Локальная сеть работает, а вот виртуальный интерфейс не поднимается.

Конфигурация cisco


Current configuration : 4325 bytes
!
version 12.4
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname r1841
!
boot-start-marker
warm-reboot
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication ppp default local
!
aaa session-id common
!
resource policy
!
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.15.1 192.168.15.99
ip dhcp excluded-address 192.168.15.254
!
ip dhcp pool HOMEPOOL
network 192.168.15.0 255.255.255.0
default-router 192.168.15.254 
dns-server 10.0.0.1 10.0.0.2 8.8.8.8 
!
!
ip domain name home.ru
ip name-server 10.0.0.1
ip name-server 10.0.0.2
ip name-server 8.8.8.8
ip multicast-routing 
ip ssh logging events
ip ssh version 2
l2tp-class pwclass2
!
l2tp-class AKADO
!
!
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-2130336792
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2130336792
revocation-check none
rsakeypair TP-self-signed-2130336792
!
!
crypto pki certificate chain TP-self-signed-2130336792
certificate self-signed 01
quit
username user privilege 15 secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXX
!
pseudowire-class CLASS2
encapsulation l2tpv3
protocol l2tpv3 AKADO
ip local interface FastEthernet0/0
!
! 
!
!
!
!
interface Loopback0
ip address 192.168.4.1 255.255.255.0
!
interface FastEthernet0/0
description AKADO
mac-address 1111.2222.3333
ip address 10.x.x.x 255.255.255.0
ip nat outside
ip virtual-reassembly
load-interval 30
duplex auto
speed auto
!
interface FastEthernet0/1
description INTERNAL
ip address 192.168.15.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Virtual-PPP1
ip address negotiated
no ip redirects
ip mtu 1460
ip flow ingress
ip nat outside
ip virtual-reassembly
load-interval 30
no peer neighbor-route
no cdp enable
ppp authentication chap
ppp chap hostname MY_USERNAME
ppp chap password MY_PASSWORD
ppp pap sent-username MY_USERNAME password 7 MY_PASSWORD
pseudowire 10.0.0.72 1 pw-class CLASS2
!
ip route 10.0.0.0 255.0.0.0 10.x.x.3
!
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 1 interface FastEthernet0/0 overload
!
ip access-list extended NAT
permit ip 192.168.15.0 0.0.0.255 any
!
access-list 1 permit 192.168.15.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
banner motd ^C
######################################
# #
# All actions logging #
# #
######################################
^C
!
line con 0
line aux 0
line vty 0 4
transport input telnet ssh
line vty 5 15
transport input telnet ssh
!
scheduler allocate 20000 1000
end

Ответить

DoMoVoY · Accepted Answer

А у АКАДО протокол точно l2tv3 (именно 3 на конце)? И разве они работают по сертификатам?

Sergey™ · Answer

Вторая версия протокола тоже не проходит
сертификат мне нужен был для доступа к cisco по ssh и для доступа к ней по https

BOFH · Answer

Вообще l2tvp3 нужен для организации l2 pseudowire и вам вообще никаким боком для Акадо не нужен, так что переделывайте и смотрите debug ppp authentication,
debug ppp negotiation...

Sergey™ · Answer

Рабочий конфиг.
Для работы внутренней сети провайдера и интернета требуется еще route-map.
Строка ppp authentication chap была лишней
Останется восстановить конфиг для DHCP и домашний роутер готов

version 15.1
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service internal
service sequence-numbers
!
hostname c1841
!
boot-start-marker
warm-reboot
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication ppp default local
!
!
!
!
!
aaa session-id common
!
dot11 syslog
ip source-route
!
!
!
!
!
ip cef
ip domain name s96.ru
ip name-server 10.0.0.1
ip name-server 10.0.0.2
ip name-server 8.8.8.8
ip multicast-routing
ip inspect WAAS flush-timeout 10
no ipv6 cef
l2tp-class AKADO
 hostname AKADO_USERNAME !!!!!!!!!!!!!!!!!!!! ваш логин для VPN
!
!
multilink bundle-name authenticated
!
!
username USERCISCO privilege 15 secret 5 XXXXXXXXXXXXXX
!
redundancy
!
!
ip ssh logging events
ip ssh version 2
pseudowire-class PWCLASSAKADO
 encapsulation l2tpv2
 protocol l2tpv2 AKADO
 ip local interface FastEthernet0/0
!
!
!
!
!
!
!
!
interface FastEthernet0/0
 description AKADO
 mac-address aaaa.vvvv.xxxx
 ip address 10.x.x.x 255.255.255.0
 ip nat outside
 ip virtual-reassembly in
 load-interval 30
 duplex auto
 speed auto
!
interface FastEthernet0/1
 description INTERNAL
 ip address 192.168.15.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
!
interface Virtual-PPP1
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1460
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 ip verify unicast reverse-path allow-self-ping
 ip tcp adjust-mss 1420
 load-interval 30
 no peer neighbor-route
 ppp chap hostname AKADO_USERNAME !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 ppp chap password AKADO_PASSWORD !!!!!!!!!! пароль от МЗТ
 no cdp enable
 pseudowire 10.0.0.68 1 encapsulation l2tpv2 pw-class PWCLASSAKADO
!
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip nat inside source route-map NAT_TO_ISP interface FastEthernet0/0 overload
ip nat inside source route-map NAT_TO_VPN interface Virtual-PPP1 overload
ip route 0.0.0.0 0.0.0.0 Virtual-PPP1
ip route 10.0.0.0 255.192.0.0 10.x.x.3
!
ip access-list extended NATHOMENET
 permit ip 192.168.15.0 0.0.0.255 any
!
access-list 1 permit 192.168.15.0 0.0.0.255
!
!
!
!
route-map NAT_TO_VPN permit 10
 match ip address NATHOMENET
 match interface Virtual-PPP1
!
route-map NAT_TO_ISP permit 10
 match ip address NATHOMENET
 match interface FastEthernet0/0
!
!
!
!
!
control-plane
!
!
banner motd ^C
######################################
#                                    #
#        All actions logging         #
#                                    #
######################################
^C
!
line con 0
line aux 0
line vty 0 4
 transport input telnet ssh
line vty 5 15
 transport input telnet ssh
!
scheduler allocate 20000 1000
end

Basilio (V^3) · Answer

Так на какой всетаки версии ios взлетело?

# sho flash | incl bin
Можно показать?

Basilio (V^3) · Answer

Сам спросил - сам отвечаю ... может кому пригодится ...
c1841-advsecurityk9-mz.124-3i.bin  - не заработал.
c1841-adventerprisek9-mz.124-24.T  - заработал.