Добрый день!
Никак не удается подключиться по l2tp к серверу Акадо. Локальная сеть работает, а вот виртуальный интерфейс не поднимается.
Конфигурация cisco
Current configuration : 4325 bytes
!
version 12.4
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname r1841
!
boot-start-marker
warm-reboot
boot-end-marker
!
!
aaa
new-model
!
!
aaa authentication ppp default local
!
aaa session-id common
!
resource policy
!
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.15.1 192.168.15.99
ip dhcp
excluded-address 192.168.15.254
!
ip dhcp pool HOMEPOOL
network 192.168.15.0 255.255.255.0
default-router 192.168.15.254
dns-server 10.0.0.1 10.0.0.2 8.8.8.8
!
!
ip domain name home.ru
ip name-server 10.0.0.1
ip name-server
10.0.0.2
ip name-server 8.8.8.8
ip multicast-routing
ip ssh logging events
ip ssh version 2
l2tp-class pwclass2
!
l2tp-class AKADO
!
!
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint
TP-self-signed-2130336792
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2130336792
revocation-check none
rsakeypair TP-self-signed-2130336792
!
!
crypto pki certificate chain TP-self-signed-2130336792
certificate self-signed
01
quit
username user privilege 15 secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXXX
!
pseudowire-class CLASS2
encapsulation l2tpv3
protocol l2tpv3 AKADO
ip local interface FastEthernet0/0
!
!
!
!
!
!
interface
Loopback0
ip address 192.168.4.1 255.255.255.0
!
interface FastEthernet0/0
description AKADO
mac-address 1111.2222.3333
ip address 10.x.x.x 255.255.255.0
ip nat outside
ip virtual-reassembly
load-interval 30
duplex auto
speed auto
!
interface FastEthernet0/1
description INTERNAL
ip address 192.168.15.254 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Virtual-PPP1
ip address negotiated
no ip
redirects
ip mtu 1460
ip flow ingress
ip nat outside
ip virtual-reassembly
load-interval 30
no peer neighbor-route
no cdp enable
ppp authentication chap
ppp chap hostname MY_USERNAME
ppp chap password MY_PASSWORD
ppp pap
sent-username MY_USERNAME password 7 MY_PASSWORD
pseudowire 10.0.0.72 1 pw-class CLASS2
!
ip route 10.0.0.0 255.0.0.0 10.x.x.3
!
!
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 1 interface
FastEthernet0/0 overload
!
ip access-list extended NAT
permit ip 192.168.15.0 0.0.0.255 any
!
access-list 1 permit 192.168.15.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
banner motd ^C
######################################
# #
# All actions logging #
# #
######################################
^C
!
line con 0
line aux 0
line vty 0 4
transport input telnet ssh
line vty 5 15
transport input
telnet ssh
!
scheduler allocate 20000 1000
end
Вообще l2tvp3 нужен для организации l2 pseudowire и вам вообще никаким боком для Акадо не нужен, так что переделывайте и смотрите debug ppp authentication,
debug ppp negotiation...
Рабочий конфиг.
Для работы внутренней сети провайдера и интернета требуется еще route-map.
Строка ppp authentication chap была лишней
Останется восстановить конфиг для DHCP и домашний роутер готов
version 15.1
service tcp-keepalives-in
service
tcp-keepalives-out
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service internal
service sequence-numbers
!
hostname c1841
!
boot-start-marker
warm-reboot
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication ppp default local
!
!
!
!
!
aaa session-id common
!
dot11 syslog
ip source-route
!
!
!
!
!
ip cef
ip domain
name s96.ru
ip name-server 10.0.0.1
ip name-server 10.0.0.2
ip name-server 8.8.8.8
ip multicast-routing
ip inspect WAAS flush-timeout 10
no ipv6 cef
l2tp-class AKADO
hostname AKADO_USERNAME !!!!!!!!!!!!!!!!!!!! ваш логин для VPN
!
!
multilink bundle-name authenticated
!
!
username USERCISCO privilege 15 secret 5 XXXXXXXXXXXXXX
!
redundancy
!
!
ip ssh logging events
ip ssh version 2
pseudowire-class PWCLASSAKADO
encapsulation l2tpv2
protocol l2tpv2
AKADO
ip local interface FastEthernet0/0
!
!
!
!
!
!
!
!
interface FastEthernet0/0
description AKADO
mac-address aaaa.vvvv.xxxx
ip address 10.x.x.x 255.255.255.0
ip nat outside
ip virtual-reassembly in
load-interval 30
duplex auto
speed auto
!
interface FastEthernet0/1
description INTERNAL
ip address 192.168.15.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Virtual-PPP1
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1460
ip flow ingress
ip nat outside
ip virtual-reassembly in
ip verify unicast reverse-path allow-self-ping
ip tcp adjust-mss 1420
load-interval
30
no peer neighbor-route
ppp chap hostname AKADO_USERNAME !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
ppp chap password AKADO_PASSWORD !!!!!!!!!! пароль от МЗТ
no cdp enable
pseudowire 10.0.0.68 1 encapsulation l2tpv2 pw-class PWCLASSAKADO
!
!
ip
forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
!
!
ip nat inside source route-map NAT_TO_ISP interface FastEthernet0/0 overload
ip nat inside source route-map NAT_TO_VPN interface Virtual-PPP1 overload
ip route
0.0.0.0 0.0.0.0 Virtual-PPP1
ip route 10.0.0.0 255.192.0.0 10.x.x.3
!
ip access-list extended NATHOMENET
permit ip 192.168.15.0 0.0.0.255 any
!
access-list 1 permit 192.168.15.0 0.0.0.255
!
!
!
!
route-map NAT_TO_VPN permit 10
match ip address NATHOMENET
match interface Virtual-PPP1
!
route-map NAT_TO_ISP permit 10
match ip address NATHOMENET
match interface FastEthernet0/0
!
!
!
!
!
control-plane
!
!
banner motd ^C
######################################
# #
# All actions logging #
# #
######################################
^C
!
line con 0
line aux 0
line vty 0 4
transport input telnet ssh
line vty 5 15
transport input telnet ssh
!
scheduler allocate 20000 1000
end
Сам спросил - сам отвечаю ... может кому пригодится ...
c1841-advsecurityk9-mz.124-3i.bin - не заработал.
c1841-adventerprisek9-mz.124-24.T - заработал.
Внимание! сейчас Вы не авторизованы и не можете подавать сообщения как зарегистрированный пользователь.
Чтобы авторизоваться, нажмите на эту ссылку (после авторизации вы вернетесь на
эту же страницу)
