0

I've extensively searched for everything I can think of regarding this subject online - I hope I'm just missing the obvious. This has been bugging me every evening for 2 weeks now.

(It's a Cisco 2851, in case that's relevant.)

I have a working VPN. What I believe is the "relevant" configuration is shown below:

aaa new-model
aaa authentication ppp default local
aaa authorization exec default local 
aaa authorization network default local
aaa accounting delay-start
aaa session-id common

l2tp congestion-control

vpdn enable

vpdn-group 1
 ! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1
 l2tp tunnel timeout no-session 15

username xxxxx password zz yyyyyyyyy

interface Virtual-Template1
 bandwidth inherit
 ip unnumbered Dialer1
 ip nat inside
 ip virtual-reassembly
 peer default ip address pool vpn_pool
 no keepalive
 ppp encrypt mppe auto
 ppp authentication pap chap ms-chap

It's a minimal configuration - (I've been trying to rule everything out!) - and it works from my OSX client using local authentication.

However upon enabling RADIUS authentication like so:

conf t
aaa authentication ppp default group radius
aaa authorization network default group radius

... I can continue to connect (all authentication passes etc) but packets don't flow.

Route table looks sane on my client. Routes on the Cisco look sane:

...
C        10.0.90.228/32 is directly connected, Virtual-Access6
...

Cisco can't ping client. Client can't ping Cisco. No traffic seems to flow.

I've got a ton of debug I'm happy to post here - but at the moment I feel like I'm not seeing the forest for the trees (so to speak). Any advice as to what specific debug to post?

This is the caller detail while connected with RADIUS:

  User: ******************, line Vi6, service PPPoVPDN
        Connected for 00:00:58, Idle for 00:00:18
  Timeouts:    Limit     Remaining Timer Type
               -         -         -         
  PPP: LCP Open, MS CHAP (<-), IPCP, CCP
  NCP: Open IPCP, CCP

Vi6 LCP: [Open] 
Our Negotiated Options
Vi6 LCP:    AuthProto MS-CHAP (0x0305C22380)
Vi6 LCP:    MagicNumber 0x45DF39FE (0x050645DF39FE)
Peer's Negotiated Options
Vi6 LCP:    ACCM 0x00000000 (0x020600000000)
Vi6 LCP:    MagicNumber 0x0066ABB7 (0x05060066ABB7)
Vi6 LCP:    PFC (0x0702)
Vi6 LCP:    ACFC (0x0802)

Vi6 IPCP: [Open] 
Our Negotiated Options
Vi6 IPCP:    Address 212.159.119.145 (0x0306D49F7791)
Peer's Negotiated Options
Vi6 IPCP:    Address 10.0.90.228 (0x03060A005AE4)
Vi6 IPCP:    PrimaryDNS 10.0.40.10 (0x81060A00280A)
Peer's Rejected options
  SecondaryDNS

Vi6 CCP: [Open] 
Our Negotiated Options
Vi6 CCP:    MS-PPC supported bits 0x01000040 (0x120601000040)
Peer's Negotiated Options
Vi6 CCP:    MS-PPC supported bits 0x01000040 (0x120601000040)
  IP: Local 212.159.119.145, remote 10.0.90.228
  Counts: 41 packets input, 3260 bytes, 0 no buffer
          0 input errors, 0 CRC, 0 frame, 0 overrun
          12 packets output, 180 bytes, 0 underruns
          0 output errors, 0 collisions, 0 interface resets

And here's a tcpdump of the RADIUS conversation (it's FreeRADIUS with an ldap backend):

    21:31:41.645834 IP (tos 0x0, ttl 254, id 61079, offset 0, flags [none], proto UDP (17), length 182)
        10.0.30.1.datametrics > sirius.ad.plfc.org.uk.radius: [udp sum ok] 

RADIUS, length: 154
 Access Request (1), id: 0x54, Authenticator: 8f1b0b4e3054e4e30000000000000000
   Framed Protocol Attribute (7), length: 6, Value: PPP
     0x0000:  0000 0001
   Username Attribute (1), length: 13, Value: **********
     0x0000:  6d61 7474 6865 7768 616c 6c
   Vendor Specific Attribute (26), length: 16, Value: Vendor: Microsoft (311)
     Vendor Attribute: 11, Length: 8, Value: ...N0T..
     0x0000:  0000 0137 0b0a 8f1b 0b4e 3054 e4e3
   Vendor Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
     Vendor Attribute: 1, Length: 50, Value: ..........................T..u....z.....u?=# .&.?.
     0x0000:  0000 0137 0134 0101 0000 0000 0000 0000
     0x0010:  0000 0000 0000 0000 0000 0000 0000 0000
     0x0020:  5405 d575 8c87 edbe 7adc 9b14 b2e6 753f
     0x0030:  3d23 20fc 26f6 8094
   NAS Port Type Attribute (61), length: 6, Value: Virtual
     0x0000:  0000 0005
   NAS Port Attribute (5), length: 6, Value: 286
     0x0000:  0000 011e
   NAS Port ID Attribute (87), length: 17, Value: Uniq-Sess-ID286
     0x0000:  556e 6971 2d53 6573 732d 4944 3238 36
   Service Type Attribute (6), length: 6, Value: Framed
     0x0000:  0000 0002
   NAS IP Address Attribute (4), length: 6, Value: 10.0.30.1
     0x0000:  0a00 1e01
21:31:41.793107 IP (tos 0x0, ttl 64, id 41574, offset 0, flags [none], proto UDP (17), length 124)
    sirius.ad.plfc.org.uk.radius > 10.0.30.1.datametrics: [bad udp cksum 0x5a85 -> 0xe26b!] RADIUS, length: 96
 Access Accept (2), id: 0x54, Authenticator: dff324dc434fb85e03fd402ed4645530
   Framed Protocol Attribute (7), length: 6, Value: PPP
     0x0000:  0000 0001
   Framed Compression Attribute (13), length: 6, Value: VJ TCP/IP
     0x0000:  0000 0001
   Vendor Specific Attribute (26), length: 40, Value: Vendor: Microsoft (311)
     Vendor Attribute: 12, Length: 32, Value: W...-..wu...i....H;. .R"....M.R"
     0x0000:  0000 0137 0c22 57f8 f2af 2dfa 0177 7585
     0x0010:  e6ff 69a8 0a03 cf48 3ba0 20e1 5222 b79e
     0x0020:  a31d 4df5 5222
   Vendor Specific Attribute (26), length: 12, Value: Vendor: Microsoft (311)
     Vendor Attribute: 7, Length: 4, Value: ....
     0x0000:  0000 0137 0706 0000 0001
   Vendor Specific Attribute (26), length: 12, Value: Vendor: Microsoft (311)
     Vendor Attribute: 8, Length: 4, Value: ....
     0x0000:  0000 0137 0806 0000 0006

I'm all out of ideas. All the debug I've tried looks identical (except where authentication is involved) as far as I can tell. Thanks in advance.

1 Answer 1

0

Well, I never solved the problem. I exhausted everything I could think of, and concluded that (simply) Cisco's IOS (version listed below) simply won't allow PPTP authentication via RADIUS.

My conclusion is strengthened only by the "lack" of proof of otherwise. Adding minimal L2TP configuration worked using the same RADIUS configuration - which suggests the issue lies within Cisco's PPTP code.

Cisco IOS Software, 2800 Software (C2800NM-ADVSECURITYK9-M), Version 15.1(1)T, R                                                                                                                                                                                                                                             

Anyway, for anyone who trips across this answer in the future - you weren't alone. I successfully switched to L2TP, and never resolved why PPTP wouldn't play ball (with RADIUS auth specifically).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .