I've extensively searched for everything I can think of regarding this subject online - I hope I'm just missing the obvious. This has been bugging me every evening for 2 weeks now.
(It's a Cisco 2851, in case that's relevant.)
I have a working VPN. What I believe is the "relevant" configuration is shown below:
aaa new-model
aaa authentication ppp default local
aaa authorization exec default local
aaa authorization network default local
aaa accounting delay-start
aaa session-id common
l2tp congestion-control
vpdn enable
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
l2tp tunnel timeout no-session 15
username xxxxx password zz yyyyyyyyy
interface Virtual-Template1
bandwidth inherit
ip unnumbered Dialer1
ip nat inside
ip virtual-reassembly
peer default ip address pool vpn_pool
no keepalive
ppp encrypt mppe auto
ppp authentication pap chap ms-chap
It's a minimal configuration - (I've been trying to rule everything out!) - and it works from my OSX client using local authentication.
However upon enabling RADIUS authentication like so:
conf t
aaa authentication ppp default group radius
aaa authorization network default group radius
... I can continue to connect (all authentication passes etc) but packets don't flow.
Route table looks sane on my client. Routes on the Cisco look sane:
...
C 10.0.90.228/32 is directly connected, Virtual-Access6
...
Cisco can't ping client. Client can't ping Cisco. No traffic seems to flow.
I've got a ton of debug I'm happy to post here - but at the moment I feel like I'm not seeing the forest for the trees (so to speak). Any advice as to what specific debug to post?
This is the caller detail while connected with RADIUS:
User: ******************, line Vi6, service PPPoVPDN
Connected for 00:00:58, Idle for 00:00:18
Timeouts: Limit Remaining Timer Type
- - -
PPP: LCP Open, MS CHAP (<-), IPCP, CCP
NCP: Open IPCP, CCP
Vi6 LCP: [Open]
Our Negotiated Options
Vi6 LCP: AuthProto MS-CHAP (0x0305C22380)
Vi6 LCP: MagicNumber 0x45DF39FE (0x050645DF39FE)
Peer's Negotiated Options
Vi6 LCP: ACCM 0x00000000 (0x020600000000)
Vi6 LCP: MagicNumber 0x0066ABB7 (0x05060066ABB7)
Vi6 LCP: PFC (0x0702)
Vi6 LCP: ACFC (0x0802)
Vi6 IPCP: [Open]
Our Negotiated Options
Vi6 IPCP: Address 212.159.119.145 (0x0306D49F7791)
Peer's Negotiated Options
Vi6 IPCP: Address 10.0.90.228 (0x03060A005AE4)
Vi6 IPCP: PrimaryDNS 10.0.40.10 (0x81060A00280A)
Peer's Rejected options
SecondaryDNS
Vi6 CCP: [Open]
Our Negotiated Options
Vi6 CCP: MS-PPC supported bits 0x01000040 (0x120601000040)
Peer's Negotiated Options
Vi6 CCP: MS-PPC supported bits 0x01000040 (0x120601000040)
IP: Local 212.159.119.145, remote 10.0.90.228
Counts: 41 packets input, 3260 bytes, 0 no buffer
0 input errors, 0 CRC, 0 frame, 0 overrun
12 packets output, 180 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
And here's a tcpdump of the RADIUS conversation (it's FreeRADIUS with an ldap backend):
21:31:41.645834 IP (tos 0x0, ttl 254, id 61079, offset 0, flags [none], proto UDP (17), length 182)
10.0.30.1.datametrics > sirius.ad.plfc.org.uk.radius: [udp sum ok]
RADIUS, length: 154
Access Request (1), id: 0x54, Authenticator: 8f1b0b4e3054e4e30000000000000000
Framed Protocol Attribute (7), length: 6, Value: PPP
0x0000: 0000 0001
Username Attribute (1), length: 13, Value: **********
0x0000: 6d61 7474 6865 7768 616c 6c
Vendor Specific Attribute (26), length: 16, Value: Vendor: Microsoft (311)
Vendor Attribute: 11, Length: 8, Value: ...N0T..
0x0000: 0000 0137 0b0a 8f1b 0b4e 3054 e4e3
Vendor Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311)
Vendor Attribute: 1, Length: 50, Value: ..........................T..u....z.....u?=# .&.?.
0x0000: 0000 0137 0134 0101 0000 0000 0000 0000
0x0010: 0000 0000 0000 0000 0000 0000 0000 0000
0x0020: 5405 d575 8c87 edbe 7adc 9b14 b2e6 753f
0x0030: 3d23 20fc 26f6 8094
NAS Port Type Attribute (61), length: 6, Value: Virtual
0x0000: 0000 0005
NAS Port Attribute (5), length: 6, Value: 286
0x0000: 0000 011e
NAS Port ID Attribute (87), length: 17, Value: Uniq-Sess-ID286
0x0000: 556e 6971 2d53 6573 732d 4944 3238 36
Service Type Attribute (6), length: 6, Value: Framed
0x0000: 0000 0002
NAS IP Address Attribute (4), length: 6, Value: 10.0.30.1
0x0000: 0a00 1e01
21:31:41.793107 IP (tos 0x0, ttl 64, id 41574, offset 0, flags [none], proto UDP (17), length 124)
sirius.ad.plfc.org.uk.radius > 10.0.30.1.datametrics: [bad udp cksum 0x5a85 -> 0xe26b!] RADIUS, length: 96
Access Accept (2), id: 0x54, Authenticator: dff324dc434fb85e03fd402ed4645530
Framed Protocol Attribute (7), length: 6, Value: PPP
0x0000: 0000 0001
Framed Compression Attribute (13), length: 6, Value: VJ TCP/IP
0x0000: 0000 0001
Vendor Specific Attribute (26), length: 40, Value: Vendor: Microsoft (311)
Vendor Attribute: 12, Length: 32, Value: W...-..wu...i....H;. .R"....M.R"
0x0000: 0000 0137 0c22 57f8 f2af 2dfa 0177 7585
0x0010: e6ff 69a8 0a03 cf48 3ba0 20e1 5222 b79e
0x0020: a31d 4df5 5222
Vendor Specific Attribute (26), length: 12, Value: Vendor: Microsoft (311)
Vendor Attribute: 7, Length: 4, Value: ....
0x0000: 0000 0137 0706 0000 0001
Vendor Specific Attribute (26), length: 12, Value: Vendor: Microsoft (311)
Vendor Attribute: 8, Length: 4, Value: ....
0x0000: 0000 0137 0806 0000 0006
I'm all out of ideas. All the debug I've tried looks identical (except where authentication is involved) as far as I can tell. Thanks in advance.