Hello, i having problem with VPN connection from a windows PC using L2TP/IPsec, i alow all necesary protocols (GRE, ESP, PPTP, UDP-500, UDP-4500 and UDP-1701) on outside interface on PIX (version 8.0(4)), i'm perfectly connect with PPTP but when i tried with L2TP the conecction can't be established, in PIX log i can see the creating session for ports 500 and 4500, on PC have and error that the server can be reach. I'm using a ISA Server cluster for VPN Server, the configuration are like follows:
PC <----> PIX <-----> MS ISA <------> LAN
PC IP 10.3.0.12/28
PIX external IP 10.3.0.1/28
PIX Internal IP 172.16.0.1/28
ISA external IP 172.16.0.2/28
I'm using Static NAT for the external interface of the ISA for the VPN access with IP 10.3.0.3
What might be forgetting???
I will appretiated the help any one can provide me.
The details given looks good.. would you have the configs handy ? Just wanted to check the CLI commands that you had used ?
Just to test, were you able to create L2TP session from inside the PIX, just to make sure the server works good ? Do you see any drops on the "show log" of PIX when you initiate L2TP from outside ? sysopt commands can be useful, but thats more for traffic initiating from inside to outside.. in your case its from internet to inside right ? Just curious, do you have any personal firewalls on your desktop ? You can also try opening ip any on the outside and test, just to test if the NAT and other stuff works good... are there any ACLs on the inside?
I attached the config of PIX, in this config you can see that I’m use tree interfaces, one for management with security 100, one DMZ between PIX and MS ISA with security 90 and the Outside with security 0.
Answering your questions, I make tests of L2TP sessions from DMZ Sub-net (Attaching PC to this Subnet) to the MS ISA Server and works perfectly, i can't see any drop packets on PIX log when initiated L2TP session from outside, like you said the traffic are initiated from outside, but to DMZ; i turn off the Windows Firewall and the Antivirus Firewall and the result is the same, i make a test open all traffic from outside (IP, TCP, UDP, ICMP) but can connect anyway; I don't have any ACL applied to inside interface.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in HA
DocumentationCode download linksGoalRequirementLimitationsSupported ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and UCS-E Blades:Step by Step ConfigurationCo...
I am currently unable to specify "crypto keyring" command when configuring VPN connection on my cisco 2901 router.
The following licenses have been activated on my router :