Cisco Support Community
Community Member

VPN Fails on 851

Using CCP installed EasyVPN after setup completed ran the test andit failed see below

What commands can I enter to check this?

New at VPN so I am sure I have something miss configured. 

Router Details

Router Model 851W
Image Name c850-advsecurityk9-mz.124-4.T7.bin
IOS Version 12.4(4)T7
Hostname MyRouter

Test Activity Summary

Checking interface status... Failed

Test Activity Details

Checking interface status... Failed

Troubleshooting Results

Failure Reason(s)Recommended Action(s)
All the crypto applied interface(s) are down or no crypto applied interface is present Make the connection up and then proceed with VPN troubleshooting.

Any ideas



VPN Fails on 851

Well, it looks like your interface is down. Can you check the status of the interfaces?

Is there something plugged already?

Please post the outcome of the commands "show ip int brief" and "show run" if you have any problems figuring that out.


Community Member

VPN Fails on 851


yes I can not sure

here are the commands you asked for

MyRouter#show run
Building configuration...

Current configuration : 7302 bytes
! Last configuration change at 15:10:27 EST Tue Dec 27 2011 by netman
! NVRAM config last updated at 10:17:10 EST Tue Dec 27 2011 by netman
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname MyRouter
logging buffered 51200 warnings
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
aaa new-model
aaa group server radius sdm-vpn-server-group-1
server auth-port 1645 acct-port 1646
aaa authentication login default local
aaa authentication login ciscocp_vpn_xauth_ml_1 group sdm-vpn-server-group-1 loc
aaa authorization exec default local
aaa authorization network ciscocp_vpn_group_ml_1 group sdm-vpn-server-group-1 lo
aaa session-id common
resource policy
clock timezone EST -5
clock summer-time edt recurring
ip subnet-zero
no ip dhcp use vrf connected
ip dhcp excluded-address
ip dhcp pool sdm-pool
   import all
   lease 0 2
ip cef
ip domain name TGCSNET.COM
ip name-server
ip name-server
ip name-server
crypto pki trustpoint TP-self-signed-1164042433
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1164042433
revocation-check none
rsakeypair TP-self-signed-1164042433
crypto pki certificate chain TP-self-signed-1164042433
certificate self-signed 01
  3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 31313634 30343234 3333301E 170D3032 30333031 30303038
  34375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 31363430
  34323433 3330819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  8100B993 8AAE8B8C D8869842 C0C80A8C 57559B0A 243A306C EF726BD6 A79FBB30
  63569C86 5117E6D9 9E14BF1D 2721D4C6 2CCFB67A D7A03AC3 6BC719DB 1237121C
  8E310E9F 68F65DF7 B5986355 71B6C338 C34EC816 A677028D 0E131859 3A50E498
  C1F94525 2DA35215 3EF10350 018C419A 4F49245F 1218C545 0BE18AA4 04A8F049
  7AA90203 010001A3 74307230 0F060355 1D130101 FF040530 030101FF 301F0603
  551D1104 18301682 144D7952 6F757465 722E5447 43534E45 542E434F 4D301F06
  03551D23 04183016 80149A8A F1DA8EF9 7BC577ED 349FDA87 2E93A11F 8D16301D
  0603551D 0E041604 149A8AF1 DA8EF97B C577ED34 9FDA872E 93A11F8D 16300D06
  092A8648 86F70D01 01040500 03818100 3092C5D5 9FA063C7 E85E37A5 7F9B3AC3
  A71B0BF1 A0BE1E4B 088C151A 6E056769 8E8FFCC9 3FA38091 38C53A49 CE1F20BE
  172A1C93 282C5F97 19A6D3B0 CF65552D FEADA8C0 E89075DD 667B6ABE 9CF76D13
  5E23D7CA A3BEC64D 21941DFB 3915D0C4 4221F663 1306DDF8 DF48E0AC DCC43028
  0D392C9C 66EABDED BB4F4D54 5ED039B9
username netman privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
username mynet privilege 15 secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp client configuration group TGCSVPN
key ourvpn
domain our
pool SDM_POOL_1
max-users 10
crypto isakmp profile ciscocp-ike-profile-1
   match identity group WGP-1
   match identity group WGP-2
   match identity group ACCTG
   match identity group CSVC
   match identity group TGCSVPN
   client authentication list ciscocp_vpn_xauth_ml_1
   isakmp authorization list ciscocp_vpn_group_ml_1
   client configuration address respond
   virtual-template 1
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec profile CiscoCP_Profile1
set transform-set ESP-3DES-SHA
set isakmp-profile ciscocp-ike-profile-1
bridge irb
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface FastEthernet4
description $ETH-WAN$
ip address
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
interface Virtual-Template1 type tunnel
ip unnumbered FastEthernet4
tunnel mode ipsec ipv4
tunnel protection ipsec profile CiscoCP_Profile1
interface Dot11Radio0
no ip address
encryption vlan 1 mode ciphers tkip
ssid 010659120255
    vlan 1
    authentication open
    authentication key-management wpa
    wpa-psk ascii 0 010659120255000000
speed basic-1.0 2.0 5.5 6.0 9.0 11.0 12.0 18.0 24.0 36.0 48.0 54.0
channel 2437
station-role root
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no snmp trap link-status
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface Vlan1
no ip address
ip virtual-reassembly
ip tcp adjust-mss 1452
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
ip address
ip nat inside
ip virtual-reassembly
ip local pool SDM_POOL_1
ip classless
ip route
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 10000
ip nat inside source list 110 interface FastEthernet4 overload
ip nat inside source static tcp 8080 interface FastEthernet4 8080
ip nat inside source static tcp 25 interface FastEthernet4 25
ip nat inside source static tcp 80 interface FastEthernet4 80
ip nat inside source static tcp 21 interface FastEthernet4 21
ip nat inside source static tcp 5900 interface FastEthernet4 5900
ip nat inside source static tcp 443 interface FastEthernet4 443
ip access-list extended denyDHCP
deny   udp any any eq bootpc
deny   udp any any eq bootps
permit ip any any
ip radius source-interface BVI1
access-list 23 permit
access-list 110 permit ip any
no cdp run
radius-server host auth-port 1645 acct-port 1646
bridge 1 route ip
banner login ^C
Cisco Router and Security Device Manager (SDM) is installed on this device.
This feature requires the one-time use of the username "cisco"
with the password "cisco". The default username and password have a privilege le
vel of 15.

Please change these publicly known initial credentials using SDM or the IOS CLI.

Here are the Cisco IOS commands.

username   privilege 15 secret 0
no username cisco

Replace and with the username and password you want to use

For more information about SDM please follow the instructions in the QUICK START

GUIDE for your router or go to
line con 0
no modem enable
line aux 0
line vty 0 4
access-class 23 in
transport input telnet ssh
scheduler max-task-time 5000
ntp clock-period 17175153
ntp server

MyRouter#show ip int brief
Interface                  IP-Address      OK? Method Status                Prot
Dot11Radio0                unassigned      YES TFTP   up                    up

Dot11Radio0.1              unassigned      YES unset  up                    up

FastEthernet0              unassigned      YES unset  up                    up

FastEthernet1              unassigned      YES unset  up                    up

FastEthernet2              unassigned      YES unset  up                    up

FastEthernet3              unassigned      YES unset  up                    down

FastEthernet4        YES NVRAM  up                    up

Vlan1                      unassigned      YES NVRAM  up                    up

NVI0                       unassigned      YES unset  up                    up

BVI1                 YES NVRAM  up                    up

Virtual-Dot11Radio0        unassigned      YES TFTP   down                  down

Virtual-Dot11Radio0.1      unassigned      YES unset  down                  down

Virtual-Template1    YES TFTP   down                  down

Virtual-Access1            unassigned      YES unset  down                  down


I am new to VPN so I might have something setup incorrectly or missing not sure



VPN Fails on 851


Your WAN interface is up, how are you testing the VPN client connection? Have you grabbed a VPN client and tried to connect to the Router with the credentials you configured?


Community Member

VPN Fails on 851


No client testing yet

the VPN light on the router is not lite and not sure if it is only when I have client activity I am guessing that is why.

Not sure have to get the clients to logon yet

what information do they need to configure the connection? is my internet address the one they need

I just tried on my laptop got this error is not set up to establish a connection on port "pptp" with this computer

You think my configuration on the router is ok?



CreatePlease to create content