Нужен рабочий пример конфига маршрутизатора ESR, сервер L2TP(IPSec)+ПК (конечный клиент)

[medvedev80]

Коллеги!

Выложите пожалуйста рабочий пример конфига маршрутизатора ESR, сервер L2TP(IPSec)+ПК (конечный клиент). Заранее большое спасибо!

Имею следующую ошибку:
2000-11-28T00:52:15+00:00 Connection established to 217.118.79.37, 43934. Local: 30501, Remote: 31794 (ref=0/0). LNS session is 'default'
2000-11-28T00:52:15+00:00 Call established with 217.118.79.37, Local: 34553, Remote: 15909, Serial: 492825395
2000-11-28T00:52:15+00:00 Plugin pppol2tp.so loaded.
2000-11-28T00:52:15+00:00 The remote system is required to authenticate itself
2000-11-28T00:52:15+00:00 but I couldn't find any suitable secret (password) for it to use to do so.
2000-11-28T00:52:15+00:00 call_close: Call 34553 to 217.118.79.37 disconnected
2000-11-28T00:52:16+00:00 handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
2000-11-28T00:52:16+00:00 Connection 31794 closed to 217.118.79.37, port 43934 (Result Code: expected at least 10, got

[medvedev80]

Собственно сам конфиг, ошибка в первом посте. Что не так? Что исправить/попробовать?



security zone trusted
exit
security zone untrusted
exit


object-group service telnet
port-range 23
exit
object-group service ssh
port-range 22
exit
object-group service dhcp_server
port-range 67
exit
object-group service dhcp_client
port-range 68
exit
object-group service ntp
port-range 123
exit
object-group service udp_500
port-range 500
exit
object-group service udp_1701
port-range 1701
exit
object-group service udp_4500
port-range 4500
exit


object-group network l2tp_local
ip address-range 10.10.10.1
exit
object-group network l2tp_dns
ip address-range 8.8.8.8
ip address-range 8.8.4.4
exit



interface gigabitethernet 1/0/1
description "Internet"
security-zone untrusted
ip address XXX.XXX.XXX.XXX/30
exit


security zone-pair trusted untrusted
rule 1
action permit
match protocol any
match source-address any
match destination-address any
enable
exit
exit
security zone-pair trusted trusted
rule 1
action permit
match protocol any
match source-address any
match destination-address any
enable
exit
exit
security zone-pair trusted self
rule 1
action permit
match protocol tcp
match source-address any
match destination-address any
match source-port any
match destination-port telnet
enable
exit
rule 10
action permit
match protocol tcp
match source-address any
match destination-address any
match source-port any
match destination-port ssh
enable
exit
rule 20
action permit
match protocol icmp
match source-address any
match destination-address any
enable
exit
rule 30
action permit
match protocol udp
match source-address any
match destination-address any
match source-port dhcp_client
match destination-port dhcp_server
enable
exit
rule 40
action permit
match protocol udp
match source-address any
match destination-address any
match source-port any
match destination-port ntp
enable
exit
exit
security zone-pair untrusted self
rule 5
action permit
match protocol any
match source-address any
match destination-address any
enable
exit
rule 10
action permit
match protocol icmp
match source-address any
match destination-address any
enable
exit
rule 20
action permit
match protocol esp
match source-address any
match destination-address any
enable
exit
rule 30
action permit
match protocol gre
match source-address any
match destination-address any
enable
exit
rule 40
action permit
match protocol udp
match source-address any
match destination-address any
match source-port any
match destination-port udp_500
enable
exit
rule 50
action permit
match protocol udp
match source-address any
match destination-address any
match source-port any
match destination-port udp_1701
enable
exit
rule 60
action permit
match protocol udp
match source-address any
match destination-address any
match source-port any
match destination-port udp_4500
enable
exit
exit



remote-access l2tp remote-workers
description "L2TP_server"
authentication mode local
local-address ip-address 10.10.10.1
remote-address address-range 10.10.10.100-10.10.10.200
outside-address ip-address XXX.XXX.XXX.XXX
dns-servers object-group l2tp_dns
security-zone trusted
ipsec authentication method pre-shared-key
ipsec authentication pre-shared-key ascii-text encrypted YYYYYYYYYYYYYYYYYYYYYYYYY
username vpntest
password ascii-text encrypted XXXXXXXXXXXXXXXXXXXXX
exit
enable
exit

[medvedev80]

Как включить debug для L2TP и IPSEC?

[leonid_zarkov]

Здравствуйте.

Секретный пароль на клиенте задан верно?
Клиент настроен так:
В конфигурации VPN для Windows выбираем тип VPN: Протокол L2TP c IPSec, переходим в дополнительные параметры и вводим ключ для IPSec в первое "Ключ".
Шифрование данных: обязательное;
Разрешить протоколы: CHAP и/или MS-CHAPv2
Логин/пароль используем в соответсвии с username на обородувании ( или RADIUS сервере, в зависимости от метода аутентификации).

[leonid_zarkov]

Необходимо активировать пользователя, дополните пожалуйста:

username vpntest
password ascii-text encrypted XXXXXXXXXXXXXXXXXXXXX
enable
exit

[medvedev80]

Спасибо большое! Помогла активация пользователя!

username vpntest
password ascii-text encrypted XXXXXXXXXXXXXXXXXXXXX
enable
exit