Back with my Cisco 3825 ISR. Now we need to have VPN working. I followed this guide: L2TP over IPsec on Cisco IOS Router Using Windows 8

It doesn't work. I'll post my config here so you can check it for mistakes:

myRouter1#show run
Building configuration...


Current configuration : 3730 bytes
!
! Last configuration change at 10:19:53 EST Fri Oct 6 2017 by theuser
! NVRAM config last updated at 09:15:32 EST Fri Oct 6 2017 by theuser
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname myRouter1
!
boot-start-marker
boot system flash:c3825-adventerprisek9-mz.124-24.T6.bin
boot-end-marker
!
logging message-counter syslog
no logging console
enable secret 5 astring
enable password password1
!
aaa new-model
!
!
aaa authentication ppp VPDN_AUTH local
!
!
aaa session-id common
clock timezone EST -4
!
dot11 syslog
ip source-route
ip cef
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.0.1.1 10.0.1.2
ip dhcp excluded-address 10.0.1.58
!
ip dhcp pool myDHCP
   network 10.0.1.0 255.255.255.0
   default-router 10.0.1.1
   dns-server 8.8.8.8 8.8.4.4
!
ip dhcp pool myPrinter
   host 10.0.1.58 255.255.255.0
   hardware-address f481.39b8.13b7
   client-name myPrinter
!
!
ip domain name office.my.com
ip name-server 8.8.8.8
ip name-server 8.8.4.4
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
vpdn enable
!
vpdn-group L2TP
! Default L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 1
 no l2tp tunnel authentication
!
!
voice-card 0
!
!
!
!
!
username theuser privilege 15 password 0 password2
username ANOTHERUSER privilege 0 password 0 password3
archive
 log config
  hidekeys
!
!
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key ANOTHERUSER address 0.0.0.0 0.0.0.0
!
!
crypto ipsec transform-set L2TP-Set2 esp-3des esp-sha-hmac
 mode transport
!
crypto dynamic-map dyn-map 10
 set nat demux
 set transform-set L2TP-Set2
!
!
crypto map outside_map 65535 ipsec-isakmp dynamic dyn-map
!
!
!
ip ssh authentication-retries 2
ip ssh version 2
!
!
!
!
interface Loopback0
 ip address 10.0.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Loopback1
 description loopback for IPsec-pool
 ip address 1.1.1.11 255.255.255.255
!
interface GigabitEthernet0/0
 description LAN
 ip address 10.0.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 media-type rj45
 no mop enabled
 hold-queue 4096 in
 hold-queue 4096 out
!
interface GigabitEthernet0/1
 description WAN
 ip address my.wan.ip.add 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
 media-type rj45
 crypto map outside_map
 hold-queue 4096 in
 hold-queue 4096 out
!
interface GigabitEthernet1/0
 no ip address
 shutdown
!
interface Virtual-Template1
 ip unnumbered Loopback1
 peer default ip address pool l2tp-pool
 ppp authentication ms-chap-v2 VPDN_AUTH
!
ip local pool l2tp-pool 1.1.1.1 1.1.1.10
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 45.73.10.69
no ip http server
no ip http secure-server
!
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
!
ip access-list extended myFirewall #Note this one isn't used.
 remark Basic set of rules to protect us
 permit icmp any any echo-reply
 permit tcp any any established
 permit udp any any eq domain
 permit udp any eq domain any
ip access-list extended SSH_ACCESS
 permit tcp 10.0.1.0 0.0.0.255 any eq 22
!
access-list 1 permit 10.0.1.0 0.0.0.255
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
gateway
 timer receive-rtp 1200
!
!
!
line con 0
line aux 0
line 66
 no activation-character
 no exec
 transport preferred none
 transport input all
 transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
line vty 0 4
 access-class SSH_ACCESS in
 transport input ssh
line vty 5 321
line vty 322 326
 transport input none
!
scheduler allocate 20000 1000
ntp server 144.217.240.204
end

When trying to connect from an outside line, this is what I get:

myRouter1#show crypto isakmp sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
       K - Keepalives, N - NAT-traversal
       T - cTCP encapsulation, X - IKE Extended Authentication
       psk - Preshared key, rsig - RSA signature
       renc - RSA encryption
IPv4 Crypto ISAKMP SA

C-id  Local           Remote          I-VRF    Status Encr Hash Auth DH Lifetime Cap.

1011  my.wan.ip.add     my.test.ip.add           ACTIVE 3des sha  psk  2  0
       Engine-id:Conn-id =  SW:11

IPv6 Crypto ISAKMP SA

Thanks in advance for any insight on this. enter image description here

  • 1
    "It doesn't work." is not a proper description of the problem. You need to be specific about what doesn't work, and why you think that. Logs and debugging information is also useful. – Ron Maupin Oct 11 '17 at 14:19
  • @RonMaupin yeah I know. Unfortunately thie above is basically all I know how to provide. Windows 10 isn't particularly verbose when it comes to errors. What could I do on the router to show more useful info? By "doesn't work" I mean that it just doesn't connect. I'll attacha screenshot of what Windows shows. – Bruce Oct 11 '17 at 14:29
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 at 17:40
  • Is there an option to close as "Unable to duplicate"? Would be useful when an OP answers their own question and it won't be useful for future readers. What should be the proper close/flag status? – Kevin Bowen Apr 10 at 3:28

I just now realized that I'd specified the username as the psk instead of the password. Sorry, it's always something that's staring you right in the face.

  • 1
    You should accept your own answer so that this question doesn't keep popping up looking for an answer. – Ron Trunk Oct 11 '17 at 16:16
  • Yeah, I have to wait two days :P – Bruce Oct 11 '17 at 20:28
  • You should accept your answer so that the question doesn't keep popping up forever looking for an answer. – Ron Maupin Dec 10 '17 at 20:45

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.