I am using several ISR G2 routers (819, 2901, etc) configured as L2TP/IPSec VPN concentrators. With current configuration it works good, but there are two odd things about it.
I used standard documents and vpdn part now look as follows:
vpdn enable ! vpdn-group L2TP ! Default L2TP VPDN group accept-dialin protocol l2tp virtual-template 1 no l2tp tunnel authentication
Working with non-standard clients, like strongswan + xl2tpd I have noticed that misconfigured client is able to exchange non-encrypted traffic in L2TP tunnel. I.e. if IPSec is not up - L2TP tunnel works by itself and I can tcpdump non-encrypted traffic. This is not happening with out-of-the-box clients, like Windows or Android. I believe those are blocking L2TP clear traffic when IPSec is not ready. I think its a bad idea having unneeded port open and leaving a flaw for client misconfiguration.
First question is - is there any configuration option to disable clear L2TP, enabling L2TP/IPSec only, except blocking it with ZBFW?
And slight other problem is L2TP with ZBFW. I have a strange rule in ZBFW:
zone-pair security pri-pub source private destination public service-policy type inspect pri-pub-pmap policy-map type inspect pri-pub-pmap class type inspect ipsec-cmap pass class-map type inspect match-all ipsec-cmap match access-group name ipsec-acl ip access-list extended ipsec-acl permit udp any eq 1701 any
Without that rule VPN works between L2TP client and router itself only. It will not work between L2TP client and internal network logging 1701/UDP frames being dropped. Both client (VT and VI interfaces) and internal network (Gigabit interface) are in private zone, so it should not be filtered. Output packet is ESP-encap-UDP from self to public zone, which is also not filtered. It is awkward because no 1701/UDP packet will ever exist even if allowed.
Is it a side-effect of ZBFW or I have other problems in configuration?