I am using several ISR G2 routers (819, 2901, etc) configured as L2TP/IPSec VPN concentrators. With current configuration it works good, but there are two odd things about it.

I used standard documents and vpdn part now look as follows:

vpdn enable
vpdn-group L2TP
 ! Default L2TP VPDN group
  protocol l2tp
  virtual-template 1
 no l2tp tunnel authentication

Working with non-standard clients, like strongswan + xl2tpd I have noticed that misconfigured client is able to exchange non-encrypted traffic in L2TP tunnel. I.e. if IPSec is not up - L2TP tunnel works by itself and I can tcpdump non-encrypted traffic. This is not happening with out-of-the-box clients, like Windows or Android. I believe those are blocking L2TP clear traffic when IPSec is not ready. I think its a bad idea having unneeded port open and leaving a flaw for client misconfiguration.

First question is - is there any configuration option to disable clear L2TP, enabling L2TP/IPSec only, except blocking it with ZBFW?

And slight other problem is L2TP with ZBFW. I have a strange rule in ZBFW:

zone-pair security pri-pub source private destination public
 service-policy type inspect pri-pub-pmap
policy-map type inspect pri-pub-pmap
 class type inspect ipsec-cmap
class-map type inspect match-all ipsec-cmap
 match access-group name ipsec-acl
ip access-list extended ipsec-acl
 permit udp any eq 1701 any

Without that rule VPN works between L2TP client and router itself only. It will not work between L2TP client and internal network logging 1701/UDP frames being dropped. Both client (VT and VI interfaces) and internal network (Gigabit interface) are in private zone, so it should not be filtered. Output packet is ESP-encap-UDP from self to public zone, which is also not filtered. It is awkward because no 1701/UDP packet will ever exist even if allowed.

Is it a side-effect of ZBFW or I have other problems in configuration?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.