I need help with the Cisco VPN server configuration using MS IAS server for authentication & authorization, when my remote clients try to establish a vpn connection, the verification of username & password is passed but they get a TCP/IP CP reported error 733 message. Its the Cisco router which is supposed to be giving out ip addresses using the pool I called VPN_pool in the setup and the MS IAS remote access policy setting has “client may request an IP Address” selected.
Below is Router configuration with some informed replaced with wxyz for security reasons
…………………………………………
Liberty#sh run
Building configuration…
Current configuration : 6874 bytes
!
! Last configuration change at 13:54:11 PCTime Fri Mar 27 2009 by Liberty
! NVRAM config last updated at 13:12:01 PCTime Fri Mar 27 2009 by Liberty
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Liberty
!
boot-start-marker
boot-end-marker
!
logging buffered 52000
enable secret 5 $1$/ban$xzor9cO33jKWMjRPSpVVj.
enable password 7 094940081B0912
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login VPN_users passwd-expiry group radius
aaa authentication ppp default group radius
aaa authorization exec default local
aaa authorization network VPN_group group radius
!
!
aaa session-id common
clock timezone PCTime 0
!
crypto pki trustpoint TP-self-signed-1689873663
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1689873663
revocation-check none
rsakeypair TP-self-signed-1689873663
!
!
crypto pki certificate chain TP-self-signed-1689873663
certificate self-signed 01
3082024D 308201B6 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31363839 38373336 3633301E 170D3032 30333031 30303435
34345A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 36383938
37333636 3330819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100ED3D 48558518 A6A949BA A32DF55A 998AA83F CACB20F3 EC79CA66 46932C10
C2591E0C B4B1DFFF F63024F7 3A9F54A0 C7F56E71 ABE85F0B 94869496 29343EF7
4A0A6E5A 3450EC64 6BEF1364 2095F3DF 304670FA 4EFC0972 7D16C2D5 6509F41E
E8E63933 064002CF F9EFBDF6 E31EB550 F8EA7B14 B3AB9B59 23DC5CF2 7DC64BFB
C8970203 010001A3 75307330 0F060355 1D130101 FF040530 030101FF 30200603
551D1104 19301782 154C6962 65727479 2E4C6962 65727479 2E6C6F63 616C301F
0603551D 23041830 16801459 91673240 AE04BCA0 2FB5CEB6 85CB8B5A FE663430
1D060355 1D0E0416 04145991 673240AE 04BCA02F B5CEB685 CB8B5AFE 6634300D
06092A86 4886F70D 01010405 00038181 00A7AD8B 0B9A0EB2 EF7F2B28 625F0A65
A34F53D2 BB6CFDB1 AC5A369B FDFB3D53 F958A7C2 B3B7A080 B80E15AB A5F76F88
A510C60A E3380CC2 E92B6141 7DAD2830 A1B06FD6 F484662E B9FE9659 1772F8CB
5458CA2A 55D0BCD2 5A3AD04E 95AD2D43 E0C8250B F2E35768 86563E80 D48A340D
76CBA699 D732ABFA 20E68CFE 75984B24 BE
quit
dot11 syslog
!
dot11 ssid BTLIBERTY
vlan 1
authentication open
guest-mode
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.2.1
ip dhcp excluded-address 192.168.2.101 192.168.2.254
ip dhcp excluded-address 192.168.1.1
ip dhcp excluded-address 192.168.1.101 192.168.1.254
!
ip dhcp pool sdm-pool
import all
network 192.168.1.0 255.255.255.0
default-router 192.168.1.254
domain-name Liberty.local
dns-server 192.168.1.120 194.72.9.34
!
ip dhcp pool Wireless
import all
network 192.168.2.0 255.255.255.0
domain-name liberty.local
dns-server 192.168.1.120 194.72.9.34
default-router 192.168.2.254
!
!
ip domain name Liberty.local
ip name-server 194.72.9.34
ip name-server 62.6.40.178
!
vpdn-group TEST-VPN
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
!
!
!
username Liberty privilege 15 secret 5 $1$5UOr$W4vOKti7PY.DDF86L4ddo/
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp client configuration group VPN_client
key challenge123
pool VPN_pool
acl 101
!
!
crypto ipsec transform-set VPN_client esp-3des esp-md5-hmac
!
crypto dynamic-map dymmap 2
set transform-set VPN_client
!
!
crypto map client client authentication list VPN_users
crypto map client isakmp authorization list VPN_group
crypto map client client configuration address respond
crypto map client 10 ipsec-isakmp dynamic dymmap
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
!
!
!
interface ATM0
no ip address
ip route-cache flow
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.2 point-to-point
pvc 0/38
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Virtual-Template1
ip unnumbered Dialer1
ip nat inside
ip virtual-reassembly
peer default ip address pool VPN_pool
ppp encrypt mppe auto required
ppp authentication ms-chap ms-chap-v2
!
interface Dot11Radio0
no ip address
ip route-cache flow
!
encryption vlan 1 key 1 size 40bit 7 075857CA375A transmit-key
encryption vlan 1 mode wep mandatory
!
ssid BTLIBERTY
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
54.0
station-role root
!
interface Dot11Radio0.1
description Wireless Interface$FW_INSIDE$
encapsulation dot1Q 1 native
ip address 192.168.2.254 255.255.255.0
ip nat inside
ip virtual-reassembly
no cdp enable
!
interface Vlan1
description LAN Interface$FW_INSIDE$
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
interface Dialer1
description WAN Interface$FW_OUTSIDE$
ip address negotiated
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip route-cache flow
dialer pool 1
dialer-group 1
no cdp enable
ppp authentication chap callin
ppp chap hostname B121671@hg39.btclick.com
ppp chap password 7 13151601181B0B382F75
crypto map client
!
ip local pool VPN_pool 192.168.3.1 192.168.3.100
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 110 interface Dialer1 overload
ip nat inside source static tcp 192.168.1.120 80 w.x.y.z 80 extendable
ip nat inside source static tcp 192.168.1.120 443 w.x.y.z 443 extendable
ip nat inside source static tcp 192.168.1.120 3389 w.x.y.z 3389 extendab
le
!
access-list 23 remark SDM_ACL Category=17
access-list 23 permit 192.168.1.0 0.0.0.255
access-list 23 permit 192.168.2.0 0.0.0.255
access-list 110 remark SDM_ACL Category=18
access-list 110 permit ip any any
dialer-list 1 protocol ip permit
no cdp run
!
!
radius-server host 192.168.1.120 auth-port 1645 acct-port 1646 key 7 13061F13070
001242C21796166
!
control-plane
!
banner login ^CThis is a property of LCF unauthorized users will be prosecuted^C
!
line con 0
no modem enable
transport output telnet
line aux 0
transport output telnet
line vty 0 4
access-class 23 in
privilege level 15
password 7 03105E07080A35
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
Liberty#
