Question
July 23, 2008 at 03:27 AM
coreilly

IPSec+L2tp with radius auth

by coreilly . Updated 18 years ago

Trying to configure a l2tp in ip sec which works fine config below. But the problem is when i add to the crypto map the following:

crypto map test client authentication list userauthen
crypto map test client configuration address initiate
crypto map test client configuration address respond

the tunnel goes down i guess this is because the l2tp password is being take from the local config “aaa authentication login default line”
but when their is a radius group assigned this authentication for the l2tp gets messed up.

Anyone ever implemented l2tp with a radius. trying not to use security certificates if possible..

aaa new-model
!
!
aaa group server radius RADIUS.GROUP
server server !
aaa authentication login default line //so l2tp uses the local authentication key
aaa authentication login userauthen local group RADIUS.GROUP
aaa authentication login test local
aaa authentication ppp default local
aaa authorization network groupauthor local
!
aaa session-id common
ip cef
!
!
!
!
ip domain name
ip name-server
vpdn enable
!
vpdn-group 1
accept-dialin
protocol l2tp
virtual-template 1
terminate-from hostname 90
local name
l2tp tunnel password 0 !
!
!
!
!
username **********************
username ************************
username ***********************
username ********************
username ********************
!
!
!
crypto isakmp policy 15
encr 3des
hash md5
authentication pre-share
group 2
lifetime 3600
crypto isakmp key address no-xauth

!
!
crypto ipsec transform-set test-3des esp-3des esp-sha-hmac
mode transport
!
crypto dynamic-map dynmap 10
set transform-set test-3des
reverse-route
!
!
crypto map test 10 ipsec-isakmp
set peer
set security-association lifetime kilobytes 400000
set transform-set test-3des
match address 101
!
!
!
!
interface Loopback0
ip address 255.255.255.0
!
interface Loopback1
ip address 255.255.255.0
!

!
interface FastEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-FE 0$
ip address 192.168.1.1 255.255.255.0
ip virtual-reassembly
speed 100
full-duplex
hold-queue 100 out
!
interface FastEthernet0/1
ip address 255.255.255.0
duplex auto
speed auto
crypto map test
!
interface Virtual-Template1
ip unnumbered FastEthernet0/1
peer default ip address pool ippool
ppp authentication chap pap
ppp chap hostname
ppp chap password 7 ******************
!
router eigrp 250
network 10.0.0.0
auto-summary
!
ip local pool ippool
ip default-gateway 89.127.224.161
ip route 0.0.0.0 0.0.0.0
ip route host
access-list 101 deny ip any any

snmp-server community always RO
snmp-server community never RO
!
!
!
radius-server host radius-server timeout 60
radius-server key 7 **********

This discussion is locked

All Comments