Hello I have a weird problem that I am trying to resolve from 15hours now...
I have the exact identical problems on two sites , the first is C2611 with 12.3(25) ADVSEC
the second site is a 2650 with 12.4(18) ADVSEC
here is the conf:
The problem is that ANY PPTP outgoing doesn't work at all. I was disperate and "downgraded" the 2650 (conf is below) to a 12.2(9)T and it worked.
Current configuration : 7099 bytes ! version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service internal service sequence-numbers no service dhcp ! hostname 89-186-68-6.dcpool.ip ! boot-start-marker boot-end-marker ! security authentication failure rate 3 log security passwords min-length 6 logging buffered 4096 notifications no logging console no logging monitor enable password 7 xxxxxxxxxxxxxxxxxxxxxxxxxx! no aaa new-model clock timezone CET 1 no network-clock-participate slot 1 no network-clock-participate wic 0 no ip source-route no ip gratuitous-arps ip cef ! ! ip inspect log drop-pkt ip inspect max-incomplete low 300 ip inspect max-incomplete high 400 ip inspect one-minute low 500 ip inspect one-minute high 600 ip inspect udp idle-time 20 ip inspect tcp idle-time 60 ip inspect tcp synwait-time 45 ip inspect tcp max-incomplete host 300 block-time 0 ip inspect name OUT-IN esmtp ip inspect name OUT-IN pop3 ip inspect name OUT-IN pop3s ip inspect name OUT-IN http ip inspect name OUT-IN https ip inspect name OUT-IN imap ip inspect name OUT-IN imaps ip inspect name OUT-IN ftp ip inspect name OUT-IN ftps ip auth-proxy max-nodata-conns 3 ip admission max-nodata-conns 3 ! ! ip ips sdf location flash:128mb.sdf ip ips signature 2004 0 disable ip ips signature 2001 0 disable ip ips name AUDIT no ip bootp server ip domain round-robin ip domain name kpnqwest.it ip name-server 217.97.32.2 ip name-server 217.97.32.7 login block-for 120 attempts 5 within 60 login on-failure log ! ! ! ! username xxxxxxxxxxxxxxx ! ! ip tcp selective-ack ip tcp synwait-time 10 ip ssh time-out 90 ip ssh version 2 ! ! ! ! interface Null0 no ip unreachables ! interface ATM0/0 description KPNQWest ADSL 2048/512 no ip address no ip redirects no ip proxy-arp no ip mroute-cache atm ilmi-keepalive dsl operating-mode auto hold-queue 224 in ! interface ATM0/0.1 point-to-point description Point to Point Uplink bandwidth 2048 ip address 89.186.68.6 255.255.255.252 ip access-group 100 in no ip redirects no ip proxy-arp ip inspect OUT-IN in ip ips AUDIT in ip nat outside ip virtual-reassembly max-fragments 16 max-reassemblies 64 no ip mroute-cache pvc 8/35 encapsulation aal5snap ! ! interface FastEthernet0/0 ip address 172.16.0.12 255.255.255.240 no ip redirects no ip proxy-arp ip nat inside no ip virtual-reassembly no ip mroute-cache duplex auto speed auto no cdp enable hold-queue 100 in ! no ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 ATM0/0.1 ! no ip http server no ip http secure-server ip nat translation timeout 3600 ip nat translation tcp-timeout 1200 ip nat translation udp-timeout 100 ip nat translation finrst-timeout 15 ip nat translation syn-timeout 45 ip nat translation icmp-timeout 120 ip nat inside source list 102 interface ATM0/0.1 overload ip nat inside source static tcp 172.16.0.1 25 89.186.68.6 25 extendable ip nat inside source static tcp 172.16.0.1 80 89.186.68.6 80 extendable ip nat inside source static tcp 172.16.0.1 110 89.186.68.6 110 extendable ip nat inside source static tcp 172.16.0.1 443 89.186.68.6 443 extendable ip nat inside source static tcp 172.16.0.1 465 89.186.68.6 465 extendable ip nat inside source static tcp 172.16.0.1 995 89.186.68.6 995 extendable ip nat inside source static tcp 172.16.0.1 3389 89.186.68.6 3389 extendable ip nat inside source static tcp 172.16.0.10 33389 89.186.68.6 33389 extendable ! ! no logging trap access-list 100 deny ip 0.0.0.0 0.255.255.255 any access-list 100 deny ip 10.0.0.0 0.255.255.255 any access-list 100 deny ip 127.0.0.0 0.255.255.255 any access-list 100 deny ip 169.254.0.0 0.0.255.255 any access-list 100 deny ip 172.16.0.0 0.15.255.255 any access-list 100 deny ip 192.0.2.0 0.0.0.255 any access-list 100 permit ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 access-list 100 deny ip 192.168.0.0 0.0.255.255 any access-list 100 deny ip 224.0.0.0 15.255.255.255 any access-list 100 deny ip host 255.255.255.255 any access-list 100 deny ip host 89.186.68.6 any access-list 100 permit udp host 77.93.230.26 eq isakmp host 89.186.68.6 access-list 100 permit esp host 77.93.230.26 host 89.186.68.6 access-list 100 permit udp host 77.93.230.26 host 89.186.68.6 range snmp snmptrap access-list 100 permit udp 77.93.229.208 0.0.0.7 host 89.186.68.6 range snmp snmptrap access-list 100 deny tcp any lt 1023 any lt 1023 access-list 100 permit udp any eq ntp any access-list 100 permit udp any eq domain any access-list 100 deny udp any lt 1023 any lt 1023 access-list 100 permit ip any any fragments access-list 100 permit icmp any any echo access-list 100 permit icmp any any echo-reply access-list 100 permit icmp any any time-exceeded access-list 100 permit icmp any any packet-too-big access-list 100 permit icmp any any unreachable access-list 100 permit icmp any any source-quench access-list 100 deny icmp any any access-list 100 deny udp any any eq echo access-list 100 deny udp any any range 33400 34400 access-list 100 permit tcp any any range ftp-data ftp access-list 100 permit tcp host 77.93.230.26 host 89.186.68.6 eq 22 access-list 100 permit tcp 77.93.229.208 0.0.0.7 host 89.186.68.6 eq 22 access-list 100 deny tcp any any eq 22 access-list 100 permit tcp any any eq smtp access-list 100 permit tcp any any eq www access-list 100 permit tcp any any eq pop3 access-list 100 permit tcp any any eq 443 access-list 100 permit tcp any any eq 465 access-list 100 deny udp any any range snmp snmptrap access-list 100 permit tcp any any eq 990 access-list 100 permit tcp any any eq 995 access-list 100 permit tcp any any access-list 100 permit udp any any access-list 100 permit 41 any any access-list 100 permit gre any any access-list 100 deny ip any any log access-list 102 permit ip 172.16.0.0 0.0.0.255 any snmp-server community public RO snmp-server ifindex persist snmp-server contact xxxxxxxx no cdp run ! ! control-plane ! ! ! banner login ^C You are connected to $(hostname).$(domain) on line $(line). If you are not authorized to access this system, disconnect now.
THIS IS FOR AUTHORIZED USE ONLY
Unauthorized or improper use of this system may result in administrative disciplinary action and civil and criminal penalties. By continuing to use this system you indicate your awareness of and consent to these terms and conditions of use. LOG OFF IMMEDIATELY if you do not agree to the conditions stated in this warning.
Network Administrator: snipped-for-privacy@paradise.org ! line con 0 login local transport output telnet stopbits 1 line aux 0 login local transport preferred none transport output telnet stopbits 1 line vty 0 4 login local transport preferred none transport input ssh transport output all flowcontrol software ! scheduler max-task-time 5000 ntp server 192.43.244.18 ntp server 193.204.114.105 ! end