Here's the Cisco config $(relevant parts):
!---------------------------------------------------------------------------- !version 12.2
hostname Cisco ! aaa new-model ! aaa authentication login default local aaa authentication ppp vpdn group radius aaa authorization network default group radius aaa session-id common ip subnet-zero no ip source-route ! vpdn enable ! vpdn-group l2tpvpn ! Default L2TP VPDN group accept-dialin protocol l2tp virtual-template 1 no l2tp tunnel authentication ! no ftp-server write-enable ! ! crypto ca trustpoint NetworklabDemoCA enrollment mode ra enrollment url http://172.16.4.1:80/certsrv/mscep/mscep.dll serial-number ip-address 192.168.0.2 revocation-check none ! ! crypto ca certificate chain NetworklabDemoCA certificate 61F92209000000000019 3082066B ........AE1F8E quit certificate ca 2927890E737263A64AF4E05E58515BF4 308204A2 ........4861 quit ! ! crypto isakmp policy 1 encr 3des group 2 ! ! crypto ipsec transform-set esp-3des-sha-tunnel esp-3des esp-sha-hmac ! crypto dynamic-map dynvpn 1 set transform-set esp-3des-sha-tunnel set pfs group2 match address 130 ! ! crypto map extmap 1 ipsec-isakmp dynamic dynvpn ! ! interface FastEthernet0 description $FW_OUTSIDE$$ETH-WAN$ ip address 9.9.9.9 255.255.255.0 ip access-group 101 in ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip inspect DEFAULT100 out ip route-cache flow duplex auto speed auto no cdp enable crypto map extmap ! interface Virtual-Template1 ip unnumbered FastEthernet0 peer default ip address pool vpnpool ppp encrypt mppe 128 ppp authentication ms-chap-v2 vpdn ! interface Vlan1 description $FW_INSIDE$$ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$ ip address 192.168.0.2 255.255.255.0 ip access-group 100 in ip access-group sdm_vlan1_out out no ip redirects no ip unreachables no ip proxy-arp ip route-cache flow ip tcp adjust-mss 1452 ! ip local pool vpnpool 10.10.10.0 10.10.10.7 ip classless ip route 0.0.0.0 0.0.0.0 9.9.9.8 ip http server ip http authentication local ip http secure-server ! ! ! ip access-list extended sdm_vlan1_out remark SDM_ACL Category=1 remark RDP permit ip 10.10.10.0 0.0.0.7 host 192.168.0.1 permit tcp 10.10.10.0 0.0.0.7 host 192.168.0.1 eq 3389 deny ip any any logging trap debugging access-list 100 remark auto generated by SDM firewall configuration access-list 100 remark SDM_ACL Category=1 access-list 100 deny ip 9.9.9.0 0.0.0.255 any access-list 100 deny ip host 255.255.255.255 any access-list 100 deny ip 127.0.0.0 0.255.255.255 any access-list 100 permit tcp host 192.168.0.1 eq 3389 10.10.10.0 0.0.0.7 log access-list 100 permit ip any any log access-list 101 remark auto generated by SDM firewall configuration access-list 101 remark SDM_ACL Category=1 access-list 101 permit udp any eq isakmp host 9.9.9.9 eq isakmp access-list 101 permit esp any host 9.9.9.9 log access-list 101 deny ip 192.168.0.0 0.0.0.255 any access-list 101 permit icmp any host 9.9.9.9 echo-reply access-list 101 permit icmp any host 9.9.9.9 time-exceeded access-list 101 permit icmp any host 9.9.9.9 unreachable access-list 101 deny ip 10.0.0.0 0.255.255.255 any access-list 101 deny ip 172.16.0.0 0.15.255.255 any access-list 101 deny ip 192.168.0.0 0.0.255.255 any access-list 101 deny ip 127.0.0.0 0.255.255.255 any access-list 101 deny ip host 255.255.255.255 any access-list 101 deny ip host 0.0.0.0 any access-list 101 deny ip any any access-list 130 remark SDM_ACL Category=20 access-list 130 permit udp host 9.9.9.9 any eq 1701 access-list 130 permit udp any eq 1701 host 9.9.9.9 no cdp run ! radius-server host 192.168.0.1 auth-port 1645 acct-port 1646 key 7
13171634946917212E3D radius-server authorization permit missing Service-Type