1. Home
  2. Cisco Systems
  3. PPTP, IAS Radius and Cisco 1801

PPTP, IAS Radius and Cisco 1801

Hi to all... I've a big trouble trying to get work a cisco 1801 os vpn pptp dial in (winth ms vpn client) I'm no able to use encryption nor compression... If i set encryption (most important thing) on the client i get 742 error...

This is pieces of the config that are involved:

aaa new-model ! ! aaa authentication attempts login 5 aaa authentication login console none aaa authentication login telnet local aaa authentication ppp VPNDialIn group radius aaa authorization exec default local aaa authorization network default if-authenticated ! aaa session-id common

vpdn enable ! vpdn-group VPNDialIn ! Default PPTP VPDN group accept-dialin protocol pptp virtual-template 1 !

interface Virtual-Template1 description $FW_OUTSIDE$ ip unnumbered Vlan1 ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip route-cache flow peer default ip address dhcp-pool sdm-pool1 no keepalive compress mppc ppp encrypt mppe auto required ppp authentication ms-chap ms-chap-v2 callin VPNDialIn !

radius-server host 192.168.x.x auth-port 1812 acct-port 1813 radius-server key xxx radius-server vsa send authentication

The client connect only without encryption and comrpession (radius communications seem ok).

Thanks to all!!!

Reply to
Masterx81
Loading thread data ...

Is this on Vista?

Since 40bit and ms-chap are not very secure maybe they are disable by default in Vista.

Just a thought? Maybe you could capture the traffic and post the results?

Reply to
Chad Mahoney

Nascondi testo tra virgolette -

Hi! Thanks for the help! So, the client is a Windows xp...

This is the result of debugging the mppe:

MPPE Packet Details debugging is on MPPE Events debugging is on MPPE Packets debugging is on

025967: Jun 13 18:34:01.874 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to up 025968: Jun 13 18:34:01.878 Asti: Vi3 MPPE: don't understand all options, NAK 025969: Jun 13 18:34:01.878 Asti: Vi3 MPPE: RADIUS keying material missing 025970: Jun 13 18:34:01.878 Asti: Vi3 MPPE: Required encryption not negotiated 025971: Jun 13 18:34:01.886 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to down

This is the debug of the ppp nego:

PPP protocol negotiation debugging is on

025972: Jun 13 18:35:50.184 Asti: ppp179 PPP: Send Message[Dynamic Bind Response ] 025973: Jun 13 18:35:50.184 Asti: ppp179 PPP: Using vpn set call direction 025974: Jun 13 18:35:50.184 Asti: ppp179 PPP: Treating connection as a callin 025975: Jun 13 18:35:50.184 Asti: ppp179 PPP: Session handle[13000126] Session i d[179] 025976: Jun 13 18:35:50.188 Asti: ppp179 PPP: Phase is ESTABLISHING, Passive Ope n 025977: Jun 13 18:35:50.188 Asti: ppp179 LCP: State is Listen 025978: Jun 13 18:35:50.196 Asti: ppp179 LCP: I CONFREQ [Listen] id 0 len 21 025979: Jun 13 18:35:50.196 Asti: ppp179 LCP: MRU 1400 (0x01040578) 025980: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber 0x449446C1 (0x05064 49446C1) 025981: Jun 13 18:35:50.196 Asti: ppp179 LCP: PFC (0x0702) 025982: Jun 13 18:35:50.196 Asti: ppp179 LCP: ACFC (0x0802) 025983: Jun 13 18:35:50.196 Asti: ppp179 LCP: Callback 6 (0x0D0306) 025984: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFREQ [Listen] id 1 len 15 025985: Jun 13 18:35:50.196 Asti: ppp179 LCP: AuthProto MS-CHAP (0x0305C22380 ) 025986: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber 0x63C93DE3 (0x05066 3C93DE3) 025987: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFREJ [Listen] id 0 len 7 025988: Jun 13 18:35:50.196 Asti: ppp179 LCP: Callback 6 (0x0D0306) 025989: Jun 13 18:35:50.196 Asti: ppp179 LCP: I CONFNAK [REQsent] id 1 len 9 025990: Jun 13 18:35:50.196 Asti: ppp179 LCP: AuthProto MS-CHAP-V2 (0x0305C22 381) 025991: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFREQ [REQsent] id 2 len 15 025992: Jun 13 18:35:50.196 Asti: ppp179 LCP: AuthProto MS-CHAP-V2 (0x0305C22 381) 025993: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber 0x63C93DE3 (0x05066 3C93DE3) 025994: Jun 13 18:35:50.196 Asti: ppp179 LCP: I CONFREQ [REQsent] id 1 len 18 025995: Jun 13 18:35:50.196 Asti: ppp179 LCP: MRU 1400 (0x01040578) 025996: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber 0x449446C1 (0x05064 49446C1) 025997: Jun 13 18:35:50.196 Asti: ppp179 LCP: PFC (0x0702) 025998: Jun 13 18:35:50.196 Asti: ppp179 LCP: ACFC (0x0802) 025999: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFNAK [REQsent] id 1 len 8 026000: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC) 026001: Jun 13 18:35:50.200 Asti: ppp179 LCP: I CONFACK [REQsent] id 2 len 15 026002: Jun 13 18:35:50.200 Asti: ppp179 LCP: AuthProto MS-CHAP-V2 (0x0305C22 381) 026003: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber 0x63C93DE3 (0x05066 3C93DE3) 026004: Jun 13 18:35:50.200 Asti: ppp179 LCP: I CONFREQ [ACKrcvd] id 2 len 18 026005: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1400 (0x01040578) 026006: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber 0x449446C1 (0x05064 49446C1) 026007: Jun 13 18:35:50.200 Asti: ppp179 LCP: PFC (0x0702) 026008: Jun 13 18:35:50.200 Asti: ppp179 LCP: ACFC (0x0802) 026009: Jun 13 18:35:50.200 Asti: ppp179 LCP: O CONFNAK [ACKrcvd] id 2 len 8 026010: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC) 026011: Jun 13 18:35:50.200 Asti: ppp179 LCP: I CONFREQ [ACKrcvd] id 3 len 18 026012: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC) 026013: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber 0x449446C1 (0x05064 49446C1) 026014: Jun 13 18:35:50.200 Asti: ppp179 LCP: PFC (0x0702) 026015: Jun 13 18:35:50.200 Asti: ppp179 LCP: ACFC (0x0802) 026016: Jun 13 18:35:50.200 Asti: ppp179 LCP: O CONFACK [ACKrcvd] id 3 len 18 026017: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC) 026018: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber 0x449446C1 (0x05064 49446C1) 026019: Jun 13 18:35:50.200 Asti: ppp179 LCP: PFC (0x0702) 026020: Jun 13 18:35:50.200 Asti: ppp179 LCP: ACFC (0x0802) 026021: Jun 13 18:35:50.200 Asti: ppp179 LCP: State is Open 026022: Jun 13 18:35:50.204 Asti: ppp179 PPP: Phase is AUTHENTICATING, by this e nd 026023: Jun 13 18:35:50.204 Asti: ppp179 MS-CHAP-V2: O CHALLENGE id 1 len 32 fro m "GecomRouter" 026024: Jun 13 18:35:50.204 Asti: ppp179 LCP: I IDENTIFY [Open] id 4 len 18 magi c 0x449446C1 MSRASV5.10 026025: Jun 13 18:35:50.204 Asti: ppp179 LCP: I IDENTIFY [Open] id 5 len 24 magi c 0x449446C1 MSRAS-0-PCENRICO 026026: Jun 13 18:35:50.204 Asti: ppp179 MS-CHAP-V2: I RESPONSE id 1 len 66 from "GECOM\\enrico" 026027: Jun 13 18:35:50.204 Asti: ppp179 PPP: Phase is FORWARDING, Attempting Fo rward 026028: Jun 13 18:35:50.204 Asti: ppp179 PPP: Phase is AUTHENTICATING, Unauthent icated User 026029: Jun 13 18:35:50.208 Asti: ppp179 PPP: Phase is FORWARDING, Attempting Fo rward 026030: Jun 13 18:35:50.208 Asti: ppp179 PPP: Send Message[Connect Local] 026031: Jun 13 18:35:50.216 Asti: Vi3 PPP: Phase is DOWN, Setup 026032: Jun 13 18:35:50.216 Asti: ppp179 PPP: Bind to [Virtual- Access3] 026033: Jun 13 18:35:50.216 Asti: Vi3 PPP: Send Message[Static Bind Response] 026034: Jun 13 18:35:50.220 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to up 026035: Jun 13 18:35:50.220 Asti: Vi3 PPP: Phase is AUTHENTICATING, Authenticate d User 026036: Jun 13 18:35:50.220 Asti: Vi3 MS-CHAP-V2: O SUCCESS id 1 len 46 msg is " S=ECEFBEF63359BD8502D589FAA1721A265449D51D" 026037: Jun 13 18:35:50.220 Asti: Vi3 PPP: Phase is UP 026038: Jun 13 18:35:50.220 Asti: Vi3 IPCP: O CONFREQ [Closed] id 1 len 10 026039: Jun 13 18:35:50.220 Asti: Vi3 IPCP: Address 192.168.200.254 (0x0306C0 A8C8FE) 026040: Jun 13 18:35:50.220 Asti: Vi3 PPP: Process pending ncp packets 026041: Jun 13 18:35:50.220 Asti: Vi3 CCP: O CONFREQ [Closed] id 1 len 10 026042: Jun 13 18:35:50.220 Asti: Vi3 CCP: MS-PPC supported bits 0x01000061 ( 0x120601000061) 026043: Jun 13 18:35:50.224 Asti: Vi3 CCP: I CONFREQ [REQsent] id 6 len 10 026044: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits 0x010000E0 ( 0x1206010000E0) 026045: Jun 13 18:35:50.224 Asti: Vi3 CCP: O CONFNAK [REQsent] id 6 len 10 026046: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits 0x01000061 ( 0x120601000061) 026047: Jun 13 18:35:50.224 Asti: Vi3 CCP: I CONFNAK [REQsent] id 1 len 10 026048: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits 0x01000040 ( 0x120601000040) 026049: Jun 13 18:35:50.224 Asti: Vi3 CCP: O CONFREQ [REQsent] id 2 len 10 026050: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits 0x01000040 ( 0x120601000040) 026051: Jun 13 18:35:50.224 Asti: Vi3 IPCP: I CONFREQ [REQsent] id 7 len 34 026052: Jun 13 18:35:50.224 Asti: Vi3 IPCP: Address 0.0.0.0 (0x030600000000) 026053: Jun 13 18:35:50.224 Asti: Vi3 IPCP: PrimaryDNS 0.0.0.0 (0x81060000000 0) 026054: Jun 13 18:35:50.224 Asti: Vi3 IPCP: PrimaryWINS 0.0.0.0 (0x8206000000 00) 026055: Jun 13 18:35:50.224 Asti: Vi3 IPCP: SecondaryDNS 0.0.0.0 (0x830600000 000) 026056: Jun 13 18:35:50.224 Asti: Vi3 IPCP: SecondaryWINS 0.0.0.0 (0x84060000 0000) 026057: Jun 13 18:35:50.224 Asti: Vi3 AAA/AUTHOR/IPCP: Start. Her address 0.0.0 .0, we want 0.0.0.0 026058: Jun 13 18:35:50.224 Asti: Vi3 AAA/AUTHOR/IPCP: Done. Her address 0.0.0. 0, we want 0.0.0.0 026059: Jun 13 18:35:50.228 Asti: Vi3 CCP: I CONFREQ [REQsent] id 8 len 10 026060: Jun 13 18:35:50.228 Asti: Vi3 CCP: MS-PPC supported bits 0x01000040 ( 0x120601000040) 026061: Jun 13 18:35:50.228 Asti: Vi3 CCP: O CONFACK [REQsent] id 8 len 10 026062: Jun 13 18:35:50.228 Asti: Vi3 CCP: MS-PPC supported bits 0x01000040 ( 0x120601000040) 026063: Jun 13 18:35:50.228 Asti: Vi3 CCP: I CONFACK [ACKsent] id 2 len 10 026064: Jun 13 18:35:50.228 Asti: Vi3 CCP: MS-PPC supported bits 0x01000040 ( 0x120601000040) 026065: Jun 13 18:35:50.228 Asti: Vi3 CCP: State is Open 026066: Jun 13 18:35:50.228 Asti: Vi3 CCP: O TERMREQ [Open] id 3 len 4 026067: Jun 13 18:35:50.228 Asti: Vi3 CCP: I TERMACK [TERMsent] id 3 len 4 026068: Jun 13 18:35:50.228 Asti: Vi3 CCP: State is Closed 026069: Jun 13 18:35:50.228 Asti: Vi3 MPPE: Required encryption not negotiated 026070: Jun 13 18:35:50.228 Asti: Vi3 PPP: Sending Acct Event[Down] id[E1] 026071: Jun 13 18:35:50.232 Asti: Vi3 IPCP: State is Closed 026072: Jun 13 18:35:50.232 Asti: Vi3 PPP: Phase is TERMINATING 026073: Jun 13 18:35:50.232 Asti: Vi3 LCP: O TERMREQ [Open] id 3 len 4 026074: Jun 13 18:35:50.232 Asti: Vi3 PPP: Block vaccess from being freed [0x48] 026075: Jun 13 18:35:50.236 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to down 026076: Jun 13 18:35:50.236 Asti: Vi3 LCP: State is Closed 026077: Jun 13 18:35:50.236 Asti: Vi3 PPP: Phase is DOWN 026078: Jun 13 18:35:50.236 Asti: Vi3 PPP: Send Message[Disconnect] 026079: Jun 13 18:35:50.236 Asti: Vi3 PPP: Unlocked by [0x8] Still Locked by [0x 42] 026080: Jun 13 18:35:50.236 Asti: Vi3 PPP: Unlocked by [0x40] Still Locked by [0 x2] 026081: Jun 13 18:35:50.236 Asti: Vi3 PPP: Unlocked by [0x2] Still Locked by [0x 0] 026082: Jun 13 18:35:50.236 Asti: Vi3 PPP: Free previously blocked vaccess 026083: Jun 13 18:35:52.224 Asti: Vi3: Handling FAILED PPP sanity after POOL_GET

A lot of things...

This trouble is driving me nuts...

Really thanks!

Reply to
Masterx81

Can't really see any major problems with the config, however I did find a post that resembles yours:

formatting link

HTH....

Reply to
Chad Mahoney

I've searched a lot over the net before posting there, but i haven't found nothing that has helped me... I've already read also that post, but it hasnt' nothing different from my config...

Reply to
Masterx81

DOH!!!

This done the trick!!!

aaa new-model ! ! aaa authentication attempts login 5 aaa authentication login console none aaa authentication login telnet local aaa authentication ppp VPNDialIn group radius aaa authorization exec default local aaa authorization network default local group radius aaa authorization network VPNDialIn group radius aaa authorization auth-proxy default group radius ! aaa session-id common

Was an aaa problem... Someone can explain me what difference there is with my prevoius config???

Reply to
Masterx81

The kay was the following line: aaa authorization network default group radius

But why it not work with: aaa authorization network VPNDialIn group VPNDialIn

Seem that it not use the group VPNDialIn for author, while it work for authentication. It work only if i set it at default group...

Reply to
Masterx81

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.