Hi to all... I've a big trouble trying to get work a cisco 1801 os vpn pptp dial in (winth ms vpn client) I'm no able to use encryption nor compression... If i set encryption (most important thing) on the client i get 742 error...
This is pieces of the config that are involved:
aaa new-model ! ! aaa authentication attempts login 5 aaa authentication login console none aaa authentication login telnet local aaa authentication ppp VPNDialIn group radius aaa authorization exec default local aaa authorization network default if-authenticated ! aaa session-id common
interface Virtual-Template1 description $FW_OUTSIDE$ ip unnumbered Vlan1 ip verify unicast reverse-path no ip redirects no ip unreachables no ip proxy-arp ip route-cache flow peer default ip address dhcp-pool sdm-pool1 no keepalive compress mppc ppp encrypt mppe auto required ppp authentication ms-chap ms-chap-v2 callin VPNDialIn !
The client connect only without encryption and comrpession (radius communications seem ok).
Thanks to all!!!
Didn't find your answer? Ask the community — no account required.
C
Chad Mahoney
Is this on Vista?
Since 40bit and ms-chap are not very secure maybe they are disable by default in Vista.
Just a thought? Maybe you could capture the traffic and post the results?
M
Masterx81
Nascondi testo tra virgolette -
Hi! Thanks for the help! So, the client is a Windows xp...
This is the result of debugging the mppe:
MPPE Packet Details debugging is on MPPE Events debugging is on MPPE Packets debugging is on
025967: Jun 13 18:34:01.874 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to up
025968: Jun 13 18:34:01.878 Asti: Vi3 MPPE: don't understand all options, NAK
025969: Jun 13 18:34:01.878 Asti: Vi3 MPPE: RADIUS keying material missing
025970: Jun 13 18:34:01.878 Asti: Vi3 MPPE: Required encryption not negotiated
025971: Jun 13 18:34:01.886 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to down
This is the debug of the ppp nego:
PPP protocol negotiation debugging is on
025972: Jun 13 18:35:50.184 Asti: ppp179 PPP: Send Message[Dynamic Bind Response ]
025973: Jun 13 18:35:50.184 Asti: ppp179 PPP: Using vpn set call direction
025974: Jun 13 18:35:50.184 Asti: ppp179 PPP: Treating connection as a callin
025975: Jun 13 18:35:50.184 Asti: ppp179 PPP: Session handle[13000126] Session i d[179]
025976: Jun 13 18:35:50.188 Asti: ppp179 PPP: Phase is ESTABLISHING, Passive Ope n
025977: Jun 13 18:35:50.188 Asti: ppp179 LCP: State is Listen
025978: Jun 13 18:35:50.196 Asti: ppp179 LCP: I CONFREQ [Listen] id 0 len 21
025979: Jun 13 18:35:50.196 Asti: ppp179 LCP: MRU 1400 (0x01040578)
025980: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber
0x449446C1 (0x05064
49446C1)
025981: Jun 13 18:35:50.196 Asti: ppp179 LCP: PFC (0x0702)
025982: Jun 13 18:35:50.196 Asti: ppp179 LCP: ACFC (0x0802)
025983: Jun 13 18:35:50.196 Asti: ppp179 LCP: Callback 6 (0x0D0306)
025984: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFREQ [Listen] id 1 len 15
025985: Jun 13 18:35:50.196 Asti: ppp179 LCP: AuthProto MS-CHAP (0x0305C22380 )
025986: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber
0x63C93DE3 (0x05066
3C93DE3)
025987: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFREJ [Listen] id 0 len 7
025988: Jun 13 18:35:50.196 Asti: ppp179 LCP: Callback 6 (0x0D0306)
025989: Jun 13 18:35:50.196 Asti: ppp179 LCP: I CONFNAK [REQsent] id 1 len 9
025990: Jun 13 18:35:50.196 Asti: ppp179 LCP: AuthProto MS-CHAP-V2 (0x0305C22
381)
025991: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFREQ [REQsent] id 2 len 15
025992: Jun 13 18:35:50.196 Asti: ppp179 LCP: AuthProto MS-CHAP-V2 (0x0305C22
381)
025993: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber
0x63C93DE3 (0x05066
3C93DE3)
025994: Jun 13 18:35:50.196 Asti: ppp179 LCP: I CONFREQ [REQsent] id 1 len 18
025995: Jun 13 18:35:50.196 Asti: ppp179 LCP: MRU 1400 (0x01040578)
025996: Jun 13 18:35:50.196 Asti: ppp179 LCP: MagicNumber
0x449446C1 (0x05064
49446C1)
025997: Jun 13 18:35:50.196 Asti: ppp179 LCP: PFC (0x0702)
025998: Jun 13 18:35:50.196 Asti: ppp179 LCP: ACFC (0x0802)
025999: Jun 13 18:35:50.196 Asti: ppp179 LCP: O CONFNAK [REQsent] id 1 len 8
026000: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC)
026001: Jun 13 18:35:50.200 Asti: ppp179 LCP: I CONFACK [REQsent] id 2 len 15
026002: Jun 13 18:35:50.200 Asti: ppp179 LCP: AuthProto MS-CHAP-V2 (0x0305C22
381)
026003: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber
0x63C93DE3 (0x05066
3C93DE3)
026004: Jun 13 18:35:50.200 Asti: ppp179 LCP: I CONFREQ [ACKrcvd] id 2 len 18
026005: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1400 (0x01040578)
026006: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber
0x449446C1 (0x05064
49446C1)
026007: Jun 13 18:35:50.200 Asti: ppp179 LCP: PFC (0x0702)
026008: Jun 13 18:35:50.200 Asti: ppp179 LCP: ACFC (0x0802)
026009: Jun 13 18:35:50.200 Asti: ppp179 LCP: O CONFNAK [ACKrcvd] id 2 len 8
026010: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC)
026011: Jun 13 18:35:50.200 Asti: ppp179 LCP: I CONFREQ [ACKrcvd] id 3 len 18
026012: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC)
026013: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber
0x449446C1 (0x05064
49446C1)
026014: Jun 13 18:35:50.200 Asti: ppp179 LCP: PFC (0x0702)
026015: Jun 13 18:35:50.200 Asti: ppp179 LCP: ACFC (0x0802)
026016: Jun 13 18:35:50.200 Asti: ppp179 LCP: O CONFACK [ACKrcvd] id 3 len 18
026017: Jun 13 18:35:50.200 Asti: ppp179 LCP: MRU 1500 (0x010405DC)
026018: Jun 13 18:35:50.200 Asti: ppp179 LCP: MagicNumber
0x449446C1 (0x05064
49446C1)
026019: Jun 13 18:35:50.200 Asti: ppp179 LCP: PFC (0x0702)
026020: Jun 13 18:35:50.200 Asti: ppp179 LCP: ACFC (0x0802)
026021: Jun 13 18:35:50.200 Asti: ppp179 LCP: State is Open
026022: Jun 13 18:35:50.204 Asti: ppp179 PPP: Phase is AUTHENTICATING, by this e nd
026023: Jun 13 18:35:50.204 Asti: ppp179 MS-CHAP-V2: O CHALLENGE id 1 len 32 fro m "GecomRouter"
026024: Jun 13 18:35:50.204 Asti: ppp179 LCP: I IDENTIFY [Open] id 4 len 18 magi c 0x449446C1 MSRASV5.10
026025: Jun 13 18:35:50.204 Asti: ppp179 LCP: I IDENTIFY [Open] id 5 len 24 magi c 0x449446C1 MSRAS-0-PCENRICO
026026: Jun 13 18:35:50.204 Asti: ppp179 MS-CHAP-V2: I RESPONSE id 1 len 66 from "GECOM\\enrico"
026027: Jun 13 18:35:50.204 Asti: ppp179 PPP: Phase is FORWARDING, Attempting Fo rward
026028: Jun 13 18:35:50.204 Asti: ppp179 PPP: Phase is AUTHENTICATING, Unauthent icated User
026029: Jun 13 18:35:50.208 Asti: ppp179 PPP: Phase is FORWARDING, Attempting Fo rward
026030: Jun 13 18:35:50.208 Asti: ppp179 PPP: Send Message[Connect Local]
026031: Jun 13 18:35:50.216 Asti: Vi3 PPP: Phase is DOWN, Setup
026032: Jun 13 18:35:50.216 Asti: ppp179 PPP: Bind to [Virtual- Access3]
026033: Jun 13 18:35:50.216 Asti: Vi3 PPP: Send Message[Static Bind Response]
026034: Jun 13 18:35:50.220 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to up
026035: Jun 13 18:35:50.220 Asti: Vi3 PPP: Phase is AUTHENTICATING, Authenticate d User
026036: Jun 13 18:35:50.220 Asti: Vi3 MS-CHAP-V2: O SUCCESS id 1 len
46 msg is " S=ECEFBEF63359BD8502D589FAA1721A265449D51D"
026037: Jun 13 18:35:50.220 Asti: Vi3 PPP: Phase is UP
026038: Jun 13 18:35:50.220 Asti: Vi3 IPCP: O CONFREQ [Closed] id 1 len 10
026039: Jun 13 18:35:50.220 Asti: Vi3 IPCP: Address 192.168.200.254 (0x0306C0 A8C8FE)
026040: Jun 13 18:35:50.220 Asti: Vi3 PPP: Process pending ncp packets
026041: Jun 13 18:35:50.220 Asti: Vi3 CCP: O CONFREQ [Closed] id 1 len
10
026042: Jun 13 18:35:50.220 Asti: Vi3 CCP: MS-PPC supported bits
0x01000061 (
0x120601000061)
026043: Jun 13 18:35:50.224 Asti: Vi3 CCP: I CONFREQ [REQsent] id 6 len 10
026044: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits
0x010000E0 (
0x1206010000E0)
026045: Jun 13 18:35:50.224 Asti: Vi3 CCP: O CONFNAK [REQsent] id 6 len 10
026046: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits
0x01000061 (
0x120601000061)
026047: Jun 13 18:35:50.224 Asti: Vi3 CCP: I CONFNAK [REQsent] id 1 len 10
026048: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits
0x01000040 (
0x120601000040)
026049: Jun 13 18:35:50.224 Asti: Vi3 CCP: O CONFREQ [REQsent] id 2 len 10
026050: Jun 13 18:35:50.224 Asti: Vi3 CCP: MS-PPC supported bits
0x01000040 (
0x120601000040)
026051: Jun 13 18:35:50.224 Asti: Vi3 IPCP: I CONFREQ [REQsent] id 7 len 34
026052: Jun 13 18:35:50.224 Asti: Vi3 IPCP: Address 0.0.0.0 (0x030600000000)
026053: Jun 13 18:35:50.224 Asti: Vi3 IPCP: PrimaryDNS 0.0.0.0 (0x81060000000
0)
026054: Jun 13 18:35:50.224 Asti: Vi3 IPCP: PrimaryWINS 0.0.0.0 (0x8206000000
00)
026055: Jun 13 18:35:50.224 Asti: Vi3 IPCP: SecondaryDNS 0.0.0.0 (0x830600000
000)
026056: Jun 13 18:35:50.224 Asti: Vi3 IPCP: SecondaryWINS 0.0.0.0 (0x84060000
0000)
026057: Jun 13 18:35:50.224 Asti: Vi3 AAA/AUTHOR/IPCP: Start. Her address 0.0.0 .0, we want 0.0.0.0
026058: Jun 13 18:35:50.224 Asti: Vi3 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.
0, we want 0.0.0.0
026059: Jun 13 18:35:50.228 Asti: Vi3 CCP: I CONFREQ [REQsent] id 8 len 10
026060: Jun 13 18:35:50.228 Asti: Vi3 CCP: MS-PPC supported bits
0x01000040 (
0x120601000040)
026061: Jun 13 18:35:50.228 Asti: Vi3 CCP: O CONFACK [REQsent] id 8 len 10
026062: Jun 13 18:35:50.228 Asti: Vi3 CCP: MS-PPC supported bits
0x01000040 (
0x120601000040)
026063: Jun 13 18:35:50.228 Asti: Vi3 CCP: I CONFACK [ACKsent] id 2 len 10
026064: Jun 13 18:35:50.228 Asti: Vi3 CCP: MS-PPC supported bits
0x01000040 (
0x120601000040)
026065: Jun 13 18:35:50.228 Asti: Vi3 CCP: State is Open
026066: Jun 13 18:35:50.228 Asti: Vi3 CCP: O TERMREQ [Open] id 3 len 4
026067: Jun 13 18:35:50.228 Asti: Vi3 CCP: I TERMACK [TERMsent] id 3 len 4
026068: Jun 13 18:35:50.228 Asti: Vi3 CCP: State is Closed
026069: Jun 13 18:35:50.228 Asti: Vi3 MPPE: Required encryption not negotiated
026070: Jun 13 18:35:50.228 Asti: Vi3 PPP: Sending Acct Event[Down] id[E1]
026071: Jun 13 18:35:50.232 Asti: Vi3 IPCP: State is Closed
026072: Jun 13 18:35:50.232 Asti: Vi3 PPP: Phase is TERMINATING
026073: Jun 13 18:35:50.232 Asti: Vi3 LCP: O TERMREQ [Open] id 3 len 4
026074: Jun 13 18:35:50.232 Asti: Vi3 PPP: Block vaccess from being freed [0x48]
026075: Jun 13 18:35:50.236 Asti: %LINK-3-UPDOWN: Interface Virtual- Access3, cha nged state to down
026076: Jun 13 18:35:50.236 Asti: Vi3 LCP: State is Closed
026077: Jun 13 18:35:50.236 Asti: Vi3 PPP: Phase is DOWN
026078: Jun 13 18:35:50.236 Asti: Vi3 PPP: Send Message[Disconnect]
026079: Jun 13 18:35:50.236 Asti: Vi3 PPP: Unlocked by [0x8] Still Locked by [0x
42]
026080: Jun 13 18:35:50.236 Asti: Vi3 PPP: Unlocked by [0x40] Still Locked by [0 x2]
026081: Jun 13 18:35:50.236 Asti: Vi3 PPP: Unlocked by [0x2] Still Locked by [0x
0]
026082: Jun 13 18:35:50.236 Asti: Vi3 PPP: Free previously blocked vaccess
026083: Jun 13 18:35:52.224 Asti: Vi3: Handling FAILED PPP sanity after POOL_GET
A lot of things...
This trouble is driving me nuts...
Really thanks!
C
Chad Mahoney
Can't really see any major problems with the config, however I did find a post that resembles yours:
formatting link
HTH....
M
Masterx81
I've searched a lot over the net before posting there, but i haven't found nothing that has helped me... I've already read also that post, but it hasnt' nothing different from my config...
M
Masterx81
DOH!!!
This done the trick!!!
aaa new-model ! ! aaa authentication attempts login 5 aaa authentication login console none aaa authentication login telnet local aaa authentication ppp VPNDialIn group radius aaa authorization exec default local aaa authorization network default local group radius aaa authorization network VPNDialIn group radius aaa authorization auth-proxy default group radius ! aaa session-id common
Was an aaa problem... Someone can explain me what difference there is with my prevoius config???
M
Masterx81
The kay was the following line: aaa authorization network default group radius
But why it not work with: aaa authorization network VPNDialIn group VPNDialIn
Seem that it not use the group VPNDialIn for author, while it work for authentication. It work only if i set it at default group...
Join the Discussion
Have something to add? Share your thoughts — no account required.
Didn't find your answer?
Ask the community — no account required
Report Content
You are reporting this content to the moderators. They will look at it
ASAP.