This document describes how to configure a client-initiated Layer 2 Tunneling Protocol version 2 (L2TPv2) tunnel with a Cisco 4000 Series Integrated Services Router- ISR4451-X/K9 (ISR4000) that acts as a server.
Cisco recommends that you meet these requirements before you attempt this configuration:
This document is not restricted to specific software and hardware versions.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Client-initiated dial-in Virtual Private Dialup Network (VPDN) tunneling deployments allow remote users to access a private network over a shared infrastructure with end-to-end protection of private data. Client-initiated VPDN tunneling does not require additional security to protect data between the client and the ISP Network Access Server (NAS).
Restriction - appxk9 must be active on the ISR4000 router. Without this license, the route will get installed towards the client at the end of PPP negotiation, but Layer 3 connectivity between the client and the server will not be established.
An example of the configuration on the client router is shown here:
!
l2tp-class CISCO
!
pseudowire-class CLASS
encapsulation l2tpv2
ip local interface Vlan333
!
interface FastEthernet0/0
switchport access vlan 333
no ip address
no keepalive
!
interface Virtual-PPP1
ip address negotiated
ppp chap hostname cisco@cisco.com
ppp chap password 0 cisco
pseudowire 10.1.1.2 1 pw-class CLASS !! Specifies the IP address of the tunnel
server and the 32-bit virtual circuit identifier (VCID) shared between the
devices at each end of the control channel.
!
interface Vlan333
ip address 10.1.1.1 255.255.255.0
!
An example of the configuration on ISR4000 that acts as a server is shown here:
vpdn enable
!
vpdn-group 1
accept-dialin
protocol l2tp
virtual-template 1
terminate-from hostname CLIENT
no l2tp tunnel authentication
!
license boot level appxk9 !! License must be appxk9
username cisco@cisco.com password 0 cisco
!
interface Loopback1
ip address 192.168.1.2 255.255.255.0
!
interface FastEthernet0/0
ip address 10.1.1.2 255.255.255.0
negotiation auto
!
ip local pool TEST 10.1.1.3 10.1.1.100
!
interface Virtual-Template1
ip unnumbered Loopback1
peer default ip address pool TEST
ppp authentication chap
!
Use this section in order to verify your configuration.
The Output Interpreter Tool (registered customers only) supports certain show commands. Use the Output Interpreter Tool in order to view an analysis of show command output.
Enter these commands in order to verify the configuration on client router:
CLIENT#show vpdn session
L2TP Session Information Total tunnels 1 sessions 1
LocID RemID TunID Username, Intf/ State Last Chg Uniq ID
Vcid, Circuit
9886 40437 48058 1, Vp1 est 00:17:51 17
!! Session up since 17:51 Minutes
CLIENT#show caller ip
Line User IP Address Local Number Remote Number <->
Vp1 SERVER 192.168.1.2 - - in
!! Tunnel Server
CLIENT#ping 192.168.1.2 !! Tunnel Server Reachable
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
CLIENT#show ppp all
Interface/ID OPEN+ Nego* Fail- Stage Peer Address Peer Name
------------ --------------------- -------- --------------- --------------------
Vp1 LCP+ IPCP+ CDPCP- LocalT 192.168.1.2 SERVER
SERVER#show license feature
Feature name Enforcement Evaluation Subscription Enabled RightToUse
appxk9 yes yes no yes yes
!! License must be Active
SERVER#show vpdn session
L2TP Session Information Total tunnels 1 sessions 1
LocID RemID TunID Username, Intf/ State Last Chg Uniq ID
Vcid, Circuit
40437 9886 19763 cisco@cisc..., Vi3.1 est 00:16:56 2
SERVER#show caller ip
Line User IP Address Local Number Remote Number <->
Vi3.1 cisco@cisco.com \
10.1.1.4 - - in
!! IP address of the Client allocated from local address pool (TEST)
SERVER#ping 10.1.1.4 !! Client reachable
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Use standard VPDN/ L2TP/ PPP procedures in order to troubleshoot any issues. However, this list of debugs can also be helpful.
debug ppp events
debug ppp error
debug ppp negotiation
debug vpdn error
debug vpdn event
debug vpdn l2x events
debug vpdn l2x errors
debug l2tp error
debug l2tp event
debug vtemplate event
debug vtemplate error
debug vtemplate cloning
Revision | Publish Date | Comments |
---|---|---|
1.0 |
18-Nov-2014 |
Initial Release |