Client-Initiated L2TPv2 Tunnel with ISR4000 That Acts as a Server Configuration Example

Introduction

This document describes how to configure a client-initiated Layer 2 Tunneling Protocol version 2 (L2TPv2) tunnel with a Cisco 4000 Series Integrated Services Router- ISR4451-X/K9 (ISR4000) that acts as a server.

Prerequisites

Requirements

Cisco recommends that you meet these requirements before you attempt this configuration:  

• Active appxk9 license on the ISR4451-X/K9 that acts as a server
• Layer 2 connectivity between the client router and server

Note: This document was created with a Cisco 887VA as the client router. However, the client can be a Microsoft Windows machine as well.

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Background

Client-initiated dial-in Virtual Private Dialup Network (VPDN) tunneling deployments allow remote users to access a private network over a shared infrastructure with end-to-end protection of private data. Client-initiated VPDN tunneling does not require additional security to protect data between the client and the ISP Network Access Server (NAS).

Restriction - appxk9 must be active on the ISR4000 router. Without this license, the route will get installed towards the client at the end of PPP negotiation, but Layer 3 connectivity between the client and the server will not be established.

Configure

Note: Use the Command Lookup Tool (registered customers only) in order to obtain more information on the commands used in this section.

Network Diagram

Configurations

Configuration on the Client Router

An example of the configuration on the client router is shown here:

!
l2tp-class CISCO
!
pseudowire-class CLASS
 encapsulation l2tpv2
 ip local interface Vlan333
!
interface FastEthernet0/0
 switchport access vlan 333
 no ip address
 no keepalive
!
interface Virtual-PPP1
 ip address negotiated
 ppp chap hostname cisco@cisco.com
 ppp chap password 0 cisco
 pseudowire 10.1.1.2 1 pw-class CLASS    !! Specifies the IP address of the tunnel
 server and the 32-bit virtual circuit identifier (VCID) shared between the
 devices at each end of the control channel. 
!
interface Vlan333
 ip address 10.1.1.1 255.255.255.0
!

Configuration on the ISR4451 That Acts as a Server

An example of the configuration on ISR4000 that acts as a server is shown here:

vpdn enable
!
vpdn-group 1
 accept-dialin
  protocol l2tp
  virtual-template 1
 terminate-from hostname CLIENT
 no l2tp tunnel authentication
!
license boot level appxk9 !! License must be appxk9

username cisco@cisco.com password 0 cisco
!
interface Loopback1
 ip address 192.168.1.2 255.255.255.0
!
interface FastEthernet0/0
 ip address 10.1.1.2 255.255.255.0
 negotiation auto
!
ip local pool TEST 10.1.1.3 10.1.1.100
!
interface Virtual-Template1
 ip unnumbered Loopback1
 peer default ip address pool TEST
 ppp authentication chap
!

Verify

Use this section in order to verify your configuration.

The Output Interpreter Tool (registered customers only) supports certain show commands. Use the Output Interpreter Tool in order to view an analysis of show command output.

Verification on the Client Router

Enter these commands in order to verify the configuration on client router:

CLIENT#show vpdn session

L2TP Session Information Total tunnels 1 sessions 1

LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID   
                                 Vcid, Circuit                                  
9886       40437      48058      1, Vp1               est    00:17:51 17       
!! Session up since 17:51 Minutes

CLIENT#show caller ip
  Line           User       IP Address      Local Number    Remote Number   <->
  Vp1            SERVER     192.168.1.2     -               -               in  
!! Tunnel Server 

CLIENT#ping 192.168.1.2 !! Tunnel Server Reachable
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

CLIENT#show ppp all
Interface/ID OPEN+ Nego* Fail-     Stage    Peer Address    Peer Name
------------ --------------------- -------- --------------- --------------------
Vp1          LCP+ IPCP+ CDPCP-     LocalT   192.168.1.2     SERVER        

Verification on the ISR4000 That Acts as a Server

SERVER#show license feature
Feature name             Enforcement  Evaluation  Subscription   Enabled  RightToUse 
appxk9                   yes          yes         no             yes      yes       
 !! License must be Active

SERVER#show vpdn session

L2TP Session Information Total tunnels 1 sessions 1

LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID   
                                 Vcid, Circuit                                  
40437      9886       19763      cisco@cisc..., Vi3.1 est    00:16:56 2         

SERVER#show caller ip
  Line           User       IP Address      Local Number    Remote Number   <->
  Vi3.1          cisco@cisco.com \
                            10.1.1.4        -               -               in 
 !! IP address of the Client allocated from local address pool (TEST)

SERVER#ping 10.1.1.4  !! Client reachable
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

Troubleshoot

Note: Refer to Important Information on Debug Commands before you use debug commands.

Use standard VPDN/ L2TP/ PPP procedures in order to troubleshoot any issues. However, this list of debugs can also be helpful.

debug ppp events
debug ppp error
debug ppp negotiation
debug vpdn error
debug vpdn event
debug vpdn l2x events
debug vpdn l2x errors
debug l2tp error
debug l2tp event
debug vtemplate event
debug vtemplate error
debug vtemplate cloning

Related Information

• Configuring Client-Initiated Dial-In VPDN Tunneling
• Technical Support & Documentation - Cisco Systems