L2TP/IPSec on IOS router

The following topic describes how to do L2TP/IPSec on Windows 8.
https://supportforums.cisco.com/document/9878401/l2tp-over-ipsec-cisco-ios-router-using-windows-8
However, I am trying to use the same template for Chrome OS clients and it does not work. Has it ever been set up successfully? Any ideas would be greatly appreciated.
Thank you,
Aram.

Randy, I understand now!
What I would do in this case is couple of things, but this still needs some minor configuration on the router, it depends on the router managed provider but.. you should be able to ask the provider know that you want to get syslog traps from the router to your syslog server, and they should be able to provide this to you and they should provide that, after all, you are paying for services even though is a managed router by provider.
On the router thye would configure a secondary logging server.
e.i
say your syslog server is 20.20.20.20
router(config)#logging 20.20.20.20
router(config)#logging trap informational
the above informational is facility #6 out of the 7 levels of facility, 0 being emergencies 1 alerts 2 critical and so on..I believe with this facility# you will see tunnel info on the syslog.
additionally, on the access-lists pertaining to the L2L Ipsec tunnel add the keyword log at the end of each of its access-list, with the keywork log the router will send traps pertaining to the access-list to your syslog thus providing you that the connection is stablihed or not.
Rgds
-Jorge

Similar Messages

  • Verifying IPSec on IOS / router

    is there a way to verify from Cisco router syslogs that an IPSec tunnel is being successfully established with another Cisco router / peer? I've been looking at the System Message manuals (SEC, Crypto events) and only see stuff that would indicate problems - would like to be able to check syslogs to validate that a tunnel came up without issue, or if a tunnel drops, etc. but not sure what these messages look like.
    thanks
    -randy

    Randy, I understand now!
    What I would do in this case is couple of things, but this still needs some minor configuration on the router, it depends on the router managed provider but.. you should be able to ask the provider know that you want to get syslog traps from the router to your syslog server, and they should be able to provide this to you and they should provide that, after all, you are paying for services even though is a managed router by provider.
    On the router thye would configure a secondary logging server.
    e.i
    say your syslog server is 20.20.20.20
    router(config)#logging 20.20.20.20
    router(config)#logging trap informational
    the above informational is facility #6 out of the 7 levels of facility, 0 being emergencies 1 alerts 2 critical and so on..I believe with this facility# you will see tunnel info on the syslog.
    additionally, on the access-lists pertaining to the L2L Ipsec tunnel add the keyword log at the end of each of its access-list, with the keywork log the router will send traps pertaining to the access-list to your syslog thus providing you that the connection is stablihed or not.
    Rgds
    -Jorge

  • Can a Cisco 881 router create an L2TP/IPsec tunnel via NAT to Windows 2008?

    Hi
    Was anyone successfull in setting up an L2TP/IPsec tunnel through NAT-T against a Windows 2008/ R2 RRAS server? I am using an 881 router and the layout is someting like this:
    Client -> 881 -> NAT -> internet -> Windows 2008 RRAS
    The tunnel goes form the 881 to the Windows server (not from the client...).
    Thanks
    Roland

    Hi Federico
    Thanks for your help! Much appreciated.
    In my case this should be transparent to the client - I would like not to initiate the connection from the client.
    Does that makes sense? I am considering L2TP because Windows 2008 R2 doesn't support IPSec tunnels through NAT (2008 R2 being the responder and the Cisco router the initiator of the IPSec connection).
    Regards
    Roland

  • Port Forwarding for L2TP/IPSec VPN Behind Verizon Actiontec MI424WR-GEN2 Rev. E v20.21.0.2

    I've got a NAS setup with various services running on custom ports to help minimize exposure (especially to script kiddies). I've tested everything both internally and externally to confirm they all work, and even had someone at a remote location confirm accessibility as well.  Port forward configurations performed on the Actiontec are working well. 
    I installed an L2TP/IPSec VPN server, tested internally and it connected successfully.  So for all intents & purposes, this validates that the VPN server is correctly configured to accept inbound connections and functioning correctly.
    I logged into the Verizon Actiontec MI424WR router, setup port forwarding for UDP ports 500, 1701 & 4500.
    Note: I added the AH & ESP protocols based on what I saw on the built-in L2TP/IPSec rules
    With the port forwarding in place, I tested VPN externally but it didn't connect.
    I've done the following so far to no avail:
    Double & triple checked the port forwards, deleted & recreated the rules a few times to be sure
    There are no other pre-existing L2RP/IPSec port forward rules or otherwise conflicting port forward rules (e.g.: another rule for ports 500, 1701 or 4500)
    There was an L2TP port triggering rule enabled, that I toggled on and off with no change
    Verified the firewall on VPN server had an exclusion for L2TP, or that the firewall is off. (Firewall is off to reduce a layer of complexity, but it worked internally to begin with so I doubt that's the issue.)
    Since it works internally, and there are no entries in the logs on the device indicating inbound connections, I'm convinced its an issue with the Verizon Actiontec router.  But unfortunately, I'm not sure what else to try or where else to look to troubleshoot this.  For instance, is there a log on the router that I can view in real time (e.g.: tail) that would show me whether or not the inbound connection attempt is reaching the device, and whether or not the device allowed or blocked it?
    My router details:
    Verizon Actiontec
    MI424WR-GEN2
    Revision E
    Firmware 20.21.0.2
    Verizon Actiontec built-in L2TP/IPSec rule templates.  They're not currently in use, but are baked into the firmware for easy configuration/selection from a drop down menu.
    Solved!
    Go to Solution.

    normally a vpn on that router, will have a GRE tunneling protocol as well.
    two ways to build the PF rules,
    Manually
    Preconfigured
    I know the preconfigured VPN rules will do the GRE protocol as well, but if you do it by hand you can't get it.

  • [SOLVED]Connecting to L2TP/IPSec VPN problem: pppd seems not starting

    I'm trying to connect to an L2TP/IPsec VPN server, by ipsec-tools + xl2tpd.
    Here is my setup:
    /etc/racoon.conf:
    log debug;
    path pre_shared_key "/etc/racoon/psk.txt";
    padding {
    maximum_length 20;
    randomize off;
    strict_check off;
    exclusive_tail off;
    remote anonymous {
    exchange_mode main;
    doi ipsec_doi;
    situation identity_only;
    generate_policy on;
    nat_traversal on;
    proposal_check obey;
    proposal {
    encryption_algorithm aes 256;
    lifetime time 3600 sec;
    hash_algorithm sha1;
    authentication_method pre_shared_key;
    dh_group modp1024;
    sainfo anonymous {
    lifetime time 3600 sec;
    encryption_algorithm aes 256;
    authentication_algorithm hmac_sha1;
    compression_algorithm deflate;
    /etc/racoon/psk.txt:
    #broadband
    137.189.192.201 the-server-psk
    137.189.192.204 the-server-psk
    Here the two IPs are the IPs of vpn.cuhk.edu.hk, which is the VPN server.
    /etc/xl2tpd/xl2tpd.conf:
    [global]
    port = 1701
    auth file = /etc/ppp/pap-secrets
    debug network = yes
    debug avp = yes
    debug packet = yes
    debug state = yes
    debug tunnel = yes
    [lac connect]
    lns = vpn.cuhk.edu.hk
    name = vpn-server
    redial = yes
    redial timeout = 15
    max redials = 5
    hidden bit = yes
    refuse chap = yes
    require pap = yes
    ppp debug = yes
    pppoptfile = /etc/ppp/options.xl2tpd
    /etc/ppp/pap-secrets:
    # Secrets for authentication using PAP
    # client server secret IP addresses
    myusername * mypassword *
    /etc/ppp/options.xl2tpd:
    lock
    debug
    mtu 1000
    nobsdcomp
    nodeflate
    noaccomp
    nopcomp
    novj
    defaultroute
    refuse-chap
    refuse-mschap
    refuse-mschap-v2
    connect-delay 5000
    name myusername
    password mypassword
    spd.sh:
    #!/bin/sh
    Then I do the following:
    # 192.168.1.1 is my lan gateway
    sudo ip route add 137.189.192.201 via 192.168.1.1
    sudo ip route add 137.189.192.204 via 192.168.1.1
    # For adding spd, script from the VPN server
    echo -e flush\; | sudo setkey -c
    echo -e spdflush\; | sudo setkey -c
    echo -e spdadd 192.168.1.173/32\[1701\] 0.0.0.0\/0\[0\] any \-P out ipsec esp\/transport\/\/require\; | sudo setkey -c
    sudo systemctl start racoon
    sudo systemctl start xl2tpd
    echo "c connect" | sudo tee /var/run/xl2tpd/l2tp-control
    I expect that some network interface like ppp0 will be created, but nothing happened.
    Then I check the record, and find something weird in xl2tpd log (from journalctl, racoon and sudo logs skipped):
    8月 21 01:13:40 nkdesktop systemd[1]: Stopped Level 2 Tunnel Protocol Daemon (L2TP).
    8月 21 01:13:41 nkdesktop systemd[1]: Starting Racoon IKEv1 key management daemon for IPSEC...
    8月 21 01:13:41 nkdesktop systemd[1]: Started Racoon IKEv1 key management daemon for IPSEC.
    8月 21 01:13:43 nkdesktop systemd[1]: Starting Level 2 Tunnel Protocol Daemon (L2TP)...
    8月 21 01:13:43 nkdesktop systemd[1]: Started Level 2 Tunnel Protocol Daemon (L2TP).
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: setsockopt recvref[30]: Protocol not available
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Using l2tp kernel support.
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: xl2tpd version xl2tpd-1.3.6 started on nkdesktop PID:19639
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Forked by Scott Balmos and David Stipp, (C) 2001
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Inherited by Jeff McAdams, (C) 2002
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Forked again by Xelerance (www.xelerance.com) (C) 2006
    8月 21 01:13:43 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Listening on IP address 0.0.0.0, port 1701
    8月 21 01:13:45 nkdesktop xl2tpd[19639]: xl2tpd[19639]: get_call: allocating new tunnel for host 137.189.192.204, port 1701.
    8月 21 01:13:45 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Connecting to host vpn.cuhk.edu.hk, port 1701
    8月 21 01:13:45 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: message type is (null)(0). Tunnel is 0, call is 0.
    8月 21 01:13:45 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: sending SCCRQ
    8月 21 01:13:46 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: select timeout
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: select timeout
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: recv packet from 137.189.192.204, size = 103, tunnel = 30858, call = 0 ref=0 refhim=0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: handle_avps: handling avp's for tunnel 30858, call 0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: message_type_avp: message type 2 (Start-Control-Connection-Reply)
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: protocol_version_avp: peer is using version 1, revision 0.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: framing_caps_avp: supported peer frames: async sync
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: bearer_caps_avp: supported peer bearers:
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: firmware_rev_avp: peer reports firmware version 1648 (0x0670)
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: hostname_avp: peer reports hostname 'eriwan'
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: vendor_avp: peer reports vendor 'Adtran, l2tpd'
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: assigned_tunnel_avp: using peer's tunnel 4733
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: message type is Start-Control-Connection-Reply(2). Tunnel is 4733, call is 0.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: sending SCCCN
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Connection established to 137.189.192.204, 1701. Local: 30858, Remote: 4733 (ref=0/0).
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Calling on tunnel 30858
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: message type is (null)(0). Tunnel is 4733, call is 0.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: sending ICRQ
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: recv packet from 137.189.192.204, size = 12, tunnel = 30858, call = 0 ref=0 refhim=0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: recv packet from 137.189.192.204, size = 28, tunnel = 30858, call = 63662 ref=0 refhim=0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: handle_avps: handling avp's for tunnel 30858, call 63662
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: message_type_avp: message type 11 (Incoming-Call-Reply)
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: assigned_call_avp: using peer's call 31346
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: message type is Incoming-Call-Reply(11). Tunnel is 4733, call is 31346.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: Sending ICCN
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Call established with 137.189.192.204, Local: 63662, Remote: 31346, Serial: 1 (ref=0/0)
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: start_pppd: I'm running:
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "/usr/sbin/pppd"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "passive"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "nodetach"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: ":"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "refuse-chap"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "name"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "vpn-server"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "debug"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "file"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "/etc/ppp/options.xl2tpd"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "plugin"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "pppol2tp.so"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "pppol2tp"
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: "7"
    8月 21 01:13:47 nkdesktop pppd[19647]: Plugin pppol2tp.so loaded.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: recv packet from 137.189.192.204, size = 12, tunnel = 30858, call = 0 ref=0 refhim=0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: recv packet from 137.189.192.204, size = 12, tunnel = 30858, call = 63662 ref=0 refhim=0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: recv packet from 137.189.192.204, size = 38, tunnel = 30858, call = 63662 ref=0 refhim=0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: handle_avps: handling avp's for tunnel 30858, call 63662
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: message_type_avp: message type 14 (Call-Disconnect-Notify)
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: result_code_avp: peer closing for reason 1 (General request to clear control connection), error = 0 ()
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: assigned_call_avp: using peer's call 31346
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: message type is Call-Disconnect-Notify(14). Tunnel is 4733, call is 31346.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: Connection closed to 137.189.192.204, serial 1 ()
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: Terminating pppd: sending TERM signal to pid 19647
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: recv packet from 137.189.192.204, size = 38, tunnel = 30858, call = 0 ref=0 refhim=0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: handle_avps: handling avp's for tunnel 30858, call 0
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: message_type_avp: message type 4 (Stop-Control-Connection-Notification)
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: assigned_tunnel_avp: using peer's tunnel 4733
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: result_code_avp: peer closing for reason 1 (General request to clear control connection), error = 0 ()
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: message type is Stop-Control-Connection-Notification(4). Tunnel is 4733, call is 0.
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: control_finish: Connection closed to 137.189.192.204, port 1701 (), Local: 30858, Remote: 4733
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: build_fdset: closing down tunnel 30858
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: select returned error 9 (Bad file descriptor)
    8月 21 01:13:47 nkdesktop xl2tpd[19639]: xl2tpd[19639]: network_thread: select returned error 4 (Interrupted system call)
    ... then xl2tpd repeatedly trying to build a connection and fails for every 15s ...
    I think pppd should have showed more logs, rather than just loading a module.
    But I have no idea about what's wrong.
    Or did I just forget to turn on the log function of pppd? If so, how should I turn it on?
    Anyone can help?
    Last edited by nnkken (2014-08-24 08:42:03)

    Additional information:
    Today I decrypted the IPSec ESP packets by Wireshark (what an awesome function) and compared the L2TP message of my ArchLinux and MacOSX to the same VPN Server.
    And I found that while both ArchLinux and MacOSX sends Incomming_Call_Connection (ICCN) packet, the packet are quite different:
    The ArchLinux ICCN Packet has 2 additional AVP fields: Random Vector AVP and RX Connect Speed AVP.
    Also, the Connect Speed AVP (and also the RX Connect Speed AVP) field is 0, which is different from MacOSX (100000).
    After the ICCN packet, MacOCX sends a PPP packet over L2TP, while ArchLinux sends nothing and the server sends a Call_Disconnect_Notification to ArchLinux.
    Anyone knows whether this is a bug or something wrong in config?
    Last edited by nnkken (2014-08-22 20:19:49)

  • RVS4000 L2TP IPSec

    Currently trying to establish L2TP IPSec VPN tunnels between Windows XP remote client and Windows 2003 RRAS Server.
    Both the XP remote client and the W2003 RRAS Server are behind RVS4000 routers.
    Have established that the W2003 RRAS server will accept L2TP IPSec connections from clients behind the Cisco RVS4000 router [LAN clients].
    Can not establish remote L2TP IPSec connections through the RVS4000 routers. Have established that PPTP VPN through the RVS4000 routers. Both routers are running version 1.3.0.5
    Both RVS 4000 routers are configured for PPTP, IPSec, & L2TP VPN passthrough with UDP port 1701 being forwarded to the RRAS server by the
    RVS 4000 router. PPTP VPN connections have no problem.
    Error code is 792
    The problem appears to be with IPSec passthrough.  UDP port 1701 is being forwarded to the RRAS server. Can not create port rules for IKE 500 or IP Protocol 50/4500 on the RVS4000 because those policies conflict with forwarding UDP1701.
    Any guidance on why the IPSec fails through the RVS4000 for remote access clients but IPSec is successful in establishing a connection to the RRAS server using LAN clients.

    I repeat one more time: Never ever forward port UDP 1701. You don't want to expose the L2TP server to the internet. If the server is configured correctly on your VPN server then it won't accept direct access to UDP port 1701 anyway. But still you don't want to do it.
    L2TP or better L2TP over IPSec tunnels L2TP traffic on UDP 1701 inside an IPSec tunnel between the client and the server. If you run your VPN server inside your LAN behind a NAT router all you ever want to forward for that purpose is IPSec, i.e. ports UDP 500 and TCP/UDP 4500. Nothing else. For L2TP over IPSec all the router will ever see is IPSec traffic. The L2TP traffic is encrypted inside the IPSec tunnel. The router does not know about this.
    If you forward UDP 1701 to your L2TP server you expose the L2TP server directly to the internet, removing the pre-shared key or certificate authentication and encryption of IPSec. All L2TP is completely unencrypted, then if someone has an L2TP (with no IPSec) client to connect.
    The standard Windows L2TP/IPSec won't connect directly to L2TP without IPSec.
    Even if the RVL allows you to forward UDP 1701 don't do it. If your VPN connection to your VPN server only works with this forwarding in place then you have a big problem with your whole VPN configuration because as I have mentioned before the router should never see any VPN traffic on UDP 1701 as it is supposed to be fully encrypted and hidden inside the IPSec tunnel...

  • Cisco IOS Router to PIX VPN Issues

    Hi Everyone,
    I have a small issue here which someone may be able to shed some light on.
    I have a Cisco IOS router which is terminating a site-to-site VPN connection on the dialer interface. The PIX on the other end is behind a NAT router. The tunnel is being established and one subnet is able to see another when the tunnel is up. The thing we are having an issue is both networks on each side of the VPN contain multiple subnets and i cannot connect to all the subnets over the same tunnel.
    Any ideas.

    Yes all this is setup.
    I have just found out that Cisco IOS can only make connections from 1 network per crypt map unless multiple connections are made from server to host. This is quite disturbing because i have not seen this in any documentation.
    Does anyone know of IOS to PIX IPsec with multiple subnets on each side of the network.

  • Is it possible to build two different L2TP/IPSec tunnels per subnet or per user?

    Dear colleagues
    I wondered whether anyone could help with this one.
    Is it possible to build two different L2TP/IPSec tunnels per subnet or per user on a Cisco router or any other third party manufacturer?  The idea behind is to allow different access to resources to different support technicians.  Your help is much appreciated.

    Sure, the ASA can use LDAP/AD information to select what access list should be applied for that specific user or group of users logging into the VPN. You can use whats called DAP or just LDAP Attribute Maps.

  • AC100 - No VPN L2TP/IPSec PSK available

    Android 2.2 (Froyo) devices show for VPN connections the following possibilities: PPTP, L2TP, L2TP/IPSec PSK and L2TP/IPSec CRT (checked on serveral brands smartphones).
    The AC100 is only showing PPTP and L2TP, so no L2TP/IPSec at all.
    Any idea why they are missing and how to resolve this?
    Need L2TP/IPSec for a VPN connection with a Sonicwall 3060/Pro.
    Here's a description how to connect:[https://www.fuzeqna.com/sonicwallkb/consumer/kbdetail.asp?kbid=8658]

    Hi
    As far as I know the L2TP/IPSec is available only for routed android devices.
    So possibly this is the reason why the L2TP/IPSec in not available for AC100.
    I found here a nice Android L2TP/IPSec VPN HowTo
    http://blogs.nopcode.org/brainstorm/2010/08/22/android-l2tpipsec-vpn-mini-howto/
    Maybe this could be helpful a little bit!

  • PIX - IOS Router Redundancy

    PIX at remote, Dual Interface/Dual ISP IOS Router at core.
    Is there a way to have an IPSEC Tunnel fromt he PIX to the Dual ISP Router at the core?
    Can't get the PIX to pass traffic over the second IPSEC Tunnel when one ISP/Interface goes down at the IOS Router.
    Help!
    Thanks,
    Bob

    PIX-501 at the remote
    Cisco1721 with Dual ISP feeds at Central site.
    I want two tunnels from the PIX to the Cisco1721.
    One ISP goes down, tarffic goes over the second tunnel.
    Thanks,
    Bob

  • Macbook clients cannot connect to Windows Server 2008 RRAS with L2TP/IPSec

    Hi everyone,
    I had installed "Remote and Routing Access" or a VPN server on Windows Server 2008. The connection type set up is L2TP/IPSec. All the Windows clients can connect to the L2TP/IPSec VPN server without problem but Macbook users are facing problem.
    The Macbook users got the error message "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator."
    I think it is something related to the pre-shared key encryption but I am not sure. The Macbook users could connect if the connection type is changed to PPTP on server and clients side. I searched for similar problems and solutions online but no luck, I couldn't find solution that helps. I found this is a common problem faced by many macbook users.
    Does anyone have a solution or suggestion for this, please? I appreciate all the helps and suggestion given.
    Thanks,
    CK

    Hi,
    Thanks for the question, however, this forum is for Remote Desktop Clients related questions.
    Regarding the issue, as Windows clients can connect with no problem, I suspect that it is a Mac side issue and I would like to suggest you contact Apple support for help.
    Thanks.
    Jeremy Wu
    TechNet Community Support

  • VPN between ASA and IOS router

    We have established a VPN tunnel between IOS router and ASA, however it i working only from the latter. What are the common dissimilarities whcih occur between these two devices when setting up VPN?

    Do a search for the following on cisco.com- "Most Common L2L and Remote Access IPSec VPN Troubleshooting Solutions"
    It should help fix any problems.
    HTH and please rate.

  • SSLVPN with iPhone Anyconnect and Cisco IOS Router, Certificate Authentication failed

    Hello,
    i have a problem regarding the authentication with a certificate from the iPhone Anyconnect 2.5 Client to a 1802 Cisco Router.
    Cisco 1802 Router:
    Cisco IOS Software, C180X Software (C180X-ADVENTERPRISEK9-M), Version 15.1(1)T, RELEASE SOFTWARE (fc1)
    First i configured SSLVPN with username and password, in this configuration the Anyconnect Client of my iPhone works.
    then i enrolled a certificate from my Windows 2008 R2 CA to the Router with the Attributes: Server Authentication and IPSEC
    and i enrolled a certificate for my iPhone with Client Authentication and IPSEC
    after a bunch of time ( i realy could not find a really good documentation on how to do this) i got it done, in the webvpn context configuration i made this changes here:
    no aaa authentication list default
    authentication certificate
    ca trustpoint CA
    as the "SSL VPN Configuration Guide, Cisco IOS Release 15.1M&T" says: if i want only certificate authentication i had to user the "authentication certificate" command and thats it.
    as i look into the debugs it seems to me that the Router accepts the certificate of the iPhone, but then i receive a window on the iphone that wants an additional username and password authentication, and no matter what i enter there's always the same dialog coming back..
    any ideas what the problem could be???
    here is the configuration:
    webvpn gateway WEBVPN_GW_OFFICE2
    ip interface Dialer0 port 1444
    ssl trustpoint CA
    inservice
    webvpn install svc flash:/webvpn/sslclient-win-1.1.4.179.pkg sequence 1
    webvpn install svc flash:/webvpn/anyconnect-win-3.0.4235-k9.pkg sequence 2
    webvpn install svc flash:/webvpn/anyconnect-dart-win-2.5.3055-k9.pkg sequence 3
    webvpn context WEBVPN_CONTEXT2
    secondary-color white
    title-color #669999
    text-color black
    ssl authenticate verify all
    policy group WEBVPN_POLICY2
       functions svc-enabled
       mask-urls
       svc address-pool "SSLVPN_OFFICE1"
       svc default-domain "domain.internal"
       svc keep-client-installed
       svc split include 192.168.0.0 255.255.0.0
       svc dns-server primary 192.168.53.33
       svc dns-server secondary 192.168.53.35
    virtual-template 3
    default-group-policy WEBVPN_POLICY2
    gateway WEBVPN_GW_OFFICE2
    authentication certificate
    ca trustpoint CA
    inservice
    here is the debug:
    OfficeRouter1# PASSING appctx is [0x89FAFFCC]
    Nov 19 22:39:53.507: WV: sslvpn process rcvd context queue event
    Nov 19 22:39:53.507: WV: sslvpn process rcvd context queue event
    Nov 19 22:39:53.607: WV: sslvpn process rcvd context queue event
    Nov 19 22:39:53.607: WV: Entering APPL with Context: 0x86529380,
          Data buffer(buffer: 0x86543A40, data: 0x15A07AB8, len: 469,
          offset: 0, domain: 0)
    Nov 19 22:39:53.607: WV: http request: / with no cookie
    Nov 19 22:39:53.607: WV: validated_tp : CA cert_username :  matched_ctx :
    Nov 19 22:39:53.607: WV: Received appinfo
    validated_tp : CA, matched_ctx : ,cert_username :
    Nov 19 22:39:53.607: WV: Trustpoint match successful
    Nov 19 22:39:53.607: WV: Extracted username:  pass: ?
    Nov 19 22:39:53.607: WV: Client side Chunk data written..
    buffer=0x86543640 total_len=661 bytes=661 tcb=0x8811FE60
    Nov 19 22:39:53.607: WV: Appl. processing Failed : 2
    Nov 19 22:39:53.607: WV: sslvpn process rcvd context queue event
    BueroRouter1# PASSING appctx is [0x89FAEEC4]
    Nov 19 22:40:24.028: WV: sslvpn process rcvd context queue event
    Nov 19 22:40:24.032: WV: sslvpn process rcvd context queue event
    Nov 19 22:40:24.132: WV: sslvpn process rcvd context queue event
    Nov 19 22:40:24.132: WV: Entering APPL with Context: 0x86529380,
          Data buffer(buffer: 0x86543A40, data: 0x160C4038, len: 469,
          offset: 0, domain: 0)
    Nov 19 22:40:24.132: WV: http request: / with no cookie
    Nov 19 22:40:24.132: WV: validated_tp : CA cert_username :  matched_ctx :
    Nov 19 22:40:24.132: WV: Received appinfo
    validated_tp : CA, matched_ctx : ,cert_username :
    Nov 19 22:40:24.132: WV: Trustpoint match successful
    Nov 19 22:40:24.132: WV: Extracted username:  pass: ?
    Nov 19 22:40:24.132: WV: Client side Chunk data written..
    buffer=0x86543640 total_len=661 bytes=661 tcb=0x88D11EEC
    Nov 19 22:40:24.136: WV: Appl. processing Failed : 2
    Nov 19 22:40:24.136: WV: sslvpn process rcvd context queue event
    Nov 19 22:40:39.764: WV: sslvpn process rcvd context queue event
    Nov 19 22:40:39.880: WV: sslvpn process rcvd context queue event
    Nov 19 22:40:39.892: WV: sslvpn process rcvd context queue event
    Nov 19 22:40:39.892: WV: Entering APPL with Context: 0x86529380,
          Data buffer(buffer: 0x86543A40, data: 0x1616FD38, len: 610,
          offset: 0, domain: 0)
    Nov 19 22:40:39.892: WV: http request: /webvpn.html with domain cookie
    Nov 19 22:40:39.892: WV: validated_tp :  cert_username :  matched_ctx :
    Nov 19 22:40:39.892: WV: Received appinfo
    validated_tp : CA, matched_ctx : ,cert_username :
    Nov 19 22:40:39.892: WV: Trustpoint match successful
    Nov 19 22:40:39.892: WV: Client side Chunk data written..
    buffer=0x86543640 total_len=607 bytes=607 tcb=0x88D11EEC
    Nov 19 22:40:39.892: WV: Appl. processing Failed : 2
    Nov 19 22:40:39.892: WV: sslvpn process rcvd context queue event

    http://www.cisco.com/en/US/products/ps8411/products_qanda_item09186a00809aec31.shtml
    HI,
    Refer to
    AnyConnect VPN Client FAQ
    Q. Is it possible to connect the iPad, iPod, or iPhone AnyConnect VPN Client to a Cisco IOS router?
    A. No. It is not possible to connect  the iPad, iPod, or iPhone AnyConnect VPN Client to a Cisco IOS router.  AnyConnect on iPad/iPhone can connect only to an ASA that runs version  8.0(3).1 or later. Cisco IOS is not supported by the AnyConnect VPN  Client for Apple iOS. For more information, refer to the Security Appliances and Software Supported section of the Release Notes for Cisco AnyConnect Secure Mobility Client 2.4, Apple iOS 4.2 and 4.3.

  • IPhone 2.1 now supports Cisco VPN Client to IOS router

    Just tested it. The Cisco VPN Client in iPhone 2.1 now connects to my IOS router. Excellent.

    I have a Cisco 1812 with 12.4(20)T. I know that 12.4(6)T and some other versions have an issue with the negotiation of IPSec policies which basically means that only the first proposal is considered. If the first proposal matches you have a connection. If it does not match, the connection is refused even though other proposals would be O.K.
    The relevant isakmp/ipsec config should be:
    crypto isakmp policy 3
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp client configuration group myvpn
    key mysecretkey
    dns 10.0.0.2 10.0.0.3
    wins 10.0.0.2
    domain mydomain.example.com
    pool ippool
    acl 150
    split-dns mydomain.example.com
    netmask 255.255.255.0
    crypto isakmp profile ike-myvpn-profile
    match identity group myvpn
    client authentication list userauthen
    isakmp authorization list groupauthor
    client configuration address respond
    virtual-template 2
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile myvpn
    set transform-set ESP-3DES-SHA
    set isakmp-profile ike-myvpn-profile
    interface Virtual-Template2 type tunnel
    ip unnumbered FastEthernet1
    ip nat inside
    ip virtual-reassembly
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile myvpn
    See also http://www.cisco.com/en/US/docs/ios/security/configuration/guide/secipsec_virt_tunnl_ps6441_TSD_Products_Configuration_GuideChapter.html
    If you have IOS 12.4(6)T or similar which has the bug I have mentioned you have to use aes instead of 3des for the transform set. The first proposal of the iPhone is aes. Be sure to check the "debug crypto ipsec" and "debug crypto isakmp" output for troubleshooting.

  • Looking for help to set up l2tp Ipsec vpn on asa 5055

    I am trying to set up a L2tp Ipsec vpn on asa 5055 and I am using windows 8.1 build in VPN client to connect to it. I got the following error. Anyone has experence please help.
    Apr 17 22:48:21 [IKEv1]Group = DefaultRAGroup, IP = 209.171.88.81, All IPSec SA proposals found unacceptable!
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, sending notify message
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, constructing blank hash payload
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, constructing ipsec notify payload for msg id 1
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, constructing qm hash payload
    Apr 17 22:48:21 [IKEv1]IP = 209.171.88.81, IKE_DECODE SENDING Message (msgid=6a50f8f9) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84
    Apr 17 22:48:21 [IKEv1]Group = DefaultRAGroup, IP = 209.171.88.81, QM FSM error (P2 struct &0xad6946b8, mess id 0x1)!
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, IKE QM Responder FSM error history (struct &0xad6946b8)  <state>, <event>:  QM_DONE, EV_ERROR-->QM_BLD_MSG2, 
    EV_NEGO_SA-->QM_BLD_MSG2, EV_IS_REKEY-->QM_BLD_MSG2, EV_CONFIRM_SA-->QM_BLD_MSG2, EV_PROC_MSG-->QM_BLD_MSG2, EV_HASH_OK-->QM_BLD_MSG2, NullEvent-->QM_BLD_MSG2, 
    EV_COMP_HASH
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, sending delete/delete with reason message
    Apr 17 22:48:21 [IKEv1]Group = DefaultRAGroup, IP = 209.171.88.81, Removing peer from correlator table failed, no match!
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, IKE SA MM:d8870fa5 rcv'd Terminate: state MM_ACTIVE  flags 0x00000042, refcnt 1, tuncnt 0
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, IKE SA MM:d8870fa5 terminating:  flags 0x01000002, refcnt 0, tuncnt 0
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, sending delete/delete with reason message
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, constructing blank hash payload
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, constructing IKE delete payload
    Apr 17 22:48:21 [IKEv1 DEBUG]Group = DefaultRAGroup, IP = 209.171.88.81, constructing qm hash payload
    Apr 17 22:48:21 [IKEv1]IP = 209.171.88.81, IKE_DECODE SENDING Message (msgid=232654dc) with payloads : HDR + HASH (8) + DELETE (12) + NONE (0) total length : 80
    Apr 17 22:48:21 [IKEv1]Group = DefaultRAGroup, IP = 209.171.88.81, Session is being torn down. Reason: Phase 2 Mismatch
    I am new to this so I don't know what I should do next. Thanks

    Here it is. Thanks.
    CL-T179-12IH# show run crypto
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
    crypto ipsec ikev2 ipsec-proposal DES
     protocol esp encryption des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal 3DES
     protocol esp encryption 3des
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES
     protocol esp encryption aes
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES192
     protocol esp encryption aes-192
     protocol esp integrity sha-1 md5
    crypto ipsec ikev2 ipsec-proposal AES256
     protocol esp encryption aes-256
     protocol esp integrity sha-1 md5
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpoint vpn
     enrollment self
     subject-name CN=174.142.90.17
     crl configure
    crypto ca trustpool policy
    crypto ca certificate chain vpn
     certificate 2d181c55
        308201ff 30820168 a0030201 0202042d 181c5530 0d06092a 864886f7 0d010105
        05003044 31163014 06035504 03130d31 37342e31 34322e39 302e3137 312a3028
        06092a86 4886f70d 01090216 1b434c2d 54313739 2d313249 482e7072 69766174
        65646e73 2e636f6d 301e170d 31353034 31363033 31393439 5a170d32 35303431
        33303331 3934395a 30443116 30140603 55040313 0d313734 2e313432 2e39302e
        3137312a 30280609 2a864886 f70d0109 02161b43 4c2d5431 37392d31 3249482e
        70726976 61746564 6e732e63 6f6d3081 9f300d06 092a8648 86f70d01 01010500
        03818d00 30818902 818100bf 797d1cc1 cfffc634 8c3b2a4b ce27b1c9 3fc3e026
        4f6cd8f4 c9675aca b5176cef 7f3df142 35ba4e15 2613d34c 91bb5da3 14b34b6c
        71e4ff44 f129046f 7f91e73f 2c9d42f9 93001559 ea6c71c1 1a848073 15da79f7
        a41081ee b4cd3cc3 baa7a272 3a5fb32d 66dedee6 5994d4b2 ad9d7489 44ec9eb9
        44038a2a 817e935f 1bb7ad02 03010001 300d0609 2a864886 f70d0101 05050003
        8181002c 6cee9ae7 a037698a 5690aca1 f01c87db 04d9cbc6 65bda6dc a17fc4b6
        b1fd419e 56df108f b06edfe6 ab5a5eb3 5474a7fe 58970da3 23e6bc6e 36ab8f62
        d5c442bf 43581eb3 26b8cf26 6a667a8b ddd25a73 a094f0d0 65092ff8 d2a644d8
        3d7da7ca efeb9e2f 84807fdf 0cf3d75e bcb65ba4 7b51cb49 f912f516 f95b5d86
        da0e01
      quit
    crypto ikev2 policy 1
     encryption aes-256
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 10
     encryption aes-192
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 30
     encryption 3des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 policy 40
     encryption des
     integrity sha
     group 5 2
     prf sha
     lifetime seconds 86400
    crypto ikev2 enable outside client-services port 443
    crypto ikev2 remote-access trustpoint vpn
    crypto ikev1 enable outside
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400

Maybe you are looking for