<P><br>
Mark,<br>
<br>
After review the debug output. It seems there is a problem <br>
at the other end of the L2TP tunnel cause the time out that <br>
is why it was not able to establish a connection. I am <br>
sure if I am interpret it correctly and not quite sure<br>
what to do with it. Please advice. <br>
<br>
Look for the ===> Missed 5 keepalives<br>
<br>
<br>
</P>
<P>First attempt:</P>
<P>7w5d: Tnl 10005 L2TP: O Hello to drbrtj08rr.mi.AADS tnlid 36530<br>
7w5d: Vi8 PPP: Missed 5 keepalives, taking LCP down<br>
7w5d: Vi8 IPCP: State is Closed<br>
7w5d: Vi8 PPP: Phase is DOWN [0 sess, 1 load]<br>
7w5d: Vi8 Tnl/Cl 13221/50405 L2TP: O CDN to sfldse31rr.mi.AADS 22931/57582<br>
7w5d: Vi8 Tnl/Cl 13221/50405 L2TP: Destroying session<br>
7w5d: Vi8 Tnl/Cl 13221/50405 L2TP: Session state change from established to idle<br>
7w5d: Vi8 Tnl/Cl 13221/50405 L2TP: Releasing idb for LAC/LNS tunnel 13221/22931 session 50405 state idle<br>
7w5d: Vi8 VTEMPLATE: Free vaccess<br>
7w5d: Vi8 VTEMPLATE: Wait for interface to transition to down before freeing<br>
7w5d: Vi8 VTEMPLATE: Try to free a freed vaccess<br>
7w5d: Vi8 VTEMPLATE: Try to free a freed vaccess<br>
7w5d: Vi8 PPP: Phase is ESTABLISHING, Passive Open [0 sess, 1 load]<br>
7w5d: Vi8 LCP: State is Listen<br>
*Nov 26 00:33:43 UTC: %LINK-3-UPDOWN: Interface Virtual-Access8, changed state to down<br>
7w5d: Vi8 VTEMPLATE: Wait for line protocol to transition to down before freeing<br>
7w5d: Vi8 LCP: State is Closed<br>
7w5d: Vi8 PPP: Phase is DOWN [0 sess, 1 load]<br>
7w5d: Vi8 VTEMPLATE: Try to free a freed vaccess<br>
7w5d: Vi8 VTEMPLATE: Try to free a freed vaccess<br>
7w5d: Vi8 VTEMPLATE: Try to free a freed vaccess<br>
*Nov 26 00:33:44 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access8, changed state to down<br>
7w5d: Vi8 VTEMPLATE: Interface and line protocol are down, proceed to free<br>
7w5d: Vi8 Debug: Condition 1, interface Vt1 cleared, count 0<br>
7w5d: VTEMPLATE: Clean up dirty vaccess queue, size 1<br>
7w5d: Vi8 VTEMPLATE: Found a dirty vaccess clone with vtemplate<br>
7w5d: Vi8 VTEMPLATE: ************ UNCLONE VACCESS8 **************<br>
7w5d: Vi8 VTEMPLATE: Unclone to-be-freed command#7<br>
interface Virtual-Access8<br>
default ip unnumbered loopback 2<br>
default ip address 209.104.172.1 255.255.255.128<br>
default ip address 209.104.172.1 255.255.255.128<br>
default ip address 209.104.172.1 255.255.255.128<br>
default mtu 1492<br>
default encap ppp<br>
default ip address<br>
end </P>
<P>7w5d: Vi8 VTEMPLATE: Remove cloneblk vtemplate with vtemplate<br>
7w5d: Vi8 VTEMPLATE: Set default settings with no ip address<br>
7w5d: Vi8 VTEMPLATE: Add vaccess to recycle queue, queue size 2</P>
<P> </P>
<P> </P>
<P><br>
********** Second Attempt *****************<br>
w5d: Vi9 LCP: MRU 1492 (0x010405D4)<br>
7w5d: Vi9 LCP: AuthProto CHAP (0x0305C22305)<br>
7w5d: Vi9 LCP: MagicNumber 0x1B89FAC3 (0x05061B89FAC3)<br>
7w5d: Vi9 LCP: State is Open<br>
7w5d: Vi9 PPP: Phase is AUTHENTICATING, by this end [0 sess, 1 load]<br>
7w5d: Vi9 CHAP: O CHALLENGE id 108 len 30 from "EIDSLRtr1"<br>
7w5d: Vi9 CHAP: I RESPONSE id 108 len 47 from "<A href="mailto:olgchurch@cecom.net">olgchurch@cecom.net</A>"<br>
*Nov 26 00:46:49 UTC: %SEC-6-IPACCESSLOGP: list 111 permitted udp 172.17.17.17(0) (FastEthernet1/0 0003.ba05.1c88) -> 17<br>
2.17.17.1(0), 1 packet<br>
7w5d: Vi9 CHAP: O SUCCESS id 108 len 4<br>
7w5d: Vi9 PPP: Phase is UP [0 sess, 1 load]<br>
7w5d: Vi9 IPCP: O CONFREQ [Closed] id 1 len 10<br>
7w5d: Vi9 IPCP: Address 209.104.172.1 (0x03062665AC01)<br>
7w5d: Vi9 IPCP: I CONFREQ [REQsent] id 77 len 22<br>
7w5d: Vi9 IPCP: Address 0.0.0.0 (0x030600000000)<br>
7w5d: Vi9 IPCP: PrimaryDNS 0.0.0.0 (0x810600000000)<br>
7w5d: Vi9 IPCP: SecondaryDNS 0.0.0.0 (0x830600000000)<br>
7w5d: Vi9 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, we want 0.0.0.0<br>
7w5d: Vi9 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, we want 209.104.172.13<br>
7w5d: Vi9 IPCP: O CONFREJ [REQsent] id 77 len 16<br>
7w5d: Vi9 IPCP: PrimaryDNS 0.0.0.0 (0x810600000000)<br>
7w5d: Vi9 IPCP: SecondaryDNS 0.0.0.0 (0x830600000000)<br>
7w5d: Vi9 IPCP: I CONFACK [REQsent] id 1 len 10<br>
7w5d: Vi9 IPCP: Address 209.104.172.1 (0x03062665AC01)<br>
7w5d: Vi9 IPCP: I CONFREQ [ACKrcvd] id 78 len 10<br>
7w5d: Vi9 IPCP: Address 0.0.0.0 (0x030600000000)<br>
7w5d: Vi9 AAA/AUTHOR/IPCP: Start. Her address 0.0.0.0, we want 209.104.172.13<br>
7w5d: Vi9 AAA/AUTHOR/IPCP: Done. Her address 0.0.0.0, we want 209.104.172.13<br>
7w5d: Vi9 IPCP: O CONFNAK [ACKrcvd] id 78 len 10<br>
7w5d: Vi9 IPCP: Address 209.104.172.13 (0x03062665AC0D)<br>
7w5d: Vi9 IPCP: I CONFREQ [ACKrcvd] id 79 len 10<br>
7w5d: Vi9 IPCP: Address 209.104.172.13 (0x03062665AC0D)<br>
7w5d: Vi9 AAA/AUTHOR/IPCP: Start. Her address 209.104.172.13, we want 209.104.172.13<br>
7w5d: Vi9 AAA/AUTHOR/IPCP: Done. Her address 209.104.172.13, we want 209.104.172.13<br>
7w5d: Vi9 IPCP: O CONFACK [ACKrcvd] id 79 len 10<br>
7w5d: Vi9 IPCP: Address 209.104.172.13 (0x03062665AC0D)<br>
7w5d: Vi9 IPCP: State is Open<br>
7w5d: Vi9 IPCP: Install route to 209.104.172.13<br>
*Nov 26 00:46:50 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access9, changed state to up<br>
7w5d: Tnl 47262 L2TP: I Hello from sfldse34rr.mi.AADS tnl 55202<br>
7w5d: Tnl 10005 L2TP: O Hello to drbrtj08rr.mi.AADS tnlid 36530<br>
7w5d: Vi9 PPP: Missed 5 keepalives, taking LCP down<br>
7w5d: Vi9 IPCP: State is Closed<br>
7w5d: Vi9 PPP: Phase is DOWN [0 sess, 1 load]<br>
7w5d: Vi9 Tnl/Cl 13221/50406 L2TP: O CDN to sfldse31rr.mi.AADS 22931/59466<br>
7w5d: Vi9 Tnl/Cl 13221/50406 L2TP: Destroying session<br>
7w5d: Vi9 Tnl/Cl 13221/50406 L2TP: Session state change from established to idle<br>
7w5d: Vi9 Tnl/Cl 13221/50406 L2TP: Releasing idb for LAC/LNS tunnel 13221/22931 session 50406 state idle<br>
7w5d: Vi9 VTEMPLATE: Ignoring free request, still in use<br>
7w5d: Vi9 VPDN: Vtemplate failure 10 upon freeing interface<br>
7w5d: Vi9 VTEMPLATE: Ignoring free request, still in use<br>
7w5d: Vi9 VPDN: Vtemplate failure 10 upon freeing interface<br>
7w5d: Vi9 VTEMPLATE: Ignoring free request, still in use<br>
7w5d: Vi9 VPDN: Vtemplate failure 10 upon freeing interface<br>
7w5d: Vi9 PPP: Phase is ESTABLISHING, Passive Open [0 sess, 1 load]<br>
7w5d: Vi9 LCP: State is Listen<br>
*Nov 26 00:49:43 UTC: %LINK-3-UPDOWN: Interface Virtual-Access9, changed state to down<br>
7w5d: Vi9 LCP: State is Closed<br>
7w5d: Vi9 PPP: Phase is DOWN [0 sess, 1 load]<br>
7w5d: Vi9 VTEMPLATE: Ignoring free request, still in use<br>
7w5d: Vi9 VPDN: Vtemplate failure 10 upon freeing interface<br>
7w5d: Vi9 VTEMPLATE: Ignoring free request, still in use<br>
7w5d: Vi9 VPDN: Vtemplate failure 10 upon freeing interface<br>
7w5d: Vi9 VTEMPLATE: Ignoring free request, still in use<br>
7w5d: Vi9 VPDN: Vtemplate failure 10 upon freeing interface<br>
7w5d: Vi9 VTEMPLATE: Free vaccess<br>
7w5d: Vi9 VTEMPLATE: Wait for line protocol to transition to down before freeing<br>
7w5d: Vi9 IPCP: Remove route to 209.104.172.13<br>
*Nov 26 00:49:44 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface Virtual-Access9, changed state to down<br>
7w5d: Vi9 VTEMPLATE: Interface and line protocol are down, proceed to free<br>
7w5d: Vi9 Debug: Condition 1, interface Vt1 cleared, count 0<br>
7w5d: VTEMPLATE: Clean up dirty vaccess queue, size 1<br>
7w5d: Vi9 VTEMPLATE: Found a dirty vaccess clone with vtemplate<br>
7w5d: Vi9 VTEMPLATE: ************ UNCLONE VACCESS9 **************<br>
7w5d: Vi9 VTEMPLATE: Unclone to-be-freed command#7<br>
interface Virtual-Access9<br>
default ip unnumbered loopback 2<br>
default ip address 209.104.172.1 255.255.255.128<br>
default ip address 209.104.172.1 255.255.255.128<br>
default ip address 209.104.172.1 255.255.255.128<br>
default mtu 1492<br>
default encap ppp<br>
default ip address<br>
end</P>
<P>7w5d: Vi9 VTEMPLATE: Remove cloneblk vtemplate with vtemplate<br>
7w5d: Vi9 VTEMPLATE: Set default settings with no ip address<br>
7w5d: Vi9 VTEMPLATE: Add vaccess to recycle queue, queue size 2</P>
<P><br>
<br>
</P>
<P> </P>
<P>Thanks much,</P>
<P>Tom<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
---- Original message ----<br>
>Date: Wed, 22 Nov 2006 06:34:50 -0800<br>
>From: Mark Johnson <mljohnso@cisco.com> <br>
>Subject: Re: Only work with 7 user (client) <br>
>To: tom@hostwebase.com, gabriel.grissett@gmail.com<br>
>Cc: cisco-bba@puck.nether.net<br>
><br>
>At 04:08 AM 11/22/2006 -0500, Tom Miller wrote:<br>
>>Would you guys help me out with this issues again please.<br>
>>I am having the same problem as before. The Cisco 7204<br>
>>won't seem to accept any more than 7 users. What am I<br>
>>missing here?<br>
><br>
>This must be a different problem. Capture <debug ppp neg><br>
>for the 8th user attempting to connect; if you don't see<br>
>any debug output, then the problem is VPDN and you want to<br>
>have a look at<br>
><br>
>debug vpdn error<br>
>debug vpdn l2x-event<br>
>debug vpdn l2x-error<br>
>debug vtemplate<br>
><br>
>mark<br>
><br>
><br>
><br>
>>Here is my 7204 configuration:<br>
>><br>
>>aaa new-model<br>
>>aaa authentication login default local<br>
>>aaa authentication login console enable<br>
>>aaa authentication login telnet line<br>
>>aaa authentication login localauth local<br>
>>aaa authentication ppp default group radius local<br>
>>aaa authorization network default group radius local<br>
>>aaa accounting delay-start<br>
>>aaa accounting nested<br>
>>aaa accounting exec default start-stop group radius<br>
>>aaa accounting network default start-stop group radius<br>
>><br>
>><br>
>><br>
>>interface Loopback2<br>
>> ip address 16.10.172.1 255.255.255.128<br>
>>!<br>
>>!<br>
>>interface Virtual-Template1<br>
>> mtu 1492<br>
>> ip unnumbered Loopback2<br>
>> peer default ip address pool DSLCustomer<br>
>> ppp authentication chap callin<br>
>><br>
>><br>
>><br>
>>Thanks so much<br>
>><br>
>>Tom<br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>><br>
>>---- Original message ----<br>
>> >Date: Thu, 05 Oct 2006 19:23:24 -0700<br>
>> >From: Mark Johnson <mljohnso@cisco.com><br>
>> >Subject: RE: [cisco-bba] Only work with 5 user (client)<br>
>> >To: tom@hostwebase.com, gabriel.grissett@gmail.com<br>
>> >Cc: cisco-bba@puck.nether.net<br>
>> ><br>
>> >At 04:31 PM 10/5/2006 -0400, Tom Miller wrote:<br>
>> >>Guys,<br>
>> >><br>
>> >>It seems to be working fine. The system is currently<br>
>> >>excepted up to 7 users without any issues. Can you guy<br>
>> >>enlighten me why it fix with the loopback interface? Is<br>
>> >>this a bug?<br>
>> ><br>
>> >IOS will not allow more than 6 interfaces with the same<br>
>> >static ip address. Without IP unnumbered, each virtual-<br>
>> >access interface is cloned with the same IP address as<br>
>> >the virtual-template, thus you'll fail on the 6th user<br>
>> >(the VT counts as 1).<br>
>> ><br>
>> >mark<br>
>> ><br>
>> ><br>
>> >>Thank you so much for your advices.<br>
>> >><br>
>> >>Tom<br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >><br>
>> >>---- Original message ----<br>
>> >> >Date: Wed, 4 Oct 2006 14:38:18 -0500<br>
>> >> >From: "Gabriel Grissett" <gabriel.grissett@gmail.com><br>
>> >> >Subject: RE: [cisco-bba] Only work with 5 user <br>
(client)<br>
>> >> >To: <tom@hostwebase.com><br>
>> >> ><br>
>> >> >Use a loopback interface ...<br>
>> >> ><br>
>> >> >Interface loopback 2<br>
>> >> > ip address 192.168.172.1 255.255.255.128<br>
>> >> ><br>
>> >> >then change your virtual-template to...<br>
>> >> ><br>
>> >> >interface Virtual-Template1<br>
>> >> > mtu 1492<br>
>> >> > ip unnumbered loopback 2<br>
>> >> >...<br>
>> >> >...<br>
>> >> >...<br>
>> >> ><br>
>> >> >This should be in the archives...<br>
>> >> ><br>
>> >> >> -----Original Message-----<br>
>> >> >> From: cisco-bba-bounces@puck.nether.net <br>
[mailto:cisco-<br>
>>bba-<br>
>> >> >> bounces@puck.nether.net] On Behalf Of Tom Miller<br>
>> >> >> Sent: Wednesday, October 04, 2006 2:28 PM<br>
>> >> >> To: cisco-bba@puck.nether.net<br>
>> >> >> Subject: [cisco-bba] Only work with 5 user (client)<br>
>> >> >><br>
>> >> >> I have a 7204 (12.0(22)S1) terminating DSL L2TP VPDN<br>
>>and<br>
>> >> >> freeradius ( 1.0.4)<br>
>> >> >><br>
>> >> >> I am having problem when number of users (clients)<br>
>> >> >> increase from 6 and up.<br>
>> >> >><br>
>> >> >> It worked fine when I have only 5 users (clients) <br>
using<br>
>> >> >> the system.<br>
>> >> >><br>
>> >> >> The Cisco 7204 sending missing informationn to the<br>
>>radius<br>
>> >> >> server when the user # 6 try to connect. <br>
Information<br>
>>such<br>
>> >> >> as Tunnel-Server-Endpoint and Tunnel-Client-<br>
Endpoint<br>
>> >> >><br>
>> >> >><br>
>> >> >> I must have a missing value within my Cisco<br>
>>configuration.<br>
>> >> >> However, I don't know what it is.<br>
>> >> >><br>
>> >> >> Would you guys help me out please.<br>
>> >> >><br>
>> >> >><br>
>> >> >> Here is my cisco 7204 configuration:<br>
>> >> >><br>
>> >> >> > aaa new-model<br>
>> >> >> > aaa authentication login default local<br>
>> >> >> > aaa authentication login console enable<br>
>> >> >> > aaa authentication login telnet line<br>
>> >> >> > aaa authentication login localauth local<br>
>> >> >> > aaa authentication ppp default group radius local<br>
>> >> >> > aaa authorization network default group radius <br>
local<br>
>> >> >> > aaa accounting delay-start<br>
>> >> >> > aaa accounting nested<br>
>> >> >> > aaa accounting exec default start-stop group <br>
radius<br>
>> >> >> > aaa accounting network default start-stop group<br>
>>radius<br>
>> >> >> ><br>
>> >> >> ><br>
>> >> >> > !<br>
>> >> >> > vpdn enable<br>
>> >> >> > vpdn aaa override-server 172.17.17.17<br>
>> >> >> > !<br>
>> >> >> > vpdn-group 1<br>
>> >> >> > accept-dialin<br>
>> >> >> > protocol l2tp<br>
>> >> >> > virtual-template 1<br>
>> >> >> > terminate-from hostname aaaabbbr.ca.AADS<br>
>> >> >> > local name abc123456789cha<br>
>> >> >> > lcp renegotiation always<br>
>> >> >> > l2tp tunnel password 7 xxxxxxxxxxxxxxxx<br>
>> >> >> > !<br>
>> >> >> ><br>
>> >> >> > radius-server host 172.17.17.17 auth-port 1645 <br>
acct-<br>
>>port<br>
>> >> >> 1646<br>
>> >> >> ><br>
>> >> >> ><br>
>> >> >> > !<br>
>> >> >> > interface Virtual-Template1<br>
>> >> >> > mtu 1492<br>
>> >> >> > ip address 192.168.172.1 255.255.255.128<br>
>> >> >> > peer default ip address pool DSLCustomer<br>
>> >> >> > ppp authentication chap callin<br>
>> >> >> > !<br>
>> >> >> > ip local pool DSLCustomer 192.168.172.51<br>
>>192.168.172.125<br>
>> >> >><br>
>> >> >><br>
>> >> >> Thank you,<br>
>> >> >><br>
>> >> >> Tom<br>
>> >> >><br>
>> >> >> _______________________________________________<br>
>> >> >> cisco-bba mailing list<br>
>> >> >> cisco-bba@puck.nether.net<br>
>> >> >> https://puck.nether.net/mailman/listinfo/cisco-bba<br>
>> >> ><br>
>> ><br>
><br>
</P>