MSR和cisco设备建立L2TP隧道不成功原因分析

MSR和cisco设备建立L2TP隧道不成功原因分析

一、   组网：

H3C系列路由器作为LAC，Cisco路由器作为LNS，之间通过Internet实现网络层互通。LNS与LAC之间通过WAN接口连接。

图1

 

二、   问题描述：

正常配置完后H3C路由器（LAC）不能与Cisco路由器（LNS）之间建立隧道。

三、   过程分析：

MSR路由器主要配置：

l2tp-group 1

 undo tunnel authentication

 tunnel name lac

 start l2tp ip 1.1.2.2 fullusername h3c

Cisco侧主要配置：

vpdn-group 1

Default L2TP VPDN group

 accept-dialin

  protocol l2tp

  virtual-template 1

 local name lns 

在LAC侧（MSR系列路由器）上使用debugging l2tp all命令打开调试开关，显示控制消息如下：

%Oct 12 21:35:35:740 2005 H3C IFNET/5/UPDOWN:Line protocol on the interface Ethenet 1/1 is UP            

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::LAC Call UP on interface: Ethenet 1/1  

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Handle Call UP  IfIndex =3718            

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::LNS Address in Radius = 1.1.2.2

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::VPDN Group Number in Radius = 1          

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::LNS Address = 1.1.2.2

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Add New Call 32006 to Tunnel 1 call list(total 1)             

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Get udp port successfully : port 57344   

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Message Type: START_CONTROL_CONNECTION_REQUEST    //此处有拨号触发，发送了第一个L2TP的控制报文。 

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Protocol version: 100           

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Host name: lac  

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Vendor name: HuaWei              

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Framing capability :3            

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Assigned Tunnel ID: 1            

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Receive window size: 128         

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 send control (SendUp & RcvLow):Ns(0) Nr(0)           

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 first ctrl in send window, start ack timer           

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP:: O Tunnel 1 Send SCCRQ  

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Recv data Len = 128     

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1  recv ctrl message Resume Hello timer                

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Receive message with message type: 2     

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Board 0 recv from SOCK CallID=0 TunnelID=1 MsgType = 2 Length = 128                

%Oct 12 21:35:35:930 2005 H3C IFNET/5/UPDOWN:Line protocol on the interface Ethenet 1/1 is DOWN           

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Proc Peer control type=2,len = 128       

*Oct 12 21:35:35:930 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 Flow ctrl: Ns(0) Nr(1) from peer

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 (SendLow=0 SendUp=1) proc ack Nr=1 from peer         

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 recv a proper:Nr(1) and clear   

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 send window empty, turn off the ack timer            

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP:: I Tunnel 1 rcv SCCRP in state 2         

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Check SCCRP MSG Type 2   //收到了对端回应的SCCRP报文，并且在后面解出了AVP携带的参数。

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Protocol version, value:  100  

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Framing capability, value: 0   

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Bearer capability, value: 0    

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Firmware revision, value: 1120 

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Host name, value: lns          

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Vendor name, value: Cisco Systems, Inc.             

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Remote tunnel ID: 49345         

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Receive window size: 800       

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Parse AVP Challenge, Value: 3C B1 B6 F8 69 67 E3 74 A1 2B 3B 9C 19 9D A9 6F         //收到了隧道验证的挑战码，由于我们没有配置隧道验证密码，无法做出回应，此时在后面马上回应是SCCCN。

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Message Type: START_CONTROL_CONNECTION_CONNECTED      

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Get a challenge from Peer LNS.      

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP:: O Tunnel 1 Send StopCCN to Tunnel 49345 

*Oct 12 21:35:35:940 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Message Type: STOP_CONTROL_CONNECTION_NOTIFICATION     //

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Assigned Tunnel ID: 1            

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Put AVP Result code: RESULT_GENERAL_ERROR

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 send control (SendUp & RcvLow):Ns(1) Nr(1)           

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Tunnel 1 first ctrl in send window, start ack timer           

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Clear Calls On Tunnel ID=1 Reason=1      

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Clear Calls On Tunnel pst Node=790d744 total=1                  

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Clean Call Structure ID = 32006          

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Proc Call ID = 32006 Down           

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Clear Tunnel remote ID:49345, local ID:1        

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Recv data Len = 12      

*Oct 12 21:35:35:950 2005 H3C L2TP/8/L2TDBG: L2TP::Error::Receive ctrl message too short, discard it!

分析原因，Cisco路由器必须配置隧道密码，默认为空，而H3C系列路由器默认隧道密码不为空。缺省情况下，Cisco路由器和H3C系列路由器都默认进行隧道验证，Cisco路由器在密码为空时自动断开隧道连接，不给对端发任何消息。

四、   解决方法：

检查LAC和LNS侧的隧道验证配置，确保两端一致，即两端都不配置隧道验证，或两端都配隧道验证且隧道验证密码相同。