R3721-F3210-F3171-HP High-End Firewalls VPN Configuration Guide-6PW101

268
Complicated network application
A security gateway can simultaneously serve as an LAC and an LNS. Additionally, it can support more
than one incoming call. If memory and physical lines are enough, L2TP can receive and make multiple
calls at the same time. For such a complicated network, you can see through the previous configuration
examples and consider them comprehensively to find a configuration solution.
Pay attention to static route configuration. Many L2TP applications rely on static routes to initiate
connection requests.
Troubleshooting L2TP
The VPN connection setup process is complex. The following presents an analysis of some common faults
that may occur in the process. Before troubleshooting the VPN, make sure that the LAC and LNS are
connected properly across the public network.
Symptom 1
Users cannot log in.
Analysis and solution
Possible reasons for login failure include:
1. Tunnel setup failure, which may occur in the following cases:
{ The address of the LNS is set incorrectly on the LAC.
{ No L2TP group is configured on the LNS (usually a router) to receive calls from the tunnel peer.
For details, see the description of the allow command.
{ Tunnel authentication fails. Tunnel authentication must be enabled on both the LAC and LNS
and the tunnel authentication passwords configured on the two sides must match.
{ If the tunnel is torn down by force on the local end but the remote end has not received the
notification packet for reasons such as network delay, a new tunnel cannot be set up.
2. PPP negotiation failure, which may occur because:
{ Usernames, passwords, or both are incorrectly configured on the LAC or are not configured on
the LNS.
{ The LNS cannot allocate addresses. This may be because the address pool is too small or no
address pool is configured.
{ The authentication type is inconsistent. For example, the default authentication type for a VPN
connection created on Windows 2000 is Microsoft Challenge Handshake Authentication
Protocol (MSCHAP). If the remote end does not support MSCHAP, the PPP negotiation will fail.
HP recommends using CHAP.
Symptom 2
Data transmission fails. A connection is setup but data cannot be transmitted. For example, the LAC and
LNS cannot ping each other.
Analysis and solution
Possible reasons for data transmission failure include:
1. No route is available. The LAC (or LAC client) must have a route to the private network behind the
LNS and the LNS must have a route to the private network behind the LAC. Otherwise, data
transmission fails. You can use the display ip routing-table command on the LAC (LAC client) and