PIX 501: PPPoE server not responding

[lupidus]

Heya, heres the situation:

Attempting to get a PIX 501 to work as a PPPoE client. SBC DSL provides the PPPoE server. The account is provisioned as dynamic ip. I am able to ping the PIX from internal net and the PIX can ping hosts on the internet net. My running config is:

PIX Version 6.3(1)
interface ethernet0 10baset
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password *********** encrypted
passwd ********** encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
access-list in permit ip any any
access-list out permit ip any any
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside pppoe setroute
ip address inside 192.168.0.2 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
access-group in in interface outside
access-group out in interface inside
conduit permit icmp any any
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group pppoe-sbc request dialout pppoe
vpdn group pppoe-sbc localname *@*
vpdn group pppoe-sbc ppp authentication pap
vpdn username *@* password *********
terminal width 80
Cryptochecksum:efa32933edb666067330cfeba006cbdc

A debug of pppoe packet/events/errors results in:

send_padiSnd) Dest:ffff.ffff.ffff Src:0009.7c2b.76c4 Type:0x8863=PPPoE-Discovery

Ver:1 Type:1 Code:09=PADI Sess:0 Len:12
Type:0101:SVCNAME-Service Name Len:0
Type:0103:HOSTUNIQ-Host Unique Tag Len:4 00000001

padi timer expired

A sure sign that the PPPoE server is not responding for some reason. I am not sure why this is (I thought I set my access lists to allow everything). Do I need to enable dhcp? Or create some additonal routes?

Some final notes, I _am_ using the correct cabling (crossover) between the PIX and DSL modem (just a Speedstream 5100). For some reason the ETH light doesnt light up on the modem - bad cable? Or is it just because its a crossover?

Thanks in advance for any help,
/Tristan

 

[yizhar]

HI.

I had similar issues, and the fix was changing the DSL modem configuration (VPI/VCI etc) as instructed by our phone company support.
So you should contact either the ISP or the DSL provider.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[lupidus]

Well...
The SBC provided DSL modem has always been able to get a reply from the PPPoE server without the PIX behind it (for example right now: winxp -> dsl modem -> isp). It wouldnt require different VP/VC with the PIX attached would it? That doesnt make sense to me. Anyway, I did try a different crossover cable just in case the one I was using was bad. I'm still getting the same results.
Some additional debug:

pixfirewall# sh ip address outside pppoe

PPPoE session has not been established yet.
pixfirewall# sh vpdn tunnel pppoe


PPPoE Tunnel Information (Total tunnels=1 sessions=0)


Tunnel id 0
time since change 26 secs
Remote MAC Address 00:00:00:00:00:00
0 packets sent, 0 received, 0 bytes sent, 0 received
pixfirewall# sh vpdn session pppoe


PPPoE Session Information (Total tunnels=1 sessions=0)

Remote MAC is 00:00:00:00:00:00
Session state is PADI_SENT
Time since event change 45 secs, interface outside
0 packets sent, 0 received, 0 bytes sent, 0 received


Thanks in advance for any help,
/Tristan

 

[yizhar]

HI.

> Anyway, I did try a different crossover cable
Try also with a straight cable.

> It wouldnt require different VP/VC with the PIX attached would it?
No, it should be the same, but maybe you'll need to power cycle the modem when changing internal device.

> Remote MAC is 00:00:00:00:00:00
I don't know much about how PPPoE works, but the above line seems not good. Try rebooting the modem...

I suggest contacting the ISP or DSL provider for asistant.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[waterman333]

Attempting same DSL setup with Earthlink ISP, but using SpeedStream 5360 DSL modem and PIX Software v6.2. Experiencing same error messages as Tristan [indicative of PPPoE server is not responding]. Ruled out any other hardware problems. Cabling is fine. Able to connect to ISP with Windows2000PRO using WinPoET without problems.

Got no love from Earthlink. Tech services recommended I contact my "third party hardware manufacturer."

Request: To anyone that has successfully gotten the PIX 501 to connect with PPPoE, please post a "show running config."

~waterman

 

[yizhar]

HI.

I have configured several pix devices with PPPoE with no problem related to pix config.
I simply used the PDM interface, I don't even know what were the exact commands generated by it, but it works.

> Got no love from Earthlink.
Try contacting the DSL provider (phone company), maybe they will be able to help.

The issues could be related to the modem device as well.
I have always used the Samsung blue modem (I don't remember the exact model, something that starts with AHxxxx).


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[waterman333]

Thanks for the feedback Mr.Yizhar.

Turns out using a straight through to connect the PIX's outside interface to the DSL modem and plain configuration using the PDM interface works like a charm.

 

[lupidus]

Aye, using a straight through cable will fix the above problem in most cases (as long as the pppoe server truly is not down). I am not sure why, in cisco's documentation, they state to use a crossover cable on the pix outside interface to the dsl/cable modem. From what I have seen, using a crossover cable does work with cable modems but definitely not DSL modems. I am not sure why this is. Additionally, there is not much that any ISP will be able to do with regard to the error "PPPOE server not responding.." because the PIX is 3rd party and its outside their scope of support. Same goes for routers, etc.

/Tristan

 

[yizhar]

HI.

Most DSL modems are designed to be connected directly to PC and not to HUB/SWITCH, and that is why a straight cable works better (The pix outside interface is like a PC).

The PIX501 has some kind of auto detection of cable type, but as you stated above it probably does not work well, at least on the outside interface.


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar