<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>OK So I got this working about 2 years ago and have used it
off and on, but not for about 10 months. I just rebuilt the latest fedora
kernel of 2.6.15.10 and openswan 2.4.5 with klips (patched the kernel for natt
as well). I have already used this certificate and connection string for
non l2tp sessions, so I know the certificate is accepted with linsys ipsec
client and this gateway before attempting l2tp with it. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Testing has been a pain with a public IP, so I actually
built natt just so I could test this without additional hassle of locating
myself at the server room while doing all of this. But natt is
deffinately needed in the environment I am providing ipsec/l2tp traffic for
anyway.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Here is the relevant sections of the ipsec.conf and
ipsec.secrets and the /var/log/secure log errors.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>----IPSEC.CONF<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>version 2.0<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>config setup<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
interfaces=%defaultroute<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> klipsdebug=none<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> plutodebug=none<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> uniqueids=yes<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> nat_traversal=yes<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
myid=@office1.ct.vpn.cleartunnel.net<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.167.0/24,%v4:!192.168.21.0/24,%v4:!192.168.200.0/24,%v4:!192.168.38.0/24,%v4:!192.168.130.0/24,%v4:!10.0.255.254/255.255.255.255,%v4:!192.168.1.0/24,%v4:!192.168.169.0/24,%v4:!192.168.128.0/24,%v4:!192.168.210.0/24,%v4:!192.168.166.0/24<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>conn %default<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> left=64.142.mumble1.mumble2<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
leftnexthop=%defaultroute<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
leftsubnet=192.168.mumble3.0/24<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> dpddelay=30<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> dpdtimeout=120<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> dpdaction=hold<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> authby=secret<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> auto=start<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> keyingtries=0<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
disablearrivalcheck=no<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>conn tbenson<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
leftcert=office1.ct.vpn.cleartunnel.net.cert<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
leftrsasigkey=%cert<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
leftprotoport=17/1701<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
rightprotoport=17/1701<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
right=64.142.7.188<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
rightnexthop=%defaultroute<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> rightca=%same<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
rightid="C=US, ST=<st1:State w:st="on">California</st1:State>, L=<st1:City
w:st="on"><st1:place w:st="on">Santa Rosa</st1:place></st1:City>, O=Mumble,
CN=tbenson.vpn.Mumble.net, E=ca-admin@Mumble.net"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>
rightrsasigkey=%cert<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> authby=rsasig<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> auto=add<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>----IPSEC.SECRETS<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>64.142.mumble1.mumble2 64.142.7.188 : RSA
office1.ct.vpn.cleartunnel.net.key "mumblepassword"<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>---- SECURE LOG<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: packet from
64.142.7.188:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: packet from
64.142.7.188:500: ignoring Vendor ID payload [FRAGMENTATION]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: packet from
64.142.7.188:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
method set to=106<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: packet from
64.142.7.188:500: ignoring Vendor ID payload [Vid-Initial-Contact]<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: responding to Main Mode<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: STATE_MAIN_R1: sent MR1, expecting MI2<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is
NATed<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: STATE_MAIN_R2: sent MR2, expecting MI3<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: Main mode peer ID is ID_DER_ASN1_DN: 'C=US, ST=<st1:State w:st="on">California</st1:State>,
L=<st1:City w:st="on"><st1:place w:st="on">Santa Rosa</st1:place></st1:City>,
O=<st1:PersonName w:st="on">ClearTunnel</st1:PersonName>, CN=tbenson.vpn.cleartunnel.net,
E=ca-admin@cleartunnel.net'<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: no crl from issuer "C=US, ST=<st1:State w:st="on">California</st1:State>,
L=<st1:City w:st="on"><st1:place w:st="on">Santa Rosa</st1:place></st1:City>,
O=<st1:PersonName w:st="on">ClearTunnel</st1:PersonName>, OU=Operations,
CN=vpn.cleartunnel.net, E=vpn-admin@cleartunnel.net" found (strict=no)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: I am sending my cert<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: | NAT-T: new mapping
64.142.7.188:500/4500)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG
cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: Dead Peer Detection (RFC 3706): not enabled because peer did not advertise
it<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: cannot respond to IPsec SA request because no connection is known for
64.142.21.254[C=US, ST=<st1:State w:st="on">California</st1:State>, L=<st1:City
w:st="on">Santa Rosa</st1:City>, O=<st1:PersonName w:st="on">ClearTunnel</st1:PersonName>,
CN=office1.ct.vpn.cleartunnel.net,
E=ca-admin@cleartunnel.net]:17/1701...64.142.7.188[C=US, ST=<st1:State w:st="on">California</st1:State>,
L=<st1:City w:st="on"><st1:place w:st="on">Santa Rosa</st1:place></st1:City>,
O=<st1:PersonName w:st="on">ClearTunnel</st1:PersonName>,
CN=tbenson.vpn.cleartunnel.net, E=ca-admin@cleartunnel.net]:17/1701<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:16 office1 pluto[5070]: "tbenson"
#35: sending encrypted notification INVALID_ID_INFORMATION to 64.142.7.188:4500<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:18 office1 pluto[5070]: "tbenson"
#35: Quick Mode I1 message is unacceptable because it uses a previously used
Message ID 0x2cf03810 (perhaps this is a duplicated packet)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:18 office1 pluto[5070]: "tbenson"
#35: sending encrypted notification INVALID_MESSAGE_ID to 64.142.7.188:4500<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:20 office1 pluto[5070]: "tbenson"
#35: Quick Mode I1 message is unacceptable because it uses a previously used
Message ID 0x2cf03810 (perhaps this is a duplicated packet)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:20 office1 pluto[5070]: "tbenson"
#35: sending encrypted notification INVALID_MESSAGE_ID to 64.142.7.188:4500<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:24 office1 pluto[5070]: "tbenson"
#35: Quick Mode I1 message is unacceptable because it uses a previously used
Message ID 0x2cf03810 (perhaps this is a duplicated packet)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Apr 24 12:33:24 office1 pluto[5070]: "tbenson"
#35: sending encrypted notification INVALID_MESSAGE_ID to 64.142.7.188:4500<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Trevor<o:p></o:p></span></font></p>
</div>
</body>
</html>