<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#333333">
<font size="-1"><font face="Arial">Hi,<br>
<br>
I'm a french people, so, i'll try to write english as well as possible.<br>
<br>
I'd like to configure ipsec with an l2tpd authentication. I already
have a fonctionnal connection<br>
at my work (using the win xp pro sp2 vpn l2tp client).<br>
<br>
The objectif of this installation is to create my vpn server to do some
tests on voip applications.<br>
<br>
So I have a small test platform :<br>
- 1 Linux debian server with openswan + l2tpd + ppp<br>
- 1 Win XP Pro SP2 laptop<br>
- 1 VPN Router (to test vpn net-to-net)<br>
<br>
I've succesfully configured the net-to-net connection. Now I have a
problem with l2tpd.<br>
The authentication doesn't seems to work. The key negociation seems to
work fine, but<br>
the connection doesn't works.<br>
<br>
<b>This is my ipsec.conf :</b><br>
<br>
version 2.0 # conforms to second version of ipsec.conf specification<br>
<br>
# basic configuration<br>
config setup<br>
interfaces="ipsec0=eth0:0"<br>
nat_traversal=yes<br>
virtual_private=%v4:!172.16.7.0/16,%v4:192.168.7.0/24<br>
<br>
conn block <br>
auto=ignore<br>
<br>
conn private <br>
auto=ignore<br>
<br>
conn private-or-clear <br>
auto=ignore<br>
<br>
conn clear-or-private <br>
auto=ignore<br>
<br>
conn clear <br>
auto=ignore<br>
<br>
conn packetdefault <br>
auto=ignore<br>
<br>
# Add connections here<br>
#leftnexthop=88.191.35.1<br>
#rightnexthop=192.168.7.7<br>
<br>
conn %default<br>
left=88.191.35.181<br>
<br>
conn roadwarriorxp<br>
type=transport<br>
keyingtries=1<br>
compress=no<br>
authby=rsasig<br>
leftrsasigkey=%cert<br>
rightrsasigkey=%cert<br>
leftcert=/data/openswan/etc/ipsec.d/certs/newcert.pem<br>
leftprotoport=17/1701<br>
right=%any<br>
rightca=%same<br>
rightprotoport=17/1701<br>
rightsubnet=vhost:%no,%priv<br>
pfs=no<br>
auto=add<br>
<br>
<b>This is my l2tpd.conf :</b><br>
<br>
[global]<br>
<br>
[lns default]<br>
ip range = 172.16.7.10-172.16.7.30<br>
local ip = 172.16.7.8<br>
require chap = yes<br>
refuse pap = yes<br>
require authentication = yes<br>
name = TestVPN<br>
ppp debug = yes<br>
pppoptfile = /etc/ppp/options.l2tpd<br>
length bit = yes<br>
<br>
<b>options.l2tpd :</b><br>
<br>
ipcp-accept-local<br>
ipcp-accept-remote<br>
ms-dns 88.191.254.60<br>
auth<br>
crtscts<br>
idle 1800<br>
mtu 1400<br>
mru 1400<br>
nodefaultroute<br>
debug<br>
lock<br>
connect-delay 5000<br>
nologfd<br>
<br>
<b>chap-secrets :</b><br>
<br>
# Secrets for authentication using MS-CHAP<br>
# client server secret IP addresses<br>
integration * "qwerty" 172.16.7.10<br>
<br>
And logs on server :<br>
<br>
==> /var/log/auth.log <==<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: packet from 82.236.77.42:500:
ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: packet from 82.236.77.42:500:
ignoring Vendor ID payload [FRAGMENTATION]<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: packet from 82.236.77.42:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: packet from 82.236.77.42:500:
ignoring Vendor ID payload [Vid-Initial-Contact]<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[3] 82.236.77.42
#3: responding to Main Mode from unknown peer 82.236.77.42<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[3] 82.236.77.42
#3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer
is NATed<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[3] 82.236.77.42
#3: Peer ID is ID_DER_ASN1_DN: 'C=FR, ST=HOST, O=Internet Widgits Pty
Ltd, CN=integration'<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[4] 82.236.77.42
#3: deleting connection "roadwarriorxp" instance with peer 82.236.77.42
{isakmp=#0/ipsec=#0}<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[4] 82.236.77.42
#3: we have a cert and are sending it upon request<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: | NAT-T: new mapping
82.236.77.42:500/11559)<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: sent MR3, ISAKMP SA established<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #4: NAT-Traversal: Transport mode disabled due to
security concerns<br>
Nov 21 17:42:48 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #4: sending encrypted notification
BAD_PROPOSAL_SYNTAX to 82.236.77.42:11559<br>
Nov 21 17:42:50 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: Quick Mode I1 message is unacceptable because it
uses a previously used Message ID 0x1da1d8d7 (perhaps this is a
duplicated packet)<br>
Nov 21 17:42:50 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: sending encrypted notification
INVALID_MESSAGE_ID to 82.236.77.42:11559<br>
Nov 21 17:42:52 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: Quick Mode I1 message is unacceptable because it
uses a previously used Message ID 0x1da1d8d7 (perhaps this is a
duplicated packet)<br>
Nov 21 17:42:52 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: sending encrypted notification
INVALID_MESSAGE_ID to 82.236.77.42:11559<br>
Nov 21 17:42:56 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: Quick Mode I1 message is unacceptable because it
uses a previously used Message ID 0x1da1d8d7 (perhaps this is a
duplicated packet)<br>
Nov 21 17:42:56 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: sending encrypted notification
INVALID_MESSAGE_ID to 82.236.77.42:11559<br>
Nov 21 17:43:02 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559 #3: received Delete SA payload: deleting ISAKMP
State #3<br>
Nov 21 17:43:02 sd-5193 pluto[25394]: "roadwarriorxp"[4]
82.236.77.42:11559: deleting connection "roadwarriorxp" instance with
peer 82.236.77.42 {isakmp=#0/ipsec=#0}<br>
<br>
I really need some help please.<br>
<br>
Thanks<br>
<br>
azer.<br>
</font></font>
</body>
</html>