now The tunnel beetwen server linux openswan and macOS tiger go up: <br>Feb 28 14:47:44 vpnserver pluto[9453]: "roadwarriormac2"[12] <a href="http://172.31.1.22">172.31.1.22</a> #12: responding to Quick Mode {msgid:a68358ba}<br>
Feb 28 14:47:44 vpnserver pluto[9453]: "roadwarriormac2"[12] <a href="http://172.31.1.22">172.31.1.22</a> #12: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1<br>Feb 28 14:47:44 vpnserver pluto[9453]: "roadwarriormac2"[12] <a href="http://172.31.1.22">172.31.1.22</a> #12: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2<br>
Feb 28 14:47:45 vpnserver pluto[9453]: "roadwarriormac2"[12] <a href="http://172.31.1.22">172.31.1.22</a> #12: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2<br>Feb 28 14:47:45 vpnserver pluto[9453]: "roadwarriormac2"[12] <a href="http://172.31.1.22">172.31.1.22</a> #12: STATE_QUICK_R2: IPsec SA established {ESP=>0x0e85d6f0 <0x051fe45a xfrm=AES_128-HMAC_SHA1 NATD=none DPD=none}<br>
<br>and /etc/init.d/ipsec status --> 1 tunnels up<br><br>but l2tpd don't work into /var/log/daemon.log write:<br><br><br>Feb 28 14:49:54 vpnserver l2tpd[7432]: ourtid = 37849, entropy_buf = 93d9<br>Feb 28 14:49:54 vpnserver l2tpd[7432]: ourcid = 19972, entropy_buf = 4e04<br>
Feb 28 14:49:54 vpnserver l2tpd[7432]: check_control: control, cid = 0, Ns = 0, Nr = 0<br>Feb 28 14:49:54 vpnserver l2tpd[7432]: handle_avps: handling avp's for tunnel 37849, call 19972<br>Feb 28 14:49:54 vpnserver l2tpd[7432]: message_type_avp: message type 1 (Start-Control-Connection-Request)<br>
Feb 28 14:49:54 vpnserver l2tpd[7432]: protocol_version_avp: peer is using version 1, revision 0.<br>Feb 28 14:49:54 vpnserver l2tpd[7432]: framing_caps_avp: supported peer frames: async sync<br>Feb 28 14:49:54 vpnserver l2tpd[7432]: hostname_avp: peer reports hostname ''<br>
Feb 28 14:49:54 vpnserver l2tpd[7432]: assigned_tunnel_avp: using peer's tunnel 15<br>Feb 28 14:49:54 vpnserver l2tpd[7432]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.<br>Feb 28 14:49:55 vpnserver l2tpd[7432]: ourtid = 65108, entropy_buf = fe54<br>
Feb 28 14:49:55 vpnserver l2tpd[7432]: check_control: control, cid = 0, Ns = 0, Nr = 0<br>Feb 28 14:49:55 vpnserver l2tpd[7432]: handle_avps: handling avp's for tunnel 65108, call 0<br>Feb 28 14:49:55 vpnserver l2tpd[7432]: message_type_avp: message type 1 (Start-Control-Connection-Request)<br>
Feb 28 14:49:55 vpnserver l2tpd[7432]: protocol_version_avp: peer is using version 1, revision 0.<br>Feb 28 14:49:55 vpnserver l2tpd[7432]: framing_caps_avp: supported peer frames: async sync<br>Feb 28 14:49:55 vpnserver l2tpd[7432]: hostname_avp: peer reports hostname ''<br>
Feb 28 14:49:55 vpnserver l2tpd[7432]: assigned_tunnel_avp: using peer's tunnel 15<br>Feb 28 14:49:55 vpnserver l2tpd[7432]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.<br>Feb 28 14:49:55 vpnserver l2tpd[7432]: control_finish: Peer requested tunnel 15 twice, ignoring second one.<br>
Feb 28 14:49:56 vpnserver l2tpd[7432]: ourtid = 54470, entropy_buf = d4c6<br>Feb 28 14:49:56 vpnserver l2tpd[7432]: check_control: control, cid = 0, Ns = 0, Nr = 0<br>Feb 28 14:49:56 vpnserver l2tpd[7432]: handle_avps: handling avp's for tunnel 54470, call 2037411698<br>
Feb 28 14:49:56 vpnserver l2tpd[7432]: message_type_avp: message type 1 (Start-Control-Connection-Request)<br>Feb 28 14:49:56 vpnserver l2tpd[7432]: protocol_version_avp: peer is using version 1, revision 0.<br>Feb 28 14:49:56 vpnserver l2tpd[7432]: framing_caps_avp: supported peer frames: async sync<br>
Feb 28 14:49:56 vpnserver l2tpd[7432]: hostname_avp: peer reports hostname ''<br>Feb 28 14:49:56 vpnserver l2tpd[7432]: assigned_tunnel_avp: using peer's tunnel 15<br>Feb 28 14:49:56 vpnserver l2tpd[7432]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.<br>
Feb 28 14:49:56 vpnserver l2tpd[7432]: control_finish: Peer requested tunnel 15 twice, ignoring second one.<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: ourtid = 24705, entropy_buf = 6081<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: ourcid = 62422, entropy_buf = f3d6<br>
Feb 28 14:49:57 vpnserver l2tpd[7432]: check_control: control, cid = 0, Ns = 0, Nr = 0<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: handle_avps: handling avp's for tunnel 24705, call 62422<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: message_type_avp: message type 1 (Start-Control-Connection-Request)<br>
Feb 28 14:49:57 vpnserver l2tpd[7432]: protocol_version_avp: peer is using version 1, revision 0.<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: framing_caps_avp: supported peer frames: async sync<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: hostname_avp: peer reports hostname ''<br>
Feb 28 14:49:57 vpnserver l2tpd[7432]: assigned_tunnel_avp: using peer's tunnel 15<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.<br>Feb 28 14:49:57 vpnserver l2tpd[7432]: control_finish: Peer requested tunnel 15 twice, ignoring second one.<br>
Feb 28 14:49:58 vpnserver l2tpd[7432]: ourtid = 5989, entropy_buf = 1765<br>Feb 28 14:49:58 vpnserver l2tpd[7432]: ourcid = 48441, entropy_buf = bd39<br>Feb 28 14:49:58 vpnserver l2tpd[7432]: check_control: control, cid = 0, Ns = 0, Nr = 0<br>
Feb 28 14:49:58 vpnserver l2tpd[7432]: handle_avps: handling avp's for tunnel 5989, call 48441<br>Feb 28 14:49:58 vpnserver l2tpd[7432]: message_type_avp: message type 1 (Start-Control-Connection-Request)<br>Feb 28 14:49:58 vpnserver l2tpd[7432]: protocol_version_avp: peer is using version 1, revision 0.<br>
Feb 28 14:49:58 vpnserver l2tpd[7432]: framing_caps_avp: supported peer frames: async sync<br>Feb 28 14:49:58 vpnserver l2tpd[7432]: hostname_avp: peer reports hostname ''<br>Feb 28 14:49:58 vpnserver l2tpd[7432]: assigned_tunnel_avp: using peer's tunnel 15<br>
Feb 28 14:49:58 vpnserver l2tpd[7432]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.<br>Feb 28 14:49:58 vpnserver l2tpd[7432]: control_finish: Peer requested tunnel 15 twice, ignoring second one.<br>
Feb 28 14:49:59 vpnserver l2tpd[7432]: ourtid = 15147, entropy_buf = 3b2b<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: ourcid = 26471, entropy_buf = 6767<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: check_control: control, cid = 0, Ns = 0, Nr = 0<br>
Feb 28 14:49:59 vpnserver l2tpd[7432]: handle_avps: handling avp's for tunnel 15147, call 26471<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: message_type_avp: message type 1 (Start-Control-Connection-Request)<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: protocol_version_avp: peer is using version 1, revision 0.<br>
Feb 28 14:49:59 vpnserver l2tpd[7432]: framing_caps_avp: supported peer frames: async sync<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: hostname_avp: peer reports hostname ''<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: assigned_tunnel_avp: using peer's tunnel 15<br>
Feb 28 14:49:59 vpnserver l2tpd[7432]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: control_finish: Peer requested tunnel 15 twice, ignoring second one.<br>
Feb 28 14:49:59 vpnserver l2tpd[7432]: control_xmit: Maximum retries exceeded for tunnel 37849. Closing.<br>Feb 28 14:49:59 vpnserver l2tpd[7432]: call_close : Connection 15 closed to <a href="http://172.31.1.22">172.31.1.22</a>, port 49205 (Timeout)<br>
Feb 28 14:50:00 vpnserver l2tpd[7432]: ourtid = 16060, entropy_buf = 3ebc<br>Feb 28 14:50:00 vpnserver l2tpd[7432]: ourcid = 42698, entropy_buf = a6ca<br>Feb 28 14:50:00 vpnserver l2tpd[7432]: check_control: control, cid = 0, Ns = 0, Nr = 0<br>
Feb 28 14:50:00 vpnserver l2tpd[7432]: handle_avps: handling avp's for tunnel 16060, call 42698<br>Feb 28 14:50:00 vpnserver l2tpd[7432]: message_type_avp: message type 1 (Start-Control-Connection-Request)<br>Feb 28 14:50:00 vpnserver l2tpd[7432]: protocol_version_avp: peer is using version 1, revision 0.<br>
Feb 28 14:50:00 vpnserver l2tpd[7432]: framing_caps_avp: supported peer frames: async sync<br>Feb 28 14:50:00 vpnserver l2tpd[7432]: hostname_avp: peer reports hostname ''<br>Feb 28 14:50:00 vpnserver l2tpd[7432]: assigned_tunnel_avp: using peer's tunnel 15<br>
Feb 28 14:50:00 vpnserver l2tpd[7432]: receive_window_size_avp: peer wants RWS of 4. Will use flow control.<br>Feb 28 14:50:00 vpnserver l2tpd[7432]: control_finish: Peer requested tunnel 15 twice, ignoring second one.<br>
<br>so, the authntication don't go up and l2tpd close the tunnel.<br><br>Suggestion?<br><br><br><div class="gmail_quote"><br><br><br><br><br><br>On Thu, Feb 28, 2008 at 12:42 PM, Jacco de Leeuw <<a href="mailto:jacco2@dds.nl">jacco2@dds.nl</a>> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div class="Ih2E3d"><br>
Denis Beltramo wrote:<br>
<br>
> for this case i have added at my openssl.cnf this line:<br>
><br>
> extendedKeyUsage=1.3.6.1.5.5.8.2.2,serverAuth<br>
</div>> subjectAltName=IP:<a href="http://172.31.1.192" target="_blank">172.31.1.192</a> <<a href="http://172.31.1.192" target="_blank">http://172.31.1.192</a>><br>
<div class="Ih2E3d">><br>
> ignoring informational payload, type INVALID_CERT_AUTHORITY<br>
<br>
</div>This error indicates that the Mac client does not find these EKUs<br>
in the certificate that the server sends. Are you sure they have<br>
been added to the server certificate? Check with:<br>
<br>
openssl x509 -text -noout -in servercrt.pem<br>
<br>
It should list no EKU at all, or:<br>
<br>
X509v3 Extended Key Usage:<br>
1.3.6.1.5.5.8.2.2, TLS Web Server Authentication<br>
<br>
(The latter is actually the "serverAuth").<br>
<div><div></div><div class="Wj3C7c"><br>
Jacco<br>
--<br>
Jacco de Leeuw mailto:<a href="mailto:jacco2@dds.nl">jacco2@dds.nl</a><br>
Zaandam, The Netherlands <a href="http://www.jacco2.dds.nl" target="_blank">http://www.jacco2.dds.nl</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Denis Beltramo