Hello,<br><br>I'm back after reinstall openswan on a new dedibox server. I am using 2.6.24 kernel,<br>and I've succesfully install the ipsec klipps module :<br><br clear="all">root@zola:/etc/ipsec.d# lsmod | grep ipsec<br>
ipsec 354756 2 [permanent]<br><br>When I start ipsec, I have the ipsec0 interface :<br>ipsec0 Lien encap:Ethernet HWaddr 00:15:17:8D:B4:EB <br> inet adr:<a href="http://88.191.91.113">88.191.91.113</a> Masque:<a href="http://255.255.255.0">255.255.255.0</a><br>
<br>Now I'm using KLIPS and i'll try to get functionnal L2TP.<br>The server only have one address (the public one). I have created a vitual interface (eth1:1)<br>- Public Adress : <a href="http://88.191.91.113/24">88.191.91.113/24</a> - network <a href="http://88.191.91.0/24">88.191.91.0/24</a><br>
- Virtal Address : <a href="http://192.168.10.45/24">192.168.10.45/24</a> - network <a href="http://192.168.10.0/24">192.168.10.0/24</a><br><br>ipsec.conf :<br><br>version 2.0<br><br>config setup<br> nat_traversal=yes<br>
virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:88.191.91.0/24,%v4:192.168.10.0/2">10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:88.191.91.0/24,%v4:192.168.10.0/2</a><br>
OE=off<br> protostack=klips<br> klipsdebug=none<br> interfaces="ipsec0=eth1"<br><br>conn %default<br> keyingtries=1<br> compress=yes<br> disablearrivalcheck=no<br> authby=rsasig<br>
leftrsasigkey=%cert<br> rightrsasigkey=%cert<br><br>conn roadwarrior-xp<br> type=transport<br> left=<a href="http://88.191.91.113">88.191.91.113</a><br> leftcert=vpn.olympecti.fr.pem<br>
leftprotoport=17/1701<br> right=%any<br> rightsubnet=vhost:%no,%priv<br> rightprotoport=17/1701<br> pfs=no<br> auto=add<br><br>l2tpd.conf :<br>[global]<br>port = 1701<br>listen-addr = <a href="http://88.191.91.113">88.191.91.113</a><br>
debug tunnel = yes<br><br>[lns default]<br>ip range = 192.168.10.10-192.168.10.20<br>local ip = <a href="http://192.168.10.1">192.168.10.1</a><br>length bit = yes<br>require chap = yes<br>refuse pap = yes<br>require authentication = yes<br>
name = OCTIVPN<br>ppp debug = yes<br>pppoptfile = /etc/ppp/options.l2tpd.lns<br><br>options.l2tpd.lns :<br><br>ipcp-accept-local<br>ipcp-accept-remote<br>noipdefault<br>require-chap<br>connect-delay 5000<br>noccp<br>noauth<br>
idle 1800<br>mtu 1410<br>mru 1410<br>nodefaultroute<br>debug<br>lock<br>proxyarp<br><br>And logs :<br><br>Nov 18 18:01:32 zola kernel: IPSEC EVENT: KLIPS device ipsec0 shut down.<br>Nov 18 18:01:32 zola kernel: <br>Nov 18 18:01:32 zola ipsec_setup: ...Openswan IPsec stopped<br>
Nov 18 18:01:32 zola ipsec_setup: Stopping Openswan IPsec...<br>Nov 18 18:01:32 zola ipsec_setup: Using KLIPS/legacy stack<br>Nov 18 18:01:32 zola ipsec_setup: KLIPS debug `none'<br>Nov 18 18:01:32 zola kernel: <br>Nov 18 18:01:32 zola ipsec_setup: KLIPS ipsec0 on eth1 <a href="http://88.191.91.113/255.255.255.0">88.191.91.113/255.255.255.0</a> broadcast <a href="http://88.191.91.255">88.191.91.255</a> <br>
Nov 18 18:01:32 zola ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d<br>Nov 18 18:01:32 zola pluto: adjusting ipsec.d to /etc/ipsec.d<br>Nov 18 18:01:32 zola ipsec_setup: ...Openswan IPsec started<br>Nov 18 18:01:32 zola ipsec_setup: Starting Openswan IPsec <a href="http://2.6.18.">2.6.18.</a>..<br>
Nov 18 18:01:32 zola ipsec__plutorun: 002 loading certificate from vpn.olympecti.fr.pem <br>Nov 18 18:01:32 zola ipsec__plutorun: 002 loaded host cert file '/etc/ipsec.d/certs/vpn.olympecti.fr.pem' (3375 bytes)<br>
Nov 18 18:01:32 zola ipsec__plutorun: 002 added connection description "roadwarrior-xp"<br><br>Nov 18 18:02:06 zola xl2tpd[8560]: init_config: Using old style config files /etc/l2tp/l2tpd.conf and /etc/l2tpd/l2tp-secrets <br>
Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: global context descriptor <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is port, value is 1701 <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_port: Setting global port number to 1701 <br>
Nov 18 18:02:06 zola xl2tpd[8560]: set_port: port flag to '1701' <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is listen-addr, value is <a href="http://88.191.91.113">88.191.91.113</a> <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_listenaddr: Setting listen address to <a href="http://88.191.91.113">88.191.91.113</a> <br>
Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is debug tunnel, value is yes <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_debug tunnel: debug tunnel flag to 'yes' <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is ip range, value is 192.168.10.10-192.168.10.20 <br>
Nov 18 18:02:06 zola xl2tpd[8560]: range start = c0a80a0a, end = c0a80a14, sense=4294967295d <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is local ip, value is <a href="http://192.168.10.1">192.168.10.1</a> <br>
Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is length bit, value is yes <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_length bit: length bit flag to 'yes' <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is require chap, value is yes <br>
Nov 18 18:02:06 zola xl2tpd[8560]: set_require chap: require chap flag to 'yes' <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is refuse pap, value is yes <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_refuse pap: refuse pap flag to 'yes' <br>
Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is require authentication, value is yes <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_require authentication: require authentication flag to 'yes' <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is name, value is OCTIVPN <br>
Nov 18 18:02:06 zola xl2tpd[8560]: set_name: name flag to 'OCTIVPN' <br>Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is ppp debug, value is yes <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_ppp debug: ppp debug flag to 'yes' <br>
Nov 18 18:02:06 zola xl2tpd[8560]: parse_config: field is pppoptfile, value is /etc/ppp/options.l2tpd.lns <br>Nov 18 18:02:06 zola xl2tpd[8560]: set_pppoptfile: pppoptfile flag to '/etc/ppp/options.l2tpd.lns' <br>
Nov 18 18:02:06 zola xl2tpd[8560]: setsockopt recvref[22]: Protocol not available <br>Nov 18 18:02:06 zola xl2tpd[8560]: This binary does not support kernel L2TP. <br>Nov 18 18:02:06 zola xl2tpd[8561]: xl2tpd version xl2tpd-1.2.3 started on zola PID:8561 <br>
Nov 18 18:02:06 zola xl2tpd[8561]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc. <br>Nov 18 18:02:06 zola xl2tpd[8561]: Forked by Scott Balmos and David Stipp, (C) 2001 <br>Nov 18 18:02:06 zola xl2tpd[8561]: Inherited by Jeff McAdams, (C) 2002 <br>
Nov 18 18:02:06 zola xl2tpd[8561]: Forked again by Xelerance (<a href="http://www.xelerance.com">www.xelerance.com</a>) (C) 2006 <br>Nov 18 18:02:06 zola xl2tpd[8561]: Listening on IP address <a href="http://88.191.91.113">88.191.91.113</a>, port 1701 <br>
<br>When I initiate the connection from my windows client (that have the cert .p12, I have these logs (and a 678 error in windows XP SP2) :<br>Nov 18 18:02:31 zola pluto[8532]: packet from <a href="http://217.128.239.224:500">217.128.239.224:500</a>: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]<br>
Nov 18 18:02:31 zola pluto[8532]: packet from <a href="http://217.128.239.224:500">217.128.239.224:500</a>: ignoring Vendor ID payload [FRAGMENTATION]<br>Nov 18 18:02:31 zola pluto[8532]: packet from <a href="http://217.128.239.224:500">217.128.239.224:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but port floating is off<br>
Nov 18 18:02:31 zola pluto[8532]: packet from <a href="http://217.128.239.224:500">217.128.239.224:500</a>: ignoring Vendor ID payload [Vid-Initial-Contact]<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[1] <a href="http://217.128.239.224">217.128.239.224</a> #1: responding to Main Mode from unknown peer <a href="http://217.128.239.224">217.128.239.224</a><br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[1] <a href="http://217.128.239.224">217.128.239.224</a> #1: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[1] <a href="http://217.128.239.224">217.128.239.224</a> #1: STATE_MAIN_R1: sent MR1, expecting MI2<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[1] <a href="http://217.128.239.224">217.128.239.224</a> #1: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[1] <a href="http://217.128.239.224">217.128.239.224</a> #1: STATE_MAIN_R2: sent MR2, expecting MI3<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[1] <a href="http://217.128.239.224">217.128.239.224</a> #1: Main mode peer ID is ID_DER_ASN1_DN: 'C=FR, ST=France, L=Var, O=Olympe CTI, OU=Ingenierie informatique, CN=<a href="http://vpn.olympecti.fr">vpn.olympecti.fr</a>, E=<a href="mailto:issanyr@olympecti.fr">issanyr@olympecti.fr</a>'<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[1] <a href="http://217.128.239.224">217.128.239.224</a> #1: switched from "roadwarrior-xp" to "roadwarrior-xp"<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: deleting connection "roadwarrior-xp" instance with peer <a href="http://217.128.239.224">217.128.239.224</a> {isakmp=#0/ipsec=#0}<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: I am sending my cert<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: the peer proposed: <a href="http://88.191.91.113/32:17/1701">88.191.91.113/32:17/1701</a> -> <a href="http://192.168.1.155/32:17/1701">192.168.1.155/32:17/1701</a><br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #2: responding to Quick Mode proposal {msgid:8521b42e}<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #2: us: <a href="http://88.191.91.113">88.191.91.113</a><<a href="http://88.191.91.113">88.191.91.113</a>>[+S=C]:17/1701<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #2: them: <a href="http://217.128.239.224">217.128.239.224</a>[C=FR, ST=France, L=Var, O=Olympe CTI, OU=Ingenierie informatique, CN=<a href="http://vpn.olympecti.fr">vpn.olympecti.fr</a>, E=<a href="mailto:issanyr@olympecti.fr">issanyr@olympecti.fr</a>,+S=C]:17/1701===<a href="http://192.168.1.155/32">192.168.1.155/32</a><br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #2: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #2: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2<br>
Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2<br>Nov 18 18:02:31 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #2: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0x2aaabe58 <0xe9e861b8 xfrm=3DES_0-HMAC_MD5 NATOA=<invalid> NATD=<invalid>:500 DPD=enabled}<br>
Nov 18 18:03:06 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: received Delete SA(0x2aaabe58) payload: deleting IPSEC State #2<br>Nov 18 18:03:06 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: received and ignored informational message<br>
Nov 18 18:03:06 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a> #1: received Delete SA payload: deleting ISAKMP State #1<br>Nov 18 18:03:06 zola pluto[8532]: "roadwarrior-xp"[2] <a href="http://217.128.239.224">217.128.239.224</a>: deleting connection "roadwarrior-xp" instance with peer <a href="http://217.128.239.224">217.128.239.224</a> {isakmp=#0/ipsec=#0}<br>
Nov 18 18:03:06 zola pluto[8532]: packet from <a href="http://217.128.239.224:500">217.128.239.224:500</a>: received and ignored informational message<br><br>How could I fix the problem ?<br><br>thanks for your helps.<br>
<br>-- <br>- reza -<br>