<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Verdana
}
</style>
</head>
<body class='hmmessage'>
I am sorry for the duplicate post.<br><br>I have the following config files working fine on kernel 2.4 (Openwrt) Openswan 2.4.4 xl2tpd 1.04<br><br>Now I have moved to, <br><br>Kernel 2.6.25.17 (openwrt 8.09) <br>xl2tpd 1.2.4 <br>openswan 2.6.18 using klips <br><br>I have also compiled Openswan 2.6.20, but it does not even reach xl2tpd. <br>So I merged ipsec_esp.c from 2.6.20 to 2.6.18 thinking it will fix my problem, but it did not. <br>I cannot even cross compile 2.6.19 for openwrt. So I am stikking with openswan 2.6.18 it compiles and connects.<br><br>I hope I have provided as much info you guys need. Please help me I really need this working.<br><br>I can connect using windows l2tp/ipsec client but only while tcpdump is running on wan interface. I have tried reducing mtu on ipsec0, wan and ppp but it has no affect. This is a test setup all private ip, no NAT. If I test it in real world on public ip, then I suppose I would need a nat patch I would need some<br>input on that too. Any help would be greatly appreciated.<br><br>ipsec.conf<br><br># /etc/ipsec.conf - Openswan IPsec configuration file<br># RCSID $Id: ipsec.conf.in,v 1.13 2004/03/24 04:14:39 ken Exp $<br><br># This file: /usr/share/doc/openswan-2.2.0/ipsec.conf-sample<br>#<br># Manual: ipsec.conf.5<br><br><br>version 2.0 # conforms to second version of ipsec.conf specification<br>config setup<br> interfaces=%defaultroute<br> klipsdebug=none<br> plutodebug=none<br> nat_traversal=yes<br> fragicmp=no<br> virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!192.168.1.0/24<br><br>conn %default<br> keyingtries=3<br> compress=yes<br> disablearrivalcheck=no<br> authby=secret<br> ike=aes-sha,3des-sha<br> esp=aes-sha1,3des-sha1<br> type=tunnel<br> keyexchange=ike<br> ikelifetime=240m<br> keylife=60m<br><br>conn roadwarrior-net<br> leftsubnet=192.168.1.0/24<br> also=roadwarrior<br><br>conn roadwarrior-all<br> leftsubnet=0.0.0.0/0<br> also=roadwarrior<br><br>conn roadwarrior-l2tp<br> leftprotoport=17/0<br> rightprotoport=17/1701<br> also=roadwarrior<br><br>conn roadwarrior-l2tp-updatedwin<br> leftprotoport=17/1701<br> rightprotoport=17/1701<br> also=roadwarrior<br><br>conn roadwarrior<br> pfs=no<br> left=%defaultroute<br> right=%any<br> rightsubnet=vhost:%no,%priv<br> auto=add<br><br>#Disable Opportunistic Encryption<br>conn block <br> auto=ignore<br><br>conn private <br> auto=ignore<br><br>conn private-or-clear <br> auto=ignore<br><br>conn clear-or-private <br> auto=ignore<br><br>conn clear <br> auto=ignore<br><br>conn packetdefault <br> auto=ignore<br><br><br><br>xll2tpd.conf<br><br>[global]<br>;listen-addr = 192.168.1.200<br>;port = 1701<br><br>[lns default]<br>ip range = 192.168.1.10-192.168.1.15<br>local ip = 192.168.1.1<br>require chap = yes<br>refuse pap = yes<br>require authentication = yes<br>name = LinuxVPNserver<br>ppp debug = yes<br>pppoptfile = /etc/ppp/options.l2tpd<br>length bit = yes<br><br>options.l2tpd<br><br>ipcp-accept-local<br>ipcp-accept-remote<br>ms-dns 192.168.1.1<br>ms-wins 192.168.1.1<br>noccp<br>auth<br>crtscts<br>idle 1800<br>mtu 1410<br>mru 1410<br>nodefaultroute<br>nodetach <br>debug<br>lock<br>proxyarp<br>connect-delay 5000<br><br><br><br><br>connects fine While tcpdump running:<br><br>Jan <br>1 00:15:10 OpenWrt authpriv.warn pluto[848]: packet from<br>192.168.20.100:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY<br>00000006]<br>Jan 1 00:15:10 OpenWrt authpriv.warn pluto[848]: packet<br>from 192.168.20.100:500: received Vendor ID payload [RFC 3947]<br>meth=109, but port floating is off<br>Jan 1 00:15:10 OpenWrt<br>authpriv.warn pluto[848]: packet from 192.168.20.100:500: received<br>Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but port<br>floating is off<br>Jan 1 00:15:10 OpenWrt authpriv.warn pluto[848]: packet from 192.168.20.100:500: ignoring Vendor ID payload [FRAGMENTATION]<br>Jan <br>1 00:15:10 OpenWrt authpriv.warn pluto[848]: packet from<br>192.168.20.100:500: ignoring Vendor ID payload [MS-Negotiation<br>Discovery Capable]<br>Jan 1 00:15:10 OpenWrt authpriv.warn pluto[848]:<br>packet from 192.168.20.100:500: ignoring Vendor ID payload<br>[Vid-Initial-Contact]<br>Jan 1 00:15:10 OpenWrt authpriv.warn pluto[848]: packet from 192.168.20.100:500: ignoring Vendor ID payload [IKE CGA version 1]<br>Jan <br>1 00:15:10 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: responding to Main Mode from unknown peer<br>192.168.20.100<br>Jan 1 00:15:10 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-l2tp"[1] 192.168.20.100 #3: OAKLEY_GROUP 20 not<br>supported. Attribute OAKLEY_GROUP_DESCRIPTION<br>Jan 1 00:15:10<br>OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100<br>#3: OAKLEY_GROUP 19 not supported. Attribute OAKLEY_GROUP_DESCRIPTION<br>Jan <br>1 00:15:10 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: transition from state STATE_MAIN_R0 to state<br>STATE_MAIN_R1<br>Jan 1 00:15:10 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-l2tp"[1] 192.168.20.100 #3: STATE_MAIN_R1: sent MR1,<br>expecting MI2<br>Jan 1 00:15:11 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-l2tp"[1] 192.168.20.100 #3: discarding packet received<br>during asynchronous work (DNS or crypto) in STATE_MAIN_R1<br>Jan 1<br>00:15:13 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: discarding packet received during asynchronous work<br>(DNS or crypto) in STATE_MAIN_R1<br>Jan 1 00:15:15 OpenWrt<br>authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #3:<br>transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<br>Jan 1<br>00:15:15 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: STATE_MAIN_R2: sent MR2, expecting MI3<br>Jan 1<br>00:15:16 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: discarding packet received during asynchronous work<br>(DNS or crypto) in STATE_MAIN_R2<br>Jan 1 00:15:18 OpenWrt<br>authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #3:<br>discarding packet received during asynchronous work (DNS or crypto) in<br>STATE_MAIN_R2<br>Jan 1 00:15:20 OpenWrt authpriv.warn pluto[879]: WARNING: calc_dh_shared(): for OAKLEY_GROUP_MODP2048 took 4832039 usec<br>Jan <br>1 00:15:20 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: Main mode peer ID is ID_IPV4_ADDR: '192.168.20.100'<br>Jan <br>1 00:15:20 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: transition from state STATE_MAIN_R2 to state<br>STATE_MAIN_R3<br>Jan 1 00:15:20 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-l2tp"[1] 192.168.20.100 #3: STATE_MAIN_R3: sent MR3,<br>ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY<br>cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}<br>Jan 1<br>00:15:20 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #3: the peer proposed: 192.168.20.1/32:17/0 -><br>192.168.20.100/32:17/1701<br>Jan 1 00:15:20 OpenWrt authpriv.warn<br>pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #4: responding to<br>Quick Mode proposal {msgid:01000000}<br>Jan 1 00:15:20 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #4: us: 192.168.20.1[+S=C]:17/0<br>Jan 1 00:15:20 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #4: them: 192.168.20.100[+S=C]:17/1701<br>Jan <br>1 00:15:20 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #4: transition from state STATE_QUICK_R0 to state<br>STATE_QUICK_R1<br>Jan 1 00:15:20 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-l2tp"[1] 192.168.20.100 #4: STATE_QUICK_R1: sent QR1,<br>inbound IPsec SA installed, expecting QI2<br>Jan 1 00:15:22 OpenWrt<br>authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #4:<br>transition from state STATE_QUICK_R1 to state STATE_QUICK_R2<br>Jan 1<br>00:15:22 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #4: STATE_QUICK_R2: IPsec SA established tunnel mode<br>{ESP=>0x5f46ef61 <0x4a92c57f xfrm=AES_128-HMAC_SHA1<br>NATOA=<invalid> NATD=<invalid>:500 DPD=none}<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: control_finish: Peer requested tunnel 20 twice, ignoring second one.<br>Jan <br>1 00:15:22 OpenWrt daemon.notice xl2tpd[877]: Connection established to<br>192.168.20.100, 1701. Local: 63325, Remote: 20 (ref=0/0). LNS session<br>is 'default'<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]:<br>result_code_avp: result code not appropriate for<br>Incoming-Call-Request. Ignoring.<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: start_pppd: I'm running:<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "/usr/sbin/pppd"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "passive"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "-detach"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "192.168.1.1:192.168.1.10"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "refuse-pap"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "auth"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "require-chap"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "name"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "LinuxVPNserver"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "debug"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "file"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "/etc/ppp/options.l2tpd"<br>Jan 1 00:15:22 OpenWrt daemon.debug xl2tpd[877]: "/dev/pts/2"<br>Jan 1 00:15:23 OpenWrt daemon.notice xl2tpd[877]: Call established with 192.168.20.100, Local: 65211, Remote: 1, Serial: 0<br><br><br><br>Will not connect without tcpdump running:<br><br>Jan <br>1 00:08:27 OpenWrt authpriv.warn pluto[848]: packet from<br>192.168.20.100:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY<br>00000006]<br>Jan 1 00:08:27 OpenWrt authpriv.warn pluto[848]: packet<br>from 192.168.20.100:500: received Vendor ID payload [RFC 3947]<br>meth=109, but port floating is off<br>Jan 1 00:08:27 OpenWrt<br>authpriv.warn pluto[848]: packet from 192.168.20.100:500: received<br>Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but port<br>floating is off<br>Jan 1 00:08:27 OpenWrt authpriv.warn pluto[848]: packet from 192.168.20.100:500: ignoring Vendor ID payload [FRAGMENTATION]<br>Jan <br>1 00:08:27 OpenWrt authpriv.warn pluto[848]: packet from<br>192.168.20.100:500: ignoring Vendor ID payload [MS-Negotiation<br>Discovery Capable]<br>Jan 1 00:08:27 OpenWrt authpriv.warn pluto[848]:<br>packet from 192.168.20.100:500: ignoring Vendor ID payload<br>[Vid-Initial-Contact]<br>Jan 1 00:08:27 OpenWrt authpriv.warn pluto[848]: packet from 192.168.20.100:500: ignoring Vendor ID payload [IKE CGA version 1]<br>Jan <br>1 00:08:27 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1]<br>192.168.20.100 #1: responding to Main Mode from unknown peer<br>192.168.20.100<br>Jan 1 00:08:27 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-net"[1] 192.168.20.100 #1: OAKLEY_GROUP 20 not supported. <br>Attribute OAKLEY_GROUP_DESCRIPTION<br>Jan 1 00:08:27 OpenWrt<br>authpriv.warn pluto[848]: "roadwarrior-net"[1] 192.168.20.100 #1:<br>OAKLEY_GROUP 19 not supported. Attribute OAKLEY_GROUP_DESCRIPTION<br>Jan <br>1 00:08:27 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1]<br>192.168.20.100 #1: transition from state STATE_MAIN_R0 to state<br>STATE_MAIN_R1<br>Jan 1 00:08:27 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1] 192.168.20.100 #1: STATE_MAIN_R1: sent MR1, expecting MI2<br>Jan <br>1 00:08:27 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1]<br>192.168.20.100 #1: transition from state STATE_MAIN_R1 to state<br>STATE_MAIN_R2<br>Jan 1 00:08:27 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1] 192.168.20.100 #1: STATE_MAIN_R2: sent MR2, expecting MI3<br>Jan <br>1 00:08:28 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1]<br>192.168.20.100 #1: Main mode peer ID is ID_IPV4_ADDR: '192.168.20.100'<br>Jan <br>1 00:08:28 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1]<br>192.168.20.100 #1: transition from state STATE_MAIN_R2 to state<br>STATE_MAIN_R3<br>Jan 1 00:08:28 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-net"[1] 192.168.20.100 #1: STATE_MAIN_R3: sent MR3, ISAKMP<br>SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192<br>prf=oakley_sha group=modp2048}<br>Jan 1 00:08:28 OpenWrt authpriv.warn<br>pluto[848]: "roadwarrior-net"[1] 192.168.20.100 #1: the peer proposed:<br>192.168.20.1/32:0/0 -> 192.168.20.100/32:0/0<br>Jan 1 00:08:28<br>OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100<br>#2: responding to Quick Mode proposal {msgid:01000000}<br>Jan 1 00:08:28 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #2: us: 192.168.20.1[+S=C]:17/0<br>Jan 1 00:08:28 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1] 192.168.20.100 #2: them: 192.168.20.100[+S=C]:17/1701<br>Jan <br>1 00:08:28 OpenWrt authpriv.warn pluto[848]: "roadwarrior-l2tp"[1]<br>192.168.20.100 #2: transition from state STATE_QUICK_R0 to state<br>STATE_QUICK_R1<br>Jan 1 00:08:28 OpenWrt authpriv.warn pluto[848]:<br>"roadwarrior-l2tp"[1] 192.168.20.100 #2: STATE_QUICK_R1: sent QR1,<br>inbound IPsec SA installed, expecting QI2<br>Jan 1 00:08:30 OpenWrt daemon.debug xl2tpd[877]: control_finish: Peer requested tunnel 19 twice, ignoring second one.<br>Jan 1 00:08:31 OpenWrt daemon.debug xl2tpd[877]: control_finish: Peer requested tunnel 19 twice, ignoring second one.<br>Jan 1 00:08:35 OpenWrt daemon.debug xl2tpd[877]: control_finish: Peer requested tunnel 19 twice, ignoring second one.<br>Jan 1 00:08:35 OpenWrt daemon.notice xl2tpd[877]: Maximum retries exceeded for tunnel 44841. Closing.<br>Jan 1 00:08:35 OpenWrt daemon.info xl2tpd[877]: Connection 19 closed to 192.168.20.100, port 1701 (Timeout)<br>Jan <br>1 00:08:35 OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1]<br>192.168.20.100 #1: ignoring Delete SA payload: PROTO_IPSEC_ESP<br>SA(0xb82c5a58) not found (maybe expired)<br>Jan 1 00:08:35 OpenWrt<br>authpriv.warn pluto[848]: "roadwarrior-net"[1] 192.168.20.100 #1:<br>received and ignored informational message<br>Jan 1 00:08:35 OpenWrt<br>authpriv.warn pluto[848]: "roadwarrior-net"[1] 192.168.20.100 #1:<br>received Delete SA payload: deleting ISAKMP State #1<br>Jan 1 00:08:35<br>OpenWrt authpriv.warn pluto[848]: "roadwarrior-net"[1] 192.168.20.100:<br>deleting connection "roadwarrior-net" instance with peer 192.168.20.100<br>{isakmp=#0/ipsec=#0}<br>Jan 1 00:08:35 OpenWrt authpriv.warn pluto[848]: packet from 192.168.20.100:500: received and ignored informational message<br><br><br><br></body>
</html>