<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.6000.16788" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2>Hi
all,</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2> I'm having a
hell of a time getting an L2TP/IPSEC connection when my client is behind
NAT.</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2>I'm using the
following configs:</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial
size=2>ipsec.conf:</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial
size=2>-----</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2>version
2.0 # conforms to second version of ipsec.conf
specification</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2># basic configuration<BR>config
setup<BR> # plutodebug / klipsdebug =
"all", "none" or a combation from
below:<BR> # "raw crypt parsing
emitting control klips pfkey natt x509
private"<BR> # eg: plutodebug="control
parsing"<BR>
#<BR> # ONLY enable plutodebug=all or
klipsdebug=all if you are a developer
!!<BR>
#<BR> # NAT-TRAVERSAL support, see
README.NAT-Traversal<BR>
nat_traversal=yes<BR>
virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!172.16.1.0/24<BR>
#<BR> # enable this if you see "failed
to find any available worker"<BR>
nhelpers=0</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2># Add connections here</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2># sample VPN connections, see
/etc/ipsec.d/examples/<BR>include
/etc/ipsec.d/examples/l2tp-psk.conf</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2>#Disable Opportunistic Encryption<BR>include
/etc/ipsec.d/examples/no_oe.conf<BR><SPAN
class=343111400-19082009>----</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=343111400-19082009></SPAN></FONT></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=343111400-19082009>l2tp-psk.conf:</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=343111400-19082009>---------</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN class=343111400-19082009>conn
L2TP-PSK-NAT<BR>
rightsubnet=vhost:%priv<BR>
also=L2TP-PSK-noNAT</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN class=343111400-19082009>conn
L2TP-PSK-noNAT<BR>
#<BR> # Configuration for one user
with any type of IPsec/L2TP client<BR>
# including the updated Windows 2000/XP (MS KB Q818043),
but<BR> # excluding the non-updated
Windows 2000/XP.<BR>
#<BR>
#<BR> # Use a Preshared Key. Disable
Perfect Forward Secrecy.<BR>
#<BR> # PreSharedSecret needs to be
specified in /etc/ipsec.secrets as<BR>
# YourIPAddress %any:
"sharedsecret"<BR>
authby=secret<BR>
pfs=no<BR>
auto=add<BR>
keyingtries=3<BR> # we cannot rekey
for %any, let client rekey<BR>
rekey=no<BR>
type=transport<BR>
#<BR>
#left=%defaultroute<BR> # or you can
use: left=YourIPAddress<BR>
left=202.134.34.214<BR>
leftnexthop=202.134.34.213<BR> # For
updated Windows 2000/XP clients,<BR> #
to support old clients as well, use
leftprotoport=17/%any<BR> leftprotoport=17/1701<BR>
#<BR> # The remote
user.<BR>
#<BR>
right=%any<BR> # Using the magic port
of "0" means "any one single port". This
is<BR> # a work around required for
Apple OSX clients that use a
randomly<BR> # high port, but propose
"0" instead of their port.<BR>
rightprotoport=17/0</SPAN></FONT></FONT></DIV>
<DIV><FONT face=Arial><FONT size=2><SPAN
class=343111400-19082009>---------</SPAN></FONT></FONT></SPAN></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=343111400-19082009>I am able to connect
OK when my client is not NATed, but when the same machine is placed behind NAT,
I can't connect. All I get in /var/log/syslog is:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=343111400-19082009></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=343111400-19082009>Aug 19 10:12:44 smtp
xl2tpd[3139]: control_finish: Peer requested tunnel 10 twice, ignoring second
one.<BR>Aug 19 10:12:45 smtp xl2tpd[3139]: control_finish: Peer requested tunnel
10 twice, ignoring second one.<BR>Aug 19 10:12:49 smtp xl2tpd[3139]: Maximum
retries exceeded for tunnel 4588. Closing.<BR>Aug 19 10:12:49 smtp
xl2tpd[3139]: Connection 10 closed to 123.208.64.224, port 1701 (Timeout)<BR>Aug
19 10:12:49 smtp xl2tpd[3139]: control_finish: Peer requested tunnel 10 twice,
ignoring second one.<BR>Aug 19 10:12:54 smtp xl2tpd[3139]: Unable to deliver
closing message for tunnel 4588. Destroying anyway.<BR></SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=343111400-19082009>And in
/var/log/auth.log, I get:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN class=343111400-19082009>Aug 19 10:12:40 smtp
pluto[8135]: packet from 123.208.64.224:500: ignoring Vendor ID payload [MS NT5
ISAKMPOAKLEY 00000004]<BR>Aug 19 10:12:40 smtp pluto[8135]: packet from
123.208.64.224:500: ignoring Vendor ID payload [FRAGMENTATION]<BR>Aug 19
10:12:40 smtp pluto[8135]: packet from 123.208.64.224:500: received Vendor ID
payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106<BR>Aug 19 10:12:40
smtp pluto[8135]: packet from 123.208.64.224:500: ignoring Vendor ID payload
[Vid-Initial-Contact]<BR>Aug 19 10:12:40 smtp pluto[8135]: "L2TP-PSK-noNAT"[1]
123.208.64.224 #1: responding to Main Mode from unknown peer
123.208.64.224<BR>Aug 19 10:12:40 smtp pluto[8135]: "L2TP-PSK-noNAT"[1]
123.208.64.224 #1: transition from state STATE_MAIN_R0 to state
STATE_MAIN_R1<BR>Aug 19 10:12:40 smtp pluto[8135]: "L2TP-PSK-noNAT"[1]
123.208.64.224 #1: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Aug 19 10:12:40
smtp pluto[8135]: packet from 123.208.64.224:500: ignoring Vendor ID payload [MS
NT5 ISAKMPOAKLEY 00000004]<BR>Aug 19 10:12:40 smtp pluto[8135]: packet from
123.208.64.224:500: ignoring Vendor ID payload [FRAGMENTATION]<BR>Aug 19
10:12:40 smtp pluto[8135]: packet from 123.208.64.224:500: received Vendor ID
payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106<BR>Aug 19 10:12:40
smtp pluto[8135]: packet from 123.208.64.224:500: ignoring Vendor ID payload
[Vid-Initial-Contact]<BR>Aug 19 10:12:40 smtp pluto[8135]: "L2TP-PSK-noNAT"[1]
123.208.64.224 #2: responding to Main Mode from unknown peer
123.208.64.224<BR>Aug 19 10:12:40 smtp pluto[8135]: "L2TP-PSK-noNAT"[1]
123.208.64.224 #2: transition from state STATE_MAIN_R0 to state
STATE_MAIN_R1<BR>Aug 19 10:12:40 smtp pluto[8135]: "L2TP-PSK-noNAT"[1]
123.208.64.224 #2: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Aug 19 10:12:41
smtp pluto[8135]: "L2TP-PSK-noNAT"[1] 123.208.64.224 #1: NAT-Traversal: Result
using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed<BR>Aug 19 10:12:41 smtp
pluto[8135]: "L2TP-PSK-noNAT"[1] 123.208.64.224 #1: transition from state
STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Aug 19 10:12:41 smtp pluto[8135]:
"L2TP-PSK-noNAT"[1] 123.208.64.224 #1: STATE_MAIN_R2: sent MR2, expecting
MI3<BR>Aug 19 10:12:41 smtp pluto[8135]: "L2TP-PSK-noNAT"[1] 123.208.64.224 #1:
Main mode peer ID is ID_FQDN: <A
href="mailto:'@omnibook'">'@omnibook'</A><BR>Aug 19 10:12:41 smtp pluto[8135]:
"L2TP-PSK-noNAT"[1] 123.208.64.224 #1: switched from "L2TP-PSK-noNAT" to
"L2TP-PSK-noNAT"<BR>Aug 19 10:12:41 smtp pluto[8135]: "L2TP-PSK-noNAT"[2]
123.208.64.224 #1: I did not send a certificate because I do not have
one.<BR>Aug 19 10:12:41 smtp pluto[8135]: "L2TP-PSK-noNAT"[2] 123.208.64.224 #1:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<BR>Aug 19 10:12:41
smtp pluto[8135]: "L2TP-PSK-noNAT"[2] 123.208.64.224 #1: STATE_MAIN_R3: sent
MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192
prf=oakley_sha group=modp2048}<BR>Aug 19 10:12:41 smtp pluto[8135]:
"L2TP-PSK-noNAT"[2] 123.208.64.224 #3: responding to Quick Mode
{msgid:be9e674c}<BR>Aug 19 10:12:41 smtp pluto[8135]: "L2TP-PSK-noNAT"[2]
123.208.64.224 #3: transition from state STATE_QUICK_R0 to state
STATE_QUICK_R1<BR>Aug 19 10:12:41 smtp pluto[8135]: "L2TP-PSK-noNAT"[2]
123.208.64.224 #3: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed,
expecting QI2<BR>Aug 19 10:12:42 smtp pluto[8135]: "L2TP-PSK-noNAT"[2]
123.208.64.224 #3: transition from state STATE_QUICK_R1 to state
STATE_QUICK_R2<BR>Aug 19 10:12:42 smtp pluto[8135]: "L2TP-PSK-noNAT"[2]
123.208.64.224 #3: STATE_QUICK_R2: IPsec SA established {ESP=>0xb746ef51
<0x747a600c xfrm=3DES_0-HMAC_MD5 NATD=123.208.64.224:4500 DPD=none}<BR>Aug 19
10:13:17 smtp pluto[8135]: "L2TP-PSK-noNAT"[2] 123.208.64.224 #1: received
Delete SA(0xb746ef51) payload: deleting IPSEC State #3<BR>Aug 19 10:13:17 smtp
pluto[8135]: "L2TP-PSK-noNAT"[2] 123.208.64.224 #1: received and ignored
informational message<BR>Aug 19 10:13:17 smtp pluto[8135]: "L2TP-PSK-noNAT"[2]
123.208.64.224 #1: received Delete SA payload: deleting ISAKMP State #1<BR>Aug
19 10:13:17 smtp pluto[8135]: "L2TP-PSK-noNAT"[2] 123.208.64.224: deleting
connection "L2TP-PSK-noNAT" instance with peer 123.208.64.224
{isakmp=#0/ipsec=#0}<BR>Aug 19 10:13:17 smtp pluto[8135]: packet from
123.208.64.224:4500: received and ignored informational message<BR>Aug 19
10:13:50 smtp pluto[8135]: "L2TP-PSK-noNAT"[1] 123.208.64.224 #2: max number of
retransmissions (2) reached STATE_MAIN_R1<BR>Aug 19 10:13:50 smtp pluto[8135]:
"L2TP-PSK-noNAT"[1] 123.208.64.224: deleting connection "L2TP-PSK-noNAT"
instance with peer 123.208.64.224 {isakmp=#0/ipsec=#0}<BR></SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=343111400-19082009></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=343111400-19082009>Now this bit strikes
me as odd:</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=343111400-19082009></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=343111400-19082009>> switched from
"L2TP-PSK-noNAT" to "L2TP-PSK-noNAT"</SPAN></FONT></DIV>
<DIV><FONT face=Arial size=2><SPAN
class=343111400-19082009></SPAN></FONT> </DIV>
<DIV><FONT face=Arial size=2><SPAN class=343111400-19082009>Shouldn't it be
switching from "L2TP-PSK-noNAT" to "L2TP-PSK-NAT"?</DIV></SPAN></FONT>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2>I started this
exercise with Debian Etch, and I've upgraded to Lenny in case I had come across
a bug which has been already fixed. Ultimately, however, it needs to run on
Etch.</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2>I've also done the
same on a seperate machine running Etch and I get the same results, so I've
mis-configured something somewhere, I just can't see where.</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2>
<DIV><SPAN class=343111400-19082009><FONT face=Arial size=2>I've tried with both
l2tpd and xl2tpd, but I get the same results.</FONT></SPAN></DIV>Any
suggestions?</FONT></SPAN></DIV>
<DIV><SPAN class=343111400-19082009><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV align=left>
<DIV align=left>
<DIV align=left><FONT face=Arial
size=2>Regards,<BR>
Leigh</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Leigh Sharpe<BR>Network Systems Engineer<BR>Pacific
Wireless<BR>Ph +61 3 9584 8966<BR>Mob 0408 009 502</FONT></DIV>
<DIV><FONT face=Arial size=2>Helpdesk 1300 300 616<BR>email <A
title="blocked::blocked::mailto:lsharpe@pacificwireless.com.au mailto:lsharpe@pacificwireless.com.au"
href="blocked::blocked::mailto:lsharpe@pacificwireless.com.au">lsharpe@pacificwireless.com.au</A><BR>web
<A
title="blocked::blocked::http://www.pacificwireless.com.au/ http://www.pacificwireless.com.au/"
href="blocked::blocked::http://www.pacificwireless.com.au/">www.pacificwireless.com.au</A></FONT></DIV></DIV></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>