Hello, I've been using openswan + l2tpns for a while now. Recently the server was<br>
rootkited so I had to make a clean install. I copied the configuration<br>
files and all, and after that I've been getting the errors at the end<br>
of this message.<br>
<br>
Sometimes it fixes itself after several minutes, sometimes it won't. I<br>
try killing l2tpns but it refuses to die, unless I do it with a signal<br>
9. Restarting it solves the problem (during this time I can't even<br>
access the l2tpns CLI).<br>
<br>
I've also noticed that restarting openswan also fixes the problem. Now I'm starting to suspect that openswan is to blame. <br>Here's debian's auth.log while the server is failing<br><br>Jan 25 11:25:34 acceso pluto[10976]: packet from <a href="http://10.5.1.74:500">10.5.1.74:500</a>: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]<br>
Jan 25 11:25:34 acceso pluto[10976]: packet from <a href="http://10.5.1.74:500">10.5.1.74:500</a>: ignoring Vendor ID payload [FRAGMENTATION]<br>Jan 25 11:25:34 acceso pluto[10976]: packet from <a href="http://10.5.1.74:500">10.5.1.74:500</a>: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set<br>
to=106<br>Jan 25 11:25:34 acceso pluto[10976]: packet from <a href="http://10.5.1.74:500">10.5.1.74:500</a>: ignoring Vendor ID payload [Vid-Initial-Contact]<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: responding to Main Mode from unknown peer 10.5.1.74<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: STATE_MAIN_R1: sent MR1, expecting MI2<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no<br> NAT detected<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: STATE_MAIN_R2: sent MR2, expecting MI3<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: Main mode peer ID is ID_IPV4_ADDR: '10.5.1.74'<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: I did not send a certificate because I do not have one.<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2116: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRES<br>HARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2117: responding to Quick Mode {msgid:35e9f288}<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2117: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2117: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting<br>QI2<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2117: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[136] 10.5.1.74 #2117: STATE_QUICK_R2: IPsec SA established {ESP=>0xc47b9ec2 <0x8913fef<br>3 xfrm=3DES_0-HMAC_MD5 NATD=none DPD=none}<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[132] 10.5.1.246 #2106: received Delete SA(0x07024e97) payload: deleting IPSEC State #2<br>
107<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[132] 10.5.1.246 #2106: received and ignored informational message<br>Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[132] 10.5.1.246 #2106: received Delete SA payload: deleting ISAKMP State #2106<br>
Jan 25 11:25:34 acceso pluto[10976]: "zpreshared"[132] <a href="http://10.5.1.246">10.5.1.246</a>: deleting connection "zpreshared" instance with peer 10.5.1.246 {isakm<br>p=#0/ipsec=#0}<br>Jan 25 11:25:34 acceso pluto[10976]: packet from <a href="http://10.5.1.246:500">10.5.1.246:500</a>: received and ignored informational message<br>
Jan 25 11:25:37 acceso pluto[10976]: "zpreshared"[51] 10.5.1.186 #2108: received Delete SA(0xe1abd805) payload: deleting IPSEC State #21<br>09<br>Jan 25 11:25:37 acceso pluto[10976]: "zpreshared"[51] 10.5.1.186 #2108: received and ignored informational message<br>
Jan 25 11:25:37 acceso pluto[10976]: "zpreshared"[51] 10.5.1.186 #2108: received Delete SA payload: deleting ISAKMP State #2108<br>Jan 25 11:25:37 acceso pluto[10976]: packet from <a href="http://10.5.1.186:500">10.5.1.186:500</a>: received and ignored informational message<br>
<br>
<br>
Any suggestions? Here's l2tpns logfile at the moment it's failing:<br>
<br>
2010-01-19 17:13:15 00/00 Sending v5 heartbeat #91343, change #594<br>
with 0 changes (18 x-sess, 18 x-tunnels, 18 highsess, 18 hightun, size<br>
3388)<br>
2010-01-19 17:13:15 00/00 Sending v5 heartbeat #91344, change #594<br>
with 0 changes (18 x-sess, 18 x-tunnels, 18 highsess, 18 hightun, size<br>
3388)<br>
2010-01-19 17:13:16 00/00 Sending v5 heartbeat #91345, change #594<br>
with 0 changes (18 x-sess, 18 x-tunnels, 18 highsess, 18 hightun, size<br>
3389)<br>
2010-01-19 17:13:16 03/03 Kill session 3 (xxxxxxxxx): Expired<br>
2010-01-19 17:13:16 00/00 Reached multi_read_count (10); processed 10<br>
udp, 10 tun and 0 cluster packets<br>
2010-01-19 18:06:56 00/00 Sending v5 heartbeat #91346, change #595<br>
with 1 changes (18 x-sess, 18 x-tunnels, 18 highsess, 18 hightun, size<br>
3323)<br>
2010-01-19 18:06:56 06/00 Sending HELLO message<br>
2010-01-19 18:06:56 07/00 Sending HELLO message<br>
2010-01-19 18:06:56 08/00 Sending HELLO message<br>
2010-01-19 18:06:56 09/00 Sending HELLO message<br>
2010-01-19 18:06:56 10/00 Sending HELLO message<br>
2010-01-19 18:06:56 11/00 Sending HELLO message<br>
2010-01-19 18:06:56 12/00 Sending HELLO message<br>
2010-01-19 18:06:56 13/00 Sending HELLO message<br>
2010-01-19 18:06:56 14/00 Sending HELLO message<br>
2010-01-19 18:06:56 15/00 Sending HELLO message<br>
2010-01-19 18:06:56 16/00 Error sending data out tunnel: No route to<br>
host (udpfd=9, buf=0xa0bcfe6, len=20, dest=10.5.2.26)<br>
2010-01-19 18:06:56 16/00 Sending HELLO message<br>
2010-01-19 18:06:56 17/00 Sending HELLO message<br>
2010-01-19 18:06:56 18/00 Sending HELLO message<br>
2010-01-19 18:06:56 01/00 Sending HELLO message<br>
2010-01-19 18:06:56 02/00 Sending HELLO message<br>
2010-01-19 18:06:56 03/00 Kill tunnel 3: Expired<br>
2010-01-19 18:06:56 04/00 Error sending data out tunnel: No route to<br>
host (udpfd=9, buf=0xa0ba43e, len=20, dest=10.5.1.26)<br>
2010-01-19 18:06:56 04/00 Sending HELLO message<br>
2010-01-19 18:06:56 05/00 Sending HELLO message<br>
2010-01-19 18:06:56 10/04 Shutting down session 4: No response to LCP<br>
ECHO requests.<br>
2010-01-19 18:06:56 10/04 Allocated radius 112<br>
2010-01-19 18:06:56 05/05 Shutting down session 5: No response to LCP<br>
ECHO requests.<br>
2010-01-19 18:06:56 05/05 Allocated radius 113<br>
2010-01-19 18:06:56 06/06 Shutting down session 6: No response to LCP<br>
ECHO requests.<br>
2010-01-19 18:06:56 06/06 Allocated radius 114<br>
2010-01-19 18:06:56 07/07 Shutting down session 7: No response to LCP<br>
ECHO requests.<br>
2010-01-19 18:06:56 07/07 Allocated radius 115<br>
2010-01-19 18:06:56 04/08 Shutting down session 8: No response to LCP<br>
ECHO requests.<br>
2010-01-19 18:06:56 04/08 Allocated radius 116<br>
2010-01-19 18:06:56 11/09 Shutting down session 9: No response to LCP<br>
ECHO requests.<br>
<br>ipsec.conf<br><br>version 2.0 # conforms to second version of ipsec.conf specification<br><br># basic configuration<br>config setup<br> interfaces="ipsec0=eth3"<br> # plutodebug / klipsdebug = "all", "none" or a combation from below:<br>
# "raw crypt parsing emitting control klips pfkey natt x509 private"<br> # eg:<br> # plutodebug="control parsing"<br> #<br> # Only enable klipsdebug=all if you are a developer<br>
#<br> # NAT-TRAVERSAL support, see README.NAT-Traversal<br> # nat_traversal=yes<br> # virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12">10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12</a><br>
# plutodebug="all"<br> nat_traversal=yes<br> virtual_private=%v4:<a href="http://10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16">10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16</a><br>
<br>#Disable Opportunistic Encryption<br>include /etc/ipsec.d/examples/no_oe.conf<br><br><br>conn zpreshared<br> authby=secret<br> pfs=no<br> left=10.1.1.10<br> leftprotoport=17/0<br> right=%any<br>
rightprotoport=17/1701<br> auto=add<br> keyingtries=3<br><br><br>conn cliente-internet<br> leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a><br> also=cliente<br><br>conn cliente<br> left=10.5.255.254<br>
leftcert=server.pem<br> right=%any<br> rightsubnet=vhost:%no,%priv<br> auto=add<br> pfs=yes<br> disablearrivalcheck=no<br> authby=rsasig<br> leftrsasigkey=%cert<br>
rightrsasigkey=%cert<br> keyingtries=1<br> compress=yes<br><br><br>conn block<br> auto=ignore<br><br>conn private<br> auto=ignore<br><br>conn private-or-clear<br> auto=ignore<br>
<br>conn clear-or-private<br> auto=ignore<br><br>conn clear<br> auto=ignore<br><br>conn packetdefault<br> auto=ignore<br><br><br><br><br>
Thanks,<br>
Hernan<br><br>