<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I have two users behind a NAT router trying to connect to an OpenSwan server. After they have both connected, the original user can no longer establish an ipsec connection. I need to reset the ADSL Router (NAT device) in order for the user
to connect again.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">i.e<o:p></o:p></p>
<p class="MsoNormal">User1 connects then disconnects<o:p></o:p></p>
<p class="MsoNormal">User2 connects then disconnects<o:p></o:p></p>
<p class="MsoNormal">User1 can no longer connect. <o:p></o:p></p>
<p class="MsoNormal">User2 can still connect.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>xl2tpd.conf<o:p></o:p></b></p>
<p class="MsoPlainText">[global]<o:p></o:p></p>
<p class="MsoPlainText">ipsec saref = yes<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">[lns default]<o:p></o:p></p>
<p class="MsoPlainText">ip range = <vpnrange><o:p></o:p></p>
<p class="MsoPlainText">local ip = <vpnip><o:p></o:p></p>
<p class="MsoPlainText">refuse chap = yes<o:p></o:p></p>
<p class="MsoPlainText">refuse pap = yes<o:p></o:p></p>
<p class="MsoPlainText">require authentication = yes<o:p></o:p></p>
<p class="MsoPlainText">ppp debug = yes<o:p></o:p></p>
<p class="MsoPlainText">pppoptfile = /etc/ppp/options.xl2tpd<o:p></o:p></p>
<p class="MsoPlainText">length bit = yes<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>ipsec.conf<o:p></o:p></b></p>
<p class="MsoPlainText">config setup<o:p></o:p></p>
<p class="MsoPlainText"> nat_traversal=yes<o:p></o:p></p>
<p class="MsoPlainText"> oe=off<o:p></o:p></p>
<p class="MsoPlainText"> interfaces="%defaultroute"<o:p></o:p></p>
<p class="MsoPlainText"> protostack=mast<o:p></o:p></p>
<p class="MsoPlainText"> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">conn L2TP-PSK-NAT<o:p></o:p></p>
<p class="MsoPlainText"> rightsubnet=vhost:%priv<o:p></o:p></p>
<p class="MsoPlainText"> also=L2TP-PSK-noNAT<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">conn L2TP-PSK-noNAT<o:p></o:p></p>
<p class="MsoPlainText"> authby=secret<o:p></o:p></p>
<p class="MsoPlainText"> pfs=no<o:p></o:p></p>
<p class="MsoPlainText"> auto=add<o:p></o:p></p>
<p class="MsoPlainText"> keyingtries=3<o:p></o:p></p>
<p class="MsoPlainText"> rekey=no<o:p></o:p></p>
<p class="MsoPlainText"> ikelifetime=8h<o:p></o:p></p>
<p class="MsoPlainText"> keylife=1h<o:p></o:p></p>
<p class="MsoPlainText"> type=transport<o:p></o:p></p>
<p class="MsoPlainText"> left=<externalIP><o:p></o:p></p>
<p class="MsoPlainText"> right=%any<o:p></o:p></p>
<p class="MsoPlainText"> rightprotoport=17/%any<o:p></o:p></p>
<p class="MsoPlainText"> dpddelay=30<o:p></o:p></p>
<p class="MsoPlainText"> dpdtimeout=120<o:p></o:p></p>
<p class="MsoPlainText"> dpdaction=clear<o:p></o:p></p>
<p class="MsoPlainText"> overlapip=yes<o:p></o:p></p>
<p class="MsoPlainText"> sareftrack=yes<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I’m running Debian 6.0.3 with a SAref patched 2.6.32 kernel.<o:p></o:p></p>
<p class="MsoPlainText"><o:p></o:p></p>
<p class="MsoPlainText"><b>ipsec verify </b>shows <o:p></o:p></p>
<p class="MsoPlainText">Kernel: IPsec SAref kernel support [OK]<o:p></o:p></p>
<p class="MsoPlainText">Kernel: IPsec SAref Bind kernel support [OK]<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>/var/log/auth.log</b> shows ipsec getting stuck at the following:<o:p></o:p></p>
<p class="MsoPlainText">pluto[1718]: packet from <Nat External IP>:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]<o:p></o:p></p>
<p class="MsoPlainText">pluto[1718]: packet from <Nat External IP>:500: ignoring Vendor ID payload [FRAGMENTATION]<o:p></o:p></p>
<p class="MsoPlainText">pluto[1718]: packet from <Nat External IP>:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106<o:p></o:p></p>
<p class="MsoPlainText">pluto[1718]: packet from <Nat External IP>:500: ignoring Vendor ID payload [Vid-Initial-Contact]<o:p></o:p></p>
<p class="MsoPlainText">pluto[1718]: "L2TP-PSK-NAT"[5] <Nat External IP> #6: responding to Main Mode from unknown peer 220.233.77.199<o:p></o:p></p>
<p class="MsoPlainText">pluto[1718]: "L2TP-PSK-NAT"[5] <Nat External IP> #6: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<o:p></o:p></p>
<p class="MsoPlainText">pluto[1718]: "L2TP-PSK-NAT"[5] <Nat External IP> #6: STATE_MAIN_R1: sent MR1, expecting MI2<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1">The contents of this email are confidential and may be subject to legal or professional privilege and copyright. No representation is made that this email is free of viruses or other defects. If you have received this
communication in error, you may not copy or distribute any part of it or otherwise disclose its contents to anyone. Please advise the sender of your incorrect receipt of this correspondence.<br>
</font>
</body>
</html>