<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi All,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I just upgraded from 2.38 to 2.39 and can see the IPSEC tunnel established, but there is NOTHING being passed to XL2TPD?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Checking if IPsec got installed and started correctly:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-family:"Courier New"'>Version check and ipsec on-path [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Openswan U2.6.39/K2.6.32-279.11.1.el6.x86_64 (netkey)<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>See `ipsec --copyright' for copyright information.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Checking for IPsec support in kernel [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> NETKEY: Testing XFRM related proc values<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> ICMP default/send_redirects [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> ICMP default/accept_redirects [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> XFRM larval drop [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Hardware random device check [N/A]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Two or more interfaces found, checking IP forwarding [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Checking rp_filter [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Checking that pluto is running [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> Pluto listening for IKE on udp 500 [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> Pluto listening for IKE on tcp 500 [NOT IMPLEMENTED]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> Pluto listening for IKE/NAT-T on udp 4500 [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> Pluto listening for IKE/NAT-T on tcp 4500 [NOT IMPLEMENTED]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'> Pluto listening for IKE on tcp 10000 (cisco) [OK]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Checking NAT and MASQUERADEing [TEST INCOMPLETE]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Checking 'ip' command [IP XFRM BROKEN]<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Courier New"'>Checking 'iptables' command [OK]<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: ignoring unknown Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: received Vendor ID payload [RFC 3947] method set to=115 <o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: ignoring Vendor ID payload [FRAGMENTATION]<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: ignoring Vendor ID payload [Vid-Initial-Contact]<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: packet from A.B.C.D:500: ignoring Vendor ID payload [IKE CGA version 1]<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: responding to Main Mode from unknown peer A.B.C.D<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: OAKLEY_GROUP 20 not supported. Attribute OAKLEY_GROUP_DESCRIPTION<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: OAKLEY_GROUP 19 not supported. Attribute OAKLEY_GROUP_DESCRIPTION<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: STATE_MAIN_R1: sent MR1, expecting MI2<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): peer is NATed<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: STATE_MAIN_R2: sent MR2, expecting MI3<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: Main mode peer ID is ID_IPV4_ADDR: '192.168.1.107'<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[3] A.B.C.D #3: switched from "L2TP-PSK-NAT" to "L2TP-PSK-NAT"<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #3: deleting connection "L2TP-PSK-NAT" instance with peer A.B.C.D {isakmp=#0/ipsec=#0}<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #3: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #3: new NAT mapping for #3, was A.B.C.D:500, now A.B.C.D:44116<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #3: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp2048}<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #3: Dead Peer Detection (RFC 3706): not enabled because peer did not advertise it<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #3: the peer proposed: W.X.Y.Z/32:17/1701 -> 192.168.1.107/32:17/0<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #3: NAT-Traversal: received 2 NAT-OA. using first, ignoring others<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: responding to Quick Mode proposal {msgid:01000000}<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: us: W.X.Y.Z:17/1701---W.X.Y.Z<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: them: A.B.C.D[192.168.1.107]:17/1701===192.168.1.107/32<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: Dead Peer Detection (RFC 3706): not enabled because peer did not advertise it<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2<o:p></o:p></p><p class=MsoNormal>Aug 8 14:50:04 ssl9 pluto[27321]: "L2TP-PSK-NAT"[4] A.B.C.D #4: STATE_QUICK_R2: IPsec SA established transport mode {ESP=>0xaf04dd26 <0xd0ed4241 xfrm=AES_128-HMAC_SHA1 NATOA=192.168.1.107 NATD=A.B.C.D:44116 DPD=none}<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># basic configuration<o:p></o:p></p><p class=MsoNormal>config setup<o:p></o:p></p><p class=MsoNormal> #dumpdir=/var/run/pluto/<o:p></o:p></p><p class=MsoNormal> nat_traversal=yes<o:p></o:p></p><p class=MsoNormal> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:172.19.0.0/12;%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10<o:p></o:p></p><p class=MsoNormal> oe=off<o:p></o:p></p><p class=MsoNormal> protostack=netkey<o:p></o:p></p><p class=MsoNormal> nhelpers=0<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal># Add connections here<o:p></o:p></p><p class=MsoNormal>conn L2TP-PSK-NAT<o:p></o:p></p><p class=MsoNormal> rightsubnet=vhost:%no,%priv<o:p></o:p></p><p class=MsoNormal> also=L2TP-PSK-noNAT<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>conn L2TP-PSK-noNAT<o:p></o:p></p><p class=MsoNormal> authby=secret<o:p></o:p></p><p class=MsoNormal> pfs=no<o:p></o:p></p><p class=MsoNormal> auto=add<o:p></o:p></p><p class=MsoNormal> keyingtries=3<o:p></o:p></p><p class=MsoNormal> rekey=no<o:p></o:p></p><p class=MsoNormal> ikelifetime=8h<o:p></o:p></p><p class=MsoNormal> keylife=1h<o:p></o:p></p><p class=MsoNormal> dpdaction=clear<o:p></o:p></p><p class=MsoNormal> dpdtimeout=120<o:p></o:p></p><p class=MsoNormal> dpddelay=3<o:p></o:p></p><p class=MsoNormal> type=transport<o:p></o:p></p><p class=MsoNormal> left=%defaultroute<o:p></o:p></p><p class=MsoNormal> leftnexthop=W.X.Y.Z<o:p></o:p></p><p class=MsoNormal> leftprotoport=17/1701<o:p></o:p></p><p class=MsoNormal> right=%any<o:p></o:p></p><p class=MsoNormal> rightprotoport=17/%any<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>conn passthrough-for-non-l2tp<o:p></o:p></p><p class=MsoNormal> type=passthrough<o:p></o:p></p><p class=MsoNormal> left=%defaultroute<o:p></o:p></p><p class=MsoNormal> leftnexthop=W.X.Y.Z<o:p></o:p></p><p class=MsoNormal> right=0.0.0.0<o:p></o:p></p><p class=MsoNormal> rightsubnet=0.0.0.0/0<o:p></o:p></p><p class=MsoNormal> auto=route<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>[root@ssl9 xl2tpd]# more xl2tpd.conf<o:p></o:p></p><p class=MsoNormal>[global]<o:p></o:p></p><p class=MsoNormal>;listen-addr = W.X.Y.Z<o:p></o:p></p><p class=MsoNormal>;<o:p></o:p></p><p class=MsoNormal>; requires openswan-2.5.18 or higher - Also does not yet work in combination<o:p></o:p></p><p class=MsoNormal>; with kernel mode l2tp as present in linux 2.6.23+<o:p></o:p></p><p class=MsoNormal>; ipsec saref = yes<o:p></o:p></p><p class=MsoNormal>; forceuserspace = yes<o:p></o:p></p><p class=MsoNormal>;<o:p></o:p></p><p class=MsoNormal>; debug tunnel = yes<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>[lns default]<o:p></o:p></p><p class=MsoNormal>ip range = 10.200.11.2-10.200.11.254<o:p></o:p></p><p class=MsoNormal>local ip = 10.200.10.1<o:p></o:p></p><p class=MsoNormal>assign ip = yes<o:p></o:p></p><p class=MsoNormal>require chap = yes<o:p></o:p></p><p class=MsoNormal>refuse pap = yes<o:p></o:p></p><p class=MsoNormal>require authentication = no<o:p></o:p></p><p class=MsoNormal>name = OpenSwanVPN<o:p></o:p></p><p class=MsoNormal>ppp debug = yes<o:p></o:p></p><p class=MsoNormal>pppoptfile = /etc/ppp/options.xl2tpd<o:p></o:p></p><p class=MsoNormal>length bit = yes<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Many Thanks<o:p></o:p></p><p class=MsoNormal>Nev<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>