<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=big5" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.6001.23515">
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT color=#0000ff size=2 face=Verdana>Dear Sirs,</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>I setup the L2TP test environment
as below.But it did not seem to work.It seem the ipsec negotiation was
failed.How do I need to do to check this question?</FONT><FONT color=#0000ff
size=2 face=Verdana>Can someone point me in the right
direction?Thank's.</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Best Regards,</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Ozai</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Windows XP -----------(LAN
side:192.168.71.X)-----GW-------(WAN side:172.17.21.X)-----------L2TP/IPSec
Server</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>L2TP/IPSec
client
Xl2tpd/openswan 2.6.38</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana></FONT> </DIV>
<DIV><FONT color=#0000ff size=2
face=Verdana>####################>>log</FONT></DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>Sep 3 03:56:09 daemon err
ipsec_setup: Starting Openswan IPsec U2.6.38/K2.6.30...<BR>Sep 3 03:56:09
daemon err ipsec_setup: Using NETKEY(XFRM) stack<BR>Sep 3 03:56:11
authpriv err ipsec__plutorun: Starting Pluto subsystem...<BR>Sep 3
03:56:11 user warn syslog: adjusting ipsec.d to /var/ipsec.d<BR>Sep 3
03:56:11 authpriv warn pluto[5955]: WARNING: 1DES is enabled<BR>Sep 3
03:56:11 authpriv warn pluto[5955]: LEAK_DETECTIVE support
[disabled]<BR>Sep 3 03:56:11 authpriv warn pluto[5955]: OCF support for
IKE [disabled]<BR>Sep 3 03:56:11 authpriv warn pluto[5955]: NSS support
[disabled]<BR>Sep 3 03:56:11 authpriv warn pluto[5955]: HAVE_STATSD
notification support not compiled in<BR>Sep 3 03:56:11 authpriv warn
pluto[5955]: Setting NAT-Traversal port-4500 floating to off<BR>Sep 3
03:56:11 authpriv warn pluto[5955]: port floating activation
criteria nat_t=0/port_float=1<BR>Sep 3 03:56:11 authpriv warn
pluto[5955]: NAT-Traversal support
[disabled]<BR>Sep 3 03:56:11 authpriv warn pluto[5955]: using /dev/urandom
as source of random entropy<BR>Sep 3 03:56:11 authpriv warn pluto[5955]:
starting up 1 cryptographic helpers<BR>Sep 3 03:56:11 authpriv warn
pluto[5958]: using /dev/urandom as source of random entropy<BR>Sep 3
03:56:11 authpriv warn pluto[5955]: started helper pid=5958 (fd:6)<BR>Sep
3 03:56:11 daemon err ipsec__plutorun: adjusting ipsec.d to
/var/ipsec.d<BR>Sep 3 03:56:11 daemon err ipsec_setup: ...Openswan IPsec
started<BR>Sep 3 03:56:13 authpriv warn pluto[5955]: Could not change to
directory '/var/ipsec.d/cacerts': No such file or directory<BR>Sep 3
03:56:13 authpriv warn pluto[5955]: Could not change to directory
'/var/ipsec.d/aacerts': No such file or directory<BR>Sep 3 03:56:13
authpriv warn pluto[5955]: Could not change to directory
'/var/ipsec.d/ocspcerts': No such file or directory<BR>Sep 3 03:56:13
authpriv warn pluto[5955]: Could not change to directory '/var/ipsec.d/crls': 2
No such file or directory<BR>Sep 3 03:56:13 authpriv warn pluto[5955]:
added connection description "test"<BR>Sep 3 03:56:13 daemon err
ipsec__plutorun: 002 added connection description "test"<BR>Sep 3 03:56:14
authpriv warn pluto[5955]: listening for IKE messages<BR>Sep 3 03:56:14
authpriv warn pluto[5955]: adding interface eth0.1/eth0.1
172.17.21.75:500<BR>Sep 3 03:56:14 authpriv warn pluto[5955]: adding
interface br0/br0 192.168.1.254:500<BR>Sep 3 03:56:14 authpriv warn
pluto[5955]: adding interface lo/lo 127.0.0.1:500<BR>Sep 3 03:56:14
authpriv warn pluto[5955]: adding interface lo/lo ::1:500<BR>Sep 3
03:56:14 authpriv warn pluto[5955]: loading secrets from
"/var/ipsec.secrets"<BR>Sep 3 03:56:15 daemon info xl2tpd[6358]: Enabling
IPsec SAref processing for L2TP transport mode SAs<BR>Sep 3 03:56:15
daemon warn xl2tpd[6358]: IPsec SAref does not work with L2TP kernel mode yet,
enabling forceuserspace=yes<BR>Sep 3 03:56:15 daemon crit xl2tpd[6358]:
setsockopt recvref[30]: Protocol not available<BR>Sep 3 03:56:15 daemon
info xl2tpd[6358]: This binary does not support kernel L2TP.<BR>Sep 3
03:56:15 daemon info xl2tpd[6359]: xl2tpd version xl2tpd-1.3.1 started on
home.gateway PID:6359<BR>Sep 3 03:56:15 daemon info xl2tpd[6359]: Written
by Mark Spencer, Copyright (C) 1998, Adtran, Inc.<BR>Sep 3 03:56:15 daemon
info xl2tpd[6359]: Forked by Scott Balmos and David Stipp, (C) 2001<BR>Sep
3 03:56:15 daemon info xl2tpd[6359]: Inherited by Jeff McAdams, (C)
2002<BR>Sep 3 03:56:15 daemon info xl2tpd[6359]: Forked again by Xelerance
(<A href="http://www.xelerance.com">www.xelerance.com</A>) (C) 2006<BR>Sep
3 03:56:15 daemon info xl2tpd[6359]: Listening on IP address 0.0.0.0, port
1701<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: packet from
172.17.21.74:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY
00000004]<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: packet from
172.17.21.74:500: ignoring Vendor ID payload [FRAGMENTATION]<BR>Sep 3
03:56:26 authpriv warn pluto[5955]: packet from 172.17.21.74:500: received
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but port floating
is off<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: packet from
172.17.21.74:500: ignoring Vendor ID payload [Vid-Initial-Contact]<BR>Sep
3 03:56:26 authpriv warn pluto[5955]: "test"[1] 172.17.21.74 #1: responding to
Main Mode from unknown peer 172.17.21.74<BR>Sep 3 03:56:26 authpriv warn
pluto[5955]: "test"[1] 172.17.21.74 #1: transition from state STATE_MAIN_R0 to
state STATE_MAIN_R1<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: "test"[1]
172.17.21.74 #1: STATE_MAIN_R1: sent MR1, expecting MI2<BR>Sep 3 03:56:26
authpriv warn pluto[5955]: "test"[1] 172.17.21.74 #1: transition from state
STATE_MAIN_R1 to state STATE_MAIN_R2<BR>Sep 3 03:56:26 authpriv warn
pluto[5955]: "test"[1] 172.17.21.74 #1: STATE_MAIN_R2: sent MR2, expecting
MI3<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: "test"[1] 172.17.21.74
#1: Main mode peer ID is ID_IPV4_ADDR: '192.168.71.1'<BR>Sep 3 03:56:26
authpriv warn pluto[5955]: "test"[1] 172.17.21.74 #1: switched from "test" to
"test"<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: "test"[2] 172.17.21.74
#1: deleting connection "test" instance with peer 172.17.21.74
{isakmp=#0/ipsec=#0}<BR>Sep 3 03:56:26 authpriv warn pluto[5955]:
"test"[2] 172.17.21.74 #1: transition from state STATE_MAIN_R2 to state
STATE_MAIN_R3<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: "test"[2]
172.17.21.74 #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha
group=modp2048}<BR>Sep 3 03:56:26 authpriv warn pluto[5955]: "test"[2]
172.17.21.74 #1: the peer proposed: 172.17.21.75/32:17/1701 ->
192.168.71.1/32:17/0<BR>Sep 3 03:56:26 authpriv warn pluto[5955]:
"test"[2] 172.17.21.74 #1: cannot respond to IPsec SA request because no
connection is known for
172.17.21.75<172.17.21.75>:17/1701...172.17.21.74[192.168.71.1]:17/%any===192.168.71.1/32<BR>Sep
3 03:56:26 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: sending
encrypted notification INVALID_ID_INFORMATION to 172.17.21.74:500<BR>Sep 3
03:56:27 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: the peer
proposed: 172.17.21.75/32:17/1701 -> 192.168.71.1/32:17/0<BR>Sep 3
03:56:27 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: cannot respond to
IPsec SA request because no connection is known for
172.17.21.75<172.17.21.75>:17/1701...172.17.21.74[192.168.71.1]:17/%any===192.168.71.1/32<BR>Sep
3 03:56:27 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: sending
encrypted notification INVALID_ID_INFORMATION to 172.17.21.74:500<BR>Sep 3
03:56:29 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: the peer
proposed: 172.17.21.75/32:17/1701 -> 192.168.71.1/32:17/0<BR>Sep 3
03:56:29 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: cannot respond to
IPsec SA request because no connection is known for
172.17.21.75<172.17.21.75>:17/1701...172.17.21.74[192.168.71.1]:17/%any===192.168.71.1/32<BR>Sep
3 03:56:29 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: sending
encrypted notification INVALID_ID_INFORMATION to 172.17.21.74:500<BR>Sep 3
03:56:33 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: the peer
proposed: 172.17.21.75/32:17/1701 -> 192.168.71.1/32:17/0<BR>Sep 3
03:56:33 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: cannot respond to
IPsec SA request because no connection is known for
172.17.21.75<172.17.21.75>:17/1701...172.17.21.74[192.168.71.1]:17/%any===192.168.71.1/32<BR>Sep
3 03:56:33 authpriv warn pluto[5955]: "test"[2] 172.17.21.74 #1: sending
encrypted notification INVALID_ID_INFORMATION to 172.17.21.74:500</FONT></DIV>
<DIV> </DIV>
<DIV><FONT color=#0000ff size=2
face=Verdana>####################>>ipsec.conf<BR>config
setup<BR>
nat_traversal=no<BR>
oe=off<BR>
protostack=netkey<BR>
interfaces=%defaultroute</FONT></DIV>
<DIV> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>conn
test<BR>
left=172.17.21.75<BR>
leftprotoport=17/1701<BR>
connaddrfamily=ipv4<BR>
right=%any<BR>
rightprotoport=17/%any<BR>
pfs=no<BR>
salifetime=60m<BR>
ikelifetime=480m<BR>
type=transport<BR>
phase2=esp<BR>
keyexchange=ike<BR>
authby=secret<BR>
auto=add</FONT></DIV>
<DIV> </DIV>
<DIV><FONT color=#0000ff size=2
face=Verdana>####################>>ipsec.secrets<BR>172.17.21.75 %any :
PSK
"123"<BR>
<BR>####################>>xl2tpd.conf<BR>[global]<BR>auth
file=/var/xl2tpd/l2tp-secrets<BR>ipsec saref = yes<BR>port = 1701</FONT></DIV>
<DIV> </DIV>
<DIV><FONT color=#0000ff size=2 face=Verdana>[lns default]<BR>ip range =
192.168.1.10-192.168.1.13<BR>local ip = 192.168.1.254<BR>require authentication
= yes<BR>name = L2TPServer<BR>pppoptfile = /var/xl2tpd/options.xl2tpd<BR>length
bit = yes<BR>challenge =
no<BR>#
</FONT></DIV></BODY></HTML>