[Openswan Users] l2tpd problem
Federico
fviel at comune.belluno.it
Thu May 11 18:23:50 CEST 2006
Hello,
I'm trying to configure openswan 2.2.0 + l2tpd 0.70 (from unstable) on
debian sarge 3.1 kernel 2.6.8 as vpn server for win xp clients
IPSEC Tunnel starts correctly (As you can see below), but l2tp won't to
start..
I follow http://www.jacco2.dds.nl/networking/win2000xp-freeswan.html to
configure the windows XP client.
Connection is NOT NATED! And there are no Firewall problem as I can't see
any packet rejected coming from client (I log every rejected packet)
Perhaps as these message appear in log files:
May 11 16:57:19 localhost l2tpd[5069]: control_xmit: Unable to deliver
closing message for tunnel 22079. Destroying anyway.
The l2tpd daemon could not send response to l2tpd client through the ipsec
tunnel. Am I right? And if yes why?
Thank you in advance!
F
Those are my config files and the logs about connection.
IPSEC.CONF
conn L2TP-PSK
authby=secret
pfs=no
rekey=no
keyingtries=3
left=xxx.xxx.xxx.xx6
leftprotoport=17/1701
# Allow incoming connections from any IP address.
right=%any
rightprotoport=17/%any
auto=add
L2TPD.CONF
[global]
;listen-addr=10.6.100.254
;port=1701
[lns default]
ip range = 10.6.100.231-10.6.100.240
local ip = 10.6.100.241
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd
length bit = yes
OPTIONS.L2TP
ms-dns 10.6.100.1
ms-dns 10.6.100.2
require-chapms-v2
proxyarp
connect-delay 5000
IPSEC:
May 11 16:56:52 localhost pluto[4985]: packet from 80.104.115.108:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
May 11 16:56:52 localhost pluto[4985]: packet from 80.104.115.108:500:
ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]
May 11 16:56:52 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
responding to Main Mode from unknown peer 80.104.115.108
May 11 16:56:52 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
transition from state (null) to state STATE_MAIN_R1
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
ignoring Vendor ID payload [FRAGMENTATION]
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]
May 11 16:56:53 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #2:
responding to Main Mode from unknown peer 80.104.115.108
May 11 16:56:53 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #2:
transition from state (null) to state STATE_MAIN_R1
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
ignoring Vendor ID payload [FRAGMENTATION]
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
May 11 16:56:53 localhost pluto[4985]: packet from 80.104.115.108:500:
ignoring Vendor ID payload [26244d38eddb61b3172a36e3d0cfb819]
May 11 16:56:53 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #3:
responding to Main Mode from unknown peer 80.104.115.108
May 11 16:56:53 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #3:
transition from state (null) to state STATE_MAIN_R1
May 11 16:56:53 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT
detected
May 11 16:56:53 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
May 11 16:56:53 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
discarding duplicate packet; already STATE_MAIN_R2
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1: Peer
ID is ID_IPV4_ADDR: '80.104.115.108'
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1: I
did not send a certificate because I do not have one.
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1: sent
MR3, ISAKMP SA established
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #4:
responding to Quick Mode
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #4:
transition from state (null) to state STATE_QUICK_R1
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #4:
route-host output: /usr/lib/ipsec/_updown: doroute `ip route add
80.104.115.108/32 via 80.104.115.108 dev eth0 ' failed (RTNETLINK answers:
Network is unreachable)
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #4:
transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
May 11 16:56:54 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #4:
IPsec SA established {ESP=>0x793ac3f8 <0x3e9c2448}
May 11 16:57:29 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
received Delete SA(0x793ac3f8) payload: deleting IPSEC State #4
May 11 16:57:29 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #4:
unroute-host output: /usr/lib/ipsec/_updown: doroute `ip route delete
80.104.115.108/32 via 80.104.115.108 dev eth0 ' failed (RTNETLINK answers:
No such process)
May 11 16:57:29 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
received and ignored informational message
May 11 16:57:29 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #1:
received Delete SA payload: deleting ISAKMP State #1
May 11 16:57:29 localhost pluto[4985]: packet from 80.104.115.108:500:
received and ignored informational message
May 11 16:58:03 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #3: max
number of retransmissions (2) reached STATE_MAIN_R1
May 11 16:58:03 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108 #2: max
number of retransmissions (2) reached STATE_MAIN_R1
May 11 16:58:03 localhost pluto[4985]: "L2TP-PSK"[1] 80.104.115.108:
deleting connection "L2TP-PSK" instance with peer 80.104.115.108
{isakmp=#0/ipsec=#0}
L2TPD
May 11 16:56:54 localhost l2tpd[5069]: ourtid = 19374, entropy_buf = 4bae
May 11 16:56:54 localhost l2tpd[5069]: check_control: control, cid = 0, Ns =
0, Nr = 0
May 11 16:56:54 localhost l2tpd[5069]: handle_avps: handling avp's for
tunnel 19374, call 0
May 11 16:56:54 localhost l2tpd[5069]: message_type_avp: message type 1
(Start-Control-Connection-Request)
May 11 16:56:54 localhost l2tpd[5069]: protocol_version_avp: peer is using
version 1, revision 0.
May 11 16:56:54 localhost l2tpd[5069]: framing_caps_avp: supported peer
frames: sync
May 11 16:56:54 localhost l2tpd[5069]: bearer_caps_avp: supported peer
bearers:
May 11 16:56:54 localhost l2tpd[5069]: firmware_rev_avp: peer reports
firmware version 1280 (0x0500)
May 11 16:56:54 localhost l2tpd[5069]: hostname_avp: peer reports hostname
'X-ONYX'
May 11 16:56:54 localhost l2tpd[5069]: vendor_avp: peer reports vendor
'Microsoft'
May 11 16:56:54 localhost l2tpd[5069]: assigned_tunnel_avp: using peer's
tunnel 1
May 11 16:56:54 localhost l2tpd[5069]: receive_window_size_avp: peer wants
RWS of 8. Will use flow control.
May 11 16:56:55 localhost l2tpd[5069]: ourtid = 24572, entropy_buf = 5ffc
May 11 16:56:55 localhost l2tpd[5069]: check_control: control, cid = 0, Ns =
0, Nr = 0
May 11 16:56:55 localhost l2tpd[5069]: handle_avps: handling avp's for
tunnel 24572, call 0
May 11 16:56:55 localhost l2tpd[5069]: message_type_avp: message type 1
(Start-Control-Connection-Request)
May 11 16:56:55 localhost l2tpd[5069]: protocol_version_avp: peer is using
version 1, revision 0.
May 11 16:56:55 localhost l2tpd[5069]: framing_caps_avp: supported peer
frames: sync
May 11 16:56:55 localhost l2tpd[5069]: bearer_caps_avp: supported peer
bearers:
May 11 16:56:55 localhost l2tpd[5069]: firmware_rev_avp: peer reports
firmware version 1280 (0x0500)
May 11 16:56:55 localhost l2tpd[5069]: hostname_avp: peer reports hostname
'X-ONYX'
May 11 16:56:55 localhost l2tpd[5069]: vendor_avp: peer reports vendor
'Microsoft'
May 11 16:56:55 localhost l2tpd[5069]: assigned_tunnel_avp: using peer's
tunnel 1
May 11 16:56:55 localhost l2tpd[5069]: receive_window_size_avp: peer wants
RWS of 8. Will use flow control.
May 11 16:56:55 localhost l2tpd[5069]: control_finish: Peer requested tunnel
1 twice, ignoring second one.
May 11 16:56:57 localhost l2tpd[5069]: ourtid = 30375, entropy_buf = 76a7
May 11 16:56:57 localhost l2tpd[5069]: check_control: control, cid = 0, Ns =
0, Nr = 0
May 11 16:56:57 localhost l2tpd[5069]: handle_avps: handling avp's for
tunnel 30375, call 0
May 11 16:56:57 localhost l2tpd[5069]: message_type_avp: message type 1
(Start-Control-Connection-Request)
May 11 16:56:57 localhost l2tpd[5069]: protocol_version_avp: peer is using
version 1, revision 0.
May 11 16:56:57 localhost l2tpd[5069]: framing_caps_avp: supported peer
frames: sync
May 11 16:56:57 localhost l2tpd[5069]: bearer_caps_avp: supported peer
bearers:
May 11 16:56:57 localhost l2tpd[5069]: firmware_rev_avp: peer reports
firmware version 1280 (0x0500)
May 11 16:56:57 localhost l2tpd[5069]: hostname_avp: peer reports hostname
'X-ONYX'
May 11 16:56:57 localhost l2tpd[5069]: vendor_avp: peer reports vendor
'Microsoft'
May 11 16:56:57 localhost l2tpd[5069]: assigned_tunnel_avp: using peer's
tunnel 1
May 11 16:56:57 localhost l2tpd[5069]: receive_window_size_avp: peer wants
RWS of 8. Will use flow control.
May 11 16:56:57 localhost l2tpd[5069]: control_finish: Peer requested tunnel
1 twice, ignoring second one.
May 11 16:56:59 localhost l2tpd[5069]: control_xmit: Maximum retries
exceeded for tunnel 19374. Closing.
May 11 16:56:59 localhost l2tpd[5069]: call_close : Connection 1 closed to
80.104.115.108, port 1701 (Timeout)
May 11 16:57:01 localhost l2tpd[5069]: ourtid = 15968, entropy_buf = 3e60
May 11 16:57:01 localhost l2tpd[5069]: ourcid = 51213, entropy_buf = c80d
May 11 16:57:01 localhost l2tpd[5069]: check_control: control, cid = 0, Ns =
0, Nr = 0
May 11 16:57:01 localhost l2tpd[5069]: handle_avps: handling avp's for
tunnel 15968, call 51213
May 11 16:57:01 localhost l2tpd[5069]: message_type_avp: message type 1
(Start-Control-Connection-Request)
May 11 16:57:01 localhost l2tpd[5069]: protocol_version_avp: peer is using
version 1, revision 0.
May 11 16:57:01 localhost l2tpd[5069]: framing_caps_avp: supported peer
frames: sync
May 11 16:57:01 localhost l2tpd[5069]: bearer_caps_avp: supported peer
bearers:
May 11 16:57:01 localhost l2tpd[5069]: firmware_rev_avp: peer reports
firmware version 1280 (0x0500)
May 11 16:57:01 localhost l2tpd[5069]: hostname_avp: peer reports hostname
'X-ONYX'
May 11 16:57:01 localhost l2tpd[5069]: vendor_avp: peer reports vendor
'Microsoft'
May 11 16:57:01 localhost l2tpd[5069]: assigned_tunnel_avp: using peer's
tunnel 1
May 11 16:57:01 localhost l2tpd[5069]: receive_window_size_avp: peer wants
RWS of 8. Will use flow control.
May 11 16:57:01 localhost l2tpd[5069]: control_finish: Peer requested tunnel
1 twice, ignoring second one.
May 11 16:57:04 localhost l2tpd[5069]: control_xmit: Unable to deliver
closing message for tunnel 19374. Destroying anyway.
May 11 16:57:09 localhost l2tpd[5069]: ourtid = 22079, entropy_buf = 563f
May 11 16:57:09 localhost l2tpd[5069]: ourcid = 31018, entropy_buf = 792a
May 11 16:57:09 localhost l2tpd[5069]: check_control: control, cid = 0, Ns =
0, Nr = 0
May 11 16:57:09 localhost l2tpd[5069]: handle_avps: handling avp's for
tunnel 22079, call 31018
May 11 16:57:09 localhost l2tpd[5069]: message_type_avp: message type 1
(Start-Control-Connection-Request)
May 11 16:57:09 localhost l2tpd[5069]: protocol_version_avp: peer is using
version 1, revision 0.
May 11 16:57:09 localhost l2tpd[5069]: framing_caps_avp: supported peer
frames: sync
May 11 16:57:09 localhost l2tpd[5069]: bearer_caps_avp: supported peer
bearers:
May 11 16:57:09 localhost l2tpd[5069]: firmware_rev_avp: peer reports
firmware version 1280 (0x0500)
May 11 16:57:09 localhost l2tpd[5069]: hostname_avp: peer reports hostname
'X-ONYX'
May 11 16:57:09 localhost l2tpd[5069]: vendor_avp: peer reports vendor
'Microsoft'
May 11 16:57:09 localhost l2tpd[5069]: assigned_tunnel_avp: using peer's
tunnel 1
May 11 16:57:09 localhost l2tpd[5069]: receive_window_size_avp: peer wants
RWS of 8. Will use flow control.
May 11 16:57:14 localhost l2tpd[5069]: control_xmit: Maximum retries
exceeded for tunnel 22079. Closing.
May 11 16:57:14 localhost l2tpd[5069]: call_close : Connection 1 closed to
80.104.115.108, port 1701 (Timeout)
May 11 16:57:19 localhost l2tpd[5069]: ourtid = 60471, entropy_buf = ec37
May 11 16:57:19 localhost l2tpd[5069]: ourcid = 5300, entropy_buf = 14b4
May 11 16:57:19 localhost l2tpd[5069]: check_control: control, cid = 0, Ns =
0, Nr = 0
May 11 16:57:19 localhost l2tpd[5069]: handle_avps: handling avp's for
tunnel 60471, call 5300
May 11 16:57:19 localhost l2tpd[5069]: message_type_avp: message type 1
(Start-Control-Connection-Request)
May 11 16:57:19 localhost l2tpd[5069]: protocol_version_avp: peer is using
version 1, revision 0.
May 11 16:57:19 localhost l2tpd[5069]: framing_caps_avp: supported peer
frames: sync
May 11 16:57:19 localhost l2tpd[5069]: bearer_caps_avp: supported peer
bearers:
May 11 16:57:19 localhost l2tpd[5069]: firmware_rev_avp: peer reports
firmware version 1280 (0x0500)
May 11 16:57:19 localhost l2tpd[5069]: hostname_avp: peer reports hostname
'X-ONYX'
May 11 16:57:19 localhost l2tpd[5069]: vendor_avp: peer reports vendor
'Microsoft'
May 11 16:57:19 localhost l2tpd[5069]: assigned_tunnel_avp: using peer's
tunnel 1
May 11 16:57:19 localhost l2tpd[5069]: receive_window_size_avp: peer wants
RWS of 8. Will use flow control.
May 11 16:57:19 localhost l2tpd[5069]: control_finish: Peer requested tunnel
1 twice, ignoring second one.
May 11 16:57:19 localhost l2tpd[5069]: control_xmit: Unable to deliver
closing message for tunnel 22079. Destroying anyway.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.openswan.org/pipermail/users/attachments/20060511/9a7a2e09/attachment-0001.htm
More information about the Users
mailing list