[Openswan Users] Vista and Openswan L2TP IPSEC vpn connection problem

Danilo Godec danilo.godec at agenda.si
Tue Oct 14 04:41:25 EDT 2008


Jacco de Leeuw pravi:
> You need this parameter if there is at least one client behind NAT.
> See man ipsec.conf or
> http://www.jacco2.dds.nl/networking/openswan-l2tp.html#NAT
>   
Hi,

I recently updated a server from SuSE Linux 9.3 (with openswan-2.4.0-5
and l2tpd-0.69-12jdl) to SuSE Enterprise Linux 10 SP2 (with
openswan-2.4.4-18.6.1 and l2tpd-0.69-12jdl). Most of the configuration
was simply carried over and it works well for Linux - Linux IPSEC
tunnels and L2TP tunnels with Windows XP.

However, it just doesn't work with Vista. This is what I get in server
logs when I try to connect Vista:

> Oct 14 10:23:11 dioda pluto[8671]: packet from YYY.YYY.YYY.YYY:500:
> ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000005]
> Oct 14 10:23:11 dioda pluto[8671]: packet from YYY.YYY.YYY.YYY:500:
> received Vendor ID payload [RFC 3947] method set to=109
> Oct 14 10:23:11 dioda pluto[8671]: packet from YYY.YYY.YYY.YYY:500:
> received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106,
> but already using method 109
> Oct 14 10:23:11 dioda pluto[8671]: packet from YYY.YYY.YYY.YYY:500:
> ignoring Vendor ID payload [FRAGMENTATION]
> Oct 14 10:23:11 dioda pluto[8671]: packet from YYY.YYY.YYY.YYY:500:
> ignoring unknown Vendor ID payload [fb1de3cdf341b7ea16b7e5be0855f120]
> Oct 14 10:23:11 dioda pluto[8671]: packet from YYY.YYY.YYY.YYY:500:
> ignoring Vendor ID payload [Vid-Initial-Contact]
> Oct 14 10:23:11 dioda pluto[8671]: packet from YYY.YYY.YYY.YYY:500:
> ignoring unknown Vendor ID payload [e3a5966a76379fe707228231e5ce8652]
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> responding to Main Mode from unknown peer YYY.YYY.YYY.YYY
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> only OAKLEY_GROUP_MODP1024 and OAKLEY_GROUP_MODP1536 supported. 
> Attribute OAKLEY_GROUP_DESCRIPTION
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> only OAKLEY_GROUP_MODP1024 and OAKLEY_GROUP_MODP1536 supported. 
> Attribute OAKLEY_GROUP_DESCRIPTION
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> STATE_MAIN_R1: sent MR1, expecting MI2
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> NAT-Traversal: Result using 3: peer is NATed
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> STATE_MAIN_R2: sent MR2, expecting MI3
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[1] YYY.YYY.YYY.YYY #7:
> Main mode peer ID is ID_DER_ASN1_DN: 'C=SI, ST=Slovenija, L=Ljubljana,
> O=IBE, OU=IT, CN=Sebastijan Silec, E=ca at ibe.si'
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> deleting connection "rw1-net" instance with peer YYY.YYY.YYY.YYY
> {isakmp=#0/ipsec=#0}
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7: I
> am sending my cert
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
> Oct 14 10:23:11 dioda pluto[8671]: | NAT-T: new mapping
> YYY.YYY.YYY.YYY:500/4500)
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG
> cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> cannot respond to IPsec SA request because no connection is known for
> XXX.XXX.XXX.XXX[C=SI, ST=Slovenija, L=Ljubljana, O=IBE, CN=lj.ibe.si,
> E=ca at ibe.si]:17/1701...YYY.YYY.YYY.YYY[C=SI, ST=Slovenija,
> L=Ljubljana, O=IBE, OU=IT, CN=Sebastijan Silec,
> E=ca at ibe.si]:17/1701===172.16.0.92/32
> Oct 14 10:23:11 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> sending encrypted notification INVALID_ID_INFORMATION to
> YYY.YYY.YYY.YYY:4500
> Oct 14 10:23:12 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> Quick Mode I1 message is unacceptable because it uses a previously
> used Message ID 0x01000000 (perhaps this is a duplicated packet)
> Oct 14 10:23:12 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> sending encrypted notification INVALID_MESSAGE_ID to YYY.YYY.YYY.YYY:4500
> Oct 14 10:23:14 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> Quick Mode I1 message is unacceptable because it uses a previously
> used Message ID 0x01000000 (perhaps this is a duplicated packet)
> Oct 14 10:23:14 dioda pluto[8671]: "rw1-net"[2] YYY.YYY.YYY.YYY #7:
> sending encrypted notification INVALID_MESSAGE_ID to YYY.YYY.YYY.YYY:4500
where:
- XXX.XXX.XXX.XXX is the public IP of the Openswan server
- YYY.YYY.YYY.YYY is the public IP of the router behind which the
Windows XP and Vista reside

The Vista and XP that I use for testing are in the same private network
(ie. behind NAT), while the server has a public IP. The private network
behind the server is 172.16.0.0/16, my private network is 172.16.0.0/24.
L2TP gives me an IP in the range of 172.17.4.1-100. As mentioned above -
this works with XP !?

This is my configuration (excluding comments and other Linux - Linux
connections:
> version 2.0
>
> config setup
>         nat_traversal=yes
>         uniqueids=yes
>        
> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12,%v4:!172.16.11.0/16
>         plutowait=yes
>
> conn %default
>         leftrsasigkey=%cert
>         rightrsasigkey=%cert
>         compress=no
>         disablearrivalcheck=no
>         auto=route
>         authby=rsasig
>
> include /etc/ipsec.d/examples/no_oe.conf
>
> conn rw1-net
>         pfs=no
>         left=XXX.XXX.XXX.XXX
>         leftnexthop=193.77.13.33
>         leftupdown=/etc/ipsec.d/road-updown
>         leftprotoport=17/1701
>         leftrsasigkey=%cert
>         leftcert=lj.ibe.si.pem
>         rightrsasigkey=%cert
>         rightprotoport=17/1701
>         rightca=%same
>         right=%any
>         rightsubnet=vhost:%no,%priv
>         auto=add
>         keyingtries=3
>         keylife=5h
>         ikelifetime=5h

What am I missing here?

 Thanks, Danilo

-------------- next part --------------
A non-text attachment was scrubbed...
Name: danilo_godec.vcf
Type: text/x-vcard
Size: 302 bytes
Desc: not available
Url : http://lists.openswan.org/pipermail/users/attachments/20081014/1d060b5f/attachment.vcf 


More information about the Users mailing list