[Openswan Users] Windows XP & L2TP issue, timeout

FLOC'H Tanguy t.floch at sofrel.com
Mon Dec 14 08:17:16 EST 2009


Hello,

Did you set the "AssumeUDPEncapsulationContextOnSendRule" registry entry on Windows ?

This is needed, since NAT is involved.

See http://support.microsoft.com/kb/885407

Best regards,

Tanguy Floc'h

-----Message d'origine-----
De : users-bounces at openswan.org [mailto:users-bounces at openswan.org] De la part de Gennady Kovalev
Envoyé : dimanche 13 décembre 2009 23:12
À : users at openswan.org
Objet : [Openswan Users] Windows XP & L2TP issue, timeout

Hello!

I have this network structure:

MyServer, real ip <-- ...internet... --> ADSLModem (nat here) --- 2 
PC(Linux, Windows)

The ipsec connection made from intranet, from linux machine with debian 
and Windows XP SP3 machine.

First, i try to set up linux connection. Where is no problems here. And 
from windows i can't connect to the server with 678 Error, connection 
time out.

Server side:
 - openswan 2.6.23
 - xl2tpd 1.2.4

About windows connection. IPSec layer connected, but l2tp packets didn't 
pass from server to client. I connect one pc between Windows and ADSL 
router, and can't see l2tp packets. Non encapsulated, non clean 1701 udp.

=========== configs =================

ipsec.conf:
config setup
    nat_traversal=yes
    oe=off
    protostack=netkey
    
virtual_private=%v4:10.0.0.0/8,%v4:172.16.0.0/12,%v4:192.168.0.0/16,%v4:!10.1.25.0/24

conn %default
    auto=add

conn roadwarrior
    authby=rsasig
    pfs=no 
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport 
    left=94.79.54.16
    #leftid=%fromcert 
    leftrsasigkey=%cert
    leftcert=myserver.crt
    right=%any  
    rightca=%same
    rightrsasigkey=%cert
    rightsubnet=vhost:%no,%priv
    leftprotoport=17/1701
    rightprotoport=17/1701

xl2tpd.conf
[lns default]
ip range = 10.1.25.128-10.1.25.254
local ip = 10.1.25.1
require chap = yes
refuse pap = yes
require authentication = yes
name = LinuxVPNserver
ppp debug = yes
pppoptfile = /etc/ppp/ppp-options.xl2tpd
length bit = yes

/etc/ppp/ppp-options.xl2tpd may be not imported now...

=========== /configs =================


And some logs:

========== logs ================

edited ipsec log, x.x.x.x - public ip of client (before nat), y.y.y.y - 
ip of server:

packet from x.x.x.x:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 
00000004]
packet from x.x.x.x:500: ignoring Vendor ID payload [FRAGMENTATION]
packet from x.x.x.x:500: received Vendor ID payload 
[draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
packet from x.x.x.x:500: ignoring Vendor ID payload [Vid-Initial-Contact]
#15: responding to Main Mode from unknown peer x.x.x.x
#15: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
#15: STATE_MAIN_R1: sent MR1, expecting MI2
#15: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer 
is NATed
#15: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
#15: STATE_MAIN_R2: sent MR2, expecting MI3
#15: Main mode peer ID is ID_DER_ASN1_DN: ' ... machine dn ... '
#15: no crl from issuer " ... ca dn ... " found (strict=no)
#15: switched from "roadwarrior" to "roadwarrior"
#15: I am sending my cert
#15: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
#15: new NAT mapping for #15, was x.x.x.x:500, now x.x.x.x:4500
#15: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_RSA_SIG 
cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp2048}
#15: peer client type is FQDN
#15: Applying workaround for MS-818043 NAT-T bug
#15: IDci was FQDN: ^O6\020, using NAT_OA=192.168.0.101/32 as IDci
#15: the peer proposed: y.y.y.y/32:17/1701 -> 192.168.0.101/32:17/1701
#16: responding to Quick Mode proposal {msgid:bde1b952}
#16:     us: y.y.y.y<y.y.y.y>[+S=C]:17/1701
#16:   them: x.x.x.x[... machine dn ...]:17/1701===192.168.0.101/32
#16: transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
#16: STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
#16: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
#16: STATE_QUICK_R2: IPsec SA established transport mode 
{ESP=>0x87d54f3f <0x4e10cc73 xfrm=3DES_0-HMAC_MD5 NATOA=192.168.0.101 
NATD=x.x.x.x:4500 DPD=none}

xl2tpd's logs:
control_finish: Peer requested tunnel 49 twice, ignoring second one.
Connection 49 closed to 95.143.213.58, port 1701 (Timeout)

When ipsec connection established, ip xfrm pol:
src 192.168.0.101/32 dst y.y.y.y/32 proto udp dport 1701
        dir in priority 2080
        tmpl src 0.0.0.0 dst 0.0.0.0
                proto esp reqid 16425 mode transport
src y.y.y.y/32 dst 192.168.0.101/32 proto udp sport 1701
        dir out priority 2080
        tmpl src 0.0.0.0 dst 0.0.0.0
                proto esp reqid 16425 mode transport

And tcpdump:
x.x.x.x.500 > y.y.y.y.500: isakmp: phase 1 I ident
y.y.y.y.500 > x.x.x.x.500: isakmp: phase 1 R ident
x.x.x.x.500 > y.y.y.y.500: isakmp: phase 1 I ident
y.y.y.y.500 > x.x.x.x.500: isakmp: phase 1 R ident
x.x.x.x.4500 > y.y.y.y.4500: NONESP-encap: isakmp: phase 1 I ident[E]
y.y.y.y.4500 > x.x.x.x.4500: NONESP-encap: isakmp: phase 1 R ident[E]
x.x.x.x.4500 > y.y.y.y.4500: NONESP-encap: isakmp: phase 2/others I 
oakley-quick[E]
y.y.y.y.4500 > x.x.x.x.4500: NONESP-encap: isakmp: phase 2/others R 
oakley-quick[E]
x.x.x.x.4500 > y.y.y.y.4500: NONESP-encap: isakmp: phase 2/others I 
oakley-quick[E]
x.x.x.x.4500 > y.y.y.y.4500: UDP-encap: ESP(spi=0x6e1167b8,seq=0x1), 
length 140
x.x.x.x.4500 > y.y.y.y.4500: UDP-encap: ESP(spi=0x6e1167b8,seq=0x2), 
length 140
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 *MSGTYPE(SCCRP) 
*PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() |...
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 ZLB
x.x.x.x.4500 > y.y.y.y.4500: UDP-encap: ESP(spi=0x6e1167b8,seq=0x3), 
length 140
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 ZLB
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 *MSGTYPE(SCCRP) 
*PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() |...
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 *MSGTYPE(SCCRP) 
*PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() |...
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 *MSGTYPE(SCCRP) 
*PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() |...
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 *MSGTYPE(SCCRP) 
*PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() |...
x.x.x.x.4500 > y.y.y.y.4500: UDP-encap: ESP(spi=0x6e1167b8,seq=0x4), 
length 140
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 ZLB
x.x.x.x.4500 > y.y.y.y.4500: UDP-encap: ESP(spi=0x6e1167b8,seq=0x5), 
length 140
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 ZLB
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=1,Nr=1 
*MSGTYPE(StopCCN) *ASSND_TUN_ID(9708) *RESULT_CODE(1/0 Timeout)
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=1,Nr=1 
*MSGTYPE(StopCCN) *ASSND_TUN_ID(9708) *RESULT_CODE(1/0 Timeout)
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=1,Nr=1 
*MSGTYPE(StopCCN) *ASSND_TUN_ID(9708) *RESULT_CODE(1/0 Timeout)
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=1,Nr=1 
*MSGTYPE(StopCCN) *ASSND_TUN_ID(9708) *RESULT_CODE(1/0 Timeout)
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=1,Nr=1 
*MSGTYPE(StopCCN) *ASSND_TUN_ID(9708) *RESULT_CODE(1/0 Timeout)
x.x.x.x.4500 > y.y.y.y.4500: isakmp-nat-keep-alive
x.x.x.x.4500 > y.y.y.y.4500: UDP-encap: ESP(spi=0x6e1167b8,seq=0x6), 
length 140
y.y.y.y.1701 > x.x.x.x.1701:  l2tp:[TLS](49/0)Ns=0,Nr=1 ZLB
x.x.x.x.4500 > y.y.y.y.4500: NONESP-encap: isakmp: phase 2/others I inf[E]
y.y.y.y.4500 > x.x.x.x.4500: NONESP-encap: isakmp: phase 2/others R inf[E]
x.x.x.x.4500 > y.y.y.y.4500: NONESP-encap: isakmp: phase 2/others I inf[E]
y.y.y.y.4500 > x.x.x.x.4500: NONESP-encap: isakmp: phase 2/others R inf[E]
x.x.x.x.4500 > y.y.y.y.4500: isakmp-nat-keep-alive

========== / logs ===============

I have same logs with successful connection from linux, i can send it if 
needed.
One this i write now: differens with tcpdumped packets afted ipsec 
session estableshed:

x.x.x.x.1025 > y.y.y.y.4500: UDP-encap: ESP(spi=0x4ff02f71,seq=0x1), 
length 180
192.168.0.100.1701 > y.y.y.y.1701:  l2tp:[TLS](0/0)Ns=0,Nr=0 
*MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() |...
x.x.x.x.1025 > y.y.y.y.4500: UDP-encap: ESP(spi=0x4ff02f71,seq=0x2), 
length 180
192.168.0.100.1701 > y.y.y.y.1701:  l2tp:[TLS](0/0)Ns=0,Nr=0 
*MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(AS) *BEARER_CAP() |...
y.y.y.y.4500 > x.x.x.x.1025: UDP-encap: ESP(spi=0x2b2873ca,seq=0x1), 
length 180
y.y.y.y.4500 > x.x.x.x.1025: UDP-encap: ESP(spi=0x2b2873ca,seq=0x2), 
length 84


Here we can see intranet's ip 192.168.0.100, and encapsulated ESP 
packets, but with Windows i can't see this.

Please help,

Thank you,

Gennady Kovalev.
_______________________________________________
Users at openswan.org
http://lists.openswan.org/mailman/listinfo/users
Building and Integrating Virtual Private Networks with Openswan: 
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155


More information about the Users mailing list