[Openswan Users] status of bug with nat-t and l2tpd -

weirauch at checkmobile.de weirauch at checkmobile.de
Mon Feb 16 04:03:11 EST 2009


hi, 
is it sure, that the nat-t xl2tpd connection is not working in a netkey 
enviroment?
(there were several entries in the mailing list refering to the following 
bug: http://bugs.xelerance.com/view.php?id=1004)
but i simply cannot believe that such a "basic" functionality (l2tp with 
internal ip and ipsec on external device) does not work. I try since 3 
weeks to get this configuration running (with the help of jacoos web page 
and the book of paul) but there seems to be an error all the time - maybe 
the wrong kernel route from ipsec?? (but if that would really be the bug, 
how come that jacoo and the openswan book both describe this type of 
setup? did it work in earlier times?)

here is my configuration and the log file:
Linux Openswan U2.6.20/K2.6.25.20-0.1-debug (netkey)

ipsec.conf:
========
config setup
        plutodebug="private"
        nat_traversal=yes
 
virtual_private=%v4:10.0.0.0/8,%v4:!192.168.229.0/24,%v4:172.31.13.0/24,%v4:192.168.178.0/24

conn nw-l2tp-psk
        left=87.253.184.140
        #left=%defaultroute
        #leftsubnet=192.168.229.0/24
        leftnexthop=87.253.184.28
        leftprotoport=17/1701
        rightprotoport=17/%any
        rightsubnet=vhost:%priv,%no
        right=%any
        auto=add
        authby=secret
        pfs=no

xl2tpd.conf
========
[global]
listen-addr = 192.168.229.128
ipsec saref = yes
debug tunnel = yes
debug avp = yes
debug network = yes
debug packet = yes
debug state = yes

[lns default]
ip range = 192.168.229.18-192.168.229.100
local ip = 192.168.229.128
require chap = yes
refuse pap = yes
require authentication = yes
name = VPNPW_NW
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes
tunnel rws = 4

options.xl2tpd
===========
ipcp-accept-local
ipcp-accept-remote
ms-dns  192.168.229.1
ms-dns  213.191.74.18
noccp
auth
crtscts
idle 1800
mtu 1410
mru 1410
nodefaultroute
debug
lock
proxyarp
connect-delay 5000

/var/log/messages
==============
Feb 16 09:31:22 vpn pluto[15792]: "nw-l2tp-psk"[2] 85.182.252.146 #803: 
max number of retransmissions (20) reached STATE_MAIN_I1.  No response (or 
no acceptable response) to our first IKE message
Feb 16 09:31:22 vpn pluto[15792]: "nw-l2tp-psk"[2] 85.182.252.146 #803: 
starting keying attempt 399 of an unlimited number
Feb 16 09:31:22 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:31:22 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:31:22 vpn pluto[15792]: "nw-l2tp-psk"[2] 85.182.252.146 #805: 
initiating Main Mode to replace #803
Feb 16 09:31:22 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:31:32 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:31:32 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:32:02 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:32:32 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:32:42 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:32:42 vpn pluto[15792]: "nw-l2tp-psk"[3] 85.182.252.146 #804: 
max number of retransmissions (20) reached STATE_MAIN_I1.  No response (or 
no acceptable response) to our first IKE message
Feb 16 09:32:42 vpn pluto[15792]: "nw-l2tp-psk"[3] 85.182.252.146 #804: 
starting keying attempt 399 of an unlimited number
Feb 16 09:32:42 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:32:42 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:32:42 vpn pluto[15792]: "nw-l2tp-psk"[3] 85.182.252.146 #806: 
initiating Main Mode to replace #804
Feb 16 09:32:52 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:33:12 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:33:12 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:33:12 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:33:52 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:34:20 vpn sshd[8072]: Accepted keyboard-interactive/pam for root 
from 192.168.229.1 port 14883 ssh2
Feb 16 09:34:32 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:34:32 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: received 
Vendor ID payload [RFC 3947] method set to=109 
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: received 
Vendor ID payload [draft-ietf-ipsec-nat-t-ike] method set to=110 
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: ignoring 
unknown Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: ignoring 
unknown Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: ignoring 
unknown Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: ignoring 
unknown Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: ignoring 
unknown Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: received 
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already 
using method 110
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: received 
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already 
using method 110
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: received 
Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already 
using method 110
Feb 16 09:34:41 vpn pluto[15792]: packet from 85.182.252.146:1: received 
Vendor ID payload [Dead Peer Detection]
Feb 16 09:34:41 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:41 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
responding to Main Mode from unknown peer 85.182.252.146
Feb 16 09:34:41 vpn pluto[15792]: | Preshared Key  6d 6f 6e 64  72 61 6c 
69  6e 21
Feb 16 09:34:41 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Feb 16 09:34:41 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
STATE_MAIN_R1: sent MR1, expecting MI2
Feb 16 09:34:41 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:41 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): peer is 
NATed
Feb 16 09:34:42 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:42 vpn pluto[15792]: | Preshared Key  6d 6f 6e 64  72 61 6c 
69  6e 21
Feb 16 09:34:42 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Feb 16 09:34:42 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
STATE_MAIN_R2: sent MR2, expecting MI3
Feb 16 09:34:42 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:42 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:42 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
Main mode peer ID is ID_IPV4_ADDR: '172.31.13.10'
Feb 16 09:34:43 vpn pluto[15792]: | Preshared Key  6d 6f 6e 64  72 61 6c 
69  6e 21
Feb 16 09:34:43 vpn pluto[15792]: | Preshared Key  6d 6f 6e 64  72 61 6c 
69  6e 21
Feb 16 09:34:43 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Feb 16 09:34:43 vpn pluto[15792]: | processing connection nw-l2tp-psk[3] 
85.182.252.146
Feb 16 09:34:43 vpn pluto[15792]: | processing connection nw-l2tp-psk[2] 
85.182.252.146
Feb 16 09:34:43 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:43 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
new NAT mapping for #807, was 85.182.252.146:1, now 85.182.252.146:4500
Feb 16 09:34:43 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY 
cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}
Feb 16 09:34:43 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:43 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Feb 16 09:34:43 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
received and ignored informational message
Feb 16 09:34:44 vpn pluto[15792]: | processing connection nw-l2tp-psk[4] 
85.182.252.146
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[4] 85.182.252.146 #807: 
the peer proposed: 87.253.184.140/32:17/1701 -> 172.31.13.10/32:17/52917
Feb 16 09:34:44 vpn pluto[15792]: | processing connection nw-l2tp-psk[5] 
85.182.252.146
Feb 16 09:34:44 vpn syslog-ng[2130]: last message repeated 2 times
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[5] 85.182.252.146 #808: 
responding to Quick Mode proposal {msgid:4f9a7cca}
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[5] 85.182.252.146 #808:  
us: 87.253.184.140<87.253.184.140>[+S=C]:17/1701---87.253.184.28
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[5] 85.182.252.146 #808: 
them: 85.182.252.146[172.31.13.10,+S=C]:17/49674===172.31.13.10/32
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[5] 85.182.252.146 #808: 
transition from state STATE_QUICK_R0 to state STATE_QUICK_R1
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[5] 85.182.252.146 #808: 
STATE_QUICK_R1: sent QR1, inbound IPsec SA installed, expecting QI2
Feb 16 09:34:44 vpn pluto[15792]: | processing connection nw-l2tp-psk[5] 
85.182.252.146
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[5] 85.182.252.146 #808: 
transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Feb 16 09:34:44 vpn pluto[15792]: "nw-l2tp-psk"[5] 85.182.252.146 #808: 
STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x0a0db4f5 
<0x7fe0482c xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=85.182.252.146:4500 
DPD=none}


after that there is silence...
thank you a lot for any comment and help!

regards,
philipp



More information about the Users mailing list