[Openswan Users] VPN L2TP/IPSec fails in securing the tunnel

Bruno de Paula Larini bruno.larini at riosoft.com.br
Tue Jul 12 18:12:16 EDT 2011


Hello everyone.
I'm trying to allow a non-openswan client to connect on my server which 
is running RHEL6.1, openswan and l2tpns. On tests using openswan as 
IPSec client, the authentication succeds. L2TP tunnel too can be 
established without IPSec. I've already checked firewall rules.
I 'think' that the client is using some sort of Cisco based IPSec and is 
using 3des-sha1 (sorry, no more info about it). All I have is the server 
side config and the logs:

 >> /etc/ipsec.conf

version 2.0
config setup
         # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
         protostack=netkey
         nat_traversal=yes
         virtual_private=
         oe=off

include /etc/ipsec.d/*.conf
--------------------

 >> /etc/ipsec.d/vpn.conf

conn L2TP-PSK
         authby=secret
         pfs=no
         rekey=no
         keyingtries=3
         left=aa.bb.cc.dd
         ike=3des-sha1
         leftprotoport=17/1701
         right=%any
         rightprotoport=17/1701
         rightid=%any
         auto=add
--------------------

 >> /etc/ipsec.d/vpn.secrets
aa.bb.cc.dd %any: PSK "mysecret"
--------------------

 >> Logs from /var/log/secure

Jul 12 18:49:28 myserver pluto[13712]: packet from ww.xx.yy.zz:500: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] method set to=108
Jul 12 18:49:28 myserver pluto[13712]: packet from ww.xx.yy.zz:500: 
received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, 
but already using method 108
Jul 12 18:49:28 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
responding to Main Mode from unknown peer ww.xx.yy.zz
Jul 12 18:49:28 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Jul 12 18:49:28 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
STATE_MAIN_R1: sent MR1, expecting MI2
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
received Vendor ID payload [Cisco-Unity]
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
received Vendor ID payload [Dead Peer Detection]
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
ignoring unknown Vendor ID payload [646dd7727d14cf644891351b8c5293b1]
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
received Vendor ID payload [XAUTH]
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: no NAT 
detected
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
STATE_MAIN_R2: sent MR2, expecting MI3
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
Main mode peer ID is ID_IPV4_ADDR: 'ww.xx.yy.zz'
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Jul 12 18:49:29 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
STATE_MAIN_R3: sent MR3, ISAKMP SA established 
{auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 
group=modp1024}
Jul 12 18:49:30 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
the peer proposed: aa.bb.cc.dd/32:17/1701 -> ss.tt.uu.vv/29:17/1701
Jul 12 18:49:30 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
cannot respond to IPsec SA request because no connection is known for 
aa.bb.cc.dd<aa.bb.cc.dd>[+S=C]...ww.xx.yy.zz[+S=C]===ss.tt.uu.vv/29
Jul 12 18:49:30 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
sending encrypted notification INVALID_ID_INFORMATION to ww.xx.yy.zz:500
Jul 12 18:49:30 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz #18: 
received Delete SA payload: deleting ISAKMP State #18
Jul 12 18:49:30 myserver pluto[13712]: "L2TP-PSK"[18] ww.xx.yy.zz: 
deleting connection "L2TP-PSK" instance with peer ww.xx.yy.zz 
{isakmp=#0/ipsec=#0}
Jul 12 18:49:30 myserver pluto[13712]: packet from ww.xx.yy.zz:500: 
received and ignored informational message


It stops right before establishing the secure connection. Am I doing 
something wrong?
Thanks in advance for any help!


More information about the Users mailing list