<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi folks,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have successfully got an IPSec/L2TP server running under Debian 6 using OpenSwan and xl2tpd. My clients are a mixture of Windows 7 (for testing) and Draytek Vigor 2830 routers (for the production environment). Using a LOT of Googling I’ve got the clients connecting successfully and all is almost well.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Once Openswan (pluto?) has negotiated the IPSec SA it hands control to xl2tpd, that much I understand. Here’s an output of my logs for this stage in the proceedings. This is running on my test LAN so no Internet, NAT or anything else in the way between the client and server.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'>Apr 3 09:21:41 tatia pluto[2977]: "TEST-L2TP-PSK"[1] 172.16.1.6 #2: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2 <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'>Apr 3 09:21:41 tatia pluto[2977]: "TEST-L2TP-PSK"[1] 172.16.1.6 #2: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x31848fd9 <0x3d72c06a xfrm=AES_128-HMAC_SHA1 NATOA=none NATD=none DPD=none} <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'>Apr 3 09:21:43 tatia xl2tpd[1089]: control_finish: Peer requested tunnel 10 twice, ignoring second one.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'>Apr 3 09:21:43 tatia xl2tpd[1089]: Connection established to 172.16.1.6, 1701. Local: 7144, Remote: 10 (ref=0/0). LNS session is 'default'<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Courier New"'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>That’s all fine – xl2tpd takes over the connection and later a ppp link is established correctly. But here's the thing, there is a 2 second delay in there. You can see in the timestamps the last output from pluto is 09:21:41 and the first output from xl2tpd is 09:21:43. This “stall” period is reliably 2 seconds and happens every time I connect with both Windows and Draytek clients. If it was just a delay I wouldn’t worry about it, but during this time no traffic passes through the L2TP/IPSec server. Packets do eventually come through once the stall passes leading to some long ping delays, but the main problem is I’m intending to pass SIP traffic over this link and a 2s delay will rather inconvenience those in phonecalls at the time.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I have tried three different Debian VMs on two different ESXi hypervisors. I have tried the Debian stable packages of OpenSwan and xl2tpd, and also tried compiling them from source (currently settled on the compiled versions to get the latest bugfixes). Even turning all the debug log output on that I can find, nothing has yet given me a clue as to what’s causing the delay.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Has anyone seen this before? What’s happening during this “stall” period; which daemon is likely to be the troublemaker? So far Google has been unable to help me in this respect.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any advice welcomed,<o:p></o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal>Giles.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>