Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 11670 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Problem connecting to L2TP VPN from Android

SimonVincent

I am trying to connect to a Sophos XG L2TP VPN from an android device however the VPN will not connect. I have connected to the sophos console and run the command show vpn L2TP-logs which results in the following:

Jun 30 20:21:07 packet from 149.254.56.18:887: received Vendor ID payload [RFC 3947] method set to=1
10                                                                                                  
Jun 30 20:21:07 packet from 149.254.56.18:887: received Vendor ID payload [draft-ietf-ipsec-nat-t-ik
e-02] meth=107, but already using method 110                                                        
Jun 30 20:21:07 packet from 149.254.56.18:887: received Vendor ID payload [draft-ietf-ipsec-nat-t-ik
e-02_n] meth=106, but already using method 110                                                      
Jun 30 20:21:07 packet from 149.254.56.18:887: received Vendor ID payload [draft-ietf-ipsec-nat-t-ik
e-00]                                                                                               
Jun 30 20:21:07 packet from 149.254.56.18:887: ignoring Vendor ID payload [FRAGMENTATION 80000000]  
Jun 30 20:21:07 packet from 149.254.56.18:887: received Vendor ID payload [Dead Peer Detection]     
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: responding to Main Mode from unknown peer 149.254.56
.18                                                                                                 
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: Oakley Transform [OAKLEY_AES_CBC (256), OAKLEY_SHA2_
256, OAKLEY_GROUP_MODP1024] refused due to strict flag                                              
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: Oakley Transform [OAKLEY_AES_CBC (256), OAKLEY_SHA1,
 OAKLEY_GROUP_MODP1024] refused due to strict flag                                                  
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: Oakley Transform [OAKLEY_AES_CBC (256), OAKLEY_MD5, 
OAKLEY_GROUP_MODP1024] refused due to strict flag                                                   
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: Oakley Transform [OAKLEY_AES_CBC (128), OAKLEY_SHA2_
256, OAKLEY_GROUP_MODP1024] refused due to strict flag                                              
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: Oakley Transform [OAKLEY_AES_CBC (128), OAKLEY_SHA1,
 OAKLEY_GROUP_MODP1024] refused due to strict flag                                                  
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: transition from state STATE_MAIN_R0 to state STATE_M
AIN_R1                                                                                              
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: STATE_MAIN_R1: sent MR1, expecting MI2              
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: NAT-Traversal: Result using RFC 3947 (NAT-Traversal)
: both are NATed                                                                                    
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: transition from state STATE_MAIN_R1 to state STATE_M
AIN_R2                                                                                              
Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: STATE_MAIN_R2: sent MR2, expecting MI3              
                                                                                                    
Jun 30 20:22:17 "l2tp_vpn"[7] 149.254.56.18 #8: max number of retransmissions (2) reached STATE_MAIN
_R2                                                                                                 
Jun 30 20:22:17 "l2tp_vpn"[7] 149.254.56.18: deleting connection "l2tp_vpn" instance with peer 149.2
54.56.18 {isakmp=#0/ipsec=#0}



Any idea what is going on?


This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    What policy is configured for L2TP tunnel? Also, verify the setting on the mobile device.

    Thanks

  • 0 in reply to sachingurung

    I am using the DefaultL2TP policy on the firewall. 

    I am using the built in VPN on Android set to L2TP/IPSec PSK I am not sure what options I can change as there are very few.

    Regards

    Simon

  • 0 in reply to SimonVincent

    Hi Simon,

    Can you verify if the IPSec policy used for L2TP connection is the DefaultL2TP policy? As the default policy uses SHA1 authentication algorithm over IPSec. What I see in the logs-

    Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: Oakley Transform [OAKLEY_AES_CBC (256), OAKLEY_SHA2_256, OAKLEY_GROUP_MODP1024] refused due to strict flag.

    There is a known bug NC-976, which does not allow L2TP over IPSec on XG with SHA256.

    I suggest you to configure a custom IPSec policy with authentication algorithm as SHA1 or MD5. Please try to connect over L2TP using both permutations in IPSec policy.

    Thanks

Reply
  • 0 in reply to SimonVincent

    Hi Simon,

    Can you verify if the IPSec policy used for L2TP connection is the DefaultL2TP policy? As the default policy uses SHA1 authentication algorithm over IPSec. What I see in the logs-

    Jun 30 20:21:07 "l2tp_vpn"[7] 149.254.56.18 #8: Oakley Transform [OAKLEY_AES_CBC (256), OAKLEY_SHA2_256, OAKLEY_GROUP_MODP1024] refused due to strict flag.

    There is a known bug NC-976, which does not allow L2TP over IPSec on XG with SHA256.

    I suggest you to configure a custom IPSec policy with authentication algorithm as SHA1 or MD5. Please try to connect over L2TP using both permutations in IPSec policy.

    Thanks

Children
No Data