Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 8 replies
  • Answers 1 answer
  • Subscribers 27 subscribers
  • Views 28419 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

xl2tpd is not listen on the system

Behzad Azarmehr

Hi

I recently buy a sophos xg 230. It's OS version is 16.01.1

I configure L2TP service.

- Enable L2TP - checked

  - Define a range

  - define dns

and so on....

but the l2tp is not start correctly.
i try to trouble shoot and I login in advanced shell. i review the log and I see this messages :


XG230_SFOS 16.01.1# tail -f /log/l2tpd.log
xl2tpd[14158]: Listening on IP address 0.0.0.0, port 1701
xl2tpd[14158]: death_handler: Fatal signal 15 received
xl2tpd[14259]: setsockopt recvref[22]: Protocol not available
xl2tpd[14259]: This binary does not support kernel L2TP.
xl2tpd[14259]: xl2tpd version xl2tpd-1.2.4 started on localhost PID:14259
xl2tpd[14259]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[14259]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[14259]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[14259]: Forked again by Xelerance (www.xelerance.com) (C) 2006
xl2tpd[14259]: Listening on IP address 0.0.0.0, port 1701


and when i use netstat command, i found the xl2tpd is not listen on 1701.

my firewall rule for vpn like this :

how can i solve this problem ?

is it a bug ? how can i fix it ?



This thread was automatically locked due to age.
Parents
  • 0

    Behzad,

    did you try to retart the VPN service using the console > Option 6 > Option 2?

    Can you check if the l2tpd service is running using this command?

    service -S from the CLI > Option 5 > Option 3.

    Thanks

  • 0 in reply to lferrara

    Dear 

    I several restart the VPN service. my pptp vpn service is work like charm but the l2tp service or better say xl2tpd is not start correctly.

    it say the service is running. I check this by service command:

     

    XG230_WP01_SFOS 16.01.1# service -S
    lcdd RUNNING
    postgres RUNNING
    sigdb RUNNING
    reportdb RUNNING
    crreport UNREGISTERED
    awarrensmtp UNREGISTERED
    awarrenmta RUNNING
    nasm RUNNING
    ntpclient RUNNING
    garner RUNNING
    skein RUNNING
    awarrenhttp RUNNING
    WINGc RUNNING
    warren RUNNING
    ftpproxy RUNNING
    improxy RUNNING
    ctipd RUNNING
    antispam RUNNING
    ips RUNNING
    ripd RUNNING
    ospfd RUNNING
    bgpd RUNNING
    zebra RUNNING
    dgd RUNNING
    dhcpd RUNNING
    dhcpd6 UNREGISTERED
    ipsec RUNNING
    ddc RUNNING
    networkd RUNNING
    dyniface UNTOUCHED
    gateway RUNNING
    tomcat RUNNING
    apache RUNNING
    antivirus RUNNING
    dnsd RUNNING
    sslvpn UNREGISTERED
    clientless_acce RUNNING
    smbnetfs RUNNING
    pptpd RUNNING
    l2tpd RUNNING
    mrouting UNREGISTERED
    pimd UNREGISTERED
    msync UNTOUCHED
    WAF UNREGISTERED
    red_client UNTOUCHED
    red UNREGISTERED
    supportaccess UNTOUCHED
    heartbeat UNREGISTERED
    hwmon UNREGISTERED
    access_server RUNNING
    bwm RUNNING
    fwm UNTOUCHED
    radvd UNREGISTERED
    fqdnd UNREGISTERED
    fwlog RUNNING
    pktcapd RUNNING
    wifiauth UNTOUCHED
    hostapd UNTOUCHED
    mdev UNREGISTERED
    awed RUNNING
    hotspotd RUNNING
    policyroute RUNNING
    cfs RUNNING
    listener RUNNING
    timer RUNNING
    shm RUNNING
    dbh RUNNING

     

    as you see the output of this command, it say l2tp is Runnig. even i check the process by ps and it say:

     

    and the output of netstat is nothing :

    XG230_WP01_SFOS 16.01.1# netstat -ntpa | grep -i 1701
    XG230_WP01_SFOS 16.01.1#

     

    Is there any way to export config of section "VPN service" ?

  • 0 in reply to Behzad Azarmehr

    Behzad,

    your netstat does not produce any output even on my XG.

    Try this:

    netstat -lnptu | grep 1701

    Also if you try to connect to your XG from external network, a telnet on that port does it work?

    Thanks

  • 0 in reply to lferrara

    You are right. that is my mistake on mis-understanding about L2TP.

    l2tp is on udp. right? so it's not list on tcp connections.

    • For PPTP:
      • IP Protocol=TCP, TCP Port number=1723   <- Used by PPTP control path
      • IP Protocol=GRE (value 47)   <- Used by PPTP data path
    • For L2TP:
      • IP Protocol Type=UDP, UDP Port Number=500    <- Used by IKEv1 (IPSec control path)
      • IP Protocol Type=UDP, UDP Port Number=4500   <- Used by IKEv1 (IPSec control path)
      • IP Protocol Type=ESP (value 50)   <- Used by IPSec data path

     

    XG230_WP01_SFOS 16.01.1# netstat -ntpa | grep -i 1723
    tcp    0    0    0.0.0.0:1723    0.0.0.0:*    LISTEN    3220/pptpd
    XG230_WP01_SFOS 16.01.1#

     

    XG230_WP01_SFOS 16.01.1# netstat -lnptu | grep 1701
    udp    0     0 0.0.0.0:1701     0.0.0.0:*     31963/l2tpd
    XG230_WP01_SFOS 16.01.1#

     

    I can't telnet to this port, becasue it is udp and telnet just support tcp port. I check this From WAN by Netcat. It say the port is open :|

    nc.exe -vu x.x.x.x 1701
    x.x.x.x: inverse host lookup failed: h_errno 11004: NO_DATA
    (UNKNOWN) [x.x.x.x] 1701 (l2tp) open

    can you explain to my, how can  i enable debug in xl2tpd? and if it is enable where it save the debug logs.

    i see it config file option but there is not a place for save log.

    i know it save a some of log in /log/l2tp.log but there is not enough for me.

     

  • 0 in reply to Behzad Azarmehr

    Behzad,

    my mistake. You are right, L2TP uses UDP ports and telnet will not simply work (a really big mistake, sorry about that).

    Enabling debugging on L2TP service does not work as expected:

    service l2tpd:debug -dsnosync

    400 Bad Request

    Send me a PM and I will have a look at it.

    Regards,

Reply
  • 0 in reply to Behzad Azarmehr

    Behzad,

    my mistake. You are right, L2TP uses UDP ports and telnet will not simply work (a really big mistake, sorry about that).

    Enabling debugging on L2TP service does not work as expected:

    service l2tpd:debug -dsnosync

    400 Bad Request

    Send me a PM and I will have a look at it.

    Regards,

Children