[7.950][FEATURE][CLOSED] L2TP/IPSEC PSK works only with MSCHAPV2

I tested this on my windows box, L2TP over IPSEC works only if MSCHAPv2 is used, plain CHAP does not work.

This means that I can't remote VPN from my android 2.1 phone, because that only does plain CHAP.


2010:06:17-23:38:39 astaro pluto[6730]: packet from :500: received Vendor ID payload [RFC 3947]

2010:06:17-23:38:39 astaro pluto[6730]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]

2010:06:17-23:38:39 astaro pluto[6730]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]

2010:06:17-23:38:39 astaro pluto[6730]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]

2010:06:17-23:38:39 astaro pluto[6730]: packet from :500: ignoring Vendor ID payload [FRAGMENTATION 80000000]

2010:06:17-23:38:39 astaro pluto[6730]: "S_REF_sOlfDJbuIG"[1]  #23: responding to Main Mode from unknown peer 

2010:06:17-23:38:39 astaro pluto[6730]: "S_REF_sOlfDJbuIG"[1]  #23: NAT-Traversal: Result using RFC 3947: no NAT detected

2010:06:17-23:38:39 astaro pluto[6730]: "S_REF_sOlfDJbuIG"[1]  #23: Peer ID is ID_IPV4_ADDR: ''

2010:06:17-23:38:39 astaro pluto[6730]: "S_REF_sOlfDJbuIG"[1]  #23: sent MR3, ISAKMP SA established

2010:06:17-23:38:39 astaro pluto[6730]: "S_REF_sOlfDJbuIG"[1]  #23: ignoring informational payload, type IPSEC_INITIAL_CONTACT

2010:06:17-23:38:40 astaro pluto[6730]: "S_REF_sOlfDJbuIG"[1]  #24: responding to Quick Mode

2010:06:17-23:38:41 astaro pluto[6730]: "S_REF_sOlfDJbuIG"[1]  #24: IPsec SA established {ESP=>0x0bde2936 

2010:06:17-23:38:42 astaro pppd-l2tp[10170]: Overriding mtu 1500 to 1380

2010:06:17-23:38:42 astaro pppd-l2tp[10170]: PPPoL2TP options: lnsmode tid 34505 sid 29304 debugmask 0

2010:06:17-23:38:42 astaro pppd-l2tp[10170]: Overriding mru 1500 to mtu value 1380

2010:06:17-23:38:42 astaro pppd-l2tp[10170]: sent [LCP ConfReq id=0x1    ]

2010:06:17-23:38:43 astaro pppd-l2tp[10170]: rcvd [LCP ConfReq id=0x1     ]

2010:06:17-23:38:43 astaro pppd-l2tp[10170]: sent [LCP ConfAck id=0x1     ]

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: sent [LCP ConfReq id=0x1    ]

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: rcvd [LCP ConfNak id=0x1 ]

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: sent [LCP ConfReq id=0x2    ]

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: rcvd [LCP ConfAck id=0x2    ]

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: Overriding mtu 1400 to 1380

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: PPPoL2TP options: lnsmode tid 34505 sid 29304 debugmask 0

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: sent [CHAP Challenge id=0x85 , name = ""]

2010:06:17-23:38:45 astaro pppd-l2tp[10170]: rcvd [CHAP Response id=0x85 , name = ""]

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: Peer  failed CHAP authentication

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: sent [CHAP Failure id=0x85 "E=691 R=1 C=3406c28caf75776a68c4c2ecf5148e70a2490b V=0 M=Access denied"]

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: Overriding mtu 1500 to 1380

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: PPPoL2TP options: lnsmode tid 34505 sid 29304 debugmask 0

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: Overriding mru 1500 to mtu value 1380

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: sent [LCP TermReq id=0x3 "Authentication failed"]

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: rcvd [LCP TermReq id=0x2 "Failed to authenticate ourselves to peer"]

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: sent [LCP TermAck id=0x2]

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: rcvd [LCP TermAck id=0x3]

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: Connection terminated.

2010:06:17-23:38:47 astaro pppd-l2tp[10170]: Exit.

0 Astaro Beta Bot over 14 years ago

Astaro Beta Report
--------------------------------
Version: 7.950
Type: FEATURE
State: CLOSED
Reporter: barkas+
Contributor: 
MantisID: 
Target version: 
Fixed in version: 
--------------------------------

0 kbr over 14 years ago

I'm not sure, but this looks like an issue that has to be fixed on the android side.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 barkas over 14 years ago in reply to kbr

I'm not sure, but this looks like an issue that has to be fixed on the android side.

Not necessarily. The feature request that you referenced isn't even about the same thing at all.

It could probably easily be fixed on the astaro side by enabling plain CHAP. The question to be asked here is "does astaro want to support android", not the other way around. We have only very limited means to influence google.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 14 years ago in reply to barkas

The feature request that you referenced isn't even about the same thing at all.

Well, it's just one lost entry linked via comment 29, pointing to id 4111.

..."does astaro want to support android"...

At least there are a couple of developers owning android phones already. This makes things easier ;-)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PaulMeredith over 14 years ago in reply to kbr

I am running into this same problem even in production 7.505.

Can we work around this by using a radius server for auth as the help file says will use plain CHAP?

First broken PPTP client in 2.1 and now cannot use the L2TP client!

Frustrating.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 14 years ago

barkas, drake3:
i've talked to the developer who would have to implement this. He likes the idea of offering plain CHAP with L2TP/IPSec, but he askes you to also file a feature request at the feature portal.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ma10wong over 14 years ago in reply to kbr

I've got an Android phone... I'll vote for it if OP wants to post it as a feature request.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PaulMeredith over 14 years ago in reply to ma10wong

Vote for feature here:

implement standard CHAP authentication for L2TP over ipsec using local users
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 ma10wong over 14 years ago

I've voted! [:D]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 PaulMeredith over 14 years ago in reply to ma10wong

Just a followup - I started running freeradius on an adjacent OpenSuse box. The radius authentication works fine and allows for CHAP auth from the Android phone. I was able to log into my 7.505 through l2tp over ipsec just fine.

freeradius is easy and quick to setup. No SQL needed, can use quick and dirty flat files.

Hope this helps other android users.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[7.950][FEATURE][CLOSED] L2TP/IPSEC PSK works only with MSCHAPV2

Submitted a Tech Support Case lately from the Support Portal?