ich versuche seit gestern ein VPN einzurichten und das über l2tp over ipsec. doch bisher scheitere ich und es ist mir unmöglich eine komplette anleitung im internet zu finden. ich habe mich schon stundenlang durchs forum gesucht aber es hat alles nichts geholfen.
ich werd euch einfach mal meine einstellungen schreiben und dann könnt ihr mir hoffentlich sagen was ich falsch mache.
l2tp over Ipsec:
Interface: External
Authetication: Preshared Key
assign IP addresses by: ip address pool
pool network: VPN Pool (L2TP)
authetiaction via : Local
Users and Groups:
Vpnmembers
der preshared key erfüllt zu testzwecken hoffentlich die anforderungen: thisismykey. der ip pool ist entweder der hier genannte ip pool, habe es aber auch schon mit einem eigenen versucht der dann die internen IP's vergibt (192.168.30.0)
un in vpnmembers ist halt der user vpn drin
bei dem schauts so aus:
authetication: local
pw***....
certificat: user cert
und kein kreuz bei use static IP
wenn ich jetzt versuche mich in das vpn einzuloggen, bekomme ich das hier als log:
asg pluto[7857]: packet from 89.204.154.161:3678: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000005]
2011:02:15-10:26:33 asg pluto[7857]: packet from 89.204.154.161:3678: received Vendor ID payload [RFC 3947]
2011:02:15-10:26:33 asg pluto[7857]: packet from 89.204.154.161:3678: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2011:02:15-10:26:33 asg pluto[7857]: packet from 89.204.154.161:3678: ignoring Vendor ID payload [FRAGMENTATION]
2011:02:15-10:26:33 asg pluto[7857]: packet from 89.204.154.161:3678: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
2011:02:15-10:26:33 asg pluto[7857]: packet from 89.204.154.161:3678: ignoring Vendor ID payload [Vid-Initial-Contact]
2011:02:15-10:26:33 asg pluto[7857]: packet from 89.204.154.161:3678: ignoring Vendor ID payload [IKE CGA version 1]
2011:02:15-10:26:33 asg pluto[7857]: "S_REF_oYptpPQvDc"[9] 89.204.154.161:3678 #9: responding to Main Mode from unknown peer 89.204.154.161:3678
2011:02:15-10:26:33 asg pluto[7857]: "S_REF_oYptpPQvDc"[9] 89.204.154.161:3678 #9: ECP_384 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
2011:02:15-10:26:33 asg pluto[7857]: "S_REF_oYptpPQvDc"[9] 89.204.154.161:3678 #9: ECP_256 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
2011:02:15-10:26:34 asg pluto[7857]: "S_REF_oYptpPQvDc"[9] 89.204.154.161:3678 #9: NAT-Traversal: Result using RFC 3947: both are NATed
2011:02:15-10:26:34 asg pluto[7857]: "S_REF_oYptpPQvDc"[9] 89.204.154.161:3678 #9: Peer ID is ID_IPV4_ADDR: '10.141.86.161'
2011:02:15-10:26:34 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:3678 #9: deleting connection "S_REF_oYptpPQvDc" instance with peer 89.204.154.161 {isakmp=#0/ipsec=#0}
2011:02:15-10:26:34 asg pluto[7857]: | NAT-T: new mapping 89.204.154.161:3678/29568)
2011:02:15-10:26:34 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sent MR3, ISAKMP SA established
2011:02:15-10:26:36 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: retransmitting in response to duplicate packet; already STATE_MAIN_R3
2011:02:15-10:26:36 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: cannot respond to IPsec SA request because no connection is known for 62.*.*.*/32===192.168.35.11:4500[192.168.35.11]:17/1701...89.204.154.161:29568[10.141.86.161]:17/%any==={10.141.86.161/32}
2011:02:15-10:26:36 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sending encrypted notification INVALID_ID_INFORMATION to 89.204.154.161:29568
2011:02:15-10:26:38 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2011:02:15-10:26:38 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sending encrypted notification INVALID_MESSAGE_ID to 89.204.154.161:29568
2011:02:15-10:26:42 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2011:02:15-10:26:42 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sending encrypted notification INVALID_MESSAGE_ID to 89.204.154.161:29568
2011:02:15-10:26:46 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2011:02:15-10:26:46 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sending encrypted notification INVALID_MESSAGE_ID to 89.204.154.161:29568
2011:02:15-10:26:54 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2011:02:15-10:26:54 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sending encrypted notification INVALID_MESSAGE_ID to 89.204.154.161:29568
2011:02:15-10:27:10 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2011:02:15-10:27:10 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sending encrypted notification INVALID_MESSAGE_ID to 89.204.154.161:29568
2011:02:15-10:27:27 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2011:02:15-10:27:27 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: sending encrypted notification INVALID_MESSAGE_ID to 89.204.154.161:29568
2011:02:15-10:27:38 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568 #9: received Delete SA payload: deleting ISAKMP State #9
2011:02:15-10:27:38 asg pluto[7857]: "S_REF_oYptpPQvDc"[10] 89.204.154.161:29568: deleting connection "S_REF_oYptpPQvDc" instance with peer 89.204.154.161 {isakmp=#0/ipsec=#0}
ich hoffe ihr könnt daraus mehr schlau werden als ich. was mich daran stört ist der part mit dem unknown connection. ich hab es auch schon mit static remote ip versucht. selbes ergebnis =(
ich hab mir erlaubt die statische ip der firewall zu maskieren
es is übrigends dringend.. ich hock auffer arbeit und komm ned weiter damit. habe es nach dem pdf hier versucht und genau das selbe. https://support.astaro.com/support/images/0/00/Remote_Access_Guide-L2TP_over_IPsec-v1.001-EN.pdf
This thread was automatically locked due to age.
