There is a slight mistake in the howto, plz uncheck the checkbox 'Require Data encryption (disconnect if none)'.
This is somehow misleading, this option is linked to the L2TP connection and the L2TP tunnel inside the IPSec tunnel is not encrypted. Therefore you need to disable it.
You dont have a drawback in security as IPSec has the stronger encryption anyway.
Well, I went through the microsoft howto for using PSK with L2TP/IPSec on a Win2k machine and get a 792 error. I also tried this on an XP machine and get the same thing.
My IPSec log looks like this...
pluto[27469]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
pluto[27469]: Changing to directory '/etc/ipsec.d/cacerts'
pluto[27469]: Warning: empty directory
pluto[27469]: Changing to directory '/etc/ipsec.d/crls'
pluto[27469]: Warning: empty directory
pluto[27469]: forgetting secrets
pluto[27469]: loading secrets from "/etc/ipsec.secrets"
pluto[27469]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
pluto[27469]: Changing to directory '/etc/ipsec.d/cacerts'
pluto[27469]: Warning: empty directory
pluto[27469]: Changing to directory '/etc/ipsec.d/crls'
pluto[27469]: Warning: empty directory
Configuring L2TP with PSK on Windows 2000 is much more complicated than on XP (where a few mouse clicks are sufficient). I also found that Microsoft's tutorial for Windows 2000 can be misleading. If you need a better tutorial for Windows 2000, then send me an e-mail.
Now I get this in my IPSec log... pluto[27469]: packet from 4.2.176.18:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: responding to Main Mode from unknown peer 4.2.176.18 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: transition from state (null) to state STATE_MAIN_R1 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: max number of retransmissions (2) reached STATE_MAIN_R2 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18: deleting connection "S_L2TP_Connection_1" instance with peer 4.2.176.18
Could it be that the corporate network i'm located at remotely is not passing protocol 50 and 51 traffic?
My software firewall on my windows2000 laptop alsow shows that there is an outbound connection from port 4500 to port 4500 (UDP) in addition to the initial port 500 UDP. I enabled port forwarding on my linksys router (between Internet and ASL) to forward 500 and 4500 traffic to the external interface of my ASL box. Now I get this in my logs.
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: sending encrypted notification INVALID_MESSAGE_ID to 4.2.176.18:27402
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x4b767e78 (perhaps this is a duplicated packet)
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: sending encrypted notification INVALID_MESSAGE_ID to 4.2.176.18:27402
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x4b767e78 (perhaps this is a duplicated packet)
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: sending encrypted notification INVALID_MESSAGE_ID to 4.2.176.18:27402
