Well, I went through the microsoft howto for using PSK with L2TP/IPSec on a Win2k machine and get a 792 error. I also tried this on an XP machine and get the same thing.
My IPSec log looks like this...
pluto[27469]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
pluto[27469]: Changing to directory '/etc/ipsec.d/cacerts'
pluto[27469]: Warning: empty directory
pluto[27469]: Changing to directory '/etc/ipsec.d/crls'
pluto[27469]: Warning: empty directory
pluto[27469]: forgetting secrets
pluto[27469]: loading secrets from "/etc/ipsec.secrets"
pluto[27469]: OpenPGP certificate file '/etc/pgpcert.pgp' not found
pluto[27469]: Changing to directory '/etc/ipsec.d/cacerts'
pluto[27469]: Warning: empty directory
pluto[27469]: Changing to directory '/etc/ipsec.d/crls'
pluto[27469]: Warning: empty directory
Configuring L2TP with PSK on Windows 2000 is much more complicated than on XP (where a few mouse clicks are sufficient). I also found that Microsoft's tutorial for Windows 2000 can be misleading. If you need a better tutorial for Windows 2000, then send me an e-mail.
Now I get this in my IPSec log... pluto[27469]: packet from 4.2.176.18:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: responding to Main Mode from unknown peer 4.2.176.18 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: transition from state (null) to state STATE_MAIN_R1 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: both are NATed pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18 #3: max number of retransmissions (2) reached STATE_MAIN_R2 pluto[27469]: "S_L2TP_Connection_1"[3] 4.2.176.18: deleting connection "S_L2TP_Connection_1" instance with peer 4.2.176.18
Could it be that the corporate network i'm located at remotely is not passing protocol 50 and 51 traffic?
My software firewall on my windows2000 laptop alsow shows that there is an outbound connection from port 4500 to port 4500 (UDP) in addition to the initial port 500 UDP. I enabled port forwarding on my linksys router (between Internet and ASL) to forward 500 and 4500 traffic to the external interface of my ASL box. Now I get this in my logs.
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: sending encrypted notification INVALID_MESSAGE_ID to 4.2.176.18:27402
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x4b767e78 (perhaps this is a duplicated packet)
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: sending encrypted notification INVALID_MESSAGE_ID to 4.2.176.18:27402
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x4b767e78 (perhaps this is a duplicated packet)
pluto[27469]: "S_L2TP_Connection_1"[7] 4.2.176.18:27402 #8: sending encrypted notification INVALID_MESSAGE_ID to 4.2.176.18:27402
OK, some progress. I changed the Windows Filter settings to use MD5/3DES instead of MD5/DES which it set to by default. I connect just fine. Now. Here's the thing. When I disconnect, I loose the ability to connect through the ASL box to the internet. Other machines can still get out. If I change my IP, I can get out too. If I change it back to the IP it was while using L2TP/IPSEC I still can't get out. After a few minutes I can but for a solid 5 minutes or so I can't get anywhere.
Yeah, probably what happened is in the network options for your vpn, you set it to automatically get an IP address. You might have to leave this setting be, and just release and renew your IP address when you finish with it. If you're lucky, you might be able to set it up with a static IP address, but it also depends on your office's policies about that sort of thing.
Yeah, probably what happened is in the network options for your vpn, you set it to automatically get an IP address. You might have to leave this setting be, and just release and renew your IP address when you finish with it. If you're lucky, you might be able to set it up with a static IP address, but it also depends on your office's policies about that sort of thing.
