Hey all,
Much to my delight I recently got L2TP working with my firewall and my laptops (posting with it right now). The only problem is that it only works when using the Microsoft L2TP over IPSec and PSK authentication. But when I try Roadwarrior / MS_DEFAULT / X509 certs it always fails with a malformed packet error. Take a look.
2006:11:28-18:46:42 (none) pluto[24856]: packet from ***.***.***.***:56429: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
2006:11:28-18:46:42 (none) pluto[24856]: packet from ***.***.***.***:56429: ignoring Vendor ID payload [FRAGMENTATION]
2006:11:28-18:46:42 (none) pluto[24856]: packet from ***.***.***.***:56429: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
2006:11:28-18:46:42 (none) pluto[24856]: packet from ***.***.***.***:56429: ignoring Vendor ID payload [Vid-Initial-Contact]
2006:11:28-18:46:42 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: responding to Main Mode from unknown peer ***.***.***.***
2006:11:28-18:46:42 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
2006:11:28-18:46:42 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: STATE_MAIN_R1: sent MR1, expecting MI2
2006:11:28-18:46:42 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike-02/03: peer is NATed
2006:11:28-18:46:42 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
2006:11:28-18:46:42 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: STATE_MAIN_R2: sent MR2, expecting MI3
2006:11:28-18:47:46 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: next payload type of ISAKMP Hash Payload has an unknown value: 69
2006:11:28-18:47:46 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: malformed payload in packet
2006:11:28-18:47:46 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: sending notification PAYLOAD_malformED to ***.***.***.***:56429
2006:11:28-18:47:52 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.*** #2: max number of retransmissions (2) reached STATE_MAIN_R2
2006:11:28-18:47:52 (none) pluto[24856]: "S_Astaro_1"[2] ***.***.***.***: deleting connection "S_Astaro_1" instance with peer ***.***.***.*** {isakmp=#0/ipsec=#0}
2006:11:28-18:48:20 (none) pluto[24856]: packet from ***.***.***.***:56429: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
2006:11:28-18:48:20 (none) pluto[24856]: packet from ***.***.***.***:56429: ignoring Vendor ID payload [FRAGMENTATION]
2006:11:28-18:48:20 (none) pluto[24856]: packet from ***.***.***.***:56429: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
2006:11:28-18:48:20 (none) pluto[24856]: packet from ***.***.***.***:56429: ignoring Vendor ID payload [Vid-Initial-Contact]
How do I fix this? I created the certs according the guide in the KB using X500 DNs and I followed all of the instructions to the dot.
What am I doing wrong here? What is going on?
Aodhan
EDIT: Do I need to have both the Signing Authority and Client cert imported?
This thread was automatically locked due to age.
