This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN no longer working L2PT over IPSec with iPhone

I am unable to get VPN working on an iphone here (works fine on another one).

The iPhone gives up with:

Could not negotiate a connection with the remote PPP server. Please verify your settings and try again.

and the IPSec VPN logs say:

2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: received Vendor ID payload [RFC 3947]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2008:10:14-09:40:43 (none) pluto[32598]: packet from 120.16.82.160:500: received Vendor ID payload [Dead Peer Detection]
2008:10:14-09:40:43 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #91: responding to Main Mode from unknown peer 120.16.82.160
2008:10:14-09:40:44 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #91: NAT-Traversal: Result using RFC 3947: no NAT detected
2008:10:14-09:40:45 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #91: Peer ID is ID_IPV4_ADDR: '120.16.82.160'
2008:10:14-09:40:45 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #91: sent MR3, ISAKMP SA established
2008:10:14-09:40:46 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #91: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2008:10:14-09:40:47 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #92: responding to Quick Mode
2008:10:14-09:40:48 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #92: Dead Peer Detection (RFC 3706) enabled
2008:10:14-09:40:48 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[4] 120.16.82.160 #92: IPsec SA established {ESP=>0x034218ae

This thread was automatically locked due to age.

Parents

0 BAlfson over 17 years ago

Have you tried deleting and reinstalling the VPN on the iPhone?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 jlbrown over 17 years ago in reply to BAlfson

On your suggestions I deleted the VPN and recreated it on the iPhone.

Still doesn't work. :-(
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 17 years ago in reply to jlbrown

And you can VPN from a regular PC?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 jlbrown over 17 years ago in reply to BAlfson

No, that's why I thought I'd set the user up with his iPhone, as I have had success setting up the VPN on my iPhone.

But even if I use my settings on his phone it doesn't work.

The logs say:

0:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: received Vendor ID payload [RFC 3947]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2008:10:15-09:36:27 (none) pluto[32598]: packet from 120.17.27.163:500: received Vendor ID payload [Dead Peer Detection]
2008:10:15-09:36:27 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_1"[14] 120.17.27.163 #180: responding to Main Mode from unknown peer 120.17.27.163
2008:10:15-09:36:28 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_1"[14] 120.17.27.163 #180: NAT-Traversal: Result using RFC 3947: no NAT detected
2008:10:15-09:36:29 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_1"[14] 120.17.27.163 #180: Peer ID is ID_IPV4_ADDR: '120.17.27.163'
2008:10:15-09:36:29 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_1"[14] 120.17.27.163 #180: sent MR3, ISAKMP SA established
2008:10:15-09:36:29 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_1"[14] 120.17.27.163 #180: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2008:10:15-09:36:30 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[11] 120.17.27.163 #181: responding to Quick Mode
2008:10:15-09:36:31 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[11] 120.17.27.163 #181: Dead Peer Detection (RFC 3706) enabled
2008:10:15-09:36:31 (none) pluto[32598]: "D_REF_ZsaEIHMFYo_0"[11] 120.17.27.163 #181: IPsec SA established {ESP=>0x05989bbe /dev/pts/0
2008:10:15-09:36:36 (none) xl2tpd[32607]: check_control: Received out of order control packet on tunnel 25 (got 3, expected 4)
2008:10:15-09:36:36 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:36:46 (none) pppd-l2tp[12680]: LCP terminated by peer (No network protocols running)
2008:10:15-09:36:47 (none) xl2tpd[32607]: result_code_avp: result code out of range (768 0 14). Ignoring.
2008:10:15-09:36:47 (none) xl2tpd[32607]: control_finish: Peer tried to disconnect without specifying result code.
2008:10:15-09:36:47 (none) xl2tpd[32607]: result_code_avp: result code out of range (256 0 14). Ignoring.
2008:10:15-09:36:47 (none) xl2tpd[32607]: control_finish: Peer tried to disconnect without specifying result code.
2008:10:15-09:36:48 (none) xl2tpd[32607]: check_control: Received out of order control packet on tunnel 25 (got 4, expected 6)
2008:10:15-09:36:48 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:36:49 (none) pppd-l2tp[12680]: Connection terminated.
2008:10:15-09:36:49 (none) pppd-l2tp[12680]: Connect time 0.2 minutes.
2008:10:15-09:36:49 (none) pppd-l2tp[12680]: Sent 84 bytes, received 144 bytes.
2008:10:15-09:36:49 (none) pppd-l2tp[12680]: Using interface ppp1
2008:10:15-09:36:49 (none) pppd-l2tp[12680]: Connect: ppp1 /dev/pts/0
2008:10:15-09:36:49 (none) pppd-l2tp[12680]: tcflush failed: Bad file descriptor
2008:10:15-09:36:50 (none) xl2tpd[32607]: check_control: Received out of order control packet on tunnel 25 (got 4, expected 6)
2008:10:15-09:36:50 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:36:50 (none) pppd-l2tp[12680]: tcsetattr: Invalid argument (line 1001)
2008:10:15-09:36:50 (none) pppd-l2tp[12680]: Exit.
2008:10:15-09:36:50 (none) xl2tpd[32607]: network_thread: tossing read packet, error = Input/output error (5). Closing call.
2008:10:15-09:36:50 (none) xl2tpd[32607]: call_close: Call 32814 to 120.17.27.163 disconnected
2008:10:15-09:36:50 (none) xl2tpd[32607]: reap_children : pppd exited for call 2054 with code 10
2008:10:15-09:36:54 (none) xl2tpd[32607]: check_control: Received out of order control packet on tunnel 25 (got 4, expected 6)
2008:10:15-09:36:54 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:37:02 (none) xl2tpd[32607]: check_control: Received out of order control packet on tunnel 25 (got 4, expected 6)
2008:10:15-09:37:02 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:37:10 (none) xl2tpd[32607]: check_control: Received out of order control packet on tunnel 25 (got 4, expected 6)
2008:10:15-09:37:10 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:37:13 (none) xl2tpd[32607]: Maximum retries exceeded for tunnel 44944. Closing.
2008:10:15-09:37:13 (none) xl2tpd[32607]: Connection 25 closed to 120.17.27.163, port 49176 (Timeout)
2008:10:15-09:37:36 (none) xl2tpd[32607]: Unable to deliver closing message for tunnel 44944. Destroying anyway.

The error the iPhone displays is:

Could not negotiate a connection with the remote PPP server. Please verify your settings and try again.

The problem seems to be around this bit in the log, where it stalls for 12 seconds:

2008:10:15-09:42:36 (none) check_control: Received out of order control packet on tunnel 26 (got 3, expected 4)
2008:10:15-09:42:36 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:42:48 (none) pppd-l2tp[12957]: LCP terminated by peer (No network protocols running)
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 17 years ago in reply to jlbrown

I think we need help from others.

Here's a successful connection from my iPhone to my Astaro.
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: received Vendor ID payload [RFC 3947]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: received Vendor ID payload [Dead Peer Detection]
2008:10:14-23:12:33 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[9] 32.147.30.167 #12: responding to Main Mode from unknown peer 32.147.30.167
2008:10:14-23:12:33 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[9] 32.147.30.167 #12: NAT-Traversal: Result using RFC 3947: peer is NATed
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[9] 32.147.30.167 #12: Peer ID is ID_IPV4_ADDR: '10.55.237.181'
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[10] 32.147.30.167 #12: deleting connection "D_REF_bqPGsVBHbM_1" instance with peer 32.147.30.167 {isakmp=#0/ipsec=#0}
2008:10:14-23:12:34 (none) pluto[3413]: | NAT-T: new mapping 32.147.30.167:500/4500)
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[10] 32.147.30.167:4500 #12: sent MR3, ISAKMP SA established
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[10] 32.147.30.167:4500 #12: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2008:10:14-23:12:35 (none) pluto[3413]: "D_REF_bqPGsVBHbM_0"[5] 32.147.30.167:4500 #13: responding to Quick Mode
2008:10:14-23:12:36 (none) xl2tpd[3447]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
2008:10:14-23:12:36 (none) pluto[3413]: "D_REF_bqPGsVBHbM_0"[5] 32.147.30.167:4500 #13: Dead Peer Detection (RFC 3706) enabled
2008:10:14-23:12:36 (none) pluto[3413]: "D_REF_bqPGsVBHbM_0"[5] 32.147.30.167:4500 #13: IPsec SA established {ESP=>0x03764cc2 /dev/pts/1
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: sent [LCP ConfReq id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: rcvd [LCP ConfReq id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: sent [LCP ConfAck id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: rcvd [LCP ConfNak id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: sent [LCP ConfReq id=0x2 ]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: rcvd [LCP ConfAck id=0x2 ]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: sent [CHAP Challenge id=0xbc , name = "Astaro Security Gateway"]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: rcvd [LCP EchoReq id=0x0 magic=0x4601d103]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: sent [LCP EchoRep id=0x0 magic=0x75ce91c9]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: rcvd [CHAP Response id=0xbc , name = "balfson"]
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: AUAconnect - Returned IPAddr *
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: AUA: authentication of user balfson succeeded
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: sent [CHAP Success id=0xbc "S=D2E637BB403D629491720A77435965560F03F699 M=Access granted"]
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: ip_choose_hook entered with peer name balfson
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: passed sanity check
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: eth0 (our ip) = 10.1.1.34
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: adapter index 2
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: adapter hardware address 00:50:8b:b9:f5:f0
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: Using relay address of '10.1.1.34'
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: Unicasting to server '10.1.1.7' only
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: 1
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: 2
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: entering kernel listen mode on *
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: Opening listen socket on 0x00000000:67 *
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Bound socket 12
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x35
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3d
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3c
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Sending discover...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Waiting on select...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Received a packet
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x35
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3d
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3c
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x32
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x36
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Sending select for 10.1.1.66...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Waiting on select...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Received a packet
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Lease of 10.1.1.66 obtained, lease time 691200
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: entering none listen mode on *
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Setting renewal timer for 345600 seconds
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: 3
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfReq id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [IPCP ConfReq id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfNak id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [proto=0x8057] 01 01 00 0e 01 0a 00 ff 94 51 c2 45 1f 89
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Unsupported protocol 0x8057 received
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [LCP ProtRej id=0x3 80 57 01 01 00 0e 01 0a 00 ff 94 51 c2 45 1f 89]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [proto=0x8235] 01 01 00 10 01 06 00 00 00 01 02 06 00 00 00 01
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Unsupported protocol 0x8235 received
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [LCP ProtRej id=0x4 82 35 01 01 00 10 01 06 00 00 00 01 02 06 00 00 00 01]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [IPCP ConfRej id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfReq id=0x2 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [IPCP ConfReq id=0x2 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfAck id=0x2 ]
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: rcvd [IPCP ConfAck id=0x2 ]
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: found interface eth0 for proxy arp
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: local IP address 10.242.3.1
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: remote IP address 10.1.1.66
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: Script /etc/ppp/ip-up started (pid 28885)
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: id="2201" severity="info" sys="SecureNet" sub="vpn" event="Connection started" username="balfson" variant="l2tp" srcip="32.147.30.167" virtual_ip="10.1.1.66"
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: Script /etc/ppp/ip-up finished (pid 28885), status = 0x0

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 BAlfson over 17 years ago in reply to jlbrown

I think we need help from others.

Here's a successful connection from my iPhone to my Astaro.
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: received Vendor ID payload [RFC 3947]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2008:10:14-23:12:33 (none) pluto[3413]: packet from 32.147.30.167:500: received Vendor ID payload [Dead Peer Detection]
2008:10:14-23:12:33 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[9] 32.147.30.167 #12: responding to Main Mode from unknown peer 32.147.30.167
2008:10:14-23:12:33 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[9] 32.147.30.167 #12: NAT-Traversal: Result using RFC 3947: peer is NATed
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[9] 32.147.30.167 #12: Peer ID is ID_IPV4_ADDR: '10.55.237.181'
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[10] 32.147.30.167 #12: deleting connection "D_REF_bqPGsVBHbM_1" instance with peer 32.147.30.167 {isakmp=#0/ipsec=#0}
2008:10:14-23:12:34 (none) pluto[3413]: | NAT-T: new mapping 32.147.30.167:500/4500)
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[10] 32.147.30.167:4500 #12: sent MR3, ISAKMP SA established
2008:10:14-23:12:34 (none) pluto[3413]: "D_REF_bqPGsVBHbM_1"[10] 32.147.30.167:4500 #12: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2008:10:14-23:12:35 (none) pluto[3413]: "D_REF_bqPGsVBHbM_0"[5] 32.147.30.167:4500 #13: responding to Quick Mode
2008:10:14-23:12:36 (none) xl2tpd[3447]: control_finish: Peer requested tunnel 2 twice, ignoring second one.
2008:10:14-23:12:36 (none) pluto[3413]: "D_REF_bqPGsVBHbM_0"[5] 32.147.30.167:4500 #13: Dead Peer Detection (RFC 3706) enabled
2008:10:14-23:12:36 (none) pluto[3413]: "D_REF_bqPGsVBHbM_0"[5] 32.147.30.167:4500 #13: IPsec SA established {ESP=>0x03764cc2 /dev/pts/1
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: sent [LCP ConfReq id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: rcvd [LCP ConfReq id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: sent [LCP ConfAck id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: rcvd [LCP ConfNak id=0x1 ]
2008:10:14-23:12:39 (none) pppd-l2tp[28881]: sent [LCP ConfReq id=0x2 ]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: rcvd [LCP ConfAck id=0x2 ]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: sent [CHAP Challenge id=0xbc , name = "Astaro Security Gateway"]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: rcvd [LCP EchoReq id=0x0 magic=0x4601d103]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: sent [LCP EchoRep id=0x0 magic=0x75ce91c9]
2008:10:14-23:12:40 (none) pppd-l2tp[28881]: rcvd [CHAP Response id=0xbc , name = "balfson"]
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: AUAconnect - Returned IPAddr *
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: AUA: authentication of user balfson succeeded
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: sent [CHAP Success id=0xbc "S=D2E637BB403D629491720A77435965560F03F699 M=Access granted"]
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: ip_choose_hook entered with peer name balfson
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: passed sanity check
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: eth0 (our ip) = 10.1.1.34
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: adapter index 2
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: adapter hardware address 00:50:8b:b9:f5:f0
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: Using relay address of '10.1.1.34'
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: Unicasting to server '10.1.1.7' only
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: 1
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: 2
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: DHCPC: entering kernel listen mode on *
2008:10:14-23:12:42 (none) pppd-l2tp[28881]: Opening listen socket on 0x00000000:67 *
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Bound socket 12
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x35
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3d
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3c
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Sending discover...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Waiting on select...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Received a packet
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x35
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3d
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x3c
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x32
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: adding option 0x36
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Sending select for 10.1.1.66...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Waiting on select...
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Received a packet
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Lease of 10.1.1.66 obtained, lease time 691200
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: entering none listen mode on *
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: Setting renewal timer for 345600 seconds
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: DHCPC: 3
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfReq id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [IPCP ConfReq id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfNak id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [proto=0x8057] 01 01 00 0e 01 0a 00 ff 94 51 c2 45 1f 89
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Unsupported protocol 0x8057 received
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [LCP ProtRej id=0x3 80 57 01 01 00 0e 01 0a 00 ff 94 51 c2 45 1f 89]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [proto=0x8235] 01 01 00 10 01 06 00 00 00 01 02 06 00 00 00 01
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: Unsupported protocol 0x8235 received
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [LCP ProtRej id=0x4 82 35 01 01 00 10 01 06 00 00 00 01 02 06 00 00 00 01]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [IPCP ConfRej id=0x1 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfReq id=0x2 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: rcvd [IPCP ConfReq id=0x2 ]
2008:10:14-23:12:44 (none) pppd-l2tp[28881]: sent [IPCP ConfAck id=0x2 ]
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: rcvd [IPCP ConfAck id=0x2 ]
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: found interface eth0 for proxy arp
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: local IP address 10.242.3.1
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: remote IP address 10.1.1.66
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: Script /etc/ppp/ip-up started (pid 28885)
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: id="2201" severity="info" sys="SecureNet" sub="vpn" event="Connection started" username="balfson" variant="l2tp" srcip="32.147.30.167" virtual_ip="10.1.1.66"
2008:10:14-23:12:45 (none) pppd-l2tp[28881]: Script /etc/ppp/ip-up finished (pid 28885), status = 0x0

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 jlbrown over 17 years ago in reply to BAlfson

Yeah, pretty much the same as what I get up to the:

xl2tpd[32607]: check_control: Received out of order control packet on tunnel 25 (got 3, expected 4)
2008:10:15-09:36:36 (none) xl2tpd[32607]: handle_packet: bad control packet!
2008:10:15-09:36:46 (none) pppd-l2tp[12680]: LCP terminated by peer (No network protocols running)
2008:10:15-09:36:47 (none) xl2tpd[32607]: result_code_avp: result code out of range (768 0 14). Ignoring.
2008:10:15-09:36:47 (none) xl2tpd[32607]: control_finish: Peer tried to disconnect without specifying result code.

bit.

Strange that it works fine on one iPhone but not the other, even with same settings.
Cancel
Vote Up 0 Vote Down

Cancel

0 markcasey over 17 years ago in reply to jlbrown

All of a sudden this has stopped working with the iphones here too.

Nothing has changed either, I tried deleting the iphone vpn settings and reconfiguring only to get the same no connection. Last night I connected in fine via L2TP on Windows XP Pro.

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: received Vendor ID payload [RFC 3947]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]

2008:10:23-11:19:38 (none) pluto[732]: packet from 82.132.136.197:49161: received Vendor ID payload [Dead Peer Detection]

2008:10:23-11:19:38 (none) pluto[732]: "D_REF_TTHjAqaeCV_1"[11] 82.132.136.197:49161 #11: responding to Main Mode from unknown peer 82.132.136.197:49161

2008:10:23-11:19:44 (none) pluto[732]: "D_REF_TTHjAqaeCV_1"[11] 82.132.136.197:49161 #11: NAT-Traversal: Result using RFC 3947: peer is NATed

2008:10:23-11:19:44 (none) pluto[732]: "D_REF_TTHjAqaeCV_1"[11] 82.132.136.197:49161 #11: Peer ID is ID_IPV4_ADDR: '10.45.115.139'

2008:10:23-11:19:44 (none) pluto[732]: "D_REF_TTHjAqaeCV_1"[12] 82.132.136.197:49161 #11: deleting connection "D_REF_TTHjAqaeCV_1" instance with peer 82.132.136.197 {isakmp=#0/ipsec=#0}

2008:10:23-11:19:44 (none) pluto[732]: | NAT-T: new mapping 82.132.136.197:49161/49392)

2008:10:23-11:19:44 (none) pluto[732]: "D_REF_TTHjAqaeCV_1"[12] 82.132.136.197:49392 #11: sent MR3, ISAKMP SA established

2008:10:23-11:19:46 (none) pluto[732]: "D_REF_TTHjAqaeCV_0"[6] 82.132.136.197:49392 #12: responding to Quick Mode

2008:10:23-11:20:25 (none) xl2tpd[1347]: Maximum retries exceeded for tunnel 8978. Closing.

2008:10:23-11:20:25 (none) xl2tpd[1347]: Connection 6 closed to 82.132.136.197, port 49392 (Timeout)

2008:10:23-11:20:48 (none) xl2tpd[1347]: Unable to deliver closing message for tunnel 8978. Destroying anyway.

2008:10:23-11:20:56 (none) pluto[732]: "D_REF_TTHjAqaeCV_0"[6] 82.132.136.197:49392 #12: max number of retransmissions (2) reached STATE_QUICK_R1

2008:10:23-11:20:56 (none) pluto[732]: "D_REF_TTHjAqaeCV_0"[6] 82.132.136.197:49392: deleting connection "D_REF_TTHjAqaeCV_0" instance with peer 82.132.136.197 {isakmp=#0/ipsec=#0}

Just now as a test I changed the interface it was listening on to the internal network and connected in to it absolutely fine from my workstation.

EDIT: Interesting! Just as a test I put the VPN back onto the internal interface, then put my iphone on the wireless network created a new VPN to connect to the firewalls internal ip address and it worked... instantly.

So perhaps the firewall is blocking some traffic that's preventing it from connecting?