This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

L2TP/IPsec with Astaro NATed

I'm having some trouble getting L2TP/IPsec working on my ASG when it's behind a NAT. I've tried it with the other end both NATed and unNATed, but I get the same error. I think the NAT that my Astaro is behind has NAT-T turned on, and also IKE, ESP, and AH allowed through explicitly. However, when I attempt to connect from any client I get:

2011:05:18-16:08:08 gateway pluto[6678]: "S_REF_moWquEVXTx"[6] 208.105.104.57 #36: NAT-Traversal: Result using RFC 3947: i am NATed

2011:05:18-16:08:09 gateway pluto[6678]: "S_REF_moWquEVXTx"[6] 208.105.104.57 #36: Peer ID is ID_IPV4_ADDR: '208.105.104.57'

2011:05:18-16:08:09 gateway pluto[6678]: | NAT-T: new mapping 208.105.104.57:500/4500)

2011:05:18-16:08:09 gateway pluto[6678]: "S_REF_moWquEVXTx"[6] 208.105.104.57:4500 #36: sent MR3, ISAKMP SA established

2011:05:18-16:08:09 gateway pluto[6678]: "S_REF_moWquEVXTx"[6] 208.105.104.57:4500 #36: cannot respond to IPsec SA request because no connection is known for /32===10.66.128.5(astaro's external interface):4500[10.66.128.5]:17/1701...208.105.104.57:4500[208.105.104.57]:17/%any

2011:05:18-16:08:09 gateway pluto[6678]: "S_REF_moWquEVXTx"[6] 208.105.104.57:4500 #36: sending encrypted notification INVALID_ID_INFORMATION to 208.105.104.57:4500

Can anyone shed some light on what's going on from that section of logs? (I can provide more if you think it will help). Is my upstream/NAT set up right, or do I have to get them to fix something?

TIA,
Adam

This thread was automatically locked due to age.

0 YasunoriMatsuo over 14 years ago

Hi,

In IPsec connecting, when you use the authentication by preshared key, ASG cannot be put behind NAT.
When preshared key is used, ASG checks IP.
Because IP that other box has accessed and IP of ASG are different, it becomes an error.
This can be solved by using RSA or X509 in IPSecVPN.
I guess that it is possible to solve by using X509 for L2TP/IPSec.
However, I have not tried this.
Cancel
Vote Up 0 Vote Down

Cancel
0 addrockk over 14 years ago

It does the same thing with Cert based IPSec.
I get "cannot respond to IPsec SA request because no connection is known for..."
Cancel
Vote Up 0 Vote Down

Cancel
0 addrockk over 14 years ago

I just noticed something then I read that error message again.
The error says no connection is known for:
===...===
I read on an openswan forums that it SHOULD be structured:
===...===.
Is it possible ASG is detecting the NAT-T wrong, and switching the two addresses, thinking the 10.0.0.0 internal address is the external one??
Cancel
Vote Up 0 Vote Down

Cancel
0 YasunoriMatsuo over 14 years ago in reply to addrockk

Hi,

If it is Site To Site VPN, it is possible to connect.
https://support.astaro.com/support/index.php/Site_To_Site_VPN_with_PSK_in_ASG_V7_when_one_or_both_sides_are_behind_NAT
However, it is not possible to do because there is no option of virtual IP in L2TP/IPsec.
If the certificate that VPN ID Type is "Email address" or "Hostname" is used, I guess possible to connect.
Cancel
Vote Up 0 Vote Down

Cancel
0 addrockk over 14 years ago

OK Thanks for your help. I'll look into getting SSL VPN to work on this client.
Cancel
Vote Up 0 Vote Down

Cancel