This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

L2TP over IPsec with Radius

I am trying to configure L2TP over IPsec VPN using Radius servers, but I'm having some problems.

1. the server is authenticating properly, follows the figure with the authentication test.
2. Did the settings by following the information shown by the Snowplow, but without success.
3. the access log, stating an error connection log for CHAP and the error message 691.

2013:03:19-12:01:06 secg97 pluto[8037]: packet from 201.49.22.163:500: ignoring Vendor ID payload [IKE CGA version 1]

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[99] 201.49.22.163 #99: responding to Main Mode from unknown peer 201.49.22.163

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[99] 201.49.22.163 #99: ECP_384 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[99] 201.49.22.163 #99: ECP_256 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[99] 201.49.22.163 #99: NAT-Traversal: Result using RFC 3947: peer is NATed

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[99] 201.49.22.163 #99: Peer ID is ID_IPV4_ADDR: '192.168.31.101'

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[100] 201.49.22.163 #99: deleting connection "S_for admin"[99] instance with peer 201.49.22.163 {isakmp=#0/ipsec=#0}

2013:03:19-12:01:06 secg97 pluto[8037]: | NAT-T: new mapping 201.49.22.163:500/4500)

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[100] 201.49.22.163:4500 #99: sent MR3, ISAKMP SA established

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[50] 201.49.22.163:4500 #100: NAT-Traversal: received 2 NAT-OA. using first, ignoring others

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[50] 201.49.22.163:4500 #100: responding to Quick Mode

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Plugin radius.so loaded.

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: RADIUS plugin initialized.

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Plugin radattr.so loaded.

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: RADATTR plugin initialized.

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Plugin ippool.so loaded.

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Plugin pppol2tp.so loaded.

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: pppd 2.4.5 started by (unknown), uid 0

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Using interface ppp0

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Connect: ppp0 

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Overriding mtu 1500 to 1380

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Overriding mru 1500 to mtu value 1380

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Overriding mtu 1400 to 1380

2013:03:19-12:01:06 secg97 pluto[8037]: "S_for admin"[50] 201.49.22.163:4500 #100: IPsec SA established {ESP=>0x2d7aa888 2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: RADIUS: wrong service type 6 for daniel.gurgel

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Peer daniel.gurgel failed CHAP authentication

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Overriding mtu 1500 to 1380

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Overriding mru 1500 to mtu value 1380

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Connection terminated.

2013:03:19-12:01:06 secg97 pppd-l2tp[25140]: Exit.

2013:03:19-12:01:07 secg97 pluto[8037]: "S_for admin"[100] 201.49.22.163:4500 #99: received Delete SA(0x2d7aa888) payload: deleting IPSEC State #100

2013:03:19-12:01:07 secg97 pluto[8037]: "S_for admin"[100] 201.49.22.163:4500 #99: deleting connection "S_for admin"[50] instance with peer 201.49.22.163 {isakmp=#0/ipsec=#0}

2013:03:19-12:01:07 secg97 pluto[8037]: "S_for admin"[100] 201.49.22.163:4500 #99: received Delete SA payload: deleting ISAKMP State #99

2013:03:19-12:01:07 secg97 pluto[8037]: "S_for admin"[100] 201.49.22.163:4500: deleting connection "S_for admin"[100] instance with peer 201.49.22.163 {isakmp=#0/ipsec=#0}

Anyone with similar problem? UTM 9,005-16.

This thread was automatically locked due to age.

Parents

0 BAlfson over 12 years ago

How to use RADIUS Authentication: Astaro Security Gateway/Sophos UTM

But, that's not much different from what you found. What are you seeing in the Event Log on the WinServer?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Siarom over 12 years ago in reply to BAlfson

Following this documentation, everything worked properly.
The only problem was how much the order of the Policies, but I solved this problem by improving the groups.

As a suggestion, in Sophos UTM Manual, could there be reference links to the KB on the website of Sophos.

Thank you BAlfson for your attention! [:D]
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Siarom over 12 years ago in reply to BAlfson

Following this documentation, everything worked properly.
The only problem was how much the order of the Policies, but I solved this problem by improving the groups.

As a suggestion, in Sophos UTM Manual, could there be reference links to the KB on the website of Sophos.

Thank you BAlfson for your attention! [:D]
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data

L2TP over IPsec with Radius

Submitted a Tech Support Case lately from the Support Portal?