I noticed this before, but since it was not a problem then, I never bothered to ask. Now I need to get a few ideas about it.
When connecting to Sophos UTM through Windows L2TP/IPsec client and the client have more then just the Sophos UTM X.509 certificate installed, I usually get an error like this:
"L_REF_IpsL2t1"[9] Y.Y.Y.Y #1545: Peer ID is ID_DER_ASN1_DN: 'CN=CNofCertificate'
"L_REF_IpsL2t1"[9] Y.Y.Y.Y #1545: issuer cacert not found
"L_REF_IpsL2t1"[9] Y.Y.Y.Y #1545: X.509 certificate rejected
"L_REF_IpsL2t1"[9] Y.Y.Y.Y #1545: no public key known for 'CN=CNofCertificate'
"L_REF_IpsL2t1"[9] Y.Y.Y.Y #1545: sending encrypted notification INVALID_KEY_INFORMATION to Y.Y.Y.Y:500
It's obvious that Sophos UTM did not accept the client certificate and it should not, because the wrong certificate was offered by the client. If I remove all other personal certificates from the computer account and leave only the certificate provided by Sophos UTM, the problem does not happen. I know some (or all) of you will say that this is a bug at the client side, and I do not disagree. My point is: there's a workaround. I'm a Linux enthusiast and have been working with OpenSwan for many, many years, and I've seem this before. Not me per say, but someone else, and he documented it very well:
www.jacco2.dds.nl/.../win2000xp-openswan.html
A simple "rightca=%same" in ipsec.conf solved it for OpenSwan, and I'm pretty sure that it would do it also for Sophos UTM StrongSwan's, since the parameter exists for it also. The issue is that there's no way I can put it there. AFAIK, all ipsec.conf settings are loaded in a database, so there's is no way to manual load this setting in Sophos UTM, not that I know of at least.
I know L2TP/IPsec sucks, SSL VPN Client does the job and many many more, but some customers really need L2TP/IPsec. And since nowadays the most common thing found on a laptop are tons of certificates installed, the problem is becoming very common for me. Anyone seem this before? Is there any way we can at least test my theory?
Regards,
Giovani
This thread was automatically locked due to age.