i am not a Sophos pro but i use it now over a year and i'm very happy!
Network:
+INTERNET
||
||
++ FirtzBox Router 10.13.37.1/24
--||
--||
--++ Sophos UTM (10.13.37.2/24, 192.168.1.254/24)
----||
----||Client1
----||Client2
----||Client3
Config:
FritzBox Router NATs all incomming traffic to the UTM. Everything works, SSL VPN, Cisco VPN, Reserve Proxy and alot more...
The L2TP connection works, if i set the interface to listen on "internal"(192.168.1.254) and my client is in 192.168.1.0/24 network.
It also works if the client is in 10.13.37.0/24 and the interface setting on "external" (10.13.37.2/24).
i think the sophos config is right, i tried PSK and PKI both works with above situtations.
Problem:
As soon as i try to connect with a client from outside (internet) it doesnt work!
Log:
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: received Vendor ID payload [RFC 3947]
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [FRAGMENTATION]
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [Vid-Initial-Contact]
2014:12:20-14:26:55 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [IKE CGA version 1]
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[7] 109.47.2.134:49534 #8: responding to Main Mode from unknown peer 109.47.2.134:49534
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[7] 109.47.2.134:49534 #8: ECP_384 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[7] 109.47.2.134:49534 #8: ECP_256 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[7] 109.47.2.134:49534 #8: NAT-Traversal: Result using RFC 3947: both are NATed
2014:12:20-14:26:55 myUTMname pluto[16765]: | NAT-T: new mapping 109.47.2.134:49534/54182)
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[7] 109.47.2.134:54182 #8: Peer ID is ID_IPV4_ADDR: '192.168.0.2'
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: deleting connection "L_for testClient1"[7] instance with peer 109.47.2.134 {isakmp=#0/ipsec=#0}
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: sent MR3, ISAKMP SA established
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: cannot respond to IPsec SA request because no connection is known for myPublicIP/32===10.13.37.2:4500[10.13.37.2]:17/1701...109.47.2.134:54182[192.168.0.2]:17/%any==={192.168.0.2/32}
2014:12:20-14:26:55 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: sending encrypted notification INVALID_ID_INFORMATION to 109.47.2.134:54182
2014:12:20-14:26:56 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2014:12:20-14:26:56 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: sending encrypted notification INVALID_MESSAGE_ID to 109.47.2.134:54182
2014:12:20-14:26:57 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2014:12:20-14:26:57 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: sending encrypted notification INVALID_MESSAGE_ID to 109.47.2.134:54182
2014:12:20-14:27:01 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2014:12:20-14:27:01 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: sending encrypted notification INVALID_MESSAGE_ID to 109.47.2.134:54182
2014:12:20-14:27:08 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2014:12:20-14:27:08 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: sending encrypted notification INVALID_MESSAGE_ID to 109.47.2.134:54182
2014:12:20-14:27:38 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
2014:12:20-14:27:38 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: sending encrypted notification INVALID_MESSAGE_ID to 109.47.2.134:54182
2014:12:20-14:27:53 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182 #8: received Delete SA payload: deleting ISAKMP State #8
2014:12:20-14:27:53 myUTMname pluto[16765]: "L_for testClient1"[8] 109.47.2.134:54182: deleting connection "L_for testClient1"[8] instance with peer 109.47.2.134 {isakmp=#0/ipsec=#0}
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: received Vendor ID payload [RFC 3947]
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [FRAGMENTATION]
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [Vid-Initial-Contact]
2014:12:20-14:27:53 myUTMname pluto[16765]: packet from 109.47.2.134:49534: ignoring Vendor ID payload [IKE CGA version 1]
2014:12:20-14:27:53 myUTMname pluto[16765]: "L_for testClient1"[9] 109.47.2.134:49534 #9: responding to Main Mode from unknown peer 109.47.2.134:49534
2014:12:20-14:27:53 myUTMname pluto[16765]: "L_for testClient1"[9] 109.47.2.134:49534 #9: ECP_384 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
2014:12:20-14:27:53 myUTMname pluto[16765]: "L_for testClient1"[9] 109.47.2.134:49534 #9: ECP_256 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
i think the problem begins her:
Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x01000000 (perhaps this is a duplicated packet)
but iam not sure...
can some one have a look at the logs?
regards!
and happy holy days!
This thread was automatically locked due to age.