Has anyone managed to get the L2TP over IPSec VPN going behind NAT?
In our situation our upstream provider NATs all our traffic to a few public IPs reserved for our use (don't ask why, I hate it... apparently for "security" they can't route these to us), so it breaks L2TP over IPSec VPN. Microsoft Forefront worked around this somehow, but now we're transitioning to Sophos and I'm having a hard time getting it to work.
Any ideas?
I'm testing from my iPhone on my private WiFi at home, the Sophos is at work. I've replaced the Sophos and iPhone's public IPs, 10.9.219.254 is the Sophos' IP on our upstream provider's network (External interface in Sophos' eyes) and 192.168.1.159 is my iPhone's private IP.
Sophos (10.9.219.254) --> Upstream provider (10.9.219.1) --> our public IP
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: received Vendor ID payload [RFC 3947]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
2014:12:28-19:17:53 sophos pluto[6236]: packet from :500: received Vendor ID payload [Dead Peer Detection]
2014:12:28-19:17:53 sophos pluto[6236]: "L_for admin"[3] #4: responding to Main Mode from unknown peer
2014:12:28-19:17:53 sophos pluto[6236]: "L_for admin"[3] #4: NAT-Traversal: Result using RFC 3947: both are NATed
2014:12:28-19:17:53 sophos pluto[6236]: "L_for admin"[3] #4: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2014:12:28-19:17:53 sophos pluto[6236]: "L_for admin"[3] #4: Peer ID is ID_IPV4_ADDR: '192.168.1.159'
2014:12:28-19:17:53 sophos pluto[6236]: "L_for admin"[4] #4: deleting connection "L_for admin"[3] instance with peer {isakmp=#0/ipsec=#0}
2014:12:28-19:17:53 sophos pluto[6236]: "L_for admin"[4] #4: Dead Peer Detection (RFC 3706) enabled
2014:12:28-19:17:53 sophos pluto[6236]: | NAT-T: new mapping :500/4501)
2014:12:28-19:17:53 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sent MR3, ISAKMP SA established
2014:12:28-19:17:54 sophos pluto[6236]: "L_for admin"[4] :4501 #4: cannot respond to IPsec SA request because no connection is known for /32===10.9.219.254:4500[10.9.219.254]:17/1701...:4501[192.168.1.159]:17/%any==={192.168.1.159/32}
2014:12:28-19:17:54 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_ID_INFORMATION to :4501
2014:12:28-19:17:57 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:17:57 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:01 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:01 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:04 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:04 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:07 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:07 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:11 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:11 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:14 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:14 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:17 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:17 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:20 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:20 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:24 sophos pluto[6236]: "L_for admin"[4] :4501 #4: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x09bbfafc (perhaps this is a duplicated packet)
2014:12:28-19:18:24 sophos pluto[6236]: "L_for admin"[4] :4501 #4: sending encrypted notification INVALID_MESSAGE_ID to :4501
2014:12:28-19:18:24 sophos pluto[6236]: "L_for admin"[4] :4501 #4: received Delete SA payload: deleting ISAKMP State #4
2014:12:28-19:18:24 sophos pluto[6236]: "L_for admin"[4] :4501: deleting connection "L_for admin"[4] instance with peer {isakmp=#0/ipsec=#0}
2014:12:28-19:18:24 sophos pluto[6236]: ERROR: asynchronous network error report on eth1 for message to port 4501, complainant : Connection refused [errno 111, origin ICMP type 3 code 3 (not authenticated)]
This thread was automatically locked due to age.
