<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>
I concur, thank you Mr Steffen. Ipsec shows good.<br>I believe the issue may be with xl2tpd. <br><br>I am getting these errors upon trying to connect with the Android. The iPad doesn't even seem to make it past the ipsec toward xl2tpd, as there are no entries when it tries to connect. I tried swapping between natraversal yes and no. Same results.<br><br>Dec 19 15:09:13 localhost xl2tpd[13458]: check_control: Received out of order control packet on tunnel -1 (got 1, expected 0)<br>Dec 19 15:09:13 localhost xl2tpd[13458]: handle_packet: bad control packet!<br>Dec 19 15:09:13 localhost xl2tpd[13458]: network_thread: bad packet<br>Dec 19 15:09:13 localhost xl2tpd[13458]: build_fdset: closing down tunnel 33169<br>Dec 19 15:09:14 localhost xl2tpd[13458]: network_thread: select timeout<br>Dec 19 15:09:15 localhost xl2tpd[13458]: network_thread: select timeout<br>Dec 19 15:09:16 localhost xl2tpd[13458]: network_thread: select timeout<br>Dec 19 15:09:17 localhost xl2tpd[13458]: network_thread: select timeout<br>Dec 19 15:09:18 localhost xl2tpd[13458]: network_thread: select timeout<br>Dec 19 15:09:18 localhost xl2tpd[13458]: Maximum retries exceeded for tunnel 12086. Closing.<br>Dec 19 15:09:18 localhost xl2tpd[13458]: Unable to deliver closing message for tunnel 19313. Destroying anyway.<br><br><br>[user@machine etc]# cat xl2tpd/xl2tpd.conf<br>[global]<br>debug network = yes<br>debug tunnel = yes<br>[lns default]<br>ip range = 192.168.2.220-192.168.2.222<br>local ip = 192.168.2.219<br>require chap = yes<br>refuse pap = yes<br>require authentication = yes<br>name = 137.x.x.x<br>ppp debug = yes<br>pppoptfile = /etc/ppp/options.xl2tpd<br>length bit = yes<br><br><br>[user@machine etc]# cat /etc/ppp/options.xl2tpd <br>ipcp-accept-local<br>ipcp-accept-remote<br>ms-dns 192.168.2.1<br>noccp<br>auth<br>crtscts<br>idle 1800<br>mtu 1410<br>mru 1410<br>nodefaultroute<br>debug<br>lock<br>proxyarp<br>connect-delay 5000<br>lcp-echo-interval 60<br>lcp-echo-failure 10<br><br><br>Anything weird stand out? All of this stuff worked with 4.3.6 with no modifications to these configs...<br><br>I think I might peel out xl2tpd and rebuild it from scratch.<br><br>Thanks,<br>Mark<br><br><br><br>> Date: Sun, 19 Dec 2010 21:48:37 +0100<br>> From: andreas.steffen@strongswan.org<br>> To: aikikid@hotmail.com<br>> CC: users@lists.strongswan.org<br>> Subject: Re: [strongSwan] ikev1 on 4.5.0 vs 4.3.6 iPad/Android problem<br>> <br>> Since you have a NAT situation over 3g you must activate NAT Traversal<br>> with<br>> <br>> nat_traversal=yes<br>> <br>> Over WIFI the tunnel is successfully established.<br>> <br>> Regards<br>> <br>> Andreas<br>> <br>> On 19.12.2010 21:19, Mark S. wrote:<br>> > thank you for the reply. I set charonstart=no and it failed on both my<br>> > Android over 3g and iPad over wifi.<br>> > <br>> > I think I should now try the socket-raw option?<br>> > <br>> > This is using my local wifi and iPad. Identical setup/problem as my<br>> > public config below.<br>> > <br>> > No entries in daemon.log<br>> > <br>> > iPad via wifi<br>> > [user@machine ipsec]# tcpdump -i eth3 port 500<br>> > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<br>> > listening on eth3, link-type EN10MB (Ethernet), capture size 65535 bytes<br>> > 13:57:09.052952 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 1 I<br>> > ident<br>> > 13:57:09.079719 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase 1 R<br>> > ident<br>> > 13:57:09.132013 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 1 I<br>> > ident<br>> > 13:57:09.134725 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase 1 R<br>> > ident<br>> > 13:57:09.188516 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase 1 I<br>> > ident[E]<br>> > 13:57:09.189188 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase 1 R<br>> > ident[E]<br>> > 13:57:10.197248 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase<br>> > 2/others I oakley-quick[E]<br>> > 13:57:10.210796 IP 10.5.5.1.isakmp > 10.5.5.2.isakmp: isakmp: phase<br>> > 2/others R oakley-quick[E]<br>> > 13:57:10.220899 IP 10.5.5.2.isakmp > 10.5.5.1.isakmp: isakmp: phase<br>> > 2/others I oakley-quick[E]<br>> > <br>> > iPad fails to connect.<br>> > <br>> > And via my Android over 3g.<br>> > Android via 3g<br>> > [user@machine ipsec]# tcpdump -i eth1 port 500<br>> > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode<br>> > listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes<br>> > 14:07:00.700072 IP 134.x.x.x.16534 > 137.x.x.x.isakmp: isakmp: phase 1 I<br>> > ident<br>> > 14:07:11.507131 IP 134.x.x.x..16534 > 137.x.x.x.isakmp: isakmp: phase 1<br>> > I ident<br>> > 14:07:21.696309 IP 134.x.x.x..16534 > 137.x.x.x.isakmp: isakmp: phase 1<br>> > I ident<br>> > 14:07:31.133663 IP 134..x.x.x..16534 > 137.x.x.x..isakmp: isakmp: phase<br>> > 1 I ident<br>> > <br>> > <br>> > [user@machine ipsec]# ipsec statusall<br>> > 000 Status of IKEv1 pluto daemon (strongSwan 4.5.0):<br>> > 000 interface foo/foo aaaa::1:500<br>> > 000 interface lo/lo ::1:500<br>> > 000 interface lo/lo 127.0.0.1:500<br>> > 000 interface eth0/eth0 192.168.2.1:500<br>> > 000 interface eth0/eth0 192.168.2.0:500<br>> > 000 interface eth1/eth1 137.x.x.x:500<br>> > 000 interface eth3/eth3 10.5.5.1:500<br>> > 000 interface eth2/eth2 192.168.4.1:500<br>> > 000 %myid = '%any'<br>> > 000 loaded plugins: aes des sha1 sha2 md5 random x509 pkcs1 pgp dnskey<br>> > pem gmp hmac xauth attr kernel-netlink resolve<br>> > 000 debug options: none<br>> > 000<br>> > 000 "L2TP":<br>> > 137.x.x.x.[137.x.x.x.]:17/1701---137.x.x.x....%any[%any]:17/%any==={0.0.0.0/0};<br>> > unrouted; eroute owner: #0<br>> > 000 "L2TP": ike_life: 10800s; ipsec_life: 3600s; rekey_margin: 540s;<br>> > rekey_fuzz: 100%; keyingtries: 3<br>> > 000 "L2TP": policy: PSK+ENCRYPT+TUNNEL+DONTREKEY; prio: 32,0;<br>> > interface: eth1;<br>> > 000 "L2TP": newest ISAKMP SA: #0; newest IPsec SA: #0;<br>> > 000 "L2TP_Wireless":<br>> > 10.5.5.1[10.5.5.1]:17/1701---137.xx.x.x...%any[%any]:17/%any==={0.0.0.0/0};<br>> > unrouted; eroute owner: #0<br>> > 000 "L2TP_Wireless": ike_life: 10800s; ipsec_life: 3600s;<br>> > rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>> > 000 "L2TP_Wireless": policy: PSK+ENCRYPT+TUNNEL+DONTREKEY; prio: 32,0;<br>> > interface: eth3;<br>> > 000 "L2TP_Wireless": newest ISAKMP SA: #0; newest IPsec SA: #0;<br>> > 000 "L2TP_Wireless"[2]:<br>> > 10.5.5.1[10.5.5.1]:17/1701---137.x.x.x.x...10.5.5.2[192.168.50.138]:17/59512===192.168.50.138/32;<br>> > erouted; eroute owner: #2<br>> > 000 "L2TP_Wireless"[2]: ike_life: 10800s; ipsec_life: 3600s;<br>> > rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 3<br>> > 000 "L2TP_Wireless"[2]: policy: PSK+ENCRYPT+TUNNEL+DONTREKEY; prio:<br>> > 32,0; interface: eth3;<br>> > 000 "L2TP_Wireless"[2]: newest ISAKMP SA: #1; newest IPsec SA: #2;<br>> > 000 "L2TP_Wireless"[2]: IKE proposal: AES_CBC_256/HMAC_SHA1/MODP_1024<br>> > 000 "L2TP_Wireless"[2]: ESP proposal: AES_CBC_256/HMAC_SHA1/<N/A><br>> > 000<br>> > 000 #2: "L2TP_Wireless"[2] 10.5.5.2 STATE_QUICK_R2 (IPsec SA<br>> > established); EVENT_SA_EXPIRE in 3302s; newest IPSEC; eroute owner<br>> > 000 #2: "L2TP_Wireless"[2] 10.5.5.2 esp.53ae617@10.5.5.2 (0 bytes)<br>> > esp.c809ae1c@10.5.5.1 (0 bytes); transport<br>> > 000 #1: "L2TP_Wireless"[2] 10.5.5.2 STATE_MAIN_R3 (sent MR3, ISAKMP SA<br>> > established); EVENT_SA_EXPIRE in 3301s; newest ISAKMP<br>> > <br>> > I really appreciate the help!<br>> > Thank you!<br>> > Mark<br>> > <br>> >> Subject: Re: [strongSwan] ikev1 on 4.5.0 vs 4.3.6 iPad/Android problem<br>> >><br>> >> Hi Mark,<br>> >><br>> >> does the problem still occur if you disable the IKEv2 charon daemon:<br>> >><br>> >> charonstart=no<br>> >><br>> >> It might be that charon loads the socket-default plugin and does<br>> >> binds to UDP port 500. If you want to run both pluto and charon<br>> >> make sure that charon loads the socket-raw plugin only.<br>> >> The plugin list can be listed using<br>> >><br>> >> ipsec statusall<br>> >><br>> >> Regards<br>> >><br>> >> Andreas<br>> >><br>> <br>> <br>> -- <br>> ======================================================================<br>> Andreas Steffen andreas.steffen@strongswan.org<br>> strongSwan - the Linux VPN Solution! www.strongswan.org<br>> Institute for Internet Technologies and Applications<br>> University of Applied Sciences Rapperswil<br>> CH-8640 Rapperswil (Switzerland)<br>> ===========================================================[ITA-HSR]==<br> </body>
</html>