<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Hi,</div><div><br></div>I have been struggling to configure strongSWAN + xl2tpd for a few weeks now, and have reached a point where a publicly accessible (not behind a NAT-device) roadwarrior client can connect to the VPN server (also no NAT). However, for this VPN to be of any use I need to get it functioning with NATed clients. This is pluto's log when a NATed OS X client try to connect:<div><br></div><div>OS X client = 213.xxx.xxx.3</div><div>VPN server = 213.xxx.xxx.9<br><div><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 11px;"><font class="Apple-style-span" face="Arial"><br></font></span></font></div><div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: received Vendor ID payload [RFC 3947]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">packet from 213.xxx.xxx.3:500: received Vendor ID payload [Dead Peer Detection]</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[1] 213.xxx.xxx.3 #1: responding to Main Mode from unknown peer 213.xxx.xxx.3</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[1] 213.xxx.xxx.3 #1: NAT-Traversal: Result using RFC 3947: peer is NATed</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[1] 213.xxx.xxx.3 #1: Peer ID is ID_IPV4_ADDR: '192.168.9.116'</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3 #1: deleting connection "mac" instance with peer 213.xxx.xxx.3 {isakmp=#0/ipsec=#0}</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">| NAT-T: new mapping 213.xxx.xxx.3:500/4500)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sent MR3, ISAKMP SA established</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: ignoring informational payload, type IPSEC_INITIAL_CONTACT</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: cannot respond to IPsec SA request because no connection is known for 213.xxx.xxx.9:4500[213.xxx.xxx.9]:17/1701...213.xxx.xxx.3:4500[192.168.9.116]:17/%any===192.168.9.116/32</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_ID_INFORMATION to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xfcf442bf (perhaps this is a duplicated packet)</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: sending encrypted notification INVALID_MESSAGE_ID to 213.xxx.xxx.3:4500</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500 #1: received Delete SA payload: deleting ISAKMP State #1</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">"mac"[2] 213.xxx.xxx.3:4500: deleting connection "mac" instance with peer 213.xxx.xxx.3 {isakmp=#0/ipsec=#0}</span></font></div></div><div><br></div></div><div>I have been struggling at this point for a while now and I just cant figure out how to resolve it.</div><div>Here is my ipsec.conf file:</div><div><br></div><div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"># /etc/ipsec.conf - strongSwan IPsec configuration file</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"><br></span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">config setup</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> strictcrlpolicy=no</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> nat_traversal=yes</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> plutostart=yes</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> plutostderrlog=/var/log/pluto.log</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> charonstart=no</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,!%v4:10.9.8.0/24</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> interfaces=213.xxx.xxx.9</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> uniqueids=yes</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"><br></span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">conn %default</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> ikelifetime=60m</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> keylife=20m</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> rekeymargin=3m</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> pfs=no</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> keyingtries=1</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> keyexchange=ikev1</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> authby=psk</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"><br></span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;">conn mac</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> left=213.115.56.9</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> leftsubnet=213.115.56.0/28</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> esp=aes128-sha1</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> ike=aes128-sha-modp1024</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> type=transport</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> rekey=no</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> leftprotoport=17/1701</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> right=%any</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> rightsubnet=vhost:%no,%priv</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> rightprotoport=17/%any</span></font></div><div><font class="Apple-style-span" face="Arial" size="2"><span class="Apple-style-span" style="font-size: 10px;"> auto=add</span></font></div><div><br></div></div><div>Apologize for the wall of text :)</div><div>I appreciate any and all help!</div><div><br></div><div>Best regards,</div><div><br></div><div>Emil</div><div><br></div></body></html>