Hi all,<div><br></div><div>I'm trying to set up the following basic configuration :</div><div>|-------------------LAN-------------------------------------------|------------------WAN-------------------------------------------------|</div>
<div>VPN SERVER --------------HOME ROUTER/NAT-|------------(internet)------------Iphone in UMTS (3g) conn</div><div>192.168.1.253 192.168.1.1 88.b.c.d %any</div><div>
<br></div><div>So here the setup of strongswan :</div><div><br></div><div>/etc/ipsec.conf</div><div><br></div><div><div><b>version 2.0 # conforms to second version of ipsec.conf specification</b></div><div><b><br></b></div>
<div><b>config setup</b></div><div><b> nat_traversal=yes</b></div><div><b> charonstart=yes</b></div><div><b> plutostart=yes</b></div><div><b> plutostderrlog=/var/log/pluto.log</b></div><div><b> charondebug=4</b></div>
<div><b> plutodebug="control controlmore"</b></div><div><b><br></b></div><div><b>conn l2tp-psk-nat</b></div><div><b> authby=psk</b></div><div><b> pfs=no</b></div><div><b> type=transport</b></div><div><b> left=192.168.1.253</b></div>
<div><b> leftprotoport=17/1701</b></div><div><b> rightprotoport=17/%any</b></div><div><b> auto=add</b></div></div><div><b><br></b></div><div>But when i connect with my iPhone using the native client, i get the following errors on the server side :</div>
<div><br></div><div><div>| *received 476 bytes from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a> on eth0</div><div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: received Vendor ID payload [RFC 3947]</div>
<div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [4df37928e9fc4fd1b3262170d515c662]</div><div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [8f8d83826d246b6fc7a8a6a428c11de8]</div>
<div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [439b59f8ba676c4c7737ae22eab8f582]</div><div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [4d1e0e136deafa34c4f3ea9f02ec7285]</div>
<div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [80d0bb3def54565ee84645d4c85ce3ee]</div><div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [9909b64eed937c6573de52ace952fa6b]</div>
<div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]</div><div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]</div>
<div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]</div><div>packet from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a>: received Vendor ID payload [Dead Peer Detection]</div>
<div>| preparse_isakmp_policy: peer requests PSK authentication</div><div>| instantiated "l2tp-psk-nat" for 213.143.45.130</div><div>| creating state object #2 at 0xb7cc7290</div><div>| ICOOKIE: 34 02 3e 36 19 88 b7 f0</div>
<div>| RCOOKIE: d5 e3 46 c3 b8 4b 24 9d</div><div>| peer: d5 8f 2d 82</div><div>| state hash entry 8</div><div>| inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #2</div><div>"l2tp-psk-nat"[2] <a href="http://213.143.45.130:22656">213.143.45.130:22656</a> #2: responding to Main Mode from unknown peer <a href="http://213.143.45.130:22656">213.143.45.130:22656</a></div>
<div>| inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #2</div><div>| next event EVENT_RETRANSMIT in 10 seconds for #2</div><div>| </div><div>| *received 228 bytes from <a href="http://213.143.45.130:22656">213.143.45.130:22656</a> on eth0</div>
<div>| ICOOKIE: 34 02 3e 36 19 88 b7 f0</div><div>| RCOOKIE: d5 e3 46 c3 b8 4b 24 9d</div><div>| peer: d5 8f 2d 82</div><div>| state hash entry 8</div><div>| state object #2 found, in STATE_MAIN_R1</div><div>"l2tp-psk-nat"[2] <a href="http://213.143.45.130:22656">213.143.45.130:22656</a> #2: NAT-Traversal: Result using RFC 3947: both are NATed</div>
<div>| inserting event EVENT_NAT_T_KEEPALIVE, timeout in 20 seconds</div><div>| inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #2</div><div>| next event EVENT_RETRANSMIT in 10 seconds for #2</div><div>| </div>
<div>| *received 108 bytes from <a href="http://213.143.45.136:24190">213.143.45.136:24190</a> on eth0</div><div>| ICOOKIE: 34 02 3e 36 19 88 b7 f0</div><div>| RCOOKIE: d5 e3 46 c3 b8 4b 24 9d</div><div>| peer: d5 8f 2d 88</div>
<div>| state hash entry 14</div><div>| state object not found</div><div>| ICOOKIE: 34 02 3e 36 19 88 b7 f0</div><div>| RCOOKIE: 00 00 00 00 00 00 00 00</div><div>| peer: d5 8f 2d 88</div><div>| state hash entry 15</div>
<div>| state object not found</div><div>packet from <a href="http://213.143.45.136:24190">213.143.45.136:24190</a>: Main Mode message is part of an unknown exchange</div><div>| next event EVENT_RETRANSMIT in 9 seconds for #2</div>
<div>| </div><div>| *time to handle event</div><div>| event after this is EVENT_NAT_T_KEEPALIVE in 10 seconds</div><div>| handling event EVENT_RETRANSMIT for 213.143.45.130 "l2tp-psk-nat" #2</div><div>| inserting event EVENT_RETRANSMIT, timeout in 20 seconds for #2</div>
<div>| next event EVENT_NAT_T_KEEPALIVE in 10 seconds</div></div><div><br></div><div>and then, after a while, the iphone finish by disconnecting :(</div><div><br></div><div>If i put my phone on the same localnetwork as the vpn server, everything goes fine and i get authenticated, but with NAT-T, doesn't work :( </div>
<div>I "nated" the udp ports 1701, 4500 and 500 as well.</div><div><br></div><div>Any help would be much appreciated :)</div><div><br></div><div>Thanks in advance</div><div><br></div><div>A lost user :)</div><div>
<br></div><div><br></div>