<div dir="ltr"><div>Hi Brad</div><div><br></div><div>It worked for me with windows 7 ipsec/l2tp. I think nothing is wrong with your configuration.</div><div><br></div><div>I think microsoft L2TP proposal is as follows:</div>
<div><br></div><div><br></div><div>IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_384,</div><div>IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256,</div><div>IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,</div><div>
IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048,</div><div>IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024</div><div><br></div><div>ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ,</div><div>ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ,</div>
<div>ESP:DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ</div><div><br></div><div>Best wishes</div><div>Ali</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, May 15, 2014 at 5:59 PM, Brad Johnson <span dir="ltr"><<a href="mailto:bjohnson@ecessa.com" target="_blank">bjohnson@ecessa.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">We are migrating to strongswan from openswan, where we use xl2tpd to handle road-warrior connections from Windows and Mac clients. This worked fine with openswan but I can't get it to work with strongswan. When trying to connect from a Windows 7 client (set up to use ipsec/l2tp with pre-shared key) the SA gets established but xl2tpd times out and closes its tunnels.<br>
<br>
Here's part of the log output (# all IP addresses redacted with "xxx"):<br>
<br>
charon: 14[IKE] CHILD_SA l2tp{21} established with SPIs c774b885_i 443ddb1c_o and TS 173.160.xxx.xxx/32[udp/l2tp] === 66.41.xxx.xx/32[udp/l2tp]<br>
<br>
xl2tpd[12145]: control_finish: Peer requested tunnel 7 twice, ignoring second one. (repeats 2 more times)<br>
xl2tpd[12145]: Maximum retries exceeded for tunnel 32034. Closing.<br>
xl2tpd[12145]: Connection 7 closed to 66.41.xxx.xx, port 1701 (Timeout)<br>
xl2tpd[12145]: Unable to deliver closing message for tunnel 32034. Destroying anyway.<br>
(above repeats for another tunnel)<br>
<br>
My question is, can this work with strongswan? Is anyone else doing this? I know according to the documentation that Windows 7 clients can use IKEv2 and avoid using l2tp altogether, but we still need to support Mac and older Windows clients and need this to work.<br>
<br>
#/etc/ipsec.conf:<br>
<br>
conn l2tp<br>
left=173.160.xxx.xxx<br>
right=%any<br>
auto=add<br>
rekey=no<br>
leftprotoport=17/1701<br>
rightprotoport=17/%any<br>
keyingtries=2<br>
keyexchange=ikev1<br>
leftauth=psk<br>
rightauth=psk<br>
ikelifetime=8h<br>
ike=aes128-sha1-modp1536<br>
esp=aes128-sha1<br>
<br>
# /etc/ipsec.secrets - strongSwan IPsec secrets file<br>
173.160.xxx.xxx %any : PSK "whatever"<br>
<br>
# /etc/xl2tpd/xl2tpd.conf:<br>
[lns road-warrior]<br>
ppp debug = yes<br>
lac = 0.0.0.0-255.255.255.255<br>
local ip = 10.100.10.1<br>
ip range = 10.100.10.2-10.100.10.50<br>
require authentication = yes<br>
pppoptfile = /etc/ppp/road-warrior.options<br>
<br>
# /etc/ppp/road-warrior.options:<br>
lock<br>
maxfail 0<br>
persist<br>
debug<br>
linkname vpn-road-warrior<br>
ipparam road-warrior<br>
auth<br>
require-chap<br>
require-mschap-v2<br>
require-mschap<br>
refuse-pap<br>
ipcp-accept-remote<br>
nodefaultroute<br>
proxyarp<br>
<br>
Thanks in advance for any help,<br>
Brad Johnson<br>
<br>
<br>
______________________________<u></u>_________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/<u></u>mailman/listinfo/users</a><br>
</blockquote></div><br></div>