Subject: [L2tpext] MSL2TP - Freeswan Problems

From: Adharsh Praveen <[email-masked]>
Date: Tue, 28 Jan 2003 10:52:10 +0530

Hai 

I am trying the following set up using freeswan 1.98b and MS-L2TP for
WIN 98 SE.

        192.168.1.77            ----         192.168.1.76
  (freeswan 1.98b and l2tpd-0.69 )        ( MS-L2TP WIN 98 )
          (RH Linux 7.3)

The configuration files are attached and it is similar to that mentioned
in Jacco's
document.

http://www.jacco2.dds.nl/networking/msl2tp.html 

I am trying to set up an IPSec connection using PSK.

When I try to connect,freeswan is complaining like this

Jan 27 14:23:57 localhost pluto[3192]: packet from 192.168.1.76:500:
ignoring Vendor ID payload
Jan 27 14:23:57 localhost last message repeated 2 times
Jan 27 14:23:57 localhost pluto[3192]: "L2TP-PSK" #1: responding to Main
Mode
Jan 27 14:23:57 localhost pluto[3192]: "L2TP-PSK" #1: ignoring Vendor ID
payload
Jan 27 14:23:57 localhost last message repeated 3 times
Jan 27 14:23:57 localhost pluto[3192]: "L2TP-PSK" #1: ignoring
informational payload, type IPSEC_INITIAL_CONTACT
Jan 27 14:23:57 localhost pluto[3192]: "L2TP-PSK" #1: sent MR3, ISAKMP
SA established
Jan 27 14:23:57 localhost pluto[3192]: "L2TP-PSK" #1: peer client ID
payload ID_IPV4_ADDR specifies protocol 17; we only support 0
Jan 27 14:24:02 localhost pluto[3192]: "L2TP-PSK" #1: Quick Mode I1
message is unacceptable because it uses a previously used Message ID
0x53bbf2f9 (perhaps this is a duplicated packet)

I tried adding the parameters in ipsec.conf

leftprotoport=udp/1701
rightprotoport=udp/1701

When I said ipsec auto --add L2TP-PSK, I got the message

ipsec_auto: fatal error in "L2TP-PSK": (/etc/ipsec.conf, line 5) unknown
parameter name "leftprotoport"

any ideas. Am I missing something? 

I am at present not trying with x.509 certificates.

I have been trying this for more than 2 weeks. My Isakmp.log in
192.168.1.76 shows this

1-27: 14:24:25.920  
 1-27: 14:24:25.920 Microsoft IPsec VPN\L2TP/IPsec - Generic entry match
with remote address 192.168.1.77.
 1-27: 14:24:27.020 Microsoft IPsec VPN\L2TP/IPsec - Initiating IKE
Phase 2 with Client IDs (message id: AD320028)
 1-27: 14:24:27.020   Initiator = IP ADDR=192.168.1.76, prot = 17 port =
1701
 1-27: 14:24:27.020   Responder = IP ADDR=192.168.1.77, prot = 17 port =
1701
 1-27: 14:24:27.020 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(HASH, SA, NON, ID, ID)
 1-27: 14:24:32.020 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: AD320028). Retry count: 1
 1-27: 14:24:32.020 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:24:37.070 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: AD320028). Retry count: 2
 1-27: 14:24:37.070 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:24:42.070 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: AD320028). Retry count: 3
 1-27: 14:24:42.070 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:24:44.980  
 1-27: 14:24:44.980 Microsoft IPsec VPN\L2TP/IPsec - Generic entry match
with remote address 192.168.1.77.
 1-27: 14:24:47.120 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: AD320028). Retry count: 4
 1-27: 14:24:47.120 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:24:52.120 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: AD320028). Retry count: 5
 1-27: 14:24:52.120 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:24:57.120 Microsoft IPsec VPN\L2TP/IPsec - Exceeded 5
re-keying attempts (message id: AD320028)
 1-27: 14:26:27.800 IREIKE Shutting down.
 1-27: 14:26:27.850 Microsoft IPsec VPN\L2TP/IPsec - Deleting IKE SA (IP
ADDR=192.168.1.77)
 1-27: 14:26:27.850    MY COOKIE c7 62 3a 2 d 3 2a cc
 1-27: 14:26:27.850    HIS COOKIE 1b a0 e0 80 5d 21 91 19
 1-27: 14:26:27.850 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK INFO *(HASH, DEL)
 1-27: 14:26:27.910 recvfrom () : 2736
 1-27: 14:26:27.910 recvfrom () : 2736
 1-27: 14:27:37.990 Interface added: 192.168.7.5/255.255.255.0 on LAN
"Compex RE100ATX/WOL PCI (NDIS5) Fast Ethernet Adapter".
 1-27: 14:27:37.990 Interface added: 192.168.1.76/255.255.255.0 on LAN
"D-Link DFE-538TX 10/100 Adapter".
 1-27: 14:28:26.600  
 1-27: 14:28:26.820 Microsoft IPsec VPN\L2TP/IPsec - Initiating IKE
Phase 1 (IP ADDR=192.168.1.77)
 1-27: 14:28:26.820 Microsoft IPsec VPN\L2TP/IPsec - Generic entry match
with remote address 192.168.1.77.
 1-27: 14:28:26.820 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK MM (SA, VID, VID, VID)
 1-27: 14:28:26.820 Microsoft IPsec VPN\L2TP/IPsec - RECEIVED<<< ISAKMP
OAK MM (SA)
 1-27: 14:28:26.880 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK MM (KE, NON, VID, VID, VID, VID)
 1-27: 14:28:26.880 Microsoft IPsec VPN\L2TP/IPsec - RECEIVED<<< ISAKMP
OAK MM (KE, NON)
 1-27: 14:28:26.930 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK MM *(ID, HASH, NOTIFY:STATUS_INITIAL_CONTACT)
 1-27: 14:28:26.930 Microsoft IPsec VPN\L2TP/IPsec - RECEIVED<<< ISAKMP
OAK MM *(ID, HASH)
 1-27: 14:28:26.930 Microsoft IPsec VPN\L2TP/IPsec - Established IKE SA
 1-27: 14:28:26.930    MY COOKIE 68 64 be 7c 71 2d 7e 35
 1-27: 14:28:26.930    HIS COOKIE bc ed 81 eb 46 ed 9 64
 1-27: 14:28:26.930 Microsoft IPsec VPN\L2TP/IPsec - Initiating IKE
Phase 2 with Client IDs (message id: F9F2BB53)
 1-27: 14:28:26.930   Initiator = IP ADDR=192.168.1.76, prot = 17 port =
1701
 1-27: 14:28:26.930   Responder = IP ADDR=192.168.1.77, prot = 17 port =
1701
 1-27: 14:28:26.930 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(HASH, SA, NON, ID, ID)
 1-27: 14:28:31.980 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: F9F2BB53). Retry count: 1
 1-27: 14:28:31.980 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:28:36.980 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: F9F2BB53). Retry count: 2
 1-27: 14:28:36.980 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:28:41.980 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: F9F2BB53). Retry count: 3
 1-27: 14:28:41.980 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:28:47.030 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: F9F2BB53). Retry count: 4
 1-27: 14:28:47.030 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:28:51.700  
 1-27: 14:28:51.700 Microsoft IPsec VPN\L2TP/IPsec - Generic entry match
with remote address 192.168.1.77.
 1-27: 14:28:52.030 Microsoft IPsec VPN\L2TP/IPsec - QM re-keying timed
out (message id: F9F2BB53). Retry count: 5
 1-27: 14:28:52.030 Microsoft IPsec VPN\L2TP/IPsec - SENDING>>>> ISAKMP
OAK QM *(Retransmission)
 1-27: 14:28:57.030 Microsoft IPsec VPN\L2TP/IPsec - Exceeded 5
re-keying attempts (message id: F9F2BB53)

Any ideas. 

regards,

adharsh.

-- 
---------------------
Think big