I've got l2tp working from a windows client to EdgeOS with RASIUS windows server. A few hours ago, it stopped connecting, so I looked at the EdgeOS /var/log/messages log. There were addresses in the trace I didn't understand. Then after 'a couple of hours' I tried the connection, and it worked fine.
My Static IP is 70.35.96.66. The addresses showing up in the trace that I don't understand are 70.35.108.118. I'm guessing this has to be an address within the ISP... would it be the fiber modem?
My question is : Why was the connection failing? Why did it start working after awhile? Do I need to involve my ISP? What do I ask them?
Thanks,
Kirby
Here's the trace:
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: received Vendor ID payload [RFC 3947]
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [FRAGMENTATION]
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Jul 29 00:37:47 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [IKE CGA version 1]
Jul 29 00:37:47 ubnt pluto[1666]: "remote-access-mac-zzz"[99] 70.35.108.118 #104: responding to Main Mode from unknown peer 70.35.108.118
Jul 29 00:37:47 ubnt pluto[1666]: "remote-access-mac-zzz"[99] 70.35.108.118 #104: Oakley Transform [AES_CBC (256), HMAC_SHA1, ECP_384] refused due to strict flag
Jul 29 00:37:47 ubnt pluto[1666]: "remote-access-mac-zzz"[99] 70.35.108.118 #104: Oakley Transform [AES_CBC (128), HMAC_SHA1, ECP_256] refused due to strict flag
Jul 29 00:37:47 ubnt pluto[1666]: "remote-access-mac-zzz"[99] 70.35.108.118 #104: Oakley Transform [AES_CBC (256), HMAC_SHA1, MODP_2048] refused due to strict flag
Jul 29 00:37:47 ubnt pluto[1666]: "remote-access-mac-zzz"[99] 70.35.108.118 #104: Oakley Transform [3DES_CBC (192), HMAC_SHA1, MODP_2048] refused due to strict flag
Jul 29 00:37:48 ubnt pluto[1666]: "remote-access-mac-zzz"[99] 70.35.108.118 #104: NAT-Traversal: Result using RFC 3947: peer is NATed
Jul 29 00:37:48 ubnt pluto[1666]: "remote-access-mac-zzz"[99] 70.35.108.118 #104: Peer ID is ID_IPV4_ADDR: '192.168.0.191'
Jul 29 00:37:48 ubnt pluto[1666]: "remote-access-mac-zzz"[100] 70.35.108.118 #104: deleting connection "remote-access-mac-zzz" instance with peer 70.35.108.118 {isakmp=#0/ipsec=#0}
Jul 29 00:37:48 ubnt pluto[1666]: "remote-access-mac-zzz"[100] 70.35.108.118:4500 #104: sent MR3, ISAKMP SA established
Jul 29 00:37:48 ubnt pluto[1666]: "remote-access-mac-zzz"[100] 70.35.108.118:4500 #105: NAT-Traversal: received 2 NAT-OA. using first, ignoring others
Jul 29 00:37:48 ubnt pluto[1666]: "remote-access-mac-zzz"[100] 70.35.108.118:4500 #105: responding to Quick Mode
Jul 29 00:37:48 ubnt pluto[1666]: "remote-access-mac-zzz"[100] 70.35.108.118:4500 #105: IPsec SA established {ESP=>0xecf4d950 <0xc73d7bfc NATOA=192.168.0.191}
Jul 29 00:37:50 ubnt xl2tpd[2122]: Connection established to 70.35.108.118, 1701. Local: 58949, Remote: 1 (ref=0/0). LNS session is 'default'
Jul 29 00:37:50 ubnt xl2tpd[2122]: Call established with 70.35.108.118, Local: 54148, Remote: 1, Serial: 0
Jul 29 00:37:50 ubnt pppd[18697]: pppd 2.4.4 started by root, uid 0
Jul 29 00:37:50 ubnt pppd[18697]: Connect: ppp0 <--> /dev/pts/1
Jul 29 00:37:50 ubnt zebra[601]: interface ppp0 index 43 <POINTOPOINT,NOARP,MULTICAST> added.
Jul 29 00:37:53 ubnt zebra[601]: interface ppp0 mtu changed from 1500 to 1024
Jul 29 00:37:53 ubnt pppd[18697]: Unsupported protocol 'Compression Control Protocol' (0x80fd) received
Jul 29 00:37:53 ubnt zebra[601]: warning: PtP interface ppp0 with addr 10.255.255.0/32 needs a peer address
Jul 29 00:37:53 ubnt zebra[601]: interface index 43 was renamed from ppp0 to l2tp0
Jul 29 00:37:53 ubnt zebra[601]: interface l2tp0 index 43 changed <UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>.
Jul 29 00:37:53 ubnt pppd[18697]: local IP address 10.255.255.0
Jul 29 00:37:53 ubnt pppd[18697]: remote IP address 192.168.1.200
---------------- End 'good' trace
--------------- Part of trace where connection failed
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: received Vendor ID payload [RFC 3947]
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [FRAGMENTATION]
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Jul 28 22:31:17 ubnt pluto[1666]: packet from 70.35.108.118:500: ignoring Vendor ID payload [IKE CGA version 1]
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[96] 70.35.108.118 #101: responding to Main Mode from unknown peer 70.35.108.118
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[96] 70.35.108.118 #101: Oakley Transform [AES_CBC (256), HMAC_SHA1, ECP_384] refused due to strict flag
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[96] 70.35.108.118 #101: Oakley Transform [AES_CBC (128), HMAC_SHA1, ECP_256] refused due to strict flag
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[96] 70.35.108.118 #101: Oakley Transform [AES_CBC (256), HMAC_SHA1, MODP_2048] refused due to strict flag
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[96] 70.35.108.118 #101: Oakley Transform [3DES_CBC (192), HMAC_SHA1, MODP_2048] refused due to strict flag
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[96] 70.35.108.118 #101: NAT-Traversal: Result using RFC 3947: peer is NATed
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[96] 70.35.108.118 #101: Peer ID is ID_IPV4_ADDR: '192.168.0.191'
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118 #101: deleting connection "remote-access-mac-zzz" instance with peer 70.35.108.118 {isakmp=#0/ipsec=#0}
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #101: sent MR3, ISAKMP SA established
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #102: NAT-Traversal: received 2 NAT-OA. using first, ignoring others
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #102: responding to Quick Mode
Jul 28 22:31:17 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #102: cannot install eroute -- it is in use for "remote-access-mac-zzz"[79] 70.35.108.118:4500 #82
Jul 28 22:31:18 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #101: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x00000001 (perhaps this is a duplicated packet)
Jul 28 22:31:18 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #101: sending encrypted notification INVALID_MESSAGE_ID to 70.35.108.118:4500
Jul 28 22:31:19 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #101: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x00000001 (perhaps this is a duplicated packet)
Jul 28 22:31:19 ubnt pluto[1666]: "remote-access-mac-zzz"[97] 70.35.108.118:4500 #101: sending encrypted notification INVALID_MESSAGE_ID to 70.35.108.118:4500