Quantcast
Channel: EdgeRouter topics
Viewing all articles
Browse latest Browse all 20028

l2tp not working since v1.8 update

$
0
0

Hi Guys

 

Recently update my ERPoE to v1.8 and having a few issues with VPN since then.

 

IPSec site-to-Site had issues initally, which were related to PFS settigns and were reolved (http://community.ubnt.com/t5/EdgeMAX-Beta/1-8-0a1-Entire-VPN-tree-configuration-disappeared-after-update/m-p/1338518#U1338518)

 

My L2TP remote access vpn's have not been working since the upgrade.  The swanctl --log command give the following. VPN section of the config also attached.

 

I'm at a loss - outside my expertise.  Can anyone shed some light ont his for me?

 

Thanks!

 

06[ENC] generating INFORMATIONAL_V1 request 136326413 [ N(NO_PROP) ]
06[NET] sending packet: from xxx.xxx.xxx.10[500] to xxx.xxx.xxx.7[500] (56 bytes)
15[NET] received packet: from xxx.xxx.xxx.7[500] to xxx.xxx.xxx.10[500] (500 bytes)
15[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V ]
15[IKE] received NAT-T (RFC 3947) vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID
15[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
15[IKE] received FRAGMENTATION vendor ID
15[IKE] received DPD vendor ID
15[IKE] xxx.xxx.xxx.7 is initiating a Main Mode IKE_SA
15[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_128/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_MD5_96/PRF_HMAC_MD5/MODP_1024
15[CFG] configured proposals: IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/ECP_256
15[IKE] no proposal found

 

ipsec {
     auto-firewall-nat-exclude disable
     disable-uniqreqids
     esp-group ESP-Group1 {
         compression disable
         lifetime 1800
         mode tunnel
         pfs dh-group19
         proposal 1 {
             encryption 3des
             hash sha1
         }
     }
     esp-group ESP-Group2 {
         compression disable
         lifetime 600
         mode tunnel
         pfs dh-group2
         proposal 1 {
             encryption 3des
             hash sha1
         }
     }
     ike-group IKE-Group1 {
         dead-peer-detection {
             action clear
             interval 30
             timeout 90
         }
         key-exchange ikev1
         lifetime 3600
         proposal 1 {
             dh-group 2
             encryption 3des
             hash sha1
         }
         proposal 2 {
             dh-group 2
             encryption 3des
             hash sha1
         }
     }
     ike-group IKE-Group2 {
         key-exchange ikev1
         lifetime 3600
         proposal 1 {
             dh-group 19
             encryption 3des
             hash sha1
         }
     }
     ipsec-interfaces {
         interface pppoe0
     }
     nat-networks {
         allowed-network 0.0.0.0/0 {
         }
     }
     nat-traversal enable
     site-to-site {
         peer xxx.xxx.xxx.114 {
             authentication {
                 mode pre-shared-secret
                 pre-shared-secret ******
             }
             connection-type respond
             default-esp-group ESP-Group2
             ike-group IKE-Group1
             local-address xxx.xxx.xxx.10
             tunnel 1 {
                 allow-nat-networks disable
                 allow-public-networks disable
                 esp-group ESP-Group1
                 local {
                     prefix ***.***.***.0/24
                 }
                 remote {
                     prefix ***.***.***.0/24
                 }
             }
         }
         peer ***.***.***.7 {
             authentication {
                 mode pre-shared-secret
                 pre-shared-secret ******
             }
             connection-type respond
             default-esp-group ESP-Group1
             ike-group IKE-Group2
             local-address ***.***.***.10
             tunnel 1 {
                 esp-group ESP-Group1
                 local {
                     prefix ***.***.***.0/24
                 }
                 remote {
                     prefix ***.***.***.0/24
                 }
             }
         }
     }
 }
 l2tp {
     remote-access {
         authentication {
             local-users {
                 username number1 {
                     password *****
                 }
             }
             mode local
         }
         client-ip-pool {
             start 192.168.11.60
             stop 192.168.11.69
         }
         dns-servers {
             server-1 ***.***.***.20
             server-2 8.8.4.4
         }
         ipsec-settings {
             authentication {
                 mode pre-shared-secret
                 pre-shared-secret *****
             }
             ike-lifetime 3600
         }
         mtu 1492
         outside-address ***.***.***.10
         outside-nexthop ***.***.***.245
     }
 }

Viewing all articles
Browse latest Browse all 20028

Trending Articles