VPN Client not connecting [SOLVED]

Duco Ergo Sum

Hi there,

For the past week and a bit I have been trying to connect to my office VPN, without success. The instructions for connecting assume the client is a Windows 7 system.

The vpn is "IPSec (L2TP/IPSEC)" using a Pre-Shared Key.

For the purpose of this post I will use faux details and values:

gateway: vpn.office.com
PSK: vpn-office-com
username: your-login-username
password: your-login-password
domain (optional): office-name

What I have tried so far, includes:

compiled every IPSEC kernel module -> No appreciable difference.

KVPN -> Gives an error racoon config error and then a long list of other debug info which as it is security related I don't want post indiscriminately.

VPNC -> reports "No responce from target"
Cisco and regular UPD
I have tried setting various ports to use, 47, 50, 51, 443, 500, 1701, 1723, 10000

Strongswan -> the demon starts but I cannot find evidence of a connection
ipsec.conf and ipsec.secret configured for the above details respectively.

I can only guess that this isn't a firewall issue as a colleague who already connects to the vpn can only do so using a virtual machine running Windows 7. My colleague says this is because of
firewall and routing issues from his Linux desktop. My assertion being that the virtual machines has to pass through the host and any other firewall in his network.

Please help...

salahx · Guru Joined: 12 Mar 2005 Posts: 530

I wrote a Gentoo wiki article covering setting up the server side of it: https://wiki.gentoo.org/wiki/IPsec_L2TP_VPN_server . Because all the protocols (ipsec, lt2p and pppd) are peer-to-peer, configuring it on the client side has a lot of similarities.

Duco Ergo Sum · Posted: Thu Aug 21, 2014 7:59 am Post subject:

Thank you.

I think what I need is the "Ipsec ID" (group id/name) parameter. I have a working Windows system now so I'll interrogate that.

Duco Ergo Sum · Posted: Mon Aug 25, 2014 10:20 pm Post subject:

This is really frustrating.

I now have:

VPNC which times out without much indication of anything happening.
StrongSwan which starts but I don't see any sign of a VPN nor have I found a way to test it.
OpenL2TP which I've had to install an overlay (booboo) to get. This doesn't seem to be able to initiate sessions, tunnel id not found, while tunnel show - shows the tunnel I configured.
NetworkManager seems to allow a sub-set of functionality in its configuration of different sub-systems but it protests that its unable to find an agent when I try to start a session.

Additionally, I've experimented with Windows. The initial setup is tricky but the VPN works. No additional information needed. With security in mind I'm sure, they've hidden the config details from prying eyes thus thwarting my plan to find the IP Sec ID there.

I am beginning to question if it this is a propriety MS VPN implementation or could my system be just missing one little screw somewhere?

I have read the IPsec L2TP VPN server wiki page and attempted to adapt its wisdom to my needs but unfortunately unsuccessfully.

Please tell me how I can test a VPN connection, just to see if it exists?

--
You know you really need help when the voices tell you that you're becoming obsessed!

salahx · Guru Joined: 12 Mar 2005 Posts: 530

The first, and most dificult layer, is the ipsec layer. Here's a simple config file you can adapt. AS the wiki page show, uncomment the "include" line at the very bottom of /etc/ipsec.conf and create a /etc/ipsec.d/office.vpn.com.conf with content similar to the following:

Duco Ergo Sum · Posted: Thu Aug 28, 2014 12:48 am Post subject:

Hi Salahx,

Thanks for again answering, I am very grateful.

The command 'ipsec up vpnclient' has been most illustrative. StrongSwan doesn't get a response from the office network either.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Its seeing SOMETHING on the other side, its just having trouble negotiating with it. It appears its trying to negoitate an IKEv2 connection, but we want IKEv1.

So lets tweak the config a bit:

Duco Ergo Sum · Posted: Thu Aug 28, 2014 8:49 am Post subject:

Thanks.

We're making progress, new response message:

Duco Ergo Sum · Posted: Thu Aug 28, 2014 9:12 am Post subject:

Looking in Windows

Control Panel - Administrative Tools - Windows Firewall with Advanced Security - Windows Firewall Properites (IPsec Settings) - Customize IPsec Defaults (Key exchange (Main Mode) - Advanced [Customize]) - Customize Advanced Key Exchange Settings

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Its "pfs=no" not "psf=no". It doesn't matter anyway because the command is ignored under strongSwan and "no" is the default. You shouldn't need the "esp=des-sha1-modp1024" as it should choose the correct method during proposition process. In fact that will negotate PFS which is NOT what you want - Microsoft's IKEv1 daemon doesn't support PFS.

Note that Windows has TWO implementations of ipsec: the IKEv1 one used for l2tp tunnel, and and IKEv2 one which is controlled via the ipsec snap-in. The windows Firewall and other ipsec settings refer to the latter, but we want to use the former.

Duco Ergo Sum · Posted: Fri Aug 29, 2014 12:04 am Post subject:

Apologies, "psf" was a typo.

However, now mater how I try to configure the pfs option, I get the same result.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

pfs option is ignored in strongSwan anyway. But that "esp" line has to be removed, because i know its wrong. If the server STILL won't accept any proposals offered by strongswan, even without the "esp" line there an "ike-scan" package in portage that should give some information on what proposals the gateway will accept.

Duco Ergo Sum · Posted: Fri Aug 29, 2014 8:45 am Post subject:

Hi,

I have used IKE-Scan which prompted me to change my Config as below and this has generated the follow information.

ike-scan output

salahx · Guru Joined: 12 Mar 2005 Posts: 530

OK now its accepting the proposal but its having problem with the PSK. It probably has to do with how the VPN server is ideifying itself. So lets change the secrets file to

Duco Ergo Sum · Posted: Fri Aug 29, 2014 9:51 pm Post subject:

Awesome! Thank you!

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Were almost there, but were not there yet. This goes back with "how the server is identifty itself" problem with the PSK: Instead of identify itself via its name (vpn.example.com), it does so by its IP address (17.11.7.5).

We just need to make one tweak:

Duco Ergo Sum · Posted: Sat Aug 30, 2014 5:21 pm Post subject:

Perfect, next step L2TP!

Duco Ergo Sum · Posted: Sat Aug 30, 2014 10:04 pm Post subject:

I thought this might happen.

/etc/xl2tp/xl2tpd.conf

salahx · Guru Joined: 12 Mar 2005 Posts: 530

Configuring an l2tp the client is a different that the server - thakfully client side is even easier:

The /etc/xl2tpd/xl2tpd.conf is even simpler then the server one:

Duco Ergo Sum · Posted: Sun Aug 31, 2014 11:58 pm Post subject:

Hi,

I have now tried a number of variations on a theme. Mostly where vpn.office.com could mean the url vpn.office.com or the ipsec connection name VPN.OFFICE.COM, capitalise to emphasis the distinciton
of these two roles. Also with and without OFFICE-NAME\\login-name login-password and in combination with including excluding options.xl2tpd.client.

/etc/xl2tpd/xl2tpd.conf

salahx · Guru Joined: 12 Mar 2005 Posts: 530

xl2tpd and strongswan are unconnect, thus the "lns" value in the LAC section is just the server's domain name or IP address. In this case though, its not seeing the L2TP LNS (server) on the other side . This usually means the ipsec tunnel is down. Check and restart the tunnel if needed.

To see if data is going over the tunnel:

Duco Ergo Sum · Posted: Tue Sep 02, 2014 9:09 am Post subject:

Hi,

I have tried variety configurations of xl2tp. Just to add to the confusion my mobo has two lan ports and wifi, I fear now this feature is coming back to confuse me and my set-up. 'eno1' is the lan port which is would be eth0 and is currently the only operational network connection in this machine.

It appears that tcpdump is looking at 'bond0' and then not finding anything. Could xl2tp be doing the same?

tcpdump -i eno1 produces the same output as below.

Make connection

salahx · Guru Joined: 12 Mar 2005 Posts: 530

We're making progress. According to the log, it seeing the l2tp server on the other end. That means the ipsec is up and configurated properly, and traffic is flowing across it..Now the problem is pppd. pppd is getting some extraneous options from somewhere. Namely, the nonexistent "/etc/ppp/options.l2tpd.lns" is causing pppd to exit. However it shouldn't even be looking for that.

Very little configuration should be needed on the l2tp side,, but there may be one tweak we need:

Duco Ergo Sum · Posted: Wed Sep 03, 2014 12:41 am Post subject:

I discovered a typo in the /etc/ppp/options.xl2tpd.client path namely the missing 'x'. Also I have added the user name as you have advised and no joy.

salahx · Guru Joined: 12 Mar 2005 Posts: 530

The name used for the lac isn't important. Its not seeing the l2tp server again. Be sure the strongSwan connection is up, and try again. If it still won'r work, stop strongswan and xl2tp, in another windows do a "ip xfrm monitor", starts strongswan and xl2tpd. Connect via strongSwan and the window "ip xfrm monitor" should display some stuff. Make a connection with xl2tpd-connect and more stuff will appear in the other window (warning: this command outputs the secrets keys for the ipsec connection. The real keys have been replaced with 0's)

Something like this: