L2TP over IPsec VPN Manager

Unable to connect to L2TP/IPSec VPN with ubuntu 17.10

Bug #1746013 reported by Jorge Ulises Useche Cuellar on 2018-01-29

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	L2TP over IPsec VPN Manager	Invalid	Undecided	Douglas Kosovic

Bug Description

Recently I've lost the vpn connection, maybe with some update, previous to this the connection was successful.
The connection in Windows it's working so well, and my VPN provider has told to me that he has not changed something.

The current versions:

network-manager-l2tp/artful,now 1.2.8-1 amd64 [installed,automatic]
network management framework (L2TP plugin core)

network-manager-l2tp-gnome/artful,now 1.2.8-1 amd64 [installed]
network management framework (L2TP plugin GNOME GUI)

xl2tpd/artful,now 1.3.8+dfsg-1 amd64 [installed]
layer 2 tunneling protocol implementation

strongswan/artful,artful,now 5.5.1-4ubuntu2 all [installed]
IPsec VPN solution metapackage

strongswan-nm/artful 5.5.1-4ubuntu2 amd64
strongSwan plugin to interact with NetworkManager

The result of ike-scan.sh

jorge@ulises:~/Desktop$ sudo ./ike-scan.sh vpn.somedomain.com | grep SA | grep -v NO-PROPOSAL
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)
SA=(Enc=AES KeyLength=128 Hash=SHA1 Group=19 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)
SA=(Enc=AES KeyLength=256 Hash=SHA1 Group=20 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)

The log of connection:

jorge@ulises:~$ journalctl -f -u NetworkManager
ene 28 22:16:42 ulises NetworkManager[803]: <info> [1517195802.6422] audit: op="connection-activate" uuid="d812fb2d-2212-44d6-a8b7-aff603b6ed10" name="MY VPN CONN" pid=1472 uid=1000 result="success"
ene 28 22:16:42 ulises NetworkManager[803]: <info> [1517195802.6549] vpn-connection[0x561cee7d82c0,d812fb2d-2212-44d6-a8b7-aff603b6ed10,"MY VPN CONN",0]: Started the VPN service, PID 15487
ene 28 22:16:42 ulises NetworkManager[803]: <info> [1517195802.6642] vpn-connection[0x561cee7d82c0,d812fb2d-2212-44d6-a8b7-aff603b6ed10,"MY VPN CONN",0]: Saw the service appear; activating connection
ene 28 22:16:42 ulises NetworkManager[803]: <info> [1517195802.7641] vpn-connection[0x561cee7d82c0,d812fb2d-2212-44d6-a8b7-aff603b6ed10,"MY VPN CONN",0]: VPN connection: (ConnectInteractive) reply received
ene 28 22:16:42 ulises nm-l2tp-service[15487]: Check port 1701
ene 28 22:16:42 ulises nm-l2tp-service[15487]: Can't bind to port 1701
ene 28 22:16:42 ulises NetworkManager[803]: Stopping strongSwan IPsec failed: starter is not running
ene 28 22:16:44 ulises NetworkManager[803]: Starting strongSwan 5.5.1 IPsec [starter]...
ene 28 22:16:44 ulises NetworkManager[803]: Loading config setup
ene 28 22:16:44 ulises NetworkManager[803]: Loading conn 'd812fb2d-2212-44d6-a8b7-aff603b6ed10'
ene 28 22:16:44 ulises ipsec_starter[15505]: Starting strongSwan 5.5.1 IPsec [starter]...
ene 28 22:16:44 ulises ipsec_starter[15505]: Loading config setup
ene 28 22:16:44 ulises ipsec_starter[15505]: Loading conn 'd812fb2d-2212-44d6-a8b7-aff603b6ed10'
ene 28 22:16:44 ulises NetworkManager[803]: found netkey IPsec stack
ene 28 22:16:44 ulises ipsec_starter[15505]: found netkey IPsec stack
ene 28 22:16:44 ulises ipsec_starter[15526]: Attempting to start charon...
ene 28 22:16:44 ulises charon[15527]: 00[DMN] Starting IKE charon daemon (strongSwan 5.5.1, Linux 4.13.0-31-generic, x86_64)
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading crls from '/etc/ipsec.d/crls'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading secrets from '/etc/ipsec.secrets'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-0ca371a4-cc35-4462-8dc5-36e516fae405.secrets'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loaded IKE secret for %any
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-12c1d3f0-ca65-4e0e-b95e-659062d377bd.secrets'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loaded IKE secret for %any
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-4412e7d5-8ea3-41e4-bdfe-0ba60b41eeca.secrets'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loaded IKE secret for %any
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-8800b906-99f8-45aa-aa9d-35324e9cb297.secrets'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loaded IKE secret for %any
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-d812fb2d-2212-44d6-a8b7-aff603b6ed10.secrets'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loaded IKE secret for %any
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-f5334845-9c98-4738-90ca-9e0c2af858d5.secrets'
ene 28 22:16:44 ulises charon[15527]: 00[CFG] loaded IKE secret for %any
ene 28 22:16:44 ulises charon[15527]: 00[LIB] loaded plugins: charon test-vectors aesni aes rc2 sha2 sha1 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac ccm gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic
ene 28 22:16:44 ulises charon[15527]: 00[LIB] dropped capabilities, running as uid 0, gid 0
ene 28 22:16:44 ulises charon[15527]: 00[JOB] spawning 16 worker threads
ene 28 22:16:44 ulises ipsec_starter[15526]: charon (15527) started after 20 ms
ene 28 22:16:44 ulises charon[15527]: 05[CFG] received stroke: add connection 'd812fb2d-2212-44d6-a8b7-aff603b6ed10'
ene 28 22:16:44 ulises charon[15527]: 05[CFG] added configuration 'd812fb2d-2212-44d6-a8b7-aff603b6ed10'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] rereading secrets
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loading secrets from '/etc/ipsec.secrets'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-0ca371a4-cc35-4462-8dc5-36e516fae405.secrets'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loaded IKE secret for %any
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-12c1d3f0-ca65-4e0e-b95e-659062d377bd.secrets'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loaded IKE secret for %any
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-4412e7d5-8ea3-41e4-bdfe-0ba60b41eeca.secrets'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loaded IKE secret for %any
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-8800b906-99f8-45aa-aa9d-35324e9cb297.secrets'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loaded IKE secret for %any
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-d812fb2d-2212-44d6-a8b7-aff603b6ed10.secrets'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loaded IKE secret for %any
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-f5334845-9c98-4738-90ca-9e0c2af858d5.secrets'
ene 28 22:16:45 ulises charon[15527]: 07[CFG] loaded IKE secret for %any
ene 28 22:16:45 ulises charon[15527]: 09[CFG] received stroke: initiate 'd812fb2d-2212-44d6-a8b7-aff603b6ed10'
ene 28 22:16:45 ulises charon[15527]: 11[IKE] initiating Main Mode IKE_SA d812fb2d-2212-44d6-a8b7-aff603b6ed10[1] to 200.69.103.48
ene 28 22:16:45 ulises charon[15527]: 11[IKE] initiating Main Mode IKE_SA d812fb2d-2212-44d6-a8b7-aff603b6ed10[1] to 200.69.103.48
ene 28 22:16:45 ulises charon[15527]: 11[ENC] generating ID_PROT request 0 [ SA V V V V V ]
ene 28 22:16:45 ulises charon[15527]: 11[NET] sending packet: from 192.168.0.16[500] to 200.69.103.48[500] (304 bytes)
ene 28 22:16:45 ulises charon[15527]: 12[NET] received packet: from 200.69.103.48[500] to 192.168.0.16[500] (208 bytes)
ene 28 22:16:45 ulises charon[15527]: 12[ENC] parsed ID_PROT response 0 [ SA V V V V V V ]
ene 28 22:16:45 ulises charon[15527]: 12[IKE] received MS NT5 ISAKMPOAKLEY vendor ID
ene 28 22:16:45 ulises charon[15527]: 12[IKE] received NAT-T (RFC 3947) vendor ID
ene 28 22:16:45 ulises charon[15527]: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
ene 28 22:16:45 ulises charon[15527]: 12[IKE] received FRAGMENTATION vendor ID
ene 28 22:16:45 ulises charon[15527]: 12[ENC] received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20
ene 28 22:16:45 ulises charon[15527]: 12[ENC] received unknown vendor ID: e3:a5:96:6a:76:37:9f:e7:07:22:82:31:e5:ce:86:52
ene 28 22:16:45 ulises charon[15527]: 12[ENC] generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
ene 28 22:16:45 ulises charon[15527]: 12[NET] sending packet: from 192.168.0.16[500] to 200.69.103.48[500] (244 bytes)
ene 28 22:16:45 ulises charon[15527]: 13[NET] received packet: from 200.69.103.48[500] to 192.168.0.16[500] (260 bytes)
ene 28 22:16:45 ulises charon[15527]: 13[ENC] parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
ene 28 22:16:45 ulises charon[15527]: 13[IKE] local host is behind NAT, sending keep alives
ene 28 22:16:45 ulises charon[15527]: 13[ENC] generating ID_PROT request 0 [ ID HASH ]
ene 28 22:16:45 ulises charon[15527]: 13[NET] sending packet: from 192.168.0.16[4500] to 200.69.103.48[4500] (68 bytes)
ene 28 22:16:45 ulises charon[15527]: 15[NET] received packet: from 200.69.103.48[500] to 192.168.0.16[500] (260 bytes)
ene 28 22:16:45 ulises charon[15527]: 15[IKE] received retransmit of response with ID 0, but next request already sent
ene 28 22:16:49 ulises charon[15527]: 06[IKE] sending retransmit 1 of request message ID 0, seq 3
ene 28 22:16:49 ulises charon[15527]: 06[NET] sending packet: from 192.168.0.16[4500] to 200.69.103.48[4500] (68 bytes)
ene 28 22:16:49 ulises charon[15527]: 05[NET] received packet: from 200.69.103.48[500] to 192.168.0.16[500] (260 bytes)
ene 28 22:16:49 ulises charon[15527]: 05[IKE] received retransmit of response with ID 0, but next request already sent
ene 28 22:16:55 ulises NetworkManager[803]: Stopping strongSwan IPsec...
ene 28 22:16:55 ulises charon[15527]: 00[DMN] signal of type SIGINT received. Shutting down
ene 28 22:16:55 ulises charon[15527]: 00[IKE] destroying IKE_SA in state CONNECTING without notification
ene 28 22:16:55 ulises NetworkManager[803]: initiating Main Mode IKE_SA d812fb2d-2212-44d6-a8b7-aff603b6ed10[1] to 200.69.103.48
ene 28 22:16:55 ulises NetworkManager[803]: generating ID_PROT request 0 [ SA V V V V V ]
ene 28 22:16:55 ulises NetworkManager[803]: sending packet: from 192.168.0.16[500] to 200.69.103.48[500] (304 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: received packet: from 200.69.103.48[500] to 192.168.0.16[500] (208 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: parsed ID_PROT response 0 [ SA V V V V V V ]
ene 28 22:16:55 ulises NetworkManager[803]: received MS NT5 ISAKMPOAKLEY vendor ID
ene 28 22:16:55 ulises NetworkManager[803]: received NAT-T (RFC 3947) vendor ID
ene 28 22:16:55 ulises NetworkManager[803]: received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
ene 28 22:16:55 ulises NetworkManager[803]: received FRAGMENTATION vendor ID
ene 28 22:16:55 ulises NetworkManager[803]: received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20
ene 28 22:16:55 ulises NetworkManager[803]: received unknown vendor ID: e3:a5:96:6a:76:37:9f:e7:07:22:82:31:e5:ce:86:52
ene 28 22:16:55 ulises NetworkManager[803]: generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
ene 28 22:16:55 ulises NetworkManager[803]: sending packet: from 192.168.0.16[500] to 200.69.103.48[500] (244 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: received packet: from 200.69.103.48[500] to 192.168.0.16[500] (260 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
ene 28 22:16:55 ulises NetworkManager[803]: local host is behind NAT, sending keep alives
ene 28 22:16:55 ulises NetworkManager[803]: generating ID_PROT request 0 [ ID HASH ]
ene 28 22:16:55 ulises NetworkManager[803]: sending packet: from 192.168.0.16[4500] to 200.69.103.48[4500] (68 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: received packet: from 200.69.103.48[500] to 192.168.0.16[500] (260 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: received retransmit of response with ID 0, but next request already sent
ene 28 22:16:55 ulises NetworkManager[803]: sending retransmit 1 of request message ID 0, seq 3
ene 28 22:16:55 ulises NetworkManager[803]: sending packet: from 192.168.0.16[4500] to 200.69.103.48[4500] (68 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: received packet: from 200.69.103.48[500] to 192.168.0.16[500] (260 bytes)
ene 28 22:16:55 ulises NetworkManager[803]: received retransmit of response with ID 0, but next request already sent
ene 28 22:16:55 ulises NetworkManager[803]: destroying IKE_SA in state CONNECTING without notification
ene 28 22:16:55 ulises NetworkManager[803]: establishing connection 'd812fb2d-2212-44d6-a8b7-aff603b6ed10' failed
ene 28 22:16:55 ulises nm-l2tp-service[15487]: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
ene 28 22:16:55 ulises NetworkManager[803]: <info> [1517195815.9985] vpn-connection[0x561cee7d82c0,d812fb2d-2212-44d6-a8b7-aff603b6ed10,"MY VPN CONN",0]: VPN plugin: state changed: stopped (6)
ene 28 22:16:56 ulises NetworkManager[803]: <info> [1517195816.0042] vpn-connection[0x561cee7d82c0,d812fb2d-2212-44d6-a8b7-aff603b6ed10,"MY VPN CONN",0]: VPN service disappeared
ene 28 22:16:56 ulises NetworkManager[803]: <warn> [1517195816.0071] vpn-connection[0x561cee7d82c0,d812fb2d-2212-44d6-a8b7-aff603b6ed10,"MY VPN CONN",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'

Tags:

Revision history for this message

Jorge Ulises Useche Cuellar (juusechec) wrote on 2018-01-29:

Download full text (7.9 KiB)

Paste aditional information as suggest in https://github.com/nm-l2tp/network-manager-l2tp/issues/70 https://github.com/nm-l2tp/network-manager-l2tp/issues/64

Phase 1 Algorithms: aes128-sha1-modp2048,3des-sha1-modp1536,3des-sha1-modp1024
Phase 2 Algorithms: aes128-sha1,3des-sha1

jorge@ulises:~/Desktop$ sudo killall -TERM nm-l2tp-service
jorge@ulises:~/Desktop$ sudo /usr/lib/NetworkManager/nm-l2tp-service --debug
nm-l2tp[26181] <debug> nm-l2tp-service (version 1.2.8) starting...
nm-l2tp[26181] <debug> uses default --bus-name "org.freedesktop.NetworkManager.l2tp"

nm-l2tp[26181] <info> ipsec enable flag: yes
** Message: Check port 1701
** Message: Can't bind to port 1701
nm-l2tp[26181] <warn> L2TP port 1701 is busy, using ephemeral.
connection
id : "MY VPN CONN" (s)
uuid : "d812fb2d-2212-44d6-a8b7-aff603b6ed10" (s)
interface-name : NULL (sd)
type : "vpn" (s)
permissions : ["user:jorge:"] (s)
autoconnect : FALSE (s)
autoconnect-priority : 0 (sd)
autoconnect-retries : -1 (sd)
timestamp : 1513964824 (s)
read-only : FALSE (sd)
zone : NULL (sd)
master : NULL (sd)
slave-type : NULL (sd)
autoconnect-slaves : ((NMSettingConnectionAutoconnectSlaves) NM_SETTING_CONNECTION_AUTOCONNECT_SLAVES_DEFAULT) (sd)
secondaries : NULL (sd)
gateway-ping-timeout : 0 (sd)
metered : ((NMMetered) NM_METERED_UNKNOWN) (sd)
lldp : -1 (sd)
stable-id : NULL (sd)

ipv6
method : "auto" (s)
dns : [] (s)
dns-search : [] (s)
dns-options : NULL (sd)
dns-priority : 0 (sd)
addresses : ((GPtrArray*) 0x55af6d3d3f60) (s)
gateway : NULL (sd)
routes : ((GPtrArray*) 0x55af6d3bed20) (s)
route-metric : -1 (sd)
ignore-auto-routes : FALSE (sd)
ignore-auto-dns : FALSE (sd)
dhcp-hostname : NULL (sd)
dhcp-send-hostname : TRUE (sd)
never-default : FALSE (sd)
may-fail : TRUE (sd)
dad-timeout : -1 (sd)
dhcp-timeout : 0 (sd)
ip6-privacy : ((NMSettingIP6ConfigPrivacy) NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN) (sd)
addr-gen-mode : 1 (sd)
token : NULL (sd)

proxy
method : 0 (sd)
browser-only : FALSE (sd)
pac-url : NULL (sd)
pac-script : NULL (sd)

vpn
service-type : "org.freedesktop.NetworkManager.l2tp" (s)
user-name : "jorge" (s)
persistent : FALSE (sd)
data : ((GHashTable*) 0x7f6100006cc0) (s)
secrets : ((GHashTable*) 0x55af6d3b4760) (s)
timeout : 0 (sd)

ipv4
method : "auto" (s)
dns : [] (s)
dns-search : [] (s)
dns-options : NULL (sd)
dns-priority : 0 (sd)
addresses : ((GPtrArray*) 0x7f61000014a0) (s)
gateway : NULL (sd)
routes : ((GPtrArray*) 0x7f61000014a0) (s)
route-metric : -1 (sd)
ignore-auto-routes : TRUE (s)
ignore-auto-dns : FALSE (sd)
dhcp-hostname : NULL (sd)
dhcp-send-hostname : TRUE (sd)
never-default : TRUE (s)
may-fail : TRUE (sd)
dad-timeout : -1 (sd)
dhcp-timeout : 0 (sd)
dhcp-client-id : NULL (sd)
dhcp-fqdn : NULL (sd)

Paste aditional information as suggest in https://github.com/nm-l2tp/network-manager-l2tp/issues/70 https://github.com/nm-l2tp/network-manager-l2tp/issues/64

Phase 1 Algorithms: aes128-sha1-modp2048,3des-sha1-modp1536,3des-sha1-modp1024
Phase 2 Algorithms: aes128-sha1,3des-sha1

jorge@ulises:~/Desktop$ sudo killall -TERM nm-l2tp-service
jorge@ulises:~/Desktop$ sudo /usr/lib/NetworkManager/nm-l2tp-service --debug
nm-l2tp[26181] <debug> nm-l2tp-service (version 1.2.8) starting...
nm-l2tp[26181] <debug>  uses default --bus-name "org.freedesktop.NetworkManager.l2tp"

nm-l2tp[26181] <info>  ipsec enable flag: yes
** Message: Check port 1701
** Message: Can't bind to port 1701
nm-l2tp[26181] <warn>  L2TP port 1701 is busy, using ephemeral.
connection
	id : "MY VPN CONN" (s)
	uuid : "d812fb2d-2212-44d6-a8b7-aff603b6ed10" (s)
	interface-name : NULL (sd)
	type : "vpn" (s)
	permissions : ["user:jorge:"] (s)
	autoconnect : FALSE (s)
	autoconnect-priority : 0 (sd)
	autoconnect-retries : -1 (sd)
	timestamp : 1513964824 (s)
	read-only : FALSE (sd)
	zone : NULL (sd)
	master : NULL (sd)
	slave-type : NULL (sd)
	autoconnect-slaves : ((NMSettingConnectionAutoconnectSlaves) NM_SETTING_CONNECTION_AUTOCONNECT_SLAVES_DEFAULT) (sd)
	secondaries : NULL (sd)
	gateway-ping-timeout : 0 (sd)
	metered : ((NMMetered) NM_METERED_UNKNOWN) (sd)
	lldp : -1 (sd)
	stable-id : NULL (sd)

ipv6
	method : "auto" (s)
	dns : [] (s)
	dns-search : [] (s)
	dns-options : NULL (sd)
	dns-priority : 0 (sd)
	addresses : ((GPtrArray*) 0x55af6d3d3f60) (s)
	gateway : NULL (sd)
	routes : ((GPtrArray*) 0x55af6d3bed20) (s)
	route-metric : -1 (sd)
	ignore-auto-routes : FALSE (sd)
	ignore-auto-dns : FALSE (sd)
	dhcp-hostname : NULL (sd)
	dhcp-send-hostname : TRUE (sd)
	never-default : FALSE (sd)
	may-fail : TRUE (sd)
	dad-timeout : -1 (sd)
	dhcp-timeout : 0 (sd)
	ip6-privacy : ((NMSettingIP6ConfigPrivacy) NM_SETTING_IP6_CONFIG_PRIVACY_UNKNOWN) (sd)
	addr-gen-mode : 1 (sd)
	token : NULL (sd)

proxy
	method : 0 (sd)
	browser-only : FALSE (sd)
	pac-url : NULL (sd)
	pac-script : NULL (sd)

vpn
	service-type : "org.freedesktop.NetworkManager.l2tp" (s)
	user-name : "jorge" (s)
	persistent : FALSE (sd)
	data : ((GHashTable*) 0x7f6100006cc0) (s)
	secrets : ((GHashTable*) 0x55af6d3b4760) (s)
	timeout : 0 (sd)

ipv4
	method : "auto" (s)
	dns : [] (s)
	dns-search : [] (s)
	dns-options : NULL (sd)
	dns-priority : 0 (sd)
	addresses : ((GPtrArray*) 0x7f61000014a0) (s)
	gateway : NULL (sd)
	routes : ((GPtrArray*) 0x7f61000014a0) (s)
	route-metric : -1 (sd)
	ignore-auto-routes : TRUE (s)
	ignore-auto-dns : FALSE (sd)
	dhcp-hostname : NULL (sd)
	dhcp-send-hostname : TRUE (sd)
	never-default : TRUE (s)
	may-fail : TRUE (sd)
	dad-timeout : -1 (sd)
	dhcp-timeout : 0 (sd)
	dhcp-client-id : NULL (sd)
	dhcp-fqdn : NULL (sd)

nm-l2tp[26181] <info>  starting ipsec
Stopping strongSwan IPsec failed: starter is not running
Starting strongSwan 5.5.1 IPsec [starter]...
Loading config setup
Loading conn 'd812fb2d-2212-44d6-a8b7-aff603b6ed10'
found netkey IPsec stack
nm-l2tp[26181] <info>  Spawned ipsec up script with PID 26248.
initiating Main Mode IKE_SA d812fb2d-2212-44d6-a8b7-aff603b6ed10[1] to 200.69.103.48
generating ID_PROT request 0 [ SA V V V V V ]
sending packet: from 192.168.0.16[500] to 200.69.103.48[500] (304 bytes)
received packet: from 200.69.103.48[500] to 192.168.0.16[500] (208 bytes)
parsed ID_PROT response 0 [ SA V V V V V V ]
received MS NT5 ISAKMPOAKLEY vendor ID
received NAT-T (RFC 3947) vendor ID
received draft-ietf-ipsec-nat-t-ike-02\n vendor ID
received FRAGMENTATION vendor ID
received unknown vendor ID: fb:1d:e3:cd:f3:41:b7:ea:16:b7:e5:be:08:55:f1:20
received unknown vendor ID: e3:a5:96:6a:76:37:9f:e7:07:22:82:31:e5:ce:86:52
generating ID_PROT request 0 [ KE No NAT-D NAT-D ]
sending packet: from 192.168.0.16[500] to 200.69.103.48[500] (244 bytes)
received packet: from 200.69.103.48[500] to 192.168.0.16[500] (260 bytes)
parsed ID_PROT response 0 [ KE No NAT-D NAT-D ]
local host is behind NAT, sending keep alives
generating ID_PROT request 0 [ ID HASH ]
sending packet: from 192.168.0.16[4500] to 200.69.103.48[4500] (68 bytes)
received packet: from 200.69.103.48[4500] to 192.168.0.16[4500] (68 bytes)
parsed ID_PROT response 0 [ ID HASH ]
IKE_SA d812fb2d-2212-44d6-a8b7-aff603b6ed10[1] established between 192.168.0.16[192.168.0.16]...200.69.103.48[200.69.103.48]
scheduling reauthentication in 10197s
maximum IKE_SA lifetime 10737s
generating QUICK_MODE request 909758342 [ HASH SA No ID ID NAT-OA NAT-OA ]
sending packet: from 192.168.0.16[4500] to 200.69.103.48[4500] (244 bytes)
received packet: from 200.69.103.48[4500] to 192.168.0.16[4500] (212 bytes)
parsed QUICK_MODE response 909758342 [ HASH SA No ID ID NAT-OA NAT-OA ]
CHILD_SA d812fb2d-2212-44d6-a8b7-aff603b6ed10{1} established with SPIs ca89bf90_i 4c616fe2_o and TS 192.168.0.16/32 === 200.69.103.48/32[udp/l2f]
connection 'd812fb2d-2212-44d6-a8b7-aff603b6ed10' established successfully
nm-l2tp[26181] <info>  strongSwan IPsec tunnel is up.
** Message: xl2tpd started with pid 26257
xl2tpd[26257]: setsockopt recvref[30]: Protocol not available
xl2tpd[26257]: Using l2tp kernel support.
xl2tpd[26257]: xl2tpd version xl2tpd-1.3.8 started on ulises PID:26257
xl2tpd[26257]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
xl2tpd[26257]: Forked by Scott Balmos and David Stipp, (C) 2001
xl2tpd[26257]: Inherited by Jeff McAdams, (C) 2002
xl2tpd[26257]: Forked again by Xelerance (www.xelerance.com) (C) 2006-2016
xl2tpd[26257]: Listening on IP address 0.0.0.0, port 46615
xl2tpd[26257]: get_call: allocating new tunnel for host 200.69.103.48, port 1701.
xl2tpd[26257]: Connecting to host 200.69.103.48, port 1701
xl2tpd[26257]: control_finish: message type is (null)(0).  Tunnel is 0, call is 0.
xl2tpd[26257]: control_finish: sending SCCRQ
xl2tpd[26257]: message_type_avp: message type 2 (Start-Control-Connection-Reply)
xl2tpd[26257]: protocol_version_avp: peer is using version 1, revision 0.
xl2tpd[26257]: framing_caps_avp: supported peer frames: sync
xl2tpd[26257]: bearer_caps_avp: supported peer bearers:
xl2tpd[26257]: firmware_rev_avp: peer reports firmware version 1539 (0x0603)
xl2tpd[26257]: hostname_avp: peer reports hostname 'mercurio.udistrital.edu.co'
xl2tpd[26257]: vendor_avp: peer reports vendor 'Microsoft'
xl2tpd[26257]: assigned_tunnel_avp: using peer's tunnel 379
xl2tpd[26257]: receive_window_size_avp: peer wants RWS of 8.  Will use flow control.
xl2tpd[26257]: control_finish: message type is Start-Control-Connection-Reply(2).  Tunnel is 379, call is 0.
xl2tpd[26257]: control_finish: sending SCCCN
xl2tpd[26257]: Connection established to 200.69.103.48, 1701.  Local: 4676, Remote: 379 (ref=0/0).
xl2tpd[26257]: Calling on tunnel 4676
xl2tpd[26257]: control_finish: message type is (null)(0).  Tunnel is 379, call is 0.
xl2tpd[26257]: control_finish: sending ICRQ
xl2tpd[26257]: message_type_avp: message type 11 (Incoming-Call-Reply)
xl2tpd[26257]: assigned_call_avp: using peer's call 2
xl2tpd[26257]: control_finish: message type is Incoming-Call-Reply(11).  Tunnel is 379, call is 2.
xl2tpd[26257]: control_finish: Sending ICCN
xl2tpd[26257]: Call established with 200.69.103.48, Local: 386, Remote: 2, Serial: 1 (ref=0/0)
xl2tpd[26257]: start_pppd: I'm running: 
xl2tpd[26257]: "/usr/sbin/pppd" 
xl2tpd[26257]: "plugin" 
xl2tpd[26257]: "pppol2tp.so" 
xl2tpd[26257]: "pppol2tp" 
xl2tpd[26257]: "7" 
xl2tpd[26257]: "passive" 
xl2tpd[26257]: "nodetach" 
xl2tpd[26257]: ":" 
xl2tpd[26257]: "debug" 
xl2tpd[26257]: "file" 
xl2tpd[26257]: "/var/run/nm-l2tp-ppp-options-d812fb2d-2212-44d6-a8b7-aff603b6ed10" 
nm-l2tp[26181] <info>  Terminated xl2tpd daemon with PID 26257.
xl2tpd[26257]: death_handler: Fatal signal 15 received
xl2tpd[26257]: Terminating pppd: sending TERM signal to pid 26258
xl2tpd[26257]: Connection 379 closed to 200.69.103.48, port 1701 (Server closing)
Stopping strongSwan IPsec...
** Message: ipsec shut down
nm-l2tp[26181] <warn>  xl2tpd exited with error code 1
Stopping strongSwan IPsec failed: starter is not running
** Message: ipsec shut down

Revision history for this message

Jorge Ulises Useche Cuellar (juusechec) wrote on 2018-01-29:

Screenshot from 2018-01-29 11-11-49.png Edit (37.8 KiB, image/png)

L2TP IPsec Options

Revision history for this message

Jorge Ulises Useche Cuellar (juusechec) wrote on 2018-01-29:

Screenshot from 2018-01-29 11-11-38.png Edit (68.6 KiB, image/png)

L2TP PPP Options

Revision history for this message

Douglas Kosovic (dkosovic) wrote on 2018-02-06:

Sorry for the delayed response, think I have a new cloud spam filter that blocked the email notification from this site and only received the email notification at 6:00am this morning.

You seem to have a collection of secrets files from multiple connections that haven't been cleaned up when the corresponding connection is stopped. Issue the following to clean things up :

sudo rm -f /etc/ipsec.d/nm-l2tp-ipsec-*.secrets

The following two lines of ./ike-scan.sh look interesting:

SA=(Enc=AES KeyLength=128 Hash=SHA1 Group=19 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)
SA=(Enc=AES KeyLength=256 Hash=SHA1 Group=20 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080)

ike-scan isn't providing the names for Diffie Hellman Groups 19 and 20, but they are listed on the following page:
https://wiki.strongswan.org/projects/strongswan/wiki/IKEv1CipherSuites

19 is ecp256 and 20 is ecp384, I've never encountered them before. So for phase 1 and 2 I would recommend :

Phase 1 : aes256-sha1-ecp384,aes128-sha1-ecp256,3des-sha1-modp1024
Phase 2 : aes256-sha1,aes128-sha1,3des-sha1

You could also try overriding and not just supplementing the default algorithms by putting an exclamation mark at the end, e.g. :

Phase 1 : aes256-sha1-ecp384,aes128-sha1-ecp256,3des-sha1-modp1024!
Phase 2 : aes256-sha1,aes128-sha1,3des-sha1!

Also note there is no guarantee phase 2 is based on the algorithms used in phase 1, just that it is the most common approach to do so. Unfortunately it isn't possible to use ike-scan to query phase 2.

Revision history for this message

Jorge Ulises Useche Cuellar (juusechec) wrote on 2018-02-06:

Thanks, I've testing removing *.secrets, then I've try connection, but isn't worked. After, I've change the algorithms of Phase 1 and Phase 2 and successfull conected!

Thanks! Is the second time that you save me from using Windows.

Douglas Kosovic (dkosovic) on 2018-02-06