iPad IPSEC Reconnect Failure

[Akagi]

Binary package hint: openswan

Hi,

I am trying to establish a IPSEC/L2TPD connection into my local infrastruction. The remote system is an iPad. After some work I am able to establish a connection. But only one time. If I disconnect and reconnect it fails. Only restart of the ipsec daemon fixes this.

After some search I have no idea what causes the problem. I installed an Openswan 2.6.33 directly, but this causes the same problem.

I will send the configuration files and logs directly.

Maybe someone can help.

Best regards!

[Akagi (akagi010)]

/etc/ipsec.conf

config setup
 nat_traversal=yes
 virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
 oe=off
 protostack=netkey

include /etc/ipsec.d/l2tp-psk.conf

[Akagi (akagi010)]

/etc/ipsec.d/l2tp-psk.conf:

conn L2TP-PSK-NAT
        also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
        authby=secret
        pfs=no
        auto=add
        keyingtries=3
        rekey=no
        ikelifetime=8h
        keylife=1h
        type=transport
        left=192.168.0.108
        leftnexthop=%defaultroute
        leftprotoport=17/1701
        right=%any
        rightprotoport=17/%any
        forceencaps=yes
        dpddelay=30
        dpdtimeout=120
        dpdaction=clear

conn passthrough-for-non-l2tp
        type=passthrough
        left=192.168.0.108
        leftnexthop=%defaultroute
        right=0.0.0.0
        rightsubnet=0.0.0.0/0
        auto=route

[Akagi (akagi010)]

/etc/ipsec.secrets:

%any : PSK "secret"

[Akagi (akagi010)]

/var/log/daemon.log:

# Startup of OpenSwan:

Jun 6 15:54:43 neptun ipsec_setup: Starting Openswan IPsec U2.6.23/K2.6.32-31-generic...
Jun 6 15:54:43 neptun ipsec_setup: Using NETKEY(XFRM) stack
Jun 6 15:54:43 neptun ipsec_setup: ...Openswan IPsec started
Jun 6 15:54:43 neptun ipsec__plutorun: adjusting ipsec.d to /etc/ipsec.d
Jun 6 15:54:43 neptun ipsec__plutorun: 002 added connection description "L2TP-PSK-NAT"
Jun 6 15:54:43 neptun ipsec__plutorun: 002 added connection description "L2TP-PSK-noNAT"
Jun 6 15:54:43 neptun ipsec__plutorun: 002 added connection description "passthrough-for-non-l2tp"
Jun 6 15:54:43 neptun ipsec__plutorun: 003 NAT-Traversal: Trying new style NAT-T
Jun 6 15:54:43 neptun ipsec__plutorun: 003 NAT-Traversal: ESPINUDP(1) setup failed for new style NAT-T family IPv4 (errno=19)
Jun 6 15:54:43 neptun ipsec__plutorun: 003 NAT-Traversal: Trying old style NAT-T

# 1. Login

Jun 6 15:55:45 neptun xl2tpd[32645]: control_finish: Peer requested tunnel 39 twice, ignoring second one.
Jun 6 15:55:45 neptun xl2tpd[32645]: Connection established to 91.57.150.43, 61418. Local: 54033, Remote: 39 (ref=0/0). LNS session is 'default'
Jun 6 15:55:45 neptun xl2tpd[32645]: start_pppd: I'm running:
Jun 6 15:55:45 neptun xl2tpd[32645]: "/usr/sbin/pppd"
Jun 6 15:55:45 neptun xl2tpd[32645]: "passive"
Jun 6 15:55:45 neptun xl2tpd[32645]: "nodetach"
Jun 6 15:55:45 neptun xl2tpd[32645]: "192.168.0.59:192.168.0.60"
Jun 6 15:55:45 neptun xl2tpd[32645]: "refuse-pap"
Jun 6 15:55:45 neptun xl2tpd[32645]: "auth"
Jun 6 15:55:45 neptun xl2tpd[32645]: "require-chap"
Jun 6 15:55:45 neptun xl2tpd[32645]: "name"
Jun 6 15:55:45 neptun xl2tpd[32645]: "..."
Jun 6 15:55:45 neptun xl2tpd[32645]: "debug"
Jun 6 15:55:45 neptun xl2tpd[32645]: "file"
Jun 6 15:55:45 neptun xl2tpd[32645]: "/etc/ppp/options.l2tpd"
Jun 6 15:55:45 neptun xl2tpd[32645]: "/dev/pts/1"
Jun 6 15:55:45 neptun xl2tpd[32645]: Call established with 91.57.150.43, Local: 39085, Remote: 18245, Serial: 1
Jun 6 15:55:45 neptun NetworkManager: SCPlugin-Ifupdown: devices added (path: /sys/devices/virtual/net/ppp0, iface: ppp0)
Jun 6 15:55:45 neptun NetworkManager: SCPlugin-Ifupdown: device added (path: /sys/devices/virtual/net/ppp0, iface: ppp0): no ifupdown configuration found.

# 1. Logoff

Jun 6 15:56:21 neptun xl2tpd[32645]: result_code_avp: result code out of range (768 0 14). Ignoring.
Jun 6 15:56:21 neptun xl2tpd[32645]: control_finish: Peer tried to disconnect without specifying result code.
Jun 6 15:56:21 neptun xl2tpd[32645]: result_code_avp: result code out of range (256 0 14). Ignoring.
Jun 6 15:56:21 neptun xl2tpd[32645]: control_finish: Peer tried to disconnect without specifying result code.
Jun 6 15:56:24 neptun NetworkManager: SCPlugin-Ifupdown: devices removed (path: /sys/devices/virtual/net/ppp0, iface: ppp0)
Jun 6 15:56:24 neptun xl2tpd[32645]: child_handler : pppd exited for call 18245 with code 16
Jun 6 15:56:24 neptun xl2tpd[32645]: call_close: Call 39085 to 91.57.150.43 disconnected
Jun 6 15:56:29 neptun xl2tpd[32645]: Maximum retries exceeded for tunnel 54033. Closing.
Jun 6 15:56:45 neptun xl2tpd[32645]: Terminating...

[Akagi (akagi010)]

/var/log/auth.log:

# Startup of OpenSwan:

Jun 6 15:54:43 neptun pluto[1426]: Starting Pluto (Openswan Version 2.6.23; Vendor ID OEm@kgSFEH@\177) pid:1426
Jun 6 15:54:43 neptun pluto[1426]: Setting NAT-Traversal port-4500 floating to on
Jun 6 15:54:43 neptun pluto[1426]: port floating activation criteria nat_t=1/port_float=1Jun 6 15:54:43 neptun pluto[1426]: including NAT-Traversal patch (Version 0.6c)
Jun 6 15:54:43 neptun pluto[1426]: using /dev/urandom as source of random entropyJun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok (ret=0)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok (ret=0)Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok (ret=0)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating OAKLEY_BLOWFISH_CBC: Ok (ret=0)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok (ret=0)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok (ret=0)
Jun 6 15:54:43 neptun pluto[1426]: starting up 1 cryptographic helpers
Jun 6 15:54:43 neptun pluto[1426]: started helper pid=1429 (fd:7)Jun 6 15:54:43 neptun pluto[1426]: Using Linux 2.6 IPsec interface code on 2.6.32-31-generic (experimental code)
Jun 6 15:54:43 neptun pluto[1429]: using /dev/urandom as source of random entropy
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating <NULL>: Ok (ret=0)Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_add(): ERROR: Algorithm already existsJun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names Jun 6 15:54:43 neptun pluto[1426]: ike_alg_add(): ERROR: Algorithm already exists
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_add(): ERROR: Algorithm already exists
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_add(): ERROR: Algorithm already exists
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): Activating <NULL>: FAILED (ret=-17)
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_register_enc(): WARNING: enc alg=0 not found in constants.c:oakley_enc_names
Jun 6 15:54:43 neptun pluto[1426]: ike_alg_add(): ERROR: Algorithm already exists
Jun 6 15:54:43 neptun pluto[1426...

[Akagi (akagi010)]

I forgot: I use an Ubuntu 10.04 Netbook Edition.

The OpenSwan version is: 2.6.23+dfsg-1ubuntu1

[Harald Jenny (harald-a-little-linux-box)]

Dear bug reporter,

as the Ipad does not send any IPSec delete notify messages how long did you wait between the connection tries?

Kind regards
Harald Jenny