Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have configured MS Server 2003 RRAS with IPSec / L2TP using PSK. iPhone devices connect fine however Android devices fail to connect. The MS "Oakley" trace file shows the negotiations for Apple and Android follow a similar path until the tunnel connection is mostly complete then I see :

2-06: 17:15:24:788:c98 Sending: SA = 0x0014B770 to XXX.XXX.90.176:Type 4.4500
2-06: 17:15:24:788:c98 ISAKMP Header: (V1.0), len = 76
2-06: 17:15:24:788:c98   I-COOKIE 05ba0fca40358ea5
2-06: 17:15:24:788:c98   R-COOKIE 249f8fb9b53208ed
2-06: 17:15:24:788:c98   exchange: Oakley Quick Mode
2-06: 17:15:24:788:c98   flags: 3 ( encrypted commit )
2-06: 17:15:24:788:c98   next payload: HASH
2-06: 17:15:24:788:c98   message ID: f0a0f242
2-06: 17:15:24:788:c98 Ports S:9411 D:9411
2-06: 17:15:26:617:65c SocketError 10054
2-06: 17:15:28:679:65c SocketError 10054
2-06: 17:15:32:663:65c SocketError 10054
2-06: 17:15:40:663:65c SocketError 10054
2-06: 17:15:50:695:65c SocketError 10054
2-06: 17:16:47:929:c98 CE Dead. sa:0014B770 ce:000DF868 status:35f0

I have tried this on JellyBean and Gingerbread devices and the outcome is the same

Here is the adb logcat from gingerbread:

I/racoon  (11163): initiate new phase 2 negotiation:[4500]<=>XXX.XXX.125.226[4500]
I/racoon  (11163): NAT detected -> UDP encapsulation (ENC_MODE 2->61444).
W/racoon  (11163): ignore RESPONDER-LIFETIME notification.
W/racoon  (11163): attribute has been modified.
I/racoon  (11163): Adjusting my encmode UDP-Transport->Transport
I/racoon  (11163): Adjusting peer's encmode UDP-Transport(61444)->Transport(2)
W/racoon  (11163): ignore CONNECTED notification.
I/racoon  (11163): IPsec-SA established: ESP/Transport XXX.XXX.125.226[0]->[0] spi=197781845(0xbc9e955)
I/racoon  (11163): IPsec-SA established: ESP/Transport[4500]->XXX.XXX.125.226[4500] spi=3463706620(0xce73f7fc)
D/mtpd    (11485): Timeout -> Sending SCCRQ
D/mtpd    (11485): Received SCCRP without valid challenge response
E/mtpd    (11485): Protocol error
D/mtpd    (11485): Sending STOPCCN
I/mtpd    (11485): Mtpd is terminated (status = 5)
I/SProxy_mtpd(10676): got data from control socket: 5
E/VpnService(10676): onError()
E/VpnService(10676): Connecting error: 5
E/VpnService(10676):    at
E/VpnService(10676):    at
E/VpnService(10676):    at
E/VpnService(10676):    at$
E/VpnService(10676):    at
I/VpnService(10676): disconnecting VPN...
D/VpnSettings( 8921): received connectivity: Mdc: connected? DISCONNECTING   err=0
I/StatusBarManagerService(  123): ADD-Mdc VPN disconnected , 0x7f020001
I/SProxy_mtpd(10676): Stop VPN daemon: mtpd
D/SProxy_mtpd(10676): mtpd is stopped after 0 msec
D/SProxy_mtpd(10676): stopping mtpd, success? true
I/SProxy_racoon(10676): Stop VPN daemon: racoon
I/racoon  (11163): Bye
D/SProxy_racoon(10676): racoon is stopped after 0 msec
D/SProxy_racoon(10676): stopping racoon, success? true
D/VpnService(10676): onFinalCleanUp()
I/VpnService(10676): restore original suffices --> null
D/dalvikvm(  196): GC_EXTERNAL_ALLOC freed 506K, 58% free 2991K/7047K, external3443K/3473K, paused 30ms
D/VpnSettings( 8921): received connectivity: Mdc: connected? IDLE   err=5
share|improve this question
Try get logs from the Android device by installing the SDK, plugging the device in, and running adb shell logcat. – mgorven Feb 7 '13 at 17:54
honestly I should have thought of that. Will try to trap the logs tonight. – Peter Feb 7 '13 at 18:19
The JellyBean trace provided a similar protocol error: D/mtpd ( 6386): Received SCCRP without valid challenge response E/mtpd ( 6386): Protocol error as shown above on Gingerbread but I am not sure what it means. – Peter Feb 8 '13 at 12:45
I think that Android is accepting the Microsoft offer of 3DES-SHA when it should be accepting 3DES-MD5 instead. I need to figure out how to get MS to offer only MD5 options. Back to the manual. – Peter Feb 8 '13 at 13:31
well I successfully restricted the negotiations to 3DES-MD5 but that didn't work wither. – Peter Feb 8 '13 at 15:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.