Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using OS X server to run the VPN, and the client is an iPhone running iOS 7.

I'm port mapping with my router, which seems fine as the server did receive packets from my iPhone.

I've tried connecting to my server in three scenarios.

a) iPhone in the same LAN with the server, server address set to local address.
b) iPhone in the same LAN with the server, server address set to external address.
c) iPhone using its 3G connection, server address set to external one, of course.

So far, only scenario a work.

I'm using tcpdump on the three ports that L2TP use to negotiate a proper connection (UDP 500, 4500, TCP 1701)

I'm stuck on phase 1, and can't seem to get a proper tunnel between my server and client.

Here's the log for scenario c:

I'm using -vv flag to give the most verbose output, and the thing I think is particularly interesting is: "bad udp checksum", most of the log is useless, as my iPhone attempts to connect tirelessly. It only happens when the packet is initiated from my server, the checksum is okay when packet is from my iPhone.

The thing I find questionable is a packet "192.168.1.2.isakmp > 218-161-23-50.hinet-ip.hinet.net.isakmp" which I have no idea why it's there.

UDP Port 500:

15:17:27.387971 IP (tos 0x0, ttl 64, id 21211, offset 0, flags [none], proto UDP (17), length 256)
    192.168.1.2.isakmp > 218-161-23-50.hinet-ip.hinet.net.isakmp: [bad udp cksum 0xb47b -> 0xf279!] isakmp 1.0 msgid 00000000 cookie 16d4c7374932c34f->8e20d94d4245dbaa: phase 1 ? ident:
    (ke: key len=128)
    (nonce: n len=16  data=(a1c15b9a1c9734d5f952...e117459576a19b432e500921c45c087e7a67ceda))
    (pay20)
    (pay20)
15:17:48.607575 IP (tos 0x0, ttl 49, id 12610, offset 0, flags [none], proto UDP (17), length 528)
    106.65.68.70.cisco-snat > 192.168.1.2.isakmp: [udp sum ok] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->0000000000000000: phase 1 I ident:
    (sa: doi=ipsec situation=identity
        (p: #1 protoid=isakmp transform=6
            (t: #1 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=aes)(type=keylen value=0100)(type=auth value=preshared)(type=hash value=sha1)(type=group desc value=modp1024))
            (t: #2 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=aes)(type=keylen value=0100)(type=auth value=preshared)(type=hash value=md5)(type=group desc value=modp1024))
            (t: #3 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=aes)(type=keylen value=0080)(type=auth value=preshared)(type=hash value=sha1)(type=group desc value=modp1024))
            (t: #4 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=aes)(type=keylen value=0080)(type=auth value=preshared)(type=hash value=md5)(type=group desc value=modp1024))
            (t: #5 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=3des)(type=auth value=preshared)(type=hash value=sha1)(type=group desc value=modp1024))
            (t: #6 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=3des)(type=auth value=preshared)(type=hash value=md5)(type=group desc value=modp1024))))
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=16)
    (vid: len=20)
    (vid: len=16)
15:17:48.607962 IP (tos 0x0, ttl 64, id 56436, offset 0, flags [none], proto UDP (17), length 176)
    192.168.1.2.isakmp > 106.65.68.70.cisco-snat: [bad udp cksum 0x70df -> 0xc561!] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 R ident:
    (sa: doi=ipsec situation=identity
        (p: #1 protoid=isakmp transform=1
            (t: #1 id=ike (type=lifetype value=sec)(type=lifeduration value=0e10)(type=enc value=aes)(type=keylen value=0100)(type=auth value=preshared)(type=hash value=sha1)(type=group desc value=modp1024))))
    (vid: len=16)
    (vid: len=16)
    (vid: len=20)
15:17:48.688377 IP (tos 0x0, ttl 49, id 23045, offset 0, flags [none], proto UDP (17), length 256)
    106.65.68.70.cisco-snat > 192.168.1.2.isakmp: [udp sum ok] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 I ident:
    (ke: key len=128)
    (nonce: n len=16  data=(8cc08257d770924845bd...1d26cdea712a09a81e29f95ad40bbe17e7b5a03f))
    (pay20)
    (pay20)
15:17:48.691593 IP (tos 0x0, ttl 64, id 17968, offset 0, flags [none], proto UDP (17), length 256)
    192.168.1.2.isakmp > 106.65.68.70.cisco-snat: [bad udp cksum 0x712f -> 0x3f5c!] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 R ident:
    (ke: key len=128)
    (nonce: n len=16  data=(e9f59fa8a6180448e523...367af45dc8ee1e97799d9a1a9f7ee44b40aeaeb9))
    (pay20)
    (pay20)
15:17:51.812646 IP (tos 0x0, ttl 64, id 2503, offset 0, flags [none], proto UDP (17), length 256)
    192.168.1.2.isakmp > 106.65.68.70.cisco-snat: [bad udp cksum 0x712f -> 0x3f5c!] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 R ident:
    (ke: key len=128)
    (nonce: n len=16  data=(e9f59fa8a6180448e523...367af45dc8ee1e97799d9a1a9f7ee44b40aeaeb9))
    (pay20)
    (pay20)
15:17:55.103659 IP (tos 0x0, ttl 64, id 17073, offset 0, flags [none], proto UDP (17), length 256)
    192.168.1.2.isakmp > 106.65.68.70.cisco-snat: [bad udp cksum 0x712f -> 0x3f5c!] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 R ident:
    (ke: key len=128)
    (nonce: n len=16  data=(e9f59fa8a6180448e523...367af45dc8ee1e97799d9a1a9f7ee44b40aeaeb9))
    (pay20)
    (pay20)
15:17:58.393090 IP (tos 0x0, ttl 64, id 17952, offset 0, flags [none], proto UDP (17), length 256)
    192.168.1.2.isakmp > 106.65.68.70.cisco-snat: [bad udp cksum 0x712f -> 0x3f5c!] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 R ident:
    (ke: key len=128)
    (nonce: n len=16  data=(e9f59fa8a6180448e523...367af45dc8ee1e97799d9a1a9f7ee44b40aeaeb9))
    (pay20)
    (pay20)
15:18:11.576905 IP (tos 0x0, ttl 64, id 51792, offset 0, flags [none], proto UDP (17), length 256)
    192.168.1.2.isakmp > 106.65.68.70.cisco-snat: [bad udp cksum 0x712f -> 0x3f5c!] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 R ident:
    (ke: key len=128)
    (nonce: n len=16  data=(e9f59fa8a6180448e523...367af45dc8ee1e97799d9a1a9f7ee44b40aeaeb9))
    (pay20)
    (pay20)
15:18:28.052158 IP (tos 0x0, ttl 64, id 6994, offset 0, flags [none], proto UDP (17), length 256)
    192.168.1.2.isakmp > 106.65.68.70.cisco-snat: [bad udp cksum 0x712f -> 0x3f5c!] isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 R ident:
    (ke: key len=128)
    (nonce: n len=16  data=(e9f59fa8a6180448e523...367af45dc8ee1e97799d9a1a9f7ee44b40aeaeb9))
    (pay20)
    (pay20)

UDP Port 4500 Dump:

15:17:48.769123 IP (tos 0x0, ttl 49, id 25456, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]
15:17:52.087659 IP (tos 0x0, ttl 49, id 8001, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]
15:17:53.764029 IP (tos 0x0, ttl 49, id 43123, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]
15:17:55.573178 IP (tos 0x0, ttl 49, id 58222, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]
15:17:58.996201 IP (tos 0x0, ttl 49, id 63542, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]
15:17:59.314276 IP (tos 0x0, ttl 49, id 9048, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]
15:18:10.919103 IP (tos 0x0, ttl 49, id 16899, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]
15:18:11.647761 IP (tos 0x0, ttl 49, id 45659, offset 0, flags [none], proto UDP (17), length 140)
    106.65.68.70.15556 > 192.168.1.2.ipsec-msft: [udp sum ok] NONESP-encap: isakmp 1.0 msgid 00000000 cookie 70fab088724e74e3->1ac6a3bb1ca35750: phase 1 ? ident[E]: [encrypted id]

port 1701 produces no result

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.