Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

An iPhone client fails to connect to a IPSec VPN powered by Openswan on Debian with xl2tpd and ppp. The iPhone itself keeps telling after some time "Server not responding" and /var/log/auth.log says repeatedly

Jan  3 23:03:30 DC01H003R178S388 pluto[11049]: "L2TP-PSK-NAT"[7] x.x.x.x #7: no acceptable Oakley Transform
Jan  3 23:03:30 DC01H003R178S388 pluto[11049]: "L2TP-PSK-NAT"[7] x.x.x.x #7: sending notification NO_PROPOSAL_CHOSEN to x.x.x.x:500

This is how the config files look:

/etc/ipsec.conf

config setup
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
    oe=off
    protostack=netkey

conn L2TP-PSK-NAT
    rightsubnet=vhost:%priv
    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT
    authby=secret
    pfs=no
    auto=add
    keyingtries=3
    rekey=no
    ikelifetime=8h
    keylife=1h
    type=transport
    left=x.x.x.x
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    dpddelay=10
    dpdtimeout=90
    dpdaction=clear

/etc/xl2tpd/xl2tpd.conf

[global]
ipsec saref = yes

[lns default]
ip range = 10.1.2.2-10.1.2.255
local ip = 10.1.2.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

/etc/ppp/options.xl2tpd

require-mschap-v2
ms-dns x.x.x.x
ms-dns x.x.x.x
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

Apple OS X Mavericks clients connect without any troubles. Surprisingly an iPad with the latest iOS connects too. As I understand the logs, the device and the server fail to negotiate the encryption method. If that guess is right, what do I have to change to allow connections of iOS clients?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.