Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have set up a L2TP/IPsec VPN server on a cloud VM (with a public IP address) running CentOS 6.5 (kernel: 2.6.32) with openswan/xl2tpd (openswan: 2.6.37, xl2tpd: 1.3.6). However, if multiple Windows clients try to connect from behind a same NAT gateway (i.e. these clients will propose the same public IP address to the VPN server), only the first one of them can connect, latter ones will get a timeout error with the following message:

Error 789: The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer.

This only happens with Windows clients (including Windows XP/7/8), while multiple Mac/iOS clients can connect at the same time with no problem.

Here is the ipsec log when the timeout error happens (IP address masked):

Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #65: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #65: new NAT mapping for #65, was xxx.xxx.xxx.xxx:500, now xxx.xxx.xxx.xxx:4500
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #65: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp2048}
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #65: Dead Peer Detection (RFC 3706): not enabled because peer did not advertise it
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #65: the peer proposed: 121.40.83.158/32:17/1701 -> 192.168.1.124/32:17/1701
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #65: NAT-Traversal: received 2 NAT-OA. using first, ignoring others
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #66: responding to Quick Mode proposal {msgid:01000000}
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #66:     us: 121.40.83.158<121.40.83.158>[+S=C]:17/1701
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #66:   them: xxx.xxx.xxx.xxx[192.168.1.124,+S=C]:17/1701
Jul 30 10:57:53 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #66: cannot install eroute -- it is in use for "l2tp-psk"[11] xxx.xxx.xxx.xxx #64
Jul 30 10:57:54 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #66: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 10:57:55 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #66: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 10:57:55 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #65: received Delete SA payload: deleting ISAKMP State #65
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #67: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #67: new NAT mapping for #67, was xxx.xxx.xxx.xxx:500, now xxx.xxx.xxx.xxx:4500
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #67: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp2048}
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #67: Dead Peer Detection (RFC 3706): not enabled because peer did not advertise it
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #67: the peer proposed: 121.40.83.158/32:17/1701 -> 192.168.1.124/32:17/1701
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #67: NAT-Traversal: received 2 NAT-OA. using first, ignoring others
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: responding to Quick Mode proposal {msgid:01000000}
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68:     us: 121.40.83.158<121.40.83.158>[+S=C]:17/1701
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68:   them: xxx.xxx.xxx.xxx[192.168.1.124,+S=C]:17/1701
Jul 30 11:04:06 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: cannot install eroute -- it is in use for "l2tp-psk"[11] xxx.xxx.xxx.xxx #64
Jul 30 11:04:07 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 11:04:08 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 11:04:11 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 11:04:18 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 11:04:33 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 11:04:48 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #68: discarding duplicate packet; already STATE_QUICK_R0
Jul 30 11:05:03 iZ23ha7haiqZ pluto[1060]: "l2tp-psk"[7] xxx.xxx.xxx.xxx #67: received Delete SA payload: deleting ISAKMP State #67

Configuration: ipsec.conf

config setup
    dumpdir=/var/run/pluto/
    nat_traversal=yes
    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v6:fd00::/8,%v6:fe80::/10
    oe=off
    protostack=netkey
conn l2tp-psk
    authby=secret
    pfs=no
    auto=add
    rekey=no
    type=transport
    left=120.40.xxx.xxx(MASKED)
    leftprotoport=17/1701
    right=%any
    rightprotoport=17/%any
    rightsubnet=vhost:%priv,%no
    dpddelay=40
    dpdtimeout=130
    dpdaction=clear

Configuration: xl2tpd.conf

[global]
listen-addr = 120.40.xxx.xxx(MASKED)

[lns default]
ip range = 10.254.253.2-10.254.253.200
local ip = 10.254.253.1
assign ip = yes
require chap = yes
refuse pap = yes
require authentication = yes
name = ibgGateway
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

It seems that something wrong happens in the IPsec layer, any ideas to identify what's actually going wrong?

Please let me know if I need to post other conf/log to identify the problem. Thank you.


UPDATE

I tried to capture packets with tcpdump on the VPN server, and found some problems with NAT. It seems that Windows clients always use a fixed source port (4500) for ESP packets, therefore when the second Windows client tries to connect, ESP packets will not be correctly delivered by NAT as the port conflicts with the previously connected Windows client.

Windows client 1:

No.     Time        Source                Src Port Destination           Dst Port Protocol Length Info
     10 0.137846    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      190    ESP (SPI=0x8396b3fd)
     11 0.138012    121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      206    ESP (SPI=0x0cb4d386)
     12 0.149534    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      110    ESP (SPI=0x8396b3fd)
     13 0.149616    121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      110    ESP (SPI=0x0cb4d386)
     14 0.149713    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      158    ESP (SPI=0x8396b3fd)
     15 0.149790    121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      126    ESP (SPI=0x0cb4d386)
     16 0.149808    121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      110    ESP (SPI=0x0cb4d386)
     17 0.164955    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      142    ESP (SPI=0x8396b3fd)
     18 0.165191    121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      110    ESP (SPI=0x0cb4d386)
     19 0.168234    121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      142    ESP (SPI=0x0cb4d386)

Windows client 2:

 No.     Time        Source                Src Port Destination           Dst Port Protocol Length Info
       1 0.000000    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      270    ESP (SPI=0x8396b3fd)
      11 2.990604    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      270    ESP (SPI=0x8396b3fd)
      13 5.998972    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      270    ESP (SPI=0x8396b3fd)
      15 9.002562    180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      270    ESP (SPI=0x8396b3fd)
      16 11.121008   180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      158    ESP (SPI=0x8396b3fd)
      17 11.122874   121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      318    ESP (SPI=0x0cb4d386)
      18 12.024904   180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      270    ESP (SPI=0x8396b3fd)
      20 15.007254   180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      270    ESP (SPI=0x8396b3fd)
      24 30.160196   180.168.xxx.xxx        4500     121.40.xxx.xxx         4500     ESP      174    ESP (SPI=0x8396b3fd)
      25 30.229914   121.40.xxx.xxx         4500     180.168.xxx.xxx        4500     ESP      398    ESP (SPI=0x0cb4d386)

In contrast, when my iPhone connects to the server, it seems to use a random port for ESP packets instead of 4500, therefore multiple Mac/iOS clients will use different ports and will not cause a NAT conflict.

iPhone client:

 No.     Time        Source                Src Port Destination           Dst Port Protocol Length Info
      11 2.813229    180.168.xxx.xxx        29717    121.40.xxx.xxx         4500     ESP      174    ESP (SPI=0xf0b5a5c7)
      12 2.813401    121.40.xxx.xxx         4500     180.168.xxx.xxx        29717    ESP      206    ESP (SPI=0x07958629)
      13 2.828423    180.168.xxx.xxx        29717    121.40.xxx.xxx         4500     ESP      110    ESP (SPI=0xf0b5a5c7)
      14 2.828508    121.40.xxx.xxx         4500     180.168.xxx.xxx        29717    ESP      110    ESP (SPI=0x07958629)
      15 2.828973    180.168.xxx.xxx        29717    121.40.xxx.xxx         4500     ESP      126    ESP (SPI=0xf0b5a5c7)
      16 2.829044    121.40.xxx.xxx         4500     180.168.xxx.xxx        29717    ESP      126    ESP (SPI=0x07958629)
      17 2.829084    121.40.xxx.xxx         4500     180.168.xxx.xxx        29717    ESP      110    ESP (SPI=0x07958629)
      18 2.839947    180.168.xxx.xxx        29717    121.40.xxx.xxx         4500     ESP      142    ESP (SPI=0xf0b5a5c7)
      19 2.840205    121.40.xxx.xxx         4500     180.168.xxx.xxx        29717    ESP      110    ESP (SPI=0x07958629)
      20 2.849696    180.168.xxx.xxx        29717    121.40.xxx.xxx         4500     ESP      126    ESP (SPI=0xf0b5a5c7)

So any idea about how I can fix this problem or is there a workaround? Thank you.

share|improve this question
    
did you manage to solve the issue –  john Nov 19 at 9:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.