I'm trying to configure a ZyWALL USG 200 firewall to let Windows XP remote clients (dynamic IP address) to connect to the workplace network with a L2TP VPN. I don't want to use certificates, a common username and password will be enough (and certificate management would be too much).
I'm not a L2TP expert, let alone IPsec, so please bear with me if I ask trivial questions or make blatant mistakes.
I've configured what I think should be a L2TP VPN on the USG200, however I get the following error in its log when I try to connect from the WinXP client:
1 2015-09-25 11:03:33 info IKE Send:[NOTIFY:NO_PROPOSAL_CHOSEN] 192.168.0.1:500 22.214.171.124:500 IKE_LOG 2 2015-09-25 11:03:33 info IKE [SA] : No proposal chosen 192.168.0.1:500 126.96.36.199:500 IKE_LOG 3 2015-09-25 11:03:33 info IKE The cookie pair is : 0x214b5575aaa53052 / 0xa212f247eeebfb4b [count=2] 192.168.0.1:500 188.8.131.52:500 IKE_LOG 4 2015-09-25 11:03:33 info IKE Recv:[SA][VID][VID][VID][VID] 184.108.40.206:500 192.168.0.1:500 IKE_LOG 5 2015-09-25 11:03:33 info IKE The cookie pair is : 0xa212f247eeebfb4b / 0x214b5575aaa53052 220.127.116.11:500 192.168.0.1:500 IKE_LOG 6 2015-09-25 11:03:33 info IKE Recv Main Mode request from [18.104.22.168] 22.214.171.124:500 192.168.0.1:500 IKE_LOG 7 2015-09-25 11:03:33 info IKE The cookie pair is : 0x214b5575aaa53052 / 0x0000000000000000 126.96.36.199:500 192.168.0.1:500 IKE_LOG
(please note that the USG200 shows most recent log entries first). From a Google search I got that the error "No proposal choosen" might be caused by a mismatch between client and server in the IKE Phase 1 proposal configuration. From this document I assume that the following USG200 configuration should work, but it doesn't:
I obviously configred the VPN connection and the L2TP VPN too, but I guess those configuration are not relevant, at least not for the time being. Unfortunately I can't tell why it's not working or if it's the firewall or the client to blame. I can't seem to be able to get any relevant log to diagnose the problem from Windows, so here is how I configured the connection:
Can you please help me understand what I'm doing wrong?