0

I've been trying to set up a L2TP/IPSec server on my Ubuntu install using this guide.

While trying to connect I ran sudo tail -f /var/log/auth.log, the output of which is below:

Feb  8 10:35:41 prometheus pluto[6167]: "L2TP-PSK-noNAT"[20] [my ip] #20: responding to Main Mode from unknown peer [my ip]
Feb  8 10:35:41 prometheus pluto[6167]: "L2TP-PSK-noNAT"[20] [my ip] #20: Can't authenticate: no preshared key found for `[server ip]' and `%any'.  Attribute OAKLEY_AUTHENTICATION_METHOD
Feb  8 10:35:41  pluto[6167]: last message repeated 5 times
Feb  8 10:35:41 prometheus pluto[6167]: "L2TP-PSK-noNAT"[20] [my ip] #20: no acceptable Oakley Transform
Feb  8 10:35:41 prometheus pluto[6167]: "L2TP-PSK-noNAT"[20] [my ip] #20: sending notification NO_PROPOSAL_CHOSEN to [my ip]:500
Feb  8 10:35:41 prometheus pluto[6167]: "L2TP-PSK-noNAT"[20] [my ip]: deleting connection "L2TP-PSK-noNAT" instance with peer [my ip] {isakmp=#0/ipsec=#0}

/etc/ipsec.conf

version 2.0

config setup
  dumpdir=/var/run/pluto/
  nat_traversal=yes
  virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
  oe=off
  protostack=netkey
  keep_alive=10

include /etc/ipsec.d/*.conf

/etc/ipsec.d/road-warrior.conf

conn L2TP-PSK-noNAT
authby=secret
  pfs=no
  auto=add
  keyingtries=3
  rekey=no
  ikelifetime=8h
  keylife=1h
  type=transport
  left=[server ip]
  leftprotoport=17/1701
  right=%any
  rightprotoport=17/%any

conn L2TP-PSK-NAT
  rightsubnet=vhost:%priv
  also=L2TP-PSK-noNAT

/etc/ipsec.d/road-warrior.secrets

[server ip] %any: PSK "psk"

Output of ipsec verify

Version check and ipsec on-path                                 [OK]
Linux Openswan U2.6.37/K3.12.9-x86_64-linode37 (netkey)
Checking for IPsec support in kernel                            [OK]
 SAref kernel support                                           [N/A]
 NETKEY:  Testing XFRM related proc values                      [OK]
    [OK]
    [OK]
Checking that pluto is running                                  [OK]
 Pluto listening for IKE on udp 500                             [OK]
 Pluto listening for NAT-T on udp 4500                          [OK]
Two or more interfaces found, checking IP forwarding            [OK]
Checking NAT and MASQUERADEing                                  [OK]
Checking for 'ip' command                                       [OK]
Checking /bin/sh is not /bin/dash                               [WARNING]
Checking for 'iptables' command                                 [OK]
Opportunistic Encryption Support                                [DISABLED]

/etc/xl2tpd/xl2tpd.conf

[global]
ipsec saref = yes

[lns default]
ip range = 10.10.10.2-10.10.10.200  
local ip = 10.10.10.1
refuse chap = yes
refuse pap = yes
require authentication = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd
length bit = yes

/etc/ppp/options.xl2tpd

require-mschap-v2
ms-dns 4.2.2.1
ms-dns 4.2.2.2
asyncmap 0
auth
crtscts
lock
hide-password
modem
debug
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

/etc/ppp/chap-secrets

# Secrets for authentication using CHAP
# client        server  secret                  IP addresses
user1           l2tpd   user1password           *
user2           l2tpd   user2password           *

Can anyone help?

1

Because the error line says:

Can't authenticate: no preshared key found for [server ip]' and %any'.

This leads me to believe that it is possible your /etc/ipsec.d/road-warrior.secrets file has a [serverip] that does not match the same as ipsec.conf left=[serverip]

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.