L2TP vpn - broken since 10.4.11

Hi,
i just want to start the thread concering the vpn problem again.
Yesterday we updated OS X Server vom 10.4.10 to 10.4.11 and suddenly only connections via PPTP are available from outside. (leopard clients)
This issue was also mentioned here before.
I think, that only apple can help us with this.
It has definitely nothing to do with our firewall. The problem immediately occurs after updating.
The next problem is, that our server doesn't respond to any request by "apple remote desktop" any more!
(also leopard clients).
Any suggestions?
Help would be very nice.
Regards
Markus
Message was edited by: Markus Roessler

Hello agnespie:
The OS X 10.4.11 update includes the release of Safari 3.0.4. First of all, delete all the extender/haxies (you mentioned a couple) that you have installed. Then run permission repair and repair disk (this from your software install DVD).
Barry

Similar Messages

Mobile Devices (Android and iOS) cannot Connect to WS 2008 RRAS L2TP VPN with Pre-Shared Key

I have my Windows Server 2008 standard installed with RRAS service and configure with L2TP VPN with pre-shared key. Services such as Active Directory, DHCP and DNS are not installed. The Internet connection doesn't pass through a router to my server machine.
I have the Verizon fios Internet cable plugged in to the server machine directly.
PCs running Windows and Mac OS X can connect to the server without problem. When I tried to connect by using android or iOS mobiles and tablets, they cannot connect to the server. If I change the VPN type to PPTP, the mobile devices can connect successfully
but I would like to use IPSec/L2TP since it's more secure.
I tried so hard to look for the solution for this issue on Internet but I had no luck on that. Can anyone please provide me some help, please ?
Thanks,
CK

Hi CK,
I think we may need to create a policy in Network Policies. Please follow the steps below,
Right click Network Policies, Click New.
Enter the policy name, click Next.
Click Add, select the Day and Time Restrictions, click
Add.
In the Day and Time Restrictions, choose Permited for
all, click OK.
Click Next five times(leave everything default), click
Finish.
Move the policy to top and try to connect with your device.
If issue persists, please make sure that the Connection Requet Policies have been configured properly.
For detailed information about how to create a network policy, please refer to the link below,
Configuring NPS network policies
http://technet.microsoft.com/en-us/library/dd441006.aspx
Best Regards.
Steven Lee
TechNet Community Support

Windows 8 L2TP VPN disconnects at 60 minutes

I have 5 windows 8 machines across various domains all configured with 8-10 L2TP VPN setups to various clients networks. Most of them are to Sonicwall firewalls but a couple are to other firewalls. My Windows 8 machines consists of both upgrades
from Windows 7 and fresh installs. Either way every one of my L2TP connections will disconnect at 60 minute increment, regardless of activity or inactivity, which never happened on Windows 7. I have looked everywhere on the Sonicwalls (all of them
are on the most up to date firmware) and there is no setting for disconnecting after 60 minutes.
The issue must be with Windows 8 - just looking for a registry hack or hotfix that will fix this problem.
Michael E. Wheeler

I also have the same problem but my timeout happens at 49 mins 54 seconds everytime. I recently switched to Windows 8 and I am facing lots of issues with the VPN.
Initially I had installed the VPN version "CISCO VPN 5.0.07.0290-k9" and my VPN would disconnect every 3 to 4 mins. Then later browsed to get the "most compatible" version of VPN "5.0.07.0440-k9" . Now also the same problem perisists. but a small improvement.
Incase I am keeping my access to the Server IP active, working on the sever and not on the local system, then my connection is active for a longer time. If I work on my local system the connection disconnects within a minute.
Since I had to work on my local system also, I did a continuous ping on the Command Prompt and then I can now work on my Server thro VPN and also on my local system for 49 mins. I was searching for a solution when I stumbled on this chain. I am not alone,
but could not find a solution. I hope someone from Microsoft looks at this thread and give a Fix build.
Please post any alternative solution to bypass this issue.
Regards
Kiruthiga Kuppuswamy

L2TP VPN not working over internet

Hello Mac Community,
It is pretty clear to me that even though I have forwarded the required ports for L2TP, that Mavericks and Server 3 break the L2TP VPN capabilites I was actively using in Mountain Lion.
I can connect locally, but when done from an external network via port forwarding, L2TP fails to connect. Before you query me on port forwarding and router make and model, let me assure you, I have been successfully doing L2TP VPN with Mountain Lion and Server 2.x.x with no issue. Pretty clear to me that Mavericks broke something.
Suggestions specific to the OS platform are appreciated! (The network is in good working order.)

Hello there as well,
I've the same issue and I investigate the problem. The reason why it does not work is, that the racoon (IKE Daemon) does not accept connections on port 4500 (IKE for NAT-T) if the source port is random generated.
Since Mavericks and IOS7 the source port from the client is no longer 4500, this lead to this problem (except you have a old VPN connection already setup bevor you update to IOS7 on your Phone).
If you are in the same network like your server, the IKE NAT-T is not used. In this case the regular port 500 (IKE) is used, and this works as expected. At the moment we have to wait if the problem is fixed by Apple.
There are two possibilities, they can adjust the clients or the server configuration. However if you want to use VPN with OS X native methods, use PPTP. This is not affected but of course it provides no Layer 2 Tunneling.
Regards,
Daniel

Cisco ASA 5505 L2TP VPN cannot access internal network

Hi,
I'm trying to configure Cisco L2TP VPN to my office. After successful connection I cannot access to internal network.
Can you jhelp me to find out the issue?
I have Cisco ASA:
inside network - 192.168.1.0
VPN network - 192.168.168.0
I have router 192.168.1.2 and I cannot ping or get access to this router.
Here is my config:
ASA Version 8.4(3)
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 198.X.X.A 255.255.255.248
ftp mode passive
same-security-traffic permit intra-interface
object network net-all
subnet 0.0.0.0 0.0.0.0
object network vpn_local
subnet 192.168.168.0 255.255.255.0
object network inside_nw
subnet 192.168.1.0 255.255.255.0
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_access_in extended deny ip any any log
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool sales_addresses 192.168.168.1-192.168.168.254
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source dynamic net-all interface
nat (inside,outside) source static inside_nw inside_nw destination static vpn_local vpn_local
nat (outside,inside) source static vpn_local vpn_local destination static inside_nw inside_nw route-lookup
object network vpn_local
nat (outside,outside) dynamic interface
object network inside_nw
nat (inside,outside) dynamic interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 198.X.X.B 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set my-transform-set-ikev1 esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set my-transform-set-ikev1 mode transport
crypto dynamic-map dyno 10 set ikev1 transform-set my-transform-set-ikev1
crypto map vpn 20 ipsec-isakmp dynamic dyno
crypto map vpn interface outside
crypto isakmp nat-traversal 3600
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 30
console timeout 0
management-access inside
dhcpd address 192.168.1.5-192.168.1.132 inside
dhcpd dns 75.75.75.75 76.76.76.76 interface inside
dhcpd enable inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy sales_policy internal
group-policy sales_policy attributes
dns-server value 75.75.75.75 76.76.76.76
vpn-tunnel-protocol l2tp-ipsec
username ----------
username ----------
tunnel-group DefaultRAGroup general-attributes
address-pool sales_addresses
default-group-policy sales_policy
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:5d1fc9409c87ecdc1e06f06980de6c13
: end
Thanks for your help.

You have to test it with "real" traffic to 192.168.1.2 and if you use ping, you have to add icmp-inspection:
policy-map global_policy
class inspection_default
inspect icmp
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Native iOS L2TP VPN not working on Lion Server

Hi Folks,
I have a very strange issue concerning making VPN work on two iOS devices I have. I have recently setup Lion Server on a MacMini here in the office with L2TP VPN using a shared secrert phrase and a password authentication.
I have Lion running on an a MacBook Air (which I setup VPN using the provisioning profile "VPN.mobileprovision") and Snow Leopard running on an iMac. (VPN was set up manually). Both systems have been tested to work both inside and outsideof my internal network as I have tested with an air card.
I also have an iPhone running 4.3.4/4.3.5 that I setup by emailing the provisioning profile and and iPad 1 running iOS 5 beta 4 setup with the vpn provisioning profile. Neither the iPad nor iPhone seem to work at all either internally nor externally. In fact I never see any activity in the vpnd.log when I attempt to connect to with these devices. All I get is the standard "The L2TP-VPN server did not respond. Try reconnecting. ..."
Based on my success with the OSX Clients both inside and outside my local network I feel it is safe to say that I do not think the issue resides on the Lion Server nor the network/firewall configuration. I am running a Time Capsule with FW 7.5.2/7.4.2. There was no change in behavior with either version of the Time capsule firmware for the clients whether they were OSX or iOS. I must be clearly missing something here and I don't know what. Any help any of you could provide would be greatly appreciated. Thanks!
Please see the below settings for my VPN Settings on the host and iOS client
root# serveradmin settings vpn
vpn:vpnHost = ""
vpn:Servers:com.apple.ppp.pptp:Server:Logfile = "/var/log/ppp/vpnd.log"
vpn:Servers:com.apple.ppp.pptp:Server:VerboseLogging = 1
vpn:Servers:com.apple.ppp.pptp:Server:MaximumSessions = 128
vpn:Servers:com.apple.ppp.pptp:DNS:OfferedSearchDomains:_array_index:0 = "ri.cox.net"
vpn:Servers:com.apple.ppp.pptp:DNS:OfferedServerAddresses:_array_index:0 = "192.168.15.1"
vpn:Servers:com.apple.ppp.pptp:Radius:Servers:_array_index:0:SharedSecret = "1"
vpn:Servers:com.apple.ppp.pptp:Radius:Servers:_array_index:0:Address = "1.1.1.1"
vpn:Servers:com.apple.ppp.pptp:Radius:Servers:_array_index:1:SharedSecret = "2"
vpn:Servers:com.apple.ppp.pptp:Radius:Servers:_array_index:1:Address = "2.2.2.2"
vpn:Servers:com.apple.ppp.pptp:enabled = no
vpn:Servers:com.apple.ppp.pptp:Interface:SubType = "PPTP"
vpn:Servers:com.apple.ppp.pptp:Interface:Type = "PPP"
vpn:Servers:com.apple.ppp.pptp:PPP:LCPEchoFailure = 5
vpn:Servers:com.apple.ppp.pptp:PPP:DisconnectOnIdle = 1
vpn:Servers:com.apple.ppp.pptp:PPP:AuthenticatorEAPPlugins:_array_index:0 = "EAP-RSA"
vpn:Servers:com.apple.ppp.pptp:PPP:AuthenticatorACLPlugins:_array_index:0 = "DSACL"
vpn:Servers:com.apple.ppp.pptp:PPP:CCPEnabled = 1
vpn:Servers:com.apple.ppp.pptp:PPP:IPCPCompressionVJ = 0
vpn:Servers:com.apple.ppp.pptp:PPP:ACSPEnabled = 1
vpn:Servers:com.apple.ppp.pptp:PPP:LCPEchoEnabled = 1
vpn:Servers:com.apple.ppp.pptp:PPP:LCPEchoInterval = 60
vpn:Servers:com.apple.ppp.pptp:PPP:MPPEKeySize128 = 1
vpn:Servers:com.apple.ppp.pptp:PPP:AuthenticatorProtocol:_array_index:0 = "MSCHAP2"
vpn:Servers:com.apple.ppp.pptp:PPP:MPPEKeySize40 = 0
vpn:Servers:com.apple.ppp.pptp:PPP:AuthenticatorPlugins:_array_index:0 = "DSAuth"
vpn:Servers:com.apple.ppp.pptp:PPP:Logfile = "/var/log/ppp/vpnd.log"
vpn:Servers:com.apple.ppp.pptp:PPP:VerboseLogging = 1
vpn:Servers:com.apple.ppp.pptp:PPP:DisconnectOnIdleTimer = 7200
vpn:Servers:com.apple.ppp.pptp:PPP:CCPProtocols:_array_index:0 = "MPPE"
vpn:Servers:com.apple.ppp.pptp:IPv4:ConfigMethod = "Manual"
vpn:Servers:com.apple.ppp.pptp:IPv4:DestAddressRanges:_array_index:0 = "192.168.15.224"
vpn:Servers:com.apple.ppp.pptp:IPv4:DestAddressRanges:_array_index:1 = "192.168.15.254"
vpn:Servers:com.apple.ppp.pptp:IPv4:OfferedRouteAddresses = _empty_array
vpn:Servers:com.apple.ppp.pptp:IPv4:OfferedRouteTypes = _empty_array
vpn:Servers:com.apple.ppp.pptp:IPv4:OfferedRouteMasks = _empty_array
vpn:Servers:com.apple.ppp.l2tp:Server:LoadBalancingAddress = "1.2.3.4"
vpn:Servers:com.apple.ppp.l2tp:Server:MaximumSessions = 128
vpn:Servers:com.apple.ppp.l2tp:Server:LoadBalancingEnabled = 0
vpn:Servers:com.apple.ppp.l2tp:Server:Logfile = "/var/log/ppp/vpnd.log"
vpn:Servers:com.apple.ppp.l2tp:Server:VerboseLogging = 1
vpn:Servers:com.apple.ppp.l2tp:DNS:OfferedSearchDomains:_array_index:0 = "ri.cox.net"
vpn:Servers:com.apple.ppp.l2tp:DNS:OfferedServerAddresses:_array_index:0 = "192.168.15.1"
vpn:Servers:com.apple.ppp.l2tp:Radius:Servers:_array_index:0:SharedSecret = "1"
vpn:Servers:com.apple.ppp.l2tp:Radius:Servers:_array_index:0:Address = "1.1.1.1"
vpn:Servers:com.apple.ppp.l2tp:Radius:Servers:_array_index:1:SharedSecret = "2"
vpn:Servers:com.apple.ppp.l2tp:Radius:Servers:_array_index:1:Address = "2.2.2.2"
vpn:Servers:com.apple.ppp.l2tp:enabled = yes
vpn:Servers:com.apple.ppp.l2tp:Interface:SubType = "L2TP"
vpn:Servers:com.apple.ppp.l2tp:Interface:Type = "PPP"
vpn:Servers:com.apple.ppp.l2tp:PPP:LCPEchoFailure = 5
vpn:Servers:com.apple.ppp.l2tp:PPP:DisconnectOnIdle = 1
vpn:Servers:com.apple.ppp.l2tp:PPP:AuthenticatorEAPPlugins:_array_index:0 = "EAP-KRB"
vpn:Servers:com.apple.ppp.l2tp:PPP:AuthenticatorACLPlugins:_array_index:0 = "DSACL"
vpn:Servers:com.apple.ppp.l2tp:PPP:VerboseLogging = 1
vpn:Servers:com.apple.ppp.l2tp:PPP:IPCPCompressionVJ = 0
vpn:Servers:com.apple.ppp.l2tp:PPP:ACSPEnabled = 1
vpn:Servers:com.apple.ppp.l2tp:PPP:LCPEchoInterval = 60
vpn:Servers:com.apple.ppp.l2tp:PPP:LCPEchoEnabled = 1
vpn:Servers:com.apple.ppp.l2tp:PPP:AuthenticatorProtocol:_array_index:0 = "MSCHAP2"
vpn:Servers:com.apple.ppp.l2tp:PPP:AuthenticatorPlugins:_array_index:0 = "DSAuth"
vpn:Servers:com.apple.ppp.l2tp:PPP:Logfile = "/var/log/ppp/vpnd.log"
vpn:Servers:com.apple.ppp.l2tp:PPP:DisconnectOnIdleTimer = 7200
vpn:Servers:com.apple.ppp.l2tp:IPSec:SharedSecretEncryption = "Keychain"
vpn:Servers:com.apple.ppp.l2tp:IPSec:LocalIdentifier = ""
vpn:Servers:com.apple.ppp.l2tp:IPSec:SharedSecret = "com.apple.ppp.l2tp"
vpn:Servers:com.apple.ppp.l2tp:IPSec:AuthenticationMethod = "SharedSecret"
vpn:Servers:com.apple.ppp.l2tp:IPSec:RemoteIdentifier = ""
vpn:Servers:com.apple.ppp.l2tp:IPSec:IdentifierVerification = "None"
vpn:Servers:com.apple.ppp.l2tp:IPSec:LocalCertificate = <>
vpn:Servers:com.apple.ppp.l2tp:IPv4:ConfigMethod = "Manual"
vpn:Servers:com.apple.ppp.l2tp:IPv4:DestAddressRanges:_array_index:0 = "192.168.15.241"
vpn:Servers:com.apple.ppp.l2tp:IPv4:DestAddressRanges:_array_index:1 = "192.168.15.249"
vpn:Servers:com.apple.ppp.l2tp:IPv4:OfferedRouteAddresses = _empty_array
vpn:Servers:com.apple.ppp.l2tp:IPv4:OfferedRouteTypes = _empty_array
vpn:Servers:com.apple.ppp.l2tp:IPv4:OfferedRouteMasks = _empty_array
vpn:Servers:com.apple.ppp.l2tp:L2TP:Transport = "IPSec"

Issue is resolved. I used the initial random generated shared secret that was generated by Lion Server. The shared secret has special characters. IOS did not like the special characters. See iPhone Console Log below:
Jul 26 20:00:36 iPhone-4 racoon[718] <Info>: [718] INFO: @(#)This product linked OpenSSL 0.9.7l 28 Sep 2006 (http://www.openssl.org/)
Jul 26 20:00:36 iPhone-4 racoon[718] <Info>: [718] INFO: Reading configuration from "/etc/racoon/racoon.conf"
Jul 26 20:00:36 iPhone-4 racoon[718] <Info>: [718] ERROR: /var/run/racoon/68.9.232.78.conf:6: "?gLA" syntax error
Jul 26 20:00:36 iPhone-4 racoon[718] <Info>: [718] ERROR: fatal parse failure (1 errors)
That is why I never saw any attempt to connect. The actual process would bomb out before attempting to make a connection to the server.
The shared secret key was:
Y|WNwvM_O"?gLA$F@adT
Looks like it was the " or the ? symbols.
Once I changed the shared secret key the issue went away and the iPhone and iPad could connect to vpn without issue.
Figured I'd let you all know

Check router for VPN Throughput - L2TP VPN

I am working on setting up a VPN for our office. I have the PPTP version working but am unable to get L2TP to function. Through various testing methods (setting up our Mac Yosemite server as a VPN and testing it in and out of the office), I am leaning towards an issue with the router not allowing some of the protocols required by an L2TP through. The reason being I am able to create a L2TP VPN connection with my Mac server when using the internal IP address, but not when using the outside IP address (which to me means the signal is being blocked at the router.)
The server is receiving the SCCRQ from the client and trying to send the SCCRP which the client is not receiving when trying to connect from outside the office.
I have checked all the ports required and they are open (show ip ports), but can not figure out how to check for ESP Protocol 50? Does anyone know how to check this protocol? And if this isn't the solution, does any have other methods I can use to find the issue?
Thank you,
Chris

I think 2811 can handle this task
2811 supports up to 1500 VPN tunnels with the AIM-EPII-PLUS Module
http://www.cisco.com/en/US/products/ps5881/index.html
So no problem with 165 VPNs...
If you speaking about huge traffic volume - you should focus on speed of Internet connectivity in head office - If you have 10 Mbit line for head office you get only 60Kbit per tunnel (10Mbit/165)
M.
Hope that helps rate if it does

L2TP VPN Problem Authenticating

Hi there
I'm trying to get my mac mini server running again after moving to a new appartment and switching the internet provider.
So I thought all I have to do is setup the new router and enable port forwarding on it on the UDP Ports 500, 1701 and 4500 (the rest should be still working, thanks to dyndns)
But somehow I can't establich a vpn connection any more, and I wonder why... when I try to establish a vpn connection with my macbook air, it seems to remain in a "authenticating" state.
I do not get an authentication failed message
Nor do I get any other message...
Here's the console output
2/23/12 1:08:14.675 AM racoon: IKEv1 Phase2 Initiator: success. (Initiator, Quick-Mode).
2/23/12 1:08:14.675 AM racoon: IPSec Phase2 established (Initiated by me).
2/23/12 1:08:14.676 AM pppd: IPSec connection established
2/23/12 1:08:14.855 AM pppd: L2TP connection established.
2/23/12 1:08:14.859 AM pppd: Connect: ppp0 <--> socket[34:18]
2/23/12 1:10:13.020 AM configd: SCNC: stop, type L2TP
2/23/12 1:10:13.030 AM pppd: Connection terminated.
As visible a connection get's established ... and then after two minutes I killed it again because it still showed "authenticating"
And if I try to connect to the server from my iPhone I get a "The L2TP-VPN server did not respond" message.
Any ideas what could be the cause?
Best regards
Alex

when i connect l2tp vpn I see the message in console ipsec connection faild after phase 1 and phase 2.
Any solutiion of someone.

[Mac OS X] Problems setting up L2TP VPN Connection

I recently moved from Windows to Mac OS X (10.6.6). Unfortunately this move was not so smoothly as I hoped for and I am currently facing some issues with the VPN-connection to the company I work for. As with many companies they do not have a Mac-guide and I am trying to solve this issue, but so far unsuccesful.
To access my data on the company’s server (MS TS Environment) I need to establish a L2TP-IPsec VPN connection. I used Mac OS X built in network tool and filled out all the necessary information such as vpn address, shared secret/key, password and accountname. I even double checked the information various times so no spelling errors occurred. After some seconds I receive the message that the L2TP-VPN-server does not respond.
I checked other posts already and I checked the box that sents all traffic via this VPN-connection but without any results. For a moment I doubted that the cause of this issue might be my home-network: MBA <-> Timecapsule <-> Thomson TG789 … however when I make a L2TP VPN connection using a Windows XP or Vista pc this can be done without problems (using the same network structure) so I guess it is a mac-related problem either with my MBA (Mac OSX) or with the companies servers…
I found out that using the console.app can provide me with some more information about the connection process:
- L2TP connecting to server
- IPSec connection started
- IKE Packet: transmit success.
- IKE Packet: receive success.
After a couple of attemps from the 6th message it suddenly shows:
- IKE Packet: receive failed.
- IKE Packet: transmit success.
- IKE Packet: receive failed.
-IKEv1 Phase1: maximum retransmits.
-IKE Packets Receive Failure-Rate Statistic.
And this finally results in ' IPSec connection failed'
Does anyone has an idea of what the problem might be (e.g. the settings of the MAC or the settings of the companies VPN or ???) and maybe a solution for this problem?
Many thanks from a newbie but satisfied Mac-user!

Hi, I have the same problem with the establishing VPN connection using L2TP without IPsec.

Steps needed to properly setup L2TP VPN in Mac OS X Server 10.6

I've been spending hours configuring my network and cannot get my L2TP VPN to connect both inside and outside my network. I am guessing I am having an IP conflict as every time I try to make a connection I get an error message of "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your administrator"
In my AEBS I have my beginning DHCP address as 10.0.1.1 and ending at 10.0.1.100. In my VPN config under Server Preferences I am asked for a range of IPs to assign for the VPN where I select 10.0.1.101 and end at 10.0.1.105. Am I doing something wrong? Can somebody list the proper steps to get this going ok?
Thanks again for the great support.

If you enable the extended logging using the following commands you will get all the details you are after in the radius log.
$ sudo radiusconfig -setconfig log_auth yes
$ sudo radiusconfig -setconfig logauthgoodpass yes
$ sudo radiusconfig -setconfig logauthbadpass yes
In the log you will then see entries like this
Auth: Login OK: [002500xxxxxx/password] (from client Airport BaseStation port 0 cli 00-25-00-xx-xx-xx)
where 'Airport BaseStation' will be the name of your access point as defined in the RADIUS server admin section.
Charlie at ewhizz d0t net
ewhizz dot net

OS X Server / VPN /The L2TP-VPN server did not respond...HELP!

I am very new to OS X Server and my goal is to setup DNS & VPN! I would like to have this setup to be able to connect into my apple computer from work or friends house. I am using an Apple Airport Extreme router and im also using the latest version OS X Mountain Lion with OS X Server installed. I have started an account with dyndns website for user host name (using a [email protected] address). I assume this would be used as an alternate way of being able to connect without starting a personal website. I also signed up for another site (no-ip) and I now have a different IP address (not sure if that was necessary). I then followed instructions on youtube (instructional videos by todd for OS X Server Mountain Lion) which seemed to be very easy to understand. But after setting up my VPN on the client side (network setting in system preferences), i tried to connect VPN (L2TP) and i receive this error message "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator.". When I open Consol in the utilities folder, I am seeing part of the following message below;
racoon[117]: IKE Packet: transmit success. (Phase1 Retransmit).
racoon[117]: IKE Packet: receive failed. (malformed or unexpected cookie).
pppd[490]: IPSec connection failed
Does anyone know what's happening or what I need to do to fix this? Or can someone tell me the basic requirements to setting things up correctly?

Im using Comcast for my ISP and from the wall I have a Motorola Surfboard 6120 cable modem (not sure how to access my setting on the modem). So basically I have my 6120 cable modem connected to the Apple AirportExtreme router and is then wirelessly connected to my macbook pro. im providing screen shots of my apple router settings, OS X Server settings and firewall (which is turned off) settings. Any suggestion on how i should set things up or if you can tell me step by step would be greatly appreciated.

Asset Generator broken since recent update to Photoshop CC

With this latest update to Photoshop CC, the asset generator no longer seems to support having masks on a folder - asset will NOT generate if this is the case. Seems the only work-around is to clip everything down to a shape layer, which is highly awkward. Is this a bug? Can it please be fixed? This used to work just fine and has only been broken since the most recent update.

My team is having the same issue. I'd love to hear about a fix to this.

L2TP VPN Error: "MPPE required but peer negotiation failed"

Clean Leopard Server install. Fairly clean Leopard client, too. Tried to setup an L2TP VPN service, and connect to it from the client machine, and I get this in the client's log:
11/6/07 2007-11-06 T 20:23:52 (PST) pppd[374] IPSec connection established
11/6/07 2007-11-06 T 20:23:52 (PST) pppd[374] L2TP connection established.
11/6/07 2007-11-06 T 20:23:52 (PST) pppd[374] Connect: ppp0 <--> socket[34:18]
11/6/07 2007-11-06 T 20:23:53 (PST) pppd[374] MPPE required but peer negotiation failed
11/6/07 2007-11-06 T 20:23:53 (PST) pppd[374] Connection terminated.
As far as I can tell from searching the web, MPPE should not even be involved (but I really don't know the protocol). If I setup a PPTP VPN on the same pair of machines all is well.
I really think this is a bug in either Leopard or Leopard Server. Anyone else bumping into this wall?
regards,
Bill.

I have the exact same problem. Hopefully Apple will fix this soon. I'm trying to connect to a Linux Box with OpenSwan and L2tpd.
My Logs:
Leopard:
Dec 2 14:43:44 MRiedel-PB-G4 pppd[18603]: L2TP connecting to server XXXXXXXX...
Dec 2 14:43:47 MRiedel-PB-G4 pppd[18603]: IPSec connection started
Dec 2 14:43:48 MRiedel-PB-G4 pppd[18603]: IPSec connection established
Dec 2 14:43:51 MRiedel-PB-G4 pppd[18603]: L2TP connection established.
Dec 2 14:43:51 MRiedel-PB-G4 pppd[18603]: Connect: ppp0 <--> socket[34:18]
Dec 2 14:43:51 MRiedel-PB-G4 pppd[18603]: MPPE required but peer negotiation failed
Dec 2 14:43:52 MRiedel-PB-G4 pppd[18603]: Connection terminated.
Dec 2 14:43:52 MRiedel-PB-G4 pppd[18603]: L2TP disconnecting...
Dec 2 14:43:52 MRiedel-PB-G4 pppd[18603]: L2TP disconnected
And on the Linux Box:
Dec 2 23:43:47 bt-server pluto[2941]: "L2TP-PSK"[9] 63.231.xxx.xxx #16: STATEQUICKR2: IPsec SA established {ESP=>0x09c22235 <0x8522bdef xfrm=AES128-HMACSHA1 NATD=63.231.52.188:4500 DPD=none}
Dec 2 23:43:49 bt-server l2tpd[6376]: control_finish: Peer requested tunnel 8 twice, ignoring second one.
Dec 2 23:43:49 bt-server l2tpd[6376]: Connection established to 63.231.xxx.xxx, 56177. Local: 51805, Remote: 8. LNS session is 'default'
Dec 2 23:43:49 bt-server l2tpd[6376]: Call established with 63.231.xxx.xxx, Local: 56732, Remote: 18603, Serial: 1
Dec 2 23:43:49 bt-server pppd[7541]: pppd 2.4.3 started by root, uid 0
Dec 2 23:43:49 bt-server pppd[7541]: using channel 2105
Dec 2 23:43:49 bt-server pppd[7541]: Using interface ppp2
Dec 2 23:43:49 bt-server pppd[7541]: Connect: ppp2 <--> /dev/pts/4
Dec 2 23:43:49 bt-server pppd[7541]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x6d3895f7> <pcomp> <accomp>]
Dec 2 23:43:49 bt-server pppd[7541]: rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x4d928d7a> <pcomp> <accomp>]
Dec 2 23:43:49 bt-server pppd[7541]: sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x4d928d7a> <pcomp> <accomp>]
Dec 2 23:43:49 bt-server pppd[7541]: rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x6d3895f7> <pcomp> <accomp>]
Dec 2 23:43:49 bt-server pppd[7541]: sent [LCP EchoReq id=0x0 magic=0x6d3895f7]
Dec 2 23:43:49 bt-server pppd[7541]: sent [CHAP Challenge id=0x12 <4885f2c708e0dbd85a3cf7cf60ed6b24>, name = "IPsecVPN"]
Dec 2 23:43:50 bt-server pppd[7541]: rcvd [LCP EchoReq id=0x0 magic=0x4d928d7a]
Dec 2 23:43:50 bt-server pppd[7541]: sent [LCP EchoRep id=0x0 magic=0x6d3895f7]
Dec 2 23:43:50 bt-server pppd[7541]: rcvd [LCP EchoRep id=0x0 magic=0x4d928d7a]
Dec 2 23:43:50 bt-server pppd[7541]: rcvd [CHAP Response id=0x12 <c574d7703411572a98de35e99f3d81ad00000000000000000b4906c55495f2727310659600c5c1 405145b06079ad9fbe00>, name = "xxx"]
Dec 2 23:43:50 bt-server pppd[7541]: sent [CHAP Success id=0x12 "S=2C78FC23BCE0D753988BB8A6AA9EB3EB22326318 M=Access granted"]
Dec 2 23:43:50 bt-server pppd[7541]: sent [CCP ConfReq id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>]
Dec 2 23:43:50 bt-server pppd[7541]: sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 192.168.184.2>]
Dec 2 23:43:50 bt-server pppd[7541]: rcvd [CCP ConfReq id=0x1 <mppe +H -M +S +L -D -C>]
Dec 2 23:43:50 bt-server pppd[7541]: sent [CCP ConfRej id=0x1 <mppe +H -M +S +L -D -C>]
Dec 2 23:43:50 bt-server pppd[7541]: rcvd [LCP TermReq id=0x2 "MPPE required but peer negotiation failed"]
Dec 2 23:43:50 bt-server pppd[7541]: LCP terminated by peer (MPPE required but peer negotiation failed)
Dec 2 23:43:50 bt-server pppd[7541]: sent [LCP TermAck id=0x2]
Dec 2 23:43:50 bt-server pppd[7541]: rcvd [CCP ConfRej id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>]
Dec 2 23:43:50 bt-server pppd[7541]: Discarded non-LCP packet when LCP not open
Dec 2 23:43:50 bt-server l2tpd[6376]: control_finish: Connection closed to 63.231.xxx.xxx, serial 1 ()
Dec 2 23:43:50 bt-server pppd[7541]: Terminating on signal 15
Dec 2 23:43:50 bt-server pppd[7541]: Modem hangup
Dec 2 23:43:50 bt-server pppd[7541]: Connection terminated.
Dec 2 23:43:50 bt-server pppd[7541]: Connect time 0.1 minutes.
Dec 2 23:43:50 bt-server pppd[7541]: Sent 41 bytes, received 10 bytes.
Dec 2 23:43:50 bt-server pppd[7541]: Exit.
Even if I force MPPE on the linux side, I get the same error. Please fix!
Regards

Getting Error 789 When Trying to Connect to L2TP VPN

Can someone take a quick look at this config and let me know why the L2TP vpn is not working? I have been banging my head with no results.
Thanks so much if anyone can help me.
ASA Version 8.2(5)
hostname companyASA
domain-name *****.com
enable password encrypted
passwd encrypted
names
name 192.168.1.0 AppletonData description Appleton Data
name 172.16.0.0 AppletonVoice description Appleton Voice
name 172.16.16.0 Watertown description Watertown
name 10.0.0.0 anyInside description anyInside
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
switchport access vlan 209
interface Ethernet0/7
switchport access vlan 209
interface Vlan1
nameif inside
security-level 100
ip address 10.76.3.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
ip address 12.XXX.XXX.XXX 255.255.255.0
interface Vlan209
nameif IPOffice
security-level 50
ip address 10.10.109.1 255.255.255.0
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8
domain-name *****.com
object-group network obj_any
object-group network Any10Address
description Data and Phone Networks Combined
object-group network AppletonData
description Appleton Data Network
object-group network AppletonPhone
description Appleton Phone Network
object-group network NETWORK_OBJ_10.76.3.0_24
object-group network Watertown
description Watertown Network
object-group network NETWORK_OBJ_10.10.109.0_24
object-group network Internal-Subnet
access-list Split-Tunnel-ACL standard permit 10.76.3.0 255.255.255.0
access-list outside_access_in extended permit icmp any any inactive
access-list outside_1_cryptomap extended permit ip 10.76.3.0 255.255.255.0 AppletonData 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.76.3.0 255.255.255.0 AppletonData 255.255.255.0
access-list inside_nat0_outbound extended permit ip anyInside 255.0.0.0 Watertown 255.255.255.0
access-list inside_nat0_outbound extended permit ip 10.76.3.0 255.255.255.0 192.168.50.0 255.255.255.192
access-list IPOffice_nat0_outbound extended permit ip 10.10.109.0 255.255.255.0 AppletonVoice 255.255.255.0
access-list IPOffice_nat0_outbound extended permit ip anyInside 255.0.0.0 Watertown 255.255.255.0
access-list outside_2_cryptomap extended permit ip 10.10.109.0 255.255.255.0 AppletonVoice 255.255.255.0
access-list outside_3_cryptomap extended permit ip anyInside 255.0.0.0 Watertown 255.255.255.0
access-list DefaultRAGroup_splitTunnelAcl standard permit 10.76.3.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu IPOffice 1500
ip local pool VPN_Pool 192.168.50.10-192.168.50.50 mask 255.255.255.0
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 101 0.0.0.0 0.0.0.0
nat (IPOffice) 0 access-list IPOffice_nat0_outbound
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 12.133.127.169 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 10.76.3.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec transform-set l2tp-transform esp-3des esp-sha-hmac
crypto ipsec transform-set l2tp-transform mode transport
crypto ipsec transform-set vpn-transform esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dyn-map 10 set transform-set l2tp-transform vpn-transform
crypto dynamic-map dyn-map 10 set reverse-route
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 99.6XX.XXX.XXX
crypto map outside_map 2 set pfs
crypto map outside_map 2 set peer 99.1XX.XXX.XXX
crypto map outside_map 3 set pfs
crypto map outside_map 3 set peer 24.XXX.XXX.XXX
crypto map L2TP-VPN-MAP 1 match address outside_1_cryptomap
crypto map L2TP-VPN-MAP 1 set pfs
crypto map L2TP-VPN-MAP 1 set peer 99.6XX.XXX.XXX
crypto map L2TP-VPN-MAP 1 set transform-set ESP-3DES-SHA
crypto map L2TP-VPN-MAP 2 match address outside_2_cryptomap
crypto map L2TP-VPN-MAP 2 set pfs
crypto map L2TP-VPN-MAP 2 set peer 99.1XX.XXX.XXX
crypto map L2TP-VPN-MAP 2 set transform-set ESP-3DES-SHA
crypto map L2TP-VPN-MAP 3 match address outside_3_cryptomap
crypto map L2TP-VPN-MAP 3 set pfs
crypto map L2TP-VPN-MAP 3 set peer 24.XXX.XXX.XXX
crypto map L2TP-VPN-MAP 3 set transform-set ESP-3DES-SHA
crypto map vpn-map 10 ipsec-isakmp dynamic dyn-map
crypto map vpn-map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
dhcpd auto_config outside
dhcpd address 10.76.3.5-10.76.3.254 inside
dhcpd dns 8.8.8.8 interface inside
dhcpd domain *****.com interface inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 8.8.8.8
vpn-tunnel-protocol l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl
default-domain value *****.com
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol l2tp-ipsec
group-policy GroupPolicy_99.6XX.XXX.XXX internal
group-policy GroupPolicy_99.6XX.XXX.XXX attributes
vpn-tunnel-protocol IPSec
group-policy GroupPolicy_24.XXX.XXX.XXX internal
group-policy GroupPolicy_24.XXX.XXX.XXX attributes
vpn-tunnel-protocol IPSec
group-policy GroupPolicy_99.1XX.XXX.XXX internal
group-policy GroupPolicy_99.1XX.XXX.XXX attributes
vpn-tunnel-protocol IPSec
group-policy vpn-policy internal
group-policy vpn-policy attributes
vpn-tunnel-protocol IPSec
username support password encrypted privilege 15
username lmk1 password nt-encrypted
username admin password encrypted privilege 15
username drm1 password nt-encrypted
username jms1 password nt-encrypted
username tcb1 password nt-encrypted
username jmb1 password nt-encrypted
username enm1 password nt-encrypted
username jason password nt-encrypted
username amw1 password nt-encrypted
username alp1 password nt-encrypted
username lab1 password nt-encrypted
tunnel-group DefaultL2LGroup ipsec-attributes
isakmp keepalive threshold 15 retry 2
tunnel-group DefaultRAGroup general-attributes
address-pool VPN_Pool
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key *****
isakmp keepalive disable
tunnel-group DefaultRAGroup ppp-attributes
authentication pap
no authentication chap
authentication ms-chap-v2
tunnel-group 99.6XX.XXX.XXX type ipsec-l2l
tunnel-group 99.6XX.XXX.XXX general-attributes
default-group-policy GroupPolicy_99.6XX.XXX.XXX
tunnel-group 99.6XX.XXX.XXX ipsec-attributes
pre-shared-key *****
tunnel-group 99.1XX.XXX.XXX type ipsec-l2l
tunnel-group 99.1XX.XXX.XXX general-attributes
default-group-policy GroupPolicy_99.1XX.XXX.XXX
tunnel-group 99.1XX.XXX.XXX ipsec-attributes
pre-shared-key *****
tunnel-group 24.XXX.XXX.XXX type ipsec-l2l
tunnel-group 24.XXX.XXX.XXX general-attributes
default-group-policy GroupPolicy_24.XXX.XXX.XXX
tunnel-group 24.XXX.XXX.XXX ipsec-attributes
pre-shared-key *****
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous

What is the version of Contribute and also the Mac OS ?
Can you try clearing the Preferences this would be like launching Contribute freshly?

IPhone 4S 5.1.1 b206 failed to connect to L2TP VPN (Mac OSX 10.6.8)

I just upgraded my iPhone 4S from 5.0.1 to 5.1.1 b206, and I noticed this issue.
I have a Mac Mini Server running Mac OSX 10.6.8.
I build up the VPN server with L2TP and PPTP.
Before I upgrade my iPhone to 5.1.1, it works with L2TP and PPTP both.
After I upgrade to 5.1.1 b206, it only connect to PPTP, L2TP shows the error message
"VPN Connection"
"The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator."
Simultaneously, I tried my iPad, it connects to L2TP AND PPTP with no problem.
Please advice, thanks.

The point of checking the console, is there might be a message that pops up in response to trying to copy a file to the target. Your looking for a doorbell like response. IE you try to copy a 1k file, error message pops up. Try to copy again, same error message.
Is Copy Enabled on the target client?
ie: ard into the target, open system preferences, click on sharing, click on remote management. ( If allow access is set to "only these users"; then select the account your using to ard into the computer. ) click on the options button, Verify the fallowing items are checked: Open & Quite Applications, Change Settings, Delete & Replace Items, Restart & Shutdown, Copy Items. click the Ok button.
if Copy Is Enabled, have you verified the firewall is off?
ie: ard into the client, open system preferences, click on security, click on the Firewall tab, verify Firewall is off. This would also go for any programs that act like a firewall. (little snitch, anti virus barrier, extra)
Have you verified the ARD reporting time on the target computer? Some times ARD can get weird if the reports have ran in a while.
ie: get info on the client in ARD. click on the reporting tab. Set the reporting time to be a few minutes from the actual time. Let the time on the target computer hit the reporting time.Then try copying a file.
Have you ruled out the network?
ie: plug the ARD computer into the target directly by ethernet. make sure airport is off on both computers. Then try copying the file again.

L2TP vpn - broken since 10.4.11

Similar Messages

Maybe you are looking for