ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Help troubleshooting L2TP over IPSEC VPN connections.

    Scheduled Pinned Locked Moved IT Discussion
    ipsecl2tpwindows 10vpnubntubiquitiedgerouteredgerouter lite
    17 Posts 4 Posters 5.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JaredBuschJ
      JaredBusch @Romo
      last edited by

      @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

      @JaredBusch @scottalanmiller Any idea?

      Is this user trying to connect from the same IP as another user?

      gjacobseG RomoR 2 Replies Last reply Reply Quote 1
      • gjacobseG
        gjacobse @JaredBusch
        last edited by

        @jaredbusch said in Help troubleshooting L2TP over IPSEC VPN connections.:

        @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

        @JaredBusch @scottalanmiller Any idea?

        Is this user trying to connect from the same IP as another user?

        Generally not.. They are remote / home users.

        1 Reply Last reply Reply Quote 0
        • RomoR
          Romo @JaredBusch
          last edited by

          @jaredbusch said in Help troubleshooting L2TP over IPSEC VPN connections.:

          @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

          @JaredBusch @scottalanmiller Any idea?

          Is this user trying to connect from the same IP as another user?

          No, a single user trying to connect from home. She connected Wednesday without a problem, but Thursday she tries to connect again and it is not possible.

          Logs show

          13[CFG] unable to install policy EDGE_ROUTER_IP/32[udp/l2f] === USER_PUBLIC_IP/32[udp/l2f] out (mark 0/0x00000000) for reqid 35, the same policy for reqid 14 exists
13[CFG] unable to install policy USER_PUBLIC_IP/32[udp/l2f] === EDGE_ROUTER_IP/32[udp/l2f] in (mark 0/0x00000000) for reqid 35, the same policy for reqid 14 exists

          New connection can't be made because a policy with the same details is already present. If we vpn from any place that has a different public ip than the one from her home, we can establish the vpn connection without a problem.

          dbeatoD 1 Reply Last reply Reply Quote 0
          • dbeatoD
            dbeato @Romo
            last edited by

            @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

            @jaredbusch said in Help troubleshooting L2TP over IPSEC VPN connections.:

            @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

            @JaredBusch @scottalanmiller Any idea?

            Is this user trying to connect from the same IP as another user?

            No, a single user trying to connect from home. She connected Wednesday without a problem, but Thursday she tries to connect again and it is not possible.

            Logs show

            13[CFG] unable to install policy EDGE_ROUTER_IP/32[udp/l2f] === USER_PUBLIC_IP/32[udp/l2f] out (mark 0/0x00000000) for reqid 35, the same policy for reqid 14 exists
13[CFG] unable to install policy USER_PUBLIC_IP/32[udp/l2f] === EDGE_ROUTER_IP/32[udp/l2f] in (mark 0/0x00000000) for reqid 35, the same policy for reqid 14 exists

            New connection can't be made because a policy with the same details is already present. If we vpn from any place that has a different public ip than the one from her home, we can establish the vpn connection without a problem.

            What VPN client are you using, default to Windows?

            RomoR 1 Reply Last reply Reply Quote 0
            • RomoR
              Romo @dbeato
              last edited by

              @dbeato Yes

              dbeatoD 1 Reply Last reply Reply Quote 0
              • dbeatoD
                dbeato @Romo
                last edited by

                @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

                @dbeato Yes

                Okay, was looking at that error on other OpenVPN clients that had issues on older versions.

                RomoR 1 Reply Last reply Reply Quote 0
                • RomoR
                  Romo @dbeato
                  last edited by

                  @dbeato said in Help troubleshooting L2TP over IPSEC VPN connections.:

                  @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

                  @dbeato Yes

                  Okay, was looking at that error on other OpenVPN clients that had issues on older versions.

                  It looks like it is a Strongswan issue, as a temporary fix it should be resolved by manually restarting the IPSec VPN (restart vpn). Unfortunately, during working hours it seems to be too disruptive to use for properly connected users. At least without having tested the effects of the restart for connected users.

                  The strange thing is the connection is acting as if two computers were trying to access the VPN server behind the same NAT when according to the user it is only a single device.

                  1 Reply Last reply Reply Quote 1
                  • RomoR
                    Romo
                    last edited by Romo

                    Here is our issue https://wiki.strongswan.org/issues/431, it was fixed 3 years ago when version 5.3 of strongSwan came out.

                    I had not found what strongSwan version we were using, I just assumed we were using something newer. Then I found that our edge router is using strongSwan 5.2.2.

                    Here is our version.

                    Status of IKE charon daemon (strongSwan 5.2.2, Linux 3.10.107-UBNT, mips64):
  uptime: 3 days, since Aug 06 22:12:40 2018
  malloc: sbrk 376832, mmap 0, used 295456, free 81376
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled:

                    From here https://community.ubnt.com/t5/EdgeMAX-Feature-Requests/Upgrade-to-strongswan-5-6-x/idi-p/1507341 we see a change to strongSwan 5.5.x has been accepted don't know when it will be available.

                    strongSwan 5.3 + can now handle identical policies by reusing the same reqid. This allows identical CHILD_SAs to the same host.

                    So that probably means multiple machines behind NAT could also work when the fix is implemented.

                    dbeatoD 1 Reply Last reply Reply Quote 2
                    • gjacobseG
                      gjacobse
                      last edited by

                      jeeze,.. that is a sad state to think that we have nbeen fighting this for that long,...

                      @JaredBusch @scottalanmiller
                      Can a cron be set to restart the ipsec every 24 hours?

                      JaredBuschJ 1 Reply Last reply Reply Quote 1
                      • dbeatoD
                        dbeato @Romo
                        last edited by

                        @romo said in Help troubleshooting L2TP over IPSEC VPN connections.:

                        Here is our issue https://wiki.strongswan.org/issues/431, it was fixed 3 years ago when version 5.3 of strongSwan came out.

                        I had not found what strongSwan version we were using, I just assumed we were using something newer. Then I found that our edge router is using strongSwan 5.2.2.

                        Here is our version.

                        Status of IKE charon daemon (strongSwan 5.2.2, Linux 3.10.107-UBNT, mips64):
  uptime: 3 days, since Aug 06 22:12:40 2018
  malloc: sbrk 376832, mmap 0, used 295456, free 81376
  worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled:

                        From here https://community.ubnt.com/t5/EdgeMAX-Feature-Requests/Upgrade-to-strongswan-5-6-x/idi-p/1507341 we see a change to strongSwan 5.5.x has been accepted don't know when it will be available.

                        strongSwan 5.3 + can now handle identical policies by reusing the same reqid. This allows identical CHILD_SAs to the same host.

                        So that probably means multiple machines behind NAT could also work when the fix is implemented.

                        Yeah, that is what I found and was referring to. I just did not post it here.

                        1 Reply Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch @gjacobse
                          last edited by

                          @gjacobse said in Help troubleshooting L2TP over IPSEC VPN connections.:

                          jeeze,.. that is a sad state to think that we have nbeen fighting this for that long,...

                          @JaredBusch @scottalanmiller
                          Can a cron be set to restart the ipsec every 24 hours?

                          Yes.

                          1 Reply Last reply Reply Quote 0
                          • 1 / 1
                          • First post
                            Last post