5

Environment:

# uname -a
Linux shrimpwagon 3.16.0-4-amd64 #1 SMP Debian 3.16.39-1+deb8u1 (2017-02-22) x86_64 GNU/Linux

I have already installed:

# apt-get install strongswan xl2tpd

I'm trying to connect to a Meraki VPN. I spoke to a Meraki tech and he said that it looks like it is not authenticating but didn't give me much more detail:

# ipsec up L2TP-PSK
generating QUICK_MODE request 2711688330 [ HASH SA No ID ID NAT-OA NAT-OA ]
sending packet: from 10.0.0.4[4500] to 50.123.152.194[4500] (252 bytes)
received packet: from 50.123.152.194[4500] to 10.0.0.4[4500] (68 bytes)
parsed INFORMATIONAL_V1 request 2555305796 [ HASH N(NO_PROP) ]
received NO_PROPOSAL_CHOSEN error notify
establishing connection 'L2TP-PSK' failed

ipsec.conf:

config setup
    virtual_private=%v4:10.0.0.0/8
#   nat_traversal=yes
    protostack=auto
    oe=off
    plutoopts="--interface=eth0"

conn L2TP-PSK
    keyexchange=ikev1
    ike=aes128-sha1-modp1024,3des-sha1-modp1024!
    phase2=ah
    phase2alg=aes128-sha1-modp1024,3des-sha1-modp1024!
    authby=secret
    aggrmode=yes
    pfs=no
    auto=add
    keyingtries=2
#   dpddelay=30
#   dpdtimeout=120
#   dpdaction=clear
#   rekey=yes
    ikelifetime=8h
    keylife=1h
    type=transport
    left=%defaultroute
#   leftnexthop=%defaultroute
#   leftprotoport=udp/l2tp
    right=50.123.152.194
    rightsubnet=10.2.150.0/24

ipsec.secrets:

%any %any : PSK "****"

xl2tpd.conf:

[lac vpn-connection]
lns = 50.123.152.194
;refuse chap = yes
;refuse pap = no
;require authentication = yes
;name = vpn-server
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes

options.l2tpd.client:

ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-mschap-v2
noccp
noauth
idle 1800
mtu 1410
mru 1410
defaultroute
usepeerdns
debug
lock
connect-delay 5000
name swelch
password ****

I have gotten most of my instructions from this site:

https://www.elastichosts.com/blog/linux-l2tpipsec-vpn-client/

I did have to put it into aggresive mode, specify ikev1 and set the ike algorithms. Once I did that then I was able to start communicating to the MX. But I'm getting this error now and I am at a total loss.

Thanks in advance!

Improve this question

2 Answers 2

Reset to default
12

When connecting as a Meraki Client VPN, it only supports protocols that have been removed from the Strongswan default protocol negotiation list (because the SWEET32 birthday attack is possible against some of these protocols) so you have to specify them explicitly (as you have).

If you install ike-scan and run it against your Meraki "server" sudo ipsec stop; sudo service xl2tpd stop; sudo ike-scan YOUR.SERVER.IP you can see what the default protocol is. I'm fairly confident it is 3des-sha1-modp1024 like you have above, though in my (NetworkManager) generated ipsec.conf I don't have the phase2 and phase2alg lines, but an esp.

Here is the snippet from my working config with the protocols:

  keyexchange=ikev1
  ike=3des-sha1-modp1024!
  esp=3des-sha1!

Sidenote: This probably doesn't matter for you since you are using the CLI, but I'm using a PPA for the NM plugin for L2TP from ppa:nm-l2tp/network-manager-l2tp and in my NetworkManager GUI it refers Phase 1 and Phase 2, but in the generated ipsec config those map to the ike and esp above. I used this blog post

Improve this answer
3
  • How do you know which algorithms to use from the output of ike-scan? Also, is it really necessary to stop the other IPSec services when running this scan?
    – Chris Watts
    Apr 12, 2019 at 12:33
  • 1
    You should ideally use the most secure protocol your server supports. In the case of the Meraki at the time the answer was posted it only supported a single insecure protocol. The stopping of the other services was required due to port conflicts if they were running during the scan.
    – dragon788
    Apr 17, 2019 at 17:38
  • What I meant to clarify was that, for example, a result of ike-scan that returns SA=(Enc=AES KeyLength=256 Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration=28800) would mean that the algorithm to use would be aes256-sha1-modp1024
    – Chris Watts
    Apr 24, 2019 at 8:20
0

When I last had NO_PROPOSAL_CHOSEN I had to make sure the MTU settings as shown above match what my system was expecting. I found it among additional error lines in syslog.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .