A conexão VPN IPSec / L2TP falha

Question

Atualmente, estou tentando estabelecer uma conexão VPN com a rede do meu escritório usando o IPSec / L2TP com o Ubuntu 16.04 (e / ou o Fedora 26), que falha com as seguintes entradas do syslog (log completo abaixo):

11:46:26 laptop NetworkManager[911]: received packet: from x.x.x.x[500] to 192.168.0.102[500] (56 bytes)
11:46:26 laptop NetworkManager[911]: parsed INFORMATIONAL_V1 request 3879417451 [ N(NO_PROP) ]
11:46:26 laptop NetworkManager[911]: received NO_PROPOSAL_CHOSEN error notify
11:46:26 laptop NetworkManager[911]: establishing connection '5f4cde33-5549-4535-864b-04944a5d4d69' failed

De acordo com esta resposta sobre uma questão semelhante, o problema pode ser a negociação do (s) protocolo (s) a usar para a conexão. Como sugerido, usei a ferramenta mencionada ike-scan para recuperar algumas informações do servidor:

# sudo ipsec stop; sudo service xl2tpd stop; sudo ike-scan x.x.x.x
Stopping strongSwan IPsec failed: starter is not running
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
x.x.x.x Main Mode Handshake returned HDR=(CKY-R=7b0d4448e7767519) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080) VID=1e2b516905991c7d7c96fcbfb587e46100000009 (MS NT5 ISAKMPOAKLEY) VID=4a131c81070358455c5728f20e95452f (RFC 3947 NAT-T) VID=90cb80913ebb696e086381b5ec427b1f (draft-ietf-ipsec-nat-t-ike-02\n) VID=4048b7d56ebce88525e7de7f00d6c2d3 (IKE Fragmentation) VID=fb1de3cdf341b7ea16b7e5be0855f120 VID=e3a5966a76379fe707228231e5ce8652

Ending ike-scan 1.9: 1 hosts scanned in 0.062 seconds (16.05 hosts/sec).  1 returned handshake; 0 returned notify

Como sugerido, atualizei a configuração de conexão do NetworkManager para usar esses algoritmos:

[connection]
id=SomeName
uuid=5f4cde33-5549-4535-864b-04944a5d4d69
type=vpn
autoconnect=false
permissions=user:arne:;
secondaries=

[vpn]
password-flags=1
ipsec-esp=3des-sha1!
ipsec-psk=****
user=****
ipsec-enabled=yes
ipsec-ike=3des-sha1-modp1024!
mru=1400
gateway=x.x.x.x
mtu=1400
service-type=org.freedesktop.NetworkManager.l2tp
keyexchange=ikev1

[ipv4]
dns-search=
method=auto

[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto

Mas isso não parece alterar nada no log de erros.

Alguém tem uma ideia de qual pode ser o problema aqui?

Muito obrigado!

Ambiente:

# uname -a
Linux arne-Latitude-E5570 4.10.0-35-generic #39~16.04.1-Ubuntu SMP Wed Sep 13 09:02:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

Syslog completo:

11:46:23 laptop NetworkManager[911]: <info>  [1508492783.2731] audit: op="connection-activate" uuid="5f4cde33-5549-4535-864b-04944a5d4d69" name="SomeName" pid=31464 uid=1000 result="success"
11:46:23 laptop NetworkManager[911]: <info>  [1508492783.2860] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: Started the VPN service, PID 1579
11:46:23 laptop NetworkManager[911]: <info>  [1508492783.3102] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: Saw the service appear; activating connection
11:46:23 laptop NetworkManager[911]: <info>  [1508492783.3934] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN connection: (ConnectInteractive) reply received
11:46:23 laptop NetworkManager[911]: nm-l2tp[1579] <info>  ipsec enable flag: yes
11:46:23 laptop NetworkManager[911]: ** Message: Check port 1701
11:46:23 laptop NetworkManager[911]: ** Message: Can't bind to port 1701
11:46:23 laptop NetworkManager[911]: nm-l2tp[1579] <warn>  L2TP port 1701 is busy, using ephemeral.
11:46:23 laptop NetworkManager[911]: nm-l2tp[1579] <info>  starting ipsec
11:46:23 laptop NetworkManager[911]: Stopping strongSwan IPsec failed: starter is not running
11:46:25 laptop NetworkManager[911]: Starting strongSwan 5.3.5 IPsec [starter]...
11:46:25 laptop NetworkManager[911]: Loading config setup
11:46:25 laptop NetworkManager[911]: Loading conn '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:25 laptop NetworkManager[911]: found netkey IPsec stack
11:46:25 laptop charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.10.0-35-generic, x86_64)
11:46:25 laptop charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
11:46:25 laptop charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
11:46:25 laptop charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
11:46:25 laptop charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
11:46:25 laptop charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
11:46:25 laptop charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
11:46:25 laptop charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-5f4cde33-5549-4535-864b-04944a5d4d69.secrets'
11:46:25 laptop charon: 00[CFG]   loaded IKE secret for %any
11:46:25 laptop charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-77751670-3316-4fdc-abaf-1293b25b7687.secrets'
11:46:25 laptop charon: 00[CFG]   loaded IKE secret for %any
11:46:25 laptop charon: 00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown
11:46:25 laptop charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
11:46:25 laptop charon: 00[JOB] spawning 16 worker threads
11:46:25 laptop charon: 04[CFG] received stroke: add connection '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:25 laptop charon: 04[CFG] added configuration '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:26 laptop charon: 06[CFG] rereading secrets
11:46:26 laptop charon: 06[CFG] loading secrets from '/etc/ipsec.secrets'
11:46:26 laptop charon: 06[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-5f4cde33-5549-4535-864b-04944a5d4d69.secrets'
11:46:26 laptop charon: 06[CFG]   loaded IKE secret for %any
11:46:26 laptop charon: 06[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-77751670-3316-4fdc-abaf-1293b25b7687.secrets'
11:46:26 laptop charon: 06[CFG]   loaded IKE secret for %any
11:46:26 laptop NetworkManager[911]: nm-l2tp[1579] <info>  Spawned ipsec up script with PID 1655.
11:46:26 laptop charon: 08[CFG] received stroke: initiate '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:26 laptop charon: 10[IKE] initiating Main Mode IKE_SA 5f4cde33-5549-4535-864b-04944a5d4d69[1] to x.x.x.x
11:46:26 laptop charon: 10[ENC] generating ID_PROT request 0 [ SA V V V V ]
11:46:26 laptop charon: 10[NET] sending packet: from 192.168.0.102[500] to x.x.x.x[500] (148 bytes)
11:46:26 laptop charon: 09[NET] received packet: from x.x.x.x[500] to 192.168.0.102[500] (56 bytes)
11:46:26 laptop charon: 09[ENC] parsed INFORMATIONAL_V1 request 3879417451 [ N(NO_PROP) ]
11:46:26 laptop charon: 09[IKE] received NO_PROPOSAL_CHOSEN error notify
11:46:26 laptop NetworkManager[911]: initiating Main Mode IKE_SA 5f4cde33-5549-4535-864b-04944a5d4d69[1] to x.x.x.x
11:46:26 laptop NetworkManager[911]: generating ID_PROT request 0 [ SA V V V V ]
11:46:26 laptop NetworkManager[911]: sending packet: from 192.168.0.102[500] to x.x.x.x[500] (148 bytes)
11:46:26 laptop NetworkManager[911]: received packet: from x.x.x.x[500] to 192.168.0.102[500] (56 bytes)
11:46:26 laptop NetworkManager[911]: parsed INFORMATIONAL_V1 request 3879417451 [ N(NO_PROP) ]
11:46:26 laptop NetworkManager[911]: received NO_PROPOSAL_CHOSEN error notify
11:46:26 laptop NetworkManager[911]: establishing connection '5f4cde33-5549-4535-864b-04944a5d4d69' failed
11:46:26 laptop NetworkManager[911]: Stopping strongSwan IPsec...
11:46:26 laptop charon: 00[DMN] signal of type SIGINT received. Shutting down
11:46:26 laptop NetworkManager[911]: nm-l2tp[1579] <warn>  Could not establish IPsec tunnel.
11:46:26 laptop NetworkManager[911]: (nm-l2tp-service:1579): GLib-GIO-CRITICAL **: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
11:46:26 laptop NetworkManager[911]: <info>  [1508492786.8335] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN plugin: state changed: stopped (6)
11:46:26 laptop NetworkManager[911]: <info>  [1508492786.8359] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN plugin: state change reason: unknown (0)
11:46:26 laptop NetworkManager[911]: <info>  [1508492786.8393] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN service disappeared
11:46:26 laptop NetworkManager[911]: <warn>  [1508492786.8418] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'

    

Answer 1

Você pode excluir os arquivos de segredos temporários que não foram excluídos:

sudo rm -f /etc/ipsec.d/nm-l2tp-ipsec-*.secrets

O erro NO_PROPOSAL_CHOSEN indica que ainda há algo errado com o algoritmo da fase 1 usado para a proposta inicial. Eu também tentaria sem o ponto de exclamação, Libreswan (que é provavelmente o que você está usando no Fedora) definitivamente não suporta esta sintaxe.

Você pode tentar executar o script ike-scan.sh na seção "Consultando o servidor VPN para criptografias IKEv1 de IPsec suportadas" da seguinte página:

• link

A execução de ike-scan por si só às vezes não é suficiente, pois o servidor VPN pode oferecer suporte a mais conjuntos de criptografia.

O que você fez para os algoritmos da fase 1 e da fase 2 deve ter funcionado com o algoritmo 3DES, mas talvez algo mais esteja errado. Espero que o seu servidor VPN suporte outros algoritmos que o ike-scan.sh irá reportar e você poderá testá-los.

Suponho que você esteja usando o PPA network-manager-l2tp para o Ubuntu 16.04 . Se você ainda está tendo problemas, você poderia tentar libreswan em vez de strongswan no Ubuntu 16.04, remover a fase 1 & 2 algoritmos na caixa de diálogo de configuração do IPsec e instale o libreswan emitindo:

sudo apt install libreswan

As versões mais antigas do libreswan ainda têm os conjuntos de cifras herdadas no conjunto padrão de cifras para os algoritmos das fases 1 e 2.

A versão mais recente do libreswan que está nas Atualizações do Fedora 26 é como o strongswan quando se trata de pacotes de criptografia legados, veja Fedora Bugzilla . Espero que você consiga usar algumas outras cifras.