troubleshooting Question

Windows 7 L2TP IPSec NAT-T

Avatar of tmi_cce
tmi_cce asked on
Windows 7Internet Protocol SecurityVPN
7 Comments3 Solutions3540 ViewsLast Modified:
Hello
I've set up a VPN between Windows 7 clients and a Juniper NS5GT Firewall according the Juniper KB articles http://kb.juniper.net/InfoCenter/index?page=content&id=KB10939  and http://kb.juniper.net/InfoCenter/index?page=content&id=KB16075.
With the first Windows 7 client, it work's just fine. With the second and the third clients, it won't work.

The error message while conecting is:
"Error 810: A network connection between your computer and the VPN server was started, but the VPN connection was not completed. This is typically caused by the use of an incorrect or expired certificate for authentication between the client and the server. Please contact your Administrator to ensure that the certificate being used for authentication is valid"

Debugging the vpn on the juniper firewall while connecting, I get the following difference betwen phase 1 and phase 2:

With the client that is ok:
## 2011-05-16 11:18:47 : IKE<138.188.100.248> responder (pki) constructing remote NAT-D
## 2011-05-16 11:18:47 : IKE<138.188.100.248> Construct [NATD]
## 2011-05-16 11:18:47 : IKE<138.188.100.248> responder (pki) constructing local NAT-D
## 2011-05-16 11:18:47 : IKE<138.188.100.248> Construct [NATD]
## 2011-05-16 11:18:47 : IKE<138.188.100.248> Xmit : [KE] [NONCE] [CERT-REQ] [NATD] [NATD]
## 2011-05-16 11:18:47 : IKE<138.188.100.248> Responder sending IPv4 IP 138.188.100.248/port 357
## 2011-05-16 11:18:47 : IKE<138.188.100.248> Send Phase 1 packet (len=278)
## 2011-05-16 11:18:47 : IKE<138.188.100.248> IKE msg done: PKI state<0> IKE state<2/1017200f>
## 2011-05-16 11:18:49 : IKE<0.0.0.0        >   from FLOAT port.
## 2011-05-16 11:18:49 : IKE<138.188.100.248> ike packet, len 1716, action 0## 2011-05-16 11:18:49 : IKE<138.188.100.248> Catcher: received 1688 bytes from socket.
## 2011-05-16 11:18:49 : IKE<138.188.100.248> ****** Recv packet if <untrust> of vsys <Root> ******
## 2011-05-16 11:18:49 : IKE<138.188.100.248> Catcher: get 1688 bytes. src port 63177
## 2011-05-16 11:18:49 : IKE<0.0.0.0        >   ISAKMP msg: len 1684, nxp 5[ID], exch 2[MM], flag 01  E
## 2011-05-16 11:18:49 : IKE<138.188.100.248> gen_skeyid()


With a client that isn't building up the VPN:
## 2011-05-16 11:43:57 : IKE<138.188.100.226> responder (pki) constructing remote NAT-D
## 2011-05-16 11:43:57 : IKE<138.188.100.226> Construct [NATD]
## 2011-05-16 11:43:57 : IKE<138.188.100.226> responder (pki) constructing local NAT-D
## 2011-05-16 11:43:57 : IKE<138.188.100.226> Construct [NATD]
## 2011-05-16 11:43:57 : IKE<138.188.100.226> Xmit : [KE] [NONCE] [CERT-REQ] [NATD] [NATD]
## 2011-05-16 11:43:57 : IKE<138.188.100.226> Responder sending IPv4 IP 138.188.100.226/port 381
## 2011-05-16 11:43:57 : IKE<138.188.100.226> Send Phase 1 packet (len=278)
## 2011-05-16 11:43:57 : IKE<138.188.100.226> IKE msg done: PKI state<0> IKE state<2/1017200f>
## 2011-05-16 11:43:57 : IKE<0.0.0.0        >   from FLOAT port.
## 2011-05-16 11:43:57 : IKE<138.188.100.226> ike packet, len 116, action 0## 2011-05-16 11:43:57 : IKE<138.188.100.226> Catcher: received 88 bytes from socket.
## 2011-05-16 11:43:57 : IKE<138.188.100.226> ****** Recv packet if <untrust> of vsys <Root> ******
## 2011-05-16 11:43:57 : IKE<138.188.100.226> Catcher: get 88 bytes. src port 14989
## 2011-05-16 11:43:57 : IKE<0.0.0.0        >   ISAKMP msg: len 84, nxp 8[HASH], exch 5[INFO], flag 01  E
## 2011-05-16 11:43:57 : IKE<138.188.100.226> Error: Responder expecting non-floated IKE packets in phase 2, drop pak.
According to the sent packet size I'm tempted to say that the second client isn't sending all the things he should, or he is floating to a different port when he shouldn't.

On booth machines, MS kb926179 (How to configure an L2TP/IPsec server behind a NAT-T)  is applied, AssumeUDPEncapsulationContextOnSendRule has value 2.

Any Idea ?
ASKER CERTIFIED SOLUTION
tmi_cce

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 3 Answers and 7 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 3 Answers and 7 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros