mpd5 + l2tp vs IPSec +iPhone

zizon · Непрочитанное сообщение **zizon** » 2012-01-31 6:57:13

Настроил сервер MPD5 с использованием протокола l2tp и IPSec.
Конфик MPD:

default:
	load l2tp_server

l2tp_server:
# Define dynamic IP address pool.
        set ippool add pool_l2tp xxx.xxx.xxx.2 xxx.xxx.xxx.6

# Create clonable bundle template named B_l2tp
        create bundle static B_l2tp
        set iface enable proxy-arp
        set iface enable tcpmssfix
        set ipcp yes vjcomp
# Specify IP address pool for dynamic assigment.
        set ipcp ranges xxx.xxx.xxx.xxx/xx ippool pool_l2tp
        set ipcp dns xx.xx.xx.xx
# Create clonable link template named L_l2tp
        create link template L_l2tp l2tp
# Set bundle template to use
        set link action bundle B_l2tp
# Multilink adds some overhead, but gives full 1500 MTU.
        set link enable multilink
	set link enable acfcomp protocomp keep-ms-domain
        set link no pap chap eap
	set link enable chap-msv2
        set link keep-alive 10 60
# We reducing link mtu to avoid ESP packet fragmentation.
        set link mtu 1280
# Configure L2TP
        set l2tp self xxx.xxx.xx.xx
        set l2tp enable length
# Allow to accept calls
        set link enable incoming

Все прекрасно работает с windows, mac os и linux.
А вот с iPhone подружить сей продукт никак не удалось. Получается подключиться только если закомментировать строку "set link enable chap-msv2", но тогда аутентификация клиента на l2tp сервере происходит без шифрования, в результате чего нужно в настройка windows подключения менять настройки безопасности, да и сама затея без шифрования использовать данный продут не имеет смысла.
В логах при попытке подключиться с iPhone выдаются следующие сообщения:

Код: Выделить всё

mpd: Incoming L2TP packet from xxx.xxx.xxx.xxx 52124
mpd: L2TP: Control connection 0x802845610 xxx.xxx.xxx.xxx 1701 <-> xxx.xxx.xxx.xxx 52124 connected
mpd: L2TP: Incoming call #1 via connection 0x802845610 received
mpd: [L_l2tp-1] L2TP: Incoming call #1 via control connection 0x802845610 accepted
mpd: [L_l2tp-1] Link: OPEN event
mpd: [L_l2tp-1] LCP: Open event
mpd: [L_l2tp-1] LCP: state change Initial --> Starting
mpd: [L_l2tp-1] LCP: LayerStart
mpd: [L_l2tp-1] L2TP: Call #1 connected
mpd: [L_l2tp-1] Link: UP event
mpd: [L_l2tp-1] LCP: Up event
mpd: [L_l2tp-1] LCP: state change Starting --> Req-Sent
mpd: [L_l2tp-1] LCP: SendConfigReq #1
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1]   MP MRRU 2048
mpd: [L_l2tp-1]   MP SHORTSEQ
mpd: [L_l2tp-1]   ENDPOINTDISC [802.1] 2c 27 d7 14 39 f0
mpd: [L_l2tp-1] LCP: rec'd Configure Request #1 (Req-Sent)
mpd: [L_l2tp-1]   ACCMAP 0x00000000
mpd: [L_l2tp-1]   MAGICNUM 550c2826
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1] LCP: SendConfigAck #1
mpd: [L_l2tp-1]   ACCMAP 0x00000000
mpd: [L_l2tp-1]   MAGICNUM 550c2826
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1] LCP: state change Req-Sent --> Ack-Sent
mpd: [L_l2tp-1] LCP: SendConfigReq #2
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1]   MP MRRU 2048
mpd: [L_l2tp-1]   MP SHORTSEQ
mpd: [L_l2tp-1]   ENDPOINTDISC [802.1] 2c 27 d7 14 39 f0
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #2 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1]   MP MRRU 2048
mpd: [L_l2tp-1]   MP SHORTSEQ
mpd: [L_l2tp-1] LCP: SendConfigReq #3
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #3 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: SendConfigReq #4
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #4 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: SendConfigReq #5
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #5 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: SendConfigReq #6
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #6 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: SendConfigReq #7
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #7 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: SendConfigReq #8
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #8 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: SendConfigReq #9
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #9 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: SendConfigReq #10
mpd: [L_l2tp-1]   ACFCOMP
mpd: [L_l2tp-1]   PROTOCOMP
mpd: [L_l2tp-1]   MRU 1500
mpd: [L_l2tp-1]   MAGICNUM 4fdaed70
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: rec'd Configure Reject #10 (Ack-Sent)
mpd: [L_l2tp-1]   AUTHPROTO CHAP MSOFTv2
mpd: [L_l2tp-1] LCP: not converging
mpd: [L_l2tp-1] LCP: parameter negotiation failed
mpd: [L_l2tp-1] LCP: state change Ack-Sent --> Stopped
mpd: [L_l2tp-1] LCP: LayerFinish
mpd: [L_l2tp-1] L2TP: Call #1 terminated locally
mpd: [L_l2tp-1] Link: DOWN event
mpd: [L_l2tp-1] LCP: Close event
mpd: [L_l2tp-1] LCP: state change Stopped --> Closed
mpd: [L_l2tp-1] LCP: Down event
mpd: [L_l2tp-1] LCP: state change Closed --> Initial
mpd: [L_l2tp-1] Link: SHUTDOWN event
mpd: [L_l2tp-1] Link: Shutdown
mpd: L2TP: Control connection 0x802845610 terminated: 0 ()
mpd: L2TP: Control connection 0x802845610 destroyed

Может есть у кого нибудь мысли на этот счет?

Хостинг HostFood.ru · **Хостинг HostFood.ru**

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

zizon · Непрочитанное сообщение **zizon** » 2012-01-31 7:01:03

Забыл добавить, что в спецификации iPhone указано:

Код: Выделить всё

L2TP/IPSec with user authentication by MS-CHAPV2 Password, RSA SecurID or CryptoCard, and machine authentication by shared secret.

Ссылка: http://help.apple.com/iosdeployment-vpn/#appc28ee0f4

nnmax · Непрочитанное сообщение **nnmax** » 2012-02-15 0:33:59

Как вариант используй для iphone просто ipsec тунель.

Dark_ASU

Версия IOS какая?

zizon · Непрочитанное сообщение **zizon** » 2012-02-24 14:12:22

iOS v5.0.1 (9A406)

Beavis2 · Непрочитанное сообщение **Beavis2** » 2014-06-17 14:56:07

mpd: [L-1] LCP: not converging
mpd: [L-1] LCP: parameter negotiation failed
проблема решилась заменой

set link yes chap
на

set link accept chap

forum.lissyara.su

mpd5 + l2tp vs IPSec +iPhone

mpd5 + l2tp vs IPSec +iPhone

Услуги хостинговой компании Host-Food.ru

Re: mpd5 + l2tp vs IPSec +iPhone

Re: mpd5 + l2tp vs IPSec +iPhone

Re: mpd5 + l2tp vs IPSec +iPhone

Re: mpd5 + l2tp vs IPSec +iPhone

Re: mpd5 + l2tp vs IPSec +iPhone