Closed bitpaydotir closed 5 years ago
Could you delete the /etc/ipsec.d/nm-l2tp-ipsec*.secrets
files, you seem to have a number of them that weren't cleaned up, probably because you configured multiple VPN connections and corresponding connections weren't successfully closed.
Could you run the ike-scan.sh script found on the following page :
Like mentioned on that page, issue sudo ./ike-scan.sh 125.17.22.12 | grep SA=
, it'll tell us what proposals the VPN server offers. Also as mentioned, you might need to issue sudo ipsec stop
first.
i delete all secrets, but problem not solved
i ran ike-scan and output were: SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds ....
i set in propsal 1: 3DES-SHA1;modp1024
proposal2: 3DES-SHA1
but not work in error (first post) says : STATE_MAIN_I1: NO_PROPOSAL_CHOSEN
please help
With the following error :
003 "/etc/ipsec.d/nm-l2tp-ipsec-108413ee-772a-4ab3-9a2f-34788aa948f3.secrets" line 1: expected record boundary in key
It's as if it isn't reading the PSK properly in that file.
Could you create a test secrets file call it say /etc/ipsec.d/test.secrets
, it doesn't matter what it is called as long as it ends in .secrets
with the contents something like :
: PSK my_pre_shared_key
with my_pre_shared_key replaced by the actual PSK value and see if you are then able to connect.
I just want to rule out an issue with commit https://github.com/nm-l2tp/network-manager-l2tp/commit/08c980797f1729474f5ea6c14861f5716d6712bc where I converted the PSK to a base64 value. It did work for me with the version of Libreswan I tested with, but I only checked with a recent version.
Forgot to mention, if the PSK contains quotes, single quotes or spaces, it might confuse Libreswan, that's why I now encode the PSK to base64 to avoid such errors.
my PSK contains double qutes
"
PSK is:
: PSK "gh"dvE#^"
is wrong?
Libreswan doesn't like having the double quote ("
) in the middle, as a workaround you could change the PSK to base64. To find out what the base64 value is, you can use the base64 command, e.g. :
$ echo -n 'gh"dvE#^' | base64
Z2giZHZFI14=
Then in the PSK file have :
: PSK 0sZ2giZHZFI14=
note: Libreswan starts a base64 string with 0s.
I use gnome Is it possible to install strongswan in centos with network-manager-l2tp I did not find anything related to centos, in wiki
I describe how to use strongswan with Fedora here :
Unfortunately RHEL7 / CentOS 7 uses an older version of RPM which doesn't support optional dependencies, so with CentOS 7 you will need to use--nodeps
to uninstall libreswan and then install strongswang, e.g. :
sudo rpm -e --nodeps libreswan
sudo yum install strongswan
Forgot to mention you might like to issue the following so that the nm-l2tp service detects the change from the default libreswan to strongswan :
sudo killall -TERM nm-l2tp-service
Also, strongswan has the same syntax restrictions with the PSK as libreswan. You can also put 0sZ2giZHZFI14=
directly into the PSK text field of the IPsec Options dialog box. At least until a release a new version which automatically stores the base64 balue.
thanks :+1: :heart:
i set PSK, phase 1 and phase 2 , but i get this error: