我目前正在尝试使用 Ubuntu 16.04（和/或 Fedora 26）使用 IPSec/L2TP 与我的办公室网络建立 VPN 连接，但失败并显示以下系统日志条目（完整日志如下）：
11:46:26 laptop NetworkManager[911]: received packet: from x.x.x.x[500] to 192.168.0.102[500] (56 bytes)
11:46:26 laptop NetworkManager[911]: parsed INFORMATIONAL_V1 request 3879417451 [ N(NO_PROP) ]
11:46:26 laptop NetworkManager[911]: received NO_PROPOSAL_CHOSEN error notify
11:46:26 laptop NetworkManager[911]: establishing connection '5f4cde33-5549-4535-864b-04944a5d4d69' failed
根据这个答案在类似的问题上，问题可能是用于连接的协议的协商。按照建议，我使用提到的工具ike-scan从服务器检索一些信息：
# sudo ipsec stop; sudo service xl2tpd stop; sudo ike-scan x.x.x.x
Stopping strongSwan IPsec failed: starter is not running
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
x.x.x.x Main Mode Handshake returned HDR=(CKY-R=7b0d4448e7767519) SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds LifeDuration(4)=0x00007080) VID=1e2b516905991c7d7c96fcbfb587e46100000009 (MS NT5 ISAKMPOAKLEY) VID=4a131c81070358455c5728f20e95452f (RFC 3947 NAT-T) VID=90cb80913ebb696e086381b5ec427b1f (draft-ietf-ipsec-nat-t-ike-02\n) VID=4048b7d56ebce88525e7de7f00d6c2d3 (IKE Fragmentation) VID=fb1de3cdf341b7ea16b7e5be0855f120 VID=e3a5966a76379fe707228231e5ce8652
Ending ike-scan 1.9: 1 hosts scanned in 0.062 seconds (16.05 hosts/sec). 1 returned handshake; 0 returned notify
正如进一步建议的那样，我更新了 NetworkManager 连接配置以使用这些算法：
[connection]
id=SomeName
uuid=5f4cde33-5549-4535-864b-04944a5d4d69
type=vpn
autoconnect=false
permissions=user:arne:;
secondaries=
[vpn]
password-flags=1
ipsec-esp=3des-sha1!
ipsec-psk=****
user=****
ipsec-enabled=yes
ipsec-ike=3des-sha1-modp1024!
mru=1400
gateway=x.x.x.x
mtu=1400
service-type=org.freedesktop.NetworkManager.l2tp
keyexchange=ikev1
[ipv4]
dns-search=
method=auto
[ipv6]
addr-gen-mode=stable-privacy
dns-search=
method=auto
但这似乎并没有改变错误日志中的任何内容。
有谁知道这里可能有什么问题吗？
非常感谢！
环境：
# uname -a
Linux arne-Latitude-E5570 4.10.0-35-generic #39~16.04.1-Ubuntu SMP Wed Sep 13 09:02:42 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
完整的系统日志：
11:46:23 laptop NetworkManager[911]: <info> [1508492783.2731] audit: op="connection-activate" uuid="5f4cde33-5549-4535-864b-04944a5d4d69" name="SomeName" pid=31464 uid=1000 result="success"
11:46:23 laptop NetworkManager[911]: <info> [1508492783.2860] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: Started the VPN service, PID 1579
11:46:23 laptop NetworkManager[911]: <info> [1508492783.3102] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: Saw the service appear; activating connection
11:46:23 laptop NetworkManager[911]: <info> [1508492783.3934] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN connection: (ConnectInteractive) reply received
11:46:23 laptop NetworkManager[911]: nm-l2tp[1579] <info> ipsec enable flag: yes
11:46:23 laptop NetworkManager[911]: ** Message: Check port 1701
11:46:23 laptop NetworkManager[911]: ** Message: Can't bind to port 1701
11:46:23 laptop NetworkManager[911]: nm-l2tp[1579] <warn> L2TP port 1701 is busy, using ephemeral.
11:46:23 laptop NetworkManager[911]: nm-l2tp[1579] <info> starting ipsec
11:46:23 laptop NetworkManager[911]: Stopping strongSwan IPsec failed: starter is not running
11:46:25 laptop NetworkManager[911]: Starting strongSwan 5.3.5 IPsec [starter]...
11:46:25 laptop NetworkManager[911]: Loading config setup
11:46:25 laptop NetworkManager[911]: Loading conn '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:25 laptop NetworkManager[911]: found netkey IPsec stack
11:46:25 laptop charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.10.0-35-generic, x86_64)
11:46:25 laptop charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
11:46:25 laptop charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
11:46:25 laptop charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
11:46:25 laptop charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
11:46:25 laptop charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
11:46:25 laptop charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
11:46:25 laptop charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-5f4cde33-5549-4535-864b-04944a5d4d69.secrets'
11:46:25 laptop charon: 00[CFG] loaded IKE secret for %any
11:46:25 laptop charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-77751670-3316-4fdc-abaf-1293b25b7687.secrets'
11:46:25 laptop charon: 00[CFG] loaded IKE secret for %any
11:46:25 laptop charon: 00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown
11:46:25 laptop charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
11:46:25 laptop charon: 00[JOB] spawning 16 worker threads
11:46:25 laptop charon: 04[CFG] received stroke: add connection '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:25 laptop charon: 04[CFG] added configuration '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:26 laptop charon: 06[CFG] rereading secrets
11:46:26 laptop charon: 06[CFG] loading secrets from '/etc/ipsec.secrets'
11:46:26 laptop charon: 06[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-5f4cde33-5549-4535-864b-04944a5d4d69.secrets'
11:46:26 laptop charon: 06[CFG] loaded IKE secret for %any
11:46:26 laptop charon: 06[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-77751670-3316-4fdc-abaf-1293b25b7687.secrets'
11:46:26 laptop charon: 06[CFG] loaded IKE secret for %any
11:46:26 laptop NetworkManager[911]: nm-l2tp[1579] <info> Spawned ipsec up script with PID 1655.
11:46:26 laptop charon: 08[CFG] received stroke: initiate '5f4cde33-5549-4535-864b-04944a5d4d69'
11:46:26 laptop charon: 10[IKE] initiating Main Mode IKE_SA 5f4cde33-5549-4535-864b-04944a5d4d69[1] to x.x.x.x
11:46:26 laptop charon: 10[ENC] generating ID_PROT request 0 [ SA V V V V ]
11:46:26 laptop charon: 10[NET] sending packet: from 192.168.0.102[500] to x.x.x.x[500] (148 bytes)
11:46:26 laptop charon: 09[NET] received packet: from x.x.x.x[500] to 192.168.0.102[500] (56 bytes)
11:46:26 laptop charon: 09[ENC] parsed INFORMATIONAL_V1 request 3879417451 [ N(NO_PROP) ]
11:46:26 laptop charon: 09[IKE] received NO_PROPOSAL_CHOSEN error notify
11:46:26 laptop NetworkManager[911]: initiating Main Mode IKE_SA 5f4cde33-5549-4535-864b-04944a5d4d69[1] to x.x.x.x
11:46:26 laptop NetworkManager[911]: generating ID_PROT request 0 [ SA V V V V ]
11:46:26 laptop NetworkManager[911]: sending packet: from 192.168.0.102[500] to x.x.x.x[500] (148 bytes)
11:46:26 laptop NetworkManager[911]: received packet: from x.x.x.x[500] to 192.168.0.102[500] (56 bytes)
11:46:26 laptop NetworkManager[911]: parsed INFORMATIONAL_V1 request 3879417451 [ N(NO_PROP) ]
11:46:26 laptop NetworkManager[911]: received NO_PROPOSAL_CHOSEN error notify
11:46:26 laptop NetworkManager[911]: establishing connection '5f4cde33-5549-4535-864b-04944a5d4d69' failed
11:46:26 laptop NetworkManager[911]: Stopping strongSwan IPsec...
11:46:26 laptop charon: 00[DMN] signal of type SIGINT received. Shutting down
11:46:26 laptop NetworkManager[911]: nm-l2tp[1579] <warn> Could not establish IPsec tunnel.
11:46:26 laptop NetworkManager[911]: (nm-l2tp-service:1579): GLib-GIO-CRITICAL **: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
11:46:26 laptop NetworkManager[911]: <info> [1508492786.8335] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN plugin: state changed: stopped (6)
11:46:26 laptop NetworkManager[911]: <info> [1508492786.8359] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN plugin: state change reason: unknown (0)
11:46:26 laptop NetworkManager[911]: <info> [1508492786.8393] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN service disappeared
11:46:26 laptop NetworkManager[911]: <warn> [1508492786.8418] vpn-connection[0xfbd460,5f4cde33-5549-4535-864b-04944a5d4d69,"SomeName",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'
答案1
您能否删除未删除的临时机密文件：
sudo rm -f /etc/ipsec.d/nm-l2tp-ipsec-*.secrets
该NO_PROPOSAL_CHOSEN错误表明用于初始提案的第一阶段算法仍然存在问题。我也会尝试不使用感叹号，Libreswan（您可能在 Fedora 上使用的）绝对不支持该语法。
您能否尝试运行ike-scan.sh以下页面的“查询 VPN 服务器以获取支持的 IPsec IKEv1 密码”部分中的脚本：
ike-scan有时单独运行是不够的，因为 VPN 服务器可能支持更多密码套件。
您对第 1 阶段和第 2 阶段算法所做的操作应该适用于 3DES 算法，但也许其他地方出了问题。希望您的 VPN 服务器支持其他ike-scan.sh可以报告的算法，您可以尝试一下。
我假设你正在使用适用于 Ubuntu 16.04 的网络管理器-l2tp PPA。如果您仍然遇到问题，您可以在 Ubuntu 16.04 上尝试使用 libreswan 而不是 Strongswan，删除 IPsec 配置对话框中的第 1 和第 2 阶段算法，然后通过发出以下命令安装 libreswan：
sudo apt install libreswan
旧版本的 libreswan 仍然在第 1 阶段和第 2 阶段算法的默认密码集中保留旧密码套件。
Fedora 26 更新中的 libreswan 的新版本在涉及遗留密码套件时类似于 Strongswan，请参阅 Fedora Bugzilla错误#1486604。希望您能够使用其他一些密码。
答案2
使用脚本 ike-scan.sh。如上所述，我已经能够发现支持哪种算法。然后我将 NM 配置更新为：
aes128-sha1-modp1024!
VPN 又启动了。原文是：
aes128-sha1-modp2048!