我正在尝试用新 VMWare 服务器 (ESXI 6.7.0) 替换旧 VMWare 服务器 (ESXI 5.1.0)，为此，我们尝试复制旧服务器的设置。我们还有另一台物理服务器需要连接到虚拟服务器。
因此，我尝试通过 lt2p 在 Windows 2012R2 服务器（客户端）和 vyatta 路由器之间建立 VNP 连接。
更新：我们现在正在尝试使用最新版本的 Vyos 路由器，但结果是一样的。
之前已经多次这样做了，目前我只是根据已经有效的解决方案复制两边的设置，但不知何故，这次它就是不想连接。
同一台服务器已成功连接到另外两个具有相同设置的 VPN，也使用 l2tp 和 vyatta 路由器。
在 vyatta 端，我可以在日志中看到以下错误：
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: received Vendor ID payload [RFC 3947]
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr 5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [IKE CGA version 1]
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: responding to Main Mode from unknown peer XX.YYY.ZZZ.86
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [AES_CBC (256), HMAC_SHA1, ECP_384] refused due to strict flag
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [AES_CBC (128), HMAC_SHA1, ECP_256] refused due to strict flag
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [AES_CBC (256), HMAC_SHA1, MODP_2048] refused due to strict flag
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [3DES_CBC (192), HMAC_SHA1, MODP_2048] refused due to strict flag
Apr 5 10:34:56 vyatta kernel: [262404.703564] [NAT-DST-2] IN=eth1 OUT= MAC=00:0c:29:0f:29:52:00:22:bd:f8:19:zz:08:00 SRC=XX.YYY.ZZZ.86 DST=VVV.MMM.WW.168 LEN=436 TOS=0x00 PREC=0x00 TTL=126 ID=28719 PROTO=UDP SPT=500 DPT=500 LEN=416
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: NAT-Traversal: Result using RFC 3947: no NAT detected
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr 5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr 5 10:34:57 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr 5 10:34:57 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr 5 10:34:57 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr 5 10:34:58 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr 5 10:34:58 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr 5 10:34:58 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr 5 10:35:01 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr 5 10:35:01 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr 5 10:35:01 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr 5 10:35:08 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr 5 10:35:08 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr 5 10:35:08 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr 5 10:35:23 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr 5 10:35:23 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr 5 10:35:23 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr 5 10:35:38 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr 5 10:35:38 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr 5 10:35:38 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr 5 10:36:06 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: max number of retransmissions (2) reached STATE_MAIN_R2
Apr 5 10:36:06 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86: deleting connection "remote-access-mac-zzz" instance with peer XX.YYY.ZZZ.86 {isakmp=#0/ipsec=#0}
日志中显示“ISAKMP 识别有效负载的下一个有效负载类型具有未知值：77”，该值在每个连接上都不同。
Windows 端的日志内容不多，只是不停地计算秒数。
Log Name: Application
Source: RasClient
Date: 05/04/2019 10:34:56
Event ID: 20221
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: *******.******.local
Description:
CoId={104D3F70-1CB1-40A1-A229-7F7E5A943E64}: The user SYSTEM has started dialing a VPN connection using a all-user connection profile named ZZZZZZZ. The connection settings are:
Dial-in User = ******
VpnStrategy = L2TP
DataEncryption = Require
PrerequisiteEntry =
AutoLogon = No
UseRasCredentials = Yes
Authentication Type = CHAP/MS-CHAPv2
Ipv4DefaultGateway = No
Ipv4AddressAssignment = By Phonebook Entry
Ipv4DNSServerAssignment = By Phonebook Entry
Ipv6DefaultGateway = Yes
Ipv6AddressAssignment = By Server
Ipv6DNSServerAssignment = By Server
IpDnsFlags =
IpNBTEnabled = No
UseFlags = Private Connection
ConnectOnWinlogon = No
IPsec authentication for L2TP = Pre-shared key.
Log Name: Application
Source: RasClient
Date: 05/04/2019 10:34:56
Event ID: 20222
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: *******.******.local
Description:
CoId={104D3F70-1CB1-40A1-A229-7F7E5A943E64}: The user SYSTEM is trying to establish a link to the Remote Access Server for the connection named ZZZZZZZ using the following device:
Server address/Phone Number = VVV.MMM.WW.168
Device = WAN Miniport (L2TP)
Port = VPN0-3
MediaType = VPN.
以下是 vyatta 路由器的配置：
interfaces {
ethernet eth0 {
address 192.168.1.254/24
duplex auto
hw-id 00:0c:29:0f:29:48
smp_affinity auto
speed auto
}
ethernet eth1 {
address VVV.MMM.WW.168/24
duplex auto
hw-id 00:0c:29:0f:29:52
smp_affinity auto
speed auto
}
loopback lo {
}
}
nat {
destination {
rule 2 {
description "IPSEC TUNNELING PORT 500"
destination {
port 500
}
inbound-interface eth1
log enable
protocol tcp_udp
translation {
port 500
}
}
rule 3 {
description "IPSEC TUNNELING PORT 4500"
destination {
port 4500
}
inbound-interface eth1
log enable
protocol tcp_udp
translation {
port 4500
}
}
rule 4 {
description "VPN CLIENT TUNNELING PORT 1701"
destination {
port 1701
}
inbound-interface eth1
log enable
protocol tcp_udp
translation {
port 1701
}
}
}
source {
rule 10 {
description "OUTSIDE CONNECTION"
outbound-interface eth1
source {
address 192.168.1.0/24
}
translation {
address masquerade
}
}
}
}
protocols {
rip {
network 192.168.1.0/24
}
static {
route 10.1.1.0/24 {
next-hop 192.168.1.1 {
}
}
route 192.168.2.0/24 {
next-hop 192.168.1.1 {
}
}
route 192.168.3.0/24 {
next-hop 192.168.1.1 {
}
}
}
}
service {
ssh {
disable-password-authentication
port 22
}
}
system {
config-management {
commit-revisions 20
}
console {
}
gateway-address VVV.MMM.WW.1
host-name vyatta
login {
user vyatta {
authentication {
encrypted-password ****************
public-keys vyatta@vyatta {
key ****************
type ssh-rsa
}
}
level admin
}
}
name-server 8.8.8.8
name-server 192.168.1.2
name-server 192.168.3.2
ntp {
server 0.vyatta.pool.ntp.org {
}
}
package {
auto-sync 1
repository community {
components main
distribution stable
password ****************
url http://packages.vyatta.com/vyatta
username ""
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone GMT
}
vpn {
ipsec {
ipsec-interfaces {
interface eth1
}
nat-networks {
allowed-network 10.1.1.0/24 {
}
allowed-network 192.168.1.0/24 {
}
allowed-network 192.168.2.0/24 {
}
allowed-network 192.168.3.0/24 {
}
}
nat-traversal enable
}
l2tp {
remote-access {
authentication {
local-users {
username XYZ {
password ****************
}
}
mode local
}
client-ip-pool {
start 192.168.1.100
stop 192.168.1.110
}
dns-servers {
server-1 192.168.1.2
}
ipsec-settings {
authentication {
mode pre-shared-secret
pre-shared-secret ****************
}
ike-lifetime 3600
}
outside-address VVV.MMM.WW.168
outside-nexthop 0.0.0.0
}
}
}
我所知道和尝试过的：
- 多次检查了预共享机密和身份验证，多次重新输入，我 100％ 确定这不是问题。
- 在某处读到 NAT 会弄乱数据包，但没有 NAT（据我所知）并且启用了 nat-traversal。
- 尝试更改虚拟路由器上的网络适配器，尝试了所有可能的选项，但仍然发生同样的错误
- 此设置与另外两个工作连接完全相同。多次检查配置是否有拼写错误或错误的 IP 地址等。
如果您知道导致此问题的原因是什么，请告诉我。
我真的很感激任何关于我可以检查什么的提示、想法，甚至猜测。:)
谢谢。
答案1
解决方案是重新启动 Windows 服务器...
经过三个星期的努力，现在它可以正常工作了，并且我没有更改 vyatta 或 Windows 服务器上的任何配置。
我们尝试了很多不同的东西，不同的虚拟路由器，不同的协议等等，但都没有起作用。
对于任何有同样或类似问题的人（也包括未来的自己），我的观察和建议如下：
- Windows 远程和路由模块充满了错误，很多时候它无缘无故地无法工作，并且没有调试消息可以告诉您原因。如果您有其他选择，请使用那个。
- 如果您创建了新的拨入连接但不起作用，则删除它并用不同的名字创建它。出于某些原因，不同的名称很重要。有时，即使删除了以前的连接，它们仍会保留在注册表和其他地方，并在 4 秒后抛出相同的错误或一些神秘的错误，例如“接口已断开连接”，而没有任何日志。
- 重启服务可能会有帮助，但并非总是如此。如果你有能力重启整个服务器，那就试一试吧。
- 两个 L2tp 连接没问题，但是三个对我来说不行。
- 端口分配方式很奇怪，最初我们有五个 L2tp 端口，服务器选择了最后两个（也许前三次都连接失败了……我只是猜测）。对我们来说，将端口数量增加到 10 很有帮助。如果您无法在 UI 上增加端口数量（因为另一个错误），请在注册表中执行此操作并重新启动服务器（再次强调，重新启动服务不起作用）。