L2TP VPN 连接不起作用-PAYLOAD_MALFORMED

L2TP VPN 连接不起作用-PAYLOAD_MALFORMED

我正在尝试用新 VMWare 服务器 (ESXI 6.7.0) 替换旧 VMWare 服务器 (ESXI 5.1.0),为此,我们尝试复制旧服务器的设置。我们还有另一台物理服务器需要连接到虚拟服务器。

因此,我尝试通过 lt2p 在 Windows 2012R2 服务器(客户端)和 vyatta 路由器之间建立 VNP 连接。

更新:我们现在正在尝试使用最新版本的 Vyos 路由器,但结果是一样的。

之前已经多次这样做了,目前我只是根据已经有效的解决方案复制两边的设置,但不知何故,这次它就是不想连接。

同一台服务器已成功连接到另外两个具有相同设置的 VPN,也使用 l2tp 和 vyatta 路由器。

在 vyatta 端,我可以在日志中看到以下错误:

Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]
Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: received Vendor ID payload [RFC 3947]
Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr  5 10:34:56 vyatta pluto[3061]: packet from XX.YYY.ZZZ.86:500: ignoring Vendor ID payload [IKE CGA version 1]
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: responding to Main Mode from unknown peer XX.YYY.ZZZ.86
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [AES_CBC (256), HMAC_SHA1, ECP_384] refused due to strict flag
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [AES_CBC (128), HMAC_SHA1, ECP_256] refused due to strict flag
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [AES_CBC (256), HMAC_SHA1, MODP_2048] refused due to strict flag
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: Oakley Transform [3DES_CBC (192), HMAC_SHA1, MODP_2048] refused due to strict flag
Apr  5 10:34:56 vyatta kernel: [262404.703564] [NAT-DST-2] IN=eth1 OUT= MAC=00:0c:29:0f:29:52:00:22:bd:f8:19:zz:08:00 SRC=XX.YYY.ZZZ.86 DST=VVV.MMM.WW.168 LEN=436 TOS=0x00 PREC=0x00 TTL=126 ID=28719 PROTO=UDP SPT=500 DPT=500 LEN=416
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: NAT-Traversal: Result using RFC 3947: no NAT detected
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr  5 10:34:56 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr  5 10:34:57 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr  5 10:34:57 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr  5 10:34:57 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr  5 10:34:58 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr  5 10:34:58 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr  5 10:34:58 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr  5 10:35:01 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr  5 10:35:01 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr  5 10:35:01 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr  5 10:35:08 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr  5 10:35:08 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr  5 10:35:08 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr  5 10:35:23 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr  5 10:35:23 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr  5 10:35:23 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr  5 10:35:38 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: next payload type of ISAKMP Identification Payload has an unknown value: 77
Apr  5 10:35:38 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: probable authentication failure (mismatch of preshared secrets?): malformed payload in packet
Apr  5 10:35:38 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: sending encrypted notification PAYLOAD_MALFORMED to XX.YYY.ZZZ.86:500
Apr  5 10:36:06 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86 #6: max number of retransmissions (2) reached STATE_MAIN_R2
Apr  5 10:36:06 vyatta pluto[3061]: "remote-access-mac-zzz"[6] XX.YYY.ZZZ.86: deleting connection "remote-access-mac-zzz" instance with peer XX.YYY.ZZZ.86 {isakmp=#0/ipsec=#0}

日志中显示“ISAKMP 识别有效负载的下一个有效负载类型具有未知值:77”,该值在每个连接上都不同。

Windows 端的日志内容不多,只是不停地计算秒数。

Log Name:      Application
Source:        RasClient
Date:          05/04/2019 10:34:56
Event ID:      20221
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      *******.******.local
Description:
CoId={104D3F70-1CB1-40A1-A229-7F7E5A943E64}: The user SYSTEM has started dialing a VPN connection using a all-user connection profile named ZZZZZZZ. The connection settings are: 
Dial-in User = ******
VpnStrategy = L2TP
DataEncryption = Require
PrerequisiteEntry = 
AutoLogon = No
UseRasCredentials = Yes
Authentication Type = CHAP/MS-CHAPv2 
Ipv4DefaultGateway = No
Ipv4AddressAssignment = By Phonebook Entry
Ipv4DNSServerAssignment = By Phonebook Entry
Ipv6DefaultGateway = Yes
Ipv6AddressAssignment = By Server
Ipv6DNSServerAssignment = By Server
IpDnsFlags = 
IpNBTEnabled = No
UseFlags = Private Connection
ConnectOnWinlogon = No
IPsec authentication for L2TP = Pre-shared key.

Log Name:      Application
Source:        RasClient
Date:          05/04/2019 10:34:56
Event ID:      20222
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      *******.******.local
Description:
CoId={104D3F70-1CB1-40A1-A229-7F7E5A943E64}: The user SYSTEM is trying to establish a link to the Remote Access Server for the connection named ZZZZZZZ using the following device: 
Server address/Phone Number = VVV.MMM.WW.168
Device = WAN Miniport (L2TP)
Port = VPN0-3
MediaType = VPN.

以下是 vyatta 路由器的配置:

interfaces {
    ethernet eth0 {
        address 192.168.1.254/24
        duplex auto
        hw-id 00:0c:29:0f:29:48
        smp_affinity auto
        speed auto
    }
    ethernet eth1 {
        address VVV.MMM.WW.168/24
        duplex auto
        hw-id 00:0c:29:0f:29:52
        smp_affinity auto
        speed auto
    }
    loopback lo {
    }
}
nat {
    destination {
        rule 2 {
            description "IPSEC TUNNELING PORT 500"
            destination {
                port 500
            }
            inbound-interface eth1
            log enable
            protocol tcp_udp
            translation {
                port 500
            }
        }
        rule 3 {
            description "IPSEC TUNNELING PORT 4500"
            destination {
                port 4500
            }
            inbound-interface eth1
            log enable
            protocol tcp_udp
            translation {
                port 4500
            }
        }
        rule 4 {
            description "VPN CLIENT TUNNELING PORT 1701"
            destination {
                port 1701
            }
            inbound-interface eth1
            log enable
            protocol tcp_udp
            translation {
                port 1701
            }
        }
    }
    source {
        rule 10 {
            description "OUTSIDE CONNECTION"
            outbound-interface eth1
            source {
                address 192.168.1.0/24
            }
            translation {
                address masquerade
            }
        }
    }
}
protocols {
    rip {
        network 192.168.1.0/24
    }
    static {
        route 10.1.1.0/24 {
            next-hop 192.168.1.1 {
            }
        }
        route 192.168.2.0/24 {
            next-hop 192.168.1.1 {
            }
        }
        route 192.168.3.0/24 {
            next-hop 192.168.1.1 {
            }
        }
    }
}
service {
    ssh {
        disable-password-authentication
        port 22
    }
}
system {
    config-management {
        commit-revisions 20
    }
    console {
    }
    gateway-address VVV.MMM.WW.1
    host-name vyatta
    login {
        user vyatta {
            authentication {
                encrypted-password ****************
                public-keys vyatta@vyatta {
                    key ****************
                    type ssh-rsa
                }
            }
            level admin
        }
    }
    name-server 8.8.8.8
    name-server 192.168.1.2
    name-server 192.168.3.2
    ntp {
        server 0.vyatta.pool.ntp.org {
        }
    }
    package {
        auto-sync 1
        repository community {
            components main
            distribution stable
            password ****************
            url http://packages.vyatta.com/vyatta
            username ""
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone GMT
}
vpn {
    ipsec {
        ipsec-interfaces {
            interface eth1
        }
        nat-networks {
            allowed-network 10.1.1.0/24 {
            }
            allowed-network 192.168.1.0/24 {
            }
            allowed-network 192.168.2.0/24 {
            }
            allowed-network 192.168.3.0/24 {
            }
        }
        nat-traversal enable
    }
    l2tp {
        remote-access {
            authentication {
                local-users {
                    username XYZ {
                        password ****************
                    }
                }
                mode local
            }
            client-ip-pool {
                start 192.168.1.100
                stop 192.168.1.110
            }
            dns-servers {
                server-1 192.168.1.2
            }
            ipsec-settings {
                authentication {
                    mode pre-shared-secret
                    pre-shared-secret ****************
                }
                ike-lifetime 3600
            }
            outside-address VVV.MMM.WW.168
            outside-nexthop 0.0.0.0
        }
    }
}

我所知道和尝试过的:

  • 多次检查了预共享机密和身份验证,多次重新输入,我 100% 确定这不是问题。
  • 在某处读到 NAT 会弄乱数据包,但没有 NAT(据我所知)并且启用了 nat-traversal。
  • 尝试更改虚拟路由器上的网络适配器,尝试了所有可能的选项,但仍然发生同样的错误
  • 此设置与另外两个工作连接完全相同。多次检查配置是否有拼写错误或错误的 IP 地址等。

如果您知道导致此问题的原因是什么,请告诉我。

我真的很感激任何关于我可以检查什么的提示、想法,甚至猜测。:)

谢谢。

答案1

解决方案是重新启动 Windows 服务器...

经过三个星期的努力,现在它可以正常工作了,并且我没有更改 vyatta 或 Windows 服务器上的任何配置。

我们尝试了很多不同的东西,不同的虚拟路由器,不同的协议等等,但都没有起作用。

对于任何有同样或类似问题的人(也包括未来的自己),我的观察和建议如下:

  • Windows 远程和路由模块充满了错误,很多时候它无缘无故地无法工作,并且没有调试消息可以告诉您原因。如果您有其他选择,请使用那个。
  • 如果您创建了新的拨入连接但不起作用,则删除它并用不同的名字创建它。出于某些原因,不同的名称很重要。有时,即使删除了以前的连接,它们仍会保留在注册表和其他地方,并在 4 秒后抛出相同的错误或一些神秘的错误,例如“接口已断开连接”,而没有任何日志。
  • 重启服务可能会有帮助,但并非总是如此。如果你有能力重启整个服务器,那就试一试吧。
  • 两个 L2tp 连接没问题,但是三个对我来说不行。
  • 端口分配方式很奇怪,最初我们有五个 L2tp 端口,服务器选择了最后两个(也许前三次都连接失败了……我只是猜测)。对我们来说,将端口数量增加到 10 很有帮助。如果您无法在 UI 上增加端口数量(因为另一个错误),请在注册表中执行此操作并重新启动服务器(再次强调,重新启动服务不起作用)。

相关内容