☰

SonicOS 增强版 5.8.1.2 L2TP VPN 身份验证失败

tag-icon • tag-icon vpn mac-osx sonicwall l2tp
SonicOS 增强版 5.8.1.2 L2TP VPN 身份验证失败

我有一台运行 SonicOS Enhanced 5.8.1.2-6o 的 SonicWall TZ 215。我已使用默认加密套件 ESP: 3DES/HMAC SHA1 (IKE) 配置了 L2TP VPN。建议如下：

IKE（第一阶段）提案

  1. DH 组：第 2 组
  2. 加密：3DES
  3. 身份验证：SHA1
  4. 使用寿命（秒）：28800

Ipsec（第 2 阶段）提案

  1. 协议：ESP
  2. 加密：3DES
  3. 身份验证：SHA1
  4. 启用完美前向保密已禁用
  5. 使用寿命（秒）：28800

尝试通过我的 Mac OS X 客户端连接时，我收到身份验证错误。它似乎通过了预身份验证，但未能完成。我完全不知所措。我多次从头开始重新配置...使用简单的用户名和密码来验证这不是密码输入错误的问题。我有以下日志（注意 IP 已被删除以保护隐私）：

7/1/13 8:19:05.174 PM pppd[1268]: setup_security_context server port: 0x1503
7/1/13 8:19:05.190 PM pppd[1268]: publish_entry SCDSet() failed: Success!
7/1/13 8:19:05.191 PM pppd[1268]: publish_entry SCDSet() failed: Success!
7/1/13 8:19:05.191 PM pppd[1268]: pppd 2.4.2 (Apple version 727.1.1) started by dean, uid 501
7/1/13 8:19:05.192 PM pppd[1268]: L2TP connecting to server ‘0.0.0.0’ (0.0.0.0)...
7/1/13 8:19:05.193 PM pppd[1268]: IPSec connection started
7/1/13 8:19:05.208 PM racoon[1269]: accepted connection on vpn control socket.
7/1/13 8:19:05.209 PM racoon[1269]: Connecting.
7/1/13 8:19:05.209 PM racoon[1269]: IPSec Phase 1 started (Initiated by me).
7/1/13 8:19:05.209 PM racoon[1269]: IKE Packet: transmit success. (Initiator, Main-Mode message 1).
7/1/13 8:19:05.209 PM racoon[1269]: >>>>> phase change status = Phase 1 started by us
7/1/13 8:19:05.231 PM racoon[1269]: >>>>> phase change status = Phase 1 started by peer
7/1/13 8:19:05.231 PM racoon[1269]: IKE Packet: receive success. (Initiator, Main-Mode message 2).
7/1/13 8:19:05.234 PM racoon[1269]: IKE Packet: transmit success. (Initiator, Main-Mode message 3).
7/1/13 8:19:05.293 PM racoon[1269]: IKE Packet: receive success. (Initiator, Main-Mode message 4).
7/1/13 8:19:05.295 PM racoon[1269]: IKE Packet: transmit success. (Initiator, Main-Mode message 5).
7/1/13 8:19:05.315 PM racoon[1269]: IKEv1 Phase 1 AUTH: success. (Initiator, Main-Mode Message 6).
7/1/13 8:19:05.315 PM racoon[1269]: IKE Packet: receive success. (Initiator, Main-Mode message 6).
7/1/13 8:19:05.315 PM racoon[1269]: IKEv1 Phase 1 Initiator: success. (Initiator, Main-Mode).
7/1/13 8:19:05.315 PM racoon[1269]: IPSec Phase 1 established (Initiated by me).
7/1/13 8:19:06.307 PM racoon[1269]: IPSec Phase 2 started (Initiated by me).
7/1/13 8:19:06.307 PM racoon[1269]: >>>>> phase change status = Phase 2 started
7/1/13 8:19:06.308 PM racoon[1269]: IKE Packet: transmit success. (Initiator, Quick-Mode message 1).
7/1/13 8:19:06.332 PM racoon[1269]: attribute has been modified.
7/1/13 8:19:06.332 PM racoon[1269]: IKE Packet: receive success. (Initiator, Quick-Mode message 2).
7/1/13 8:19:06.332 PM racoon[1269]: IKE Packet: transmit success. (Initiator, Quick-Mode message 3).
7/1/13 8:19:06.333 PM racoon[1269]: IKEv1 Phase 2 Initiator: success. (Initiator, Quick-Mode).
7/1/13 8:19:06.333 PM racoon[1269]: IPSec Phase 2 established (Initiated by me).
7/1/13 8:19:06.333 PM racoon[1269]: >>>>> phase change status = Phase 2 established
7/1/13 8:19:06.333 PM pppd[1268]: IPSec connection established
7/1/13 8:19:07.145 PM pppd[1268]: L2TP connection established.
7/1/13 8:19:07.000 PM kernel[0]: ppp0: is now delegating en0 (type 0x6, family 2, sub-family 3)
7/1/13 8:19:07.146 PM pppd[1268]: Connect: ppp0 <--> socket[34:18]
7/1/13 8:19:08.709 PM pppd[1268]: MS-CHAPv2 mutual authentication failed.
7/1/13 8:19:08.710 PM pppd[1268]: Connection terminated.
7/1/13 8:19:08.710 PM pppd[1268]: L2TP disconnecting...
7/1/13 8:19:08.711 PM pppd[1268]: L2TP disconnected
7/1/13 8:19:08.711 PM racoon[1269]: IPSec disconnecting from server 0.0.0.0
7/1/13 8:19:08.711 PM racoon[1269]: IKE Packet: transmit success. (Information message).
7/1/13 8:19:08.712 PM racoon[1269]: IKEv1 Information-Notice: transmit success. (Delete IPSEC-SA).
7/1/13 8:19:08.712 PM racoon[1269]: IKE Packet: transmit success. (Information message).
7/1/13 8:19:08.712 PM racoon[1269]: IKEv1 Information-Notice: transmit success. (Delete ISAKMP-SA).
7/1/13 8:19:08.713 PM racoon[1269]: glob found no matches for path "/var/run/racoon/*.conf"
7/1/13 8:19:08.714 PM racoon[1269]: pfkey DELETE failed: No such file or directory

答案1

自己解决。以防有人在 SonicOS 5.8 上配置 L2TP 时遇到此问题：PPP 的首选身份验证方法是 MSCHAPv2。我查看了我的日志，发现我的预身份验证在两个阶段都成功了，但在 MSCHAPv2 相互身份验证期间我遇到了身份验证错误。我将首选方法更改为 CHAP 而不是 Microsoft 实现，并且它有效。我推测这是 OS X 的问题。

相关内容