Note: L2TP with Microsoft Vista
With L2TP, Microsoft Vista tries by default to contact and download the CRL list,
while Microsoft XP does not. This can be turned off in Vista.
•
If multiple similar or roaming tunnels exist and there is a need to separate them using ID lists, a
possible cause can be that none of the ID lists match the certificate properties of the connecting
user. Either the user is not authorized or the certificate properties are wrong on the client or the
ID list needs to be updated with this user/information.
•
With L2TP, the client certificate is imported into the wrong certificate store on the Windows
client. When the client connects, it is using the wrong certificate.
9.7.6. Specific Symptoms
There are two specific symptoms that will be discussed in this section:
1. The tunnel can only be initiated from one side.
2. The tunnel is unable to be set up and the ikesnoop command reports a config mode XAuth
problem even though XAuth is not used.
1. The tunnel can only be initiated from one side
This is a common problem and is due to a mismatch of the size in local or remote network and/or
the lifetime settings on the proposal list(s).
To troubleshoot this it is necessary to examine the settings for the local network, remote network,
IKE proposal list and IPsec proposal list on both sides to try to identify a miss-match.
For example, suppose the following IPsec settings are at either end of a tunnel:
•
Side A
Local Network = 192.168.10.0/24
Remote Network = 10.10.10.0/24
•
Side B
Local Network = 10.10.10.0/24
Remote Network = 192.168.10.0/16
In this scenario, it can be seen that the defined remote network on Side B is larger than that defined
for Side A's local network. This means that Side A can only initiate the tunnel successfully towards
Site B as its network is smaller.
When Side B tries to initiate the tunnel, Side A will reject it because the network is bigger than
what is defined. The reason it works the other way around is because a smaller network is
considered more secure and will be accepted. This principle also applies to the lifetimes in the
proposal lists.
2. Unable to set up with config mode and getting a spurious XAuth message
The reason for this message is basically "No proposal chosen". The case where this will appear is
when there is something that fails in terms of network size on either local network or remote
network. Since NetDefendOS has determined that it is a type of network size problem, it will try one
last attempt to get the correct network by sending a config mode request.
9.7.6. Specific Symptoms
Chapter 9. VPN
448
Summary of Contents for NetDefend DFL-260E
Page 27: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 27...
Page 79: ...2 7 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 79...
Page 146: ...3 9 DNS Chapter 3 Fundamentals 146...
Page 227: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 227...
Page 241: ...5 4 IP Pools Chapter 5 DHCP Services 241...
Page 339: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 339...
Page 360: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 360...
Page 382: ...8 3 Customizing HTML Pages Chapter 8 User Authentication 382...
Page 386: ...The TLS ALG 9 1 5 The TLS Alternative for VPN Chapter 9 VPN 386...
Page 439: ...Figure 9 3 PPTP Client Usage 9 5 4 PPTP L2TP Clients Chapter 9 VPN 439...
Page 450: ...9 7 6 Specific Symptoms Chapter 9 VPN 450...
Page 488: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 488...
Page 503: ...11 6 HA Advanced Settings Chapter 11 High Availability 503...
Page 510: ...12 3 5 Limitations Chapter 12 ZoneDefense 510...
Page 533: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 533...