主页 / ubuntu / 问题 / 1076892
Accepted
forvas
Asked: 2018-09-21 03:30:27 +0800 CST

如何在 Kubuntu 18.04 LTS 中连接到 VPN L2TP IPsec？

  • 772

我必须连接到 Cisco Meraki VPN。

  • 我正在使用全新安装的 Kubuntu 18.04 LTS。
  • 我得到了一个公共 IP、一个 VPN 用户、它的密码和一个预共享密钥。
  • 我打开网络管理器并创建了一个新的 VPN，选择第 2 层隧道协议 (L2TP) -与 L2TP VPN 服务器兼容-。我在各自的字段中填写了数据。

我能够在 16.04 年前连接到这些类型的 VPN，但是当我连接到这个时，我得到了错误，因为我是这个主题的新手，所以我不能很好地理解错误消息。这是系统日志（XXX.XXX.XXX.XXX 表示我必须连接到的公共 IP）：

Sep 20 12:11:51 H81M-DS2V NetworkManager[570]: <info>  [1537438311.1469] audit: op="connection-activate" uuid="e08aedcd-7c6c-41ac-92fe-796c04bd5345" name="Cisco Meraki VPN" pid=1009 uid=1000 result="success"
Sep 20 12:11:51 H81M-DS2V NetworkManager[570]: <info>  [1537438311.1522] vpn-connection[0x5591977d64c0,e08aedcd-7c6c-41ac-92fe-796c04bd5345,"Cisco Meraki VPN",0]: Started the VPN service, PID 31186
Sep 20 12:11:51 H81M-DS2V NetworkManager[570]: <info>  [1537438311.1668] vpn-connection[0x5591977d64c0,e08aedcd-7c6c-41ac-92fe-796c04bd5345,"Cisco Meraki VPN",0]: Saw the service appear; activating connection
Sep 20 12:11:51 H81M-DS2V nm-l2tp-service[31186]: Check port 1701
Sep 20 12:11:51 H81M-DS2V nm-l2tp-service[31186]: Can't bind to port 1701
Sep 20 12:11:51 H81M-DS2V NetworkManager[570]: Stopping strongSwan IPsec failed: starter is not running
Sep 20 12:11:53 H81M-DS2V NetworkManager[570]: Starting strongSwan 5.6.2 IPsec [starter]...
Sep 20 12:11:53 H81M-DS2V NetworkManager[570]: Loading config setup
Sep 20 12:11:53 H81M-DS2V NetworkManager[570]: Loading conn 'e08aedcd-7c6c-41ac-92fe-796c04bd5345'
Sep 20 12:11:53 H81M-DS2V NetworkManager[570]: found netkey IPsec stack
Sep 20 12:11:53 H81M-DS2V charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.6.2, Linux 4.15.0-29-generic, x86_64)
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-e08aedcd-7c6c-41ac-92fe-796c04bd5345.secrets'
Sep 20 12:11:53 H81M-DS2V charon: 00[CFG]   loaded IKE secret for %any
Sep 20 12:11:53 H81M-DS2V charon: 00[LIB] loaded plugins: charon aes rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark stroke updown eap-mschapv2 xauth-generic counters
Sep 20 12:11:53 H81M-DS2V charon: 00[LIB] dropped capabilities, running as uid 0, gid 0
Sep 20 12:11:53 H81M-DS2V charon: 00[JOB] spawning 16 worker threads
Sep 20 12:11:54 H81M-DS2V charon: 13[CFG] rereading secrets
Sep 20 12:11:54 H81M-DS2V charon: 13[CFG] loading secrets from '/etc/ipsec.secrets'
Sep 20 12:11:54 H81M-DS2V charon: 13[CFG] loading secrets from '/etc/ipsec.d/nm-l2tp-ipsec-e08aedcd-7c6c-41ac-92fe-796c04bd5345.secrets'
Sep 20 12:11:54 H81M-DS2V charon: 13[CFG]   loaded IKE secret for %any
Sep 20 12:11:54 H81M-DS2V charon: 15[CFG] received stroke: initiate 'e08aedcd-7c6c-41ac-92fe-796c04bd5345'
Sep 20 12:11:54 H81M-DS2V charon: 07[IKE] initiating Main Mode IKE_SA e08aedcd-7c6c-41ac-92fe-796c04bd5345[1] to XXX.XXX.XXX.XXX
Sep 20 12:11:54 H81M-DS2V charon: 07[ENC] generating ID_PROT request 0 [ SA V V V V V ]
Sep 20 12:11:54 H81M-DS2V charon: 07[NET] sending packet: from 192.168.0.24[500] to XXX.XXX.XXX.XXX[500] (204 bytes)
Sep 20 12:11:58 H81M-DS2V charon: 04[IKE] sending retransmit 1 of request message ID 0, seq 1
Sep 20 12:11:58 H81M-DS2V charon: 04[NET] sending packet: from 192.168.0.24[500] to XXX.XXX.XXX.XXX[500] (204 bytes)
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: Stopping strongSwan IPsec...
Sep 20 12:12:04 H81M-DS2V charon: 00[DMN] signal of type SIGINT received. Shutting down
Sep 20 12:12:04 H81M-DS2V charon: 00[IKE] destroying IKE_SA in state CONNECTING without notification
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: initiating Main Mode IKE_SA e08aedcd-7c6c-41ac-92fe-796c04bd5345[1] to XXX.XXX.XXX.XXX
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: generating ID_PROT request 0 [ SA V V V V V ]
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: sending packet: from 192.168.0.24[500] to XXX.XXX.XXX.XXX[500] (204 bytes)
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: sending retransmit 1 of request message ID 0, seq 1
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: sending packet: from 192.168.0.24[500] to XXX.XXX.XXX.XXX[500] (204 bytes)
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: destroying IKE_SA in state CONNECTING without notification
Sep 20 12:12:04 H81M-DS2V nm-l2tp-service[31186]: g_dbus_method_invocation_take_error: assertion 'error != NULL' failed
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: <info>  [1537438324.3534] vpn-connection[0x5591977d64c0,e08aedcd-7c6c-41ac-92fe-796c04bd5345,"Cisco Meraki VPN",0]: VPN plugin: state changed: stopped (6)
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: <info>  [1537438324.3568] vpn-connection[0x5591977d64c0,e08aedcd-7c6c-41ac-92fe-796c04bd5345,"Cisco Meraki VPN",0]: VPN service disappeared
Sep 20 12:12:04 H81M-DS2V NetworkManager[570]: <warn>  [1537438324.3578] vpn-connection[0x5591977d64c0,e08aedcd-7c6c-41ac-92fe-796c04bd5345,"Cisco Meraki VPN",0]: VPN connection: failed to connect: 'Message recipient disconnected from message bus without replying'

然后我尝试连接xl2tpd停止的服务。无法绑定到端口 1701的消息消失了，但出现了新的错误，实际上我认为结果更糟，因为我什至无法在任何消息中看到我必须连接到的公共 IP。

我也尝试填写 IPsec 设置的Phase 1和Phase 2字段，正如我在几个论坛中阅读的那样，但我什至不知道该写什么，我只是复制了其他答案，所以这是废话。

谁能帮我理解发生了什么？

vpn network-manager cisco 18.04

1 个回答

  1. Best Answer

    解决了。无需填写第 1阶段和第 2 阶段字段。我不得不安装ipsec-tools包。

    在那之后，就我而言，我还不得不停止xl2tpd服务。

    sudo /etc/init.d/xl2tpd stop

    为什么？因为这：

    NetworkManager-l2tp 启动它自己的 xl2tpd 实例，如果系统 xl2tpd 服务正在运行，它自己的 xl2tpd 实例将无法使用 UDP 端口 1701，因此将使用临时端口（即随机高端口）。

    尽管在 RFC3193（Microsoft 和 Cisco 共同编写的 L2TP/IPsec 标准）中认为使用临时端口是可以接受的，但如果使用临时端口，一些 L2TP/IPsec 服务器和/或防火墙会出现问题。

    完成这两个步骤后，我再次尝试连接并且成功了。

    • 3

相关问题