Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be unavailable on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 887674 - NetworkManager-l2tp not establishing connection
Summary: NetworkManager-l2tp not establishing connection
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: NetworkManager-l2tp
Version: 23
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Ivan Romanov
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
: 924840 1272767 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-12-17 00:05 UTC by Maurice James
Modified: 2019-10-02 14:00 UTC (History)
33 users (show)

Fixed In Version: NetworkManager-l2tp-0.9.8-4.fc20 NetworkManager-l2tp-1.0.2-1.fc23
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-06-02 14:55:59 UTC
Type: Bug


Attachments (Terms of Use)
selinux policy for ipsec/l2tp (1.33 KB, text/plain)
2012-12-24 21:21 UTC, Carl Byington
no flags Details
selinux module for NetworkManager-l2tp (722 bytes, text/plain)
2013-03-28 07:18 UTC, Gordon Messmer
no flags Details
selinux AVCs from connection (3.37 KB, text/plain)
2013-03-28 07:19 UTC, Gordon Messmer
no flags Details
Fixes ipsec restart and noccp options (969 bytes, patch)
2013-09-04 18:19 UTC, Gordon Messmer
no flags Details | Diff
modified spec file (5.03 KB, text/x-matlab)
2014-12-22 20:05 UTC, Carl Byington
no flags Details
NetworkManager-l2tp.spec for version 1.0.2 (5.08 KB, text/x-matlab)
2016-05-12 22:54 UTC, Douglas Kosovic
no flags Details

Description Maurice James 2012-12-17 00:05:56 UTC
Description of problem:
VPN will not connect

Version-Release number of selected component (if applicable):
0.9.6-3

How reproducible:
100%

Steps to Reproduce:
1.Create L2TP connection with the following options
PPP Settings:

Authentication:
PAP
CHAP
MSCHAPv2

Security and Compression:
Nothing checked

Echo:
Send PPP echo packets


IPSEC Settings:

"Enable IPSec tunnel L2TP host" Checked
Pre-shared key: **********

2.Attempt to establish connection
  
Actual results:
Plugin Failed
Dec 16 19:04:40 charon NetworkManager[596]: <info> VPN service 'l2tp' started (org.freedesktop.NetworkManager.l2tp), PID 2790
Dec 16 19:04:40 charon NetworkManager[596]: <info> VPN service 'l2tp' appeared; activating connections
Dec 16 19:04:41 charon NetworkManager[596]: <info> VPN plugin state changed: starting (3)
Dec 16 19:04:41 charon NetworkManager[596]: <info> VPN connection 'Home' (Connect) reply received.
Dec 16 19:04:51 charon NetworkManager[596]: <warn> VPN plugin failed: 7


Expected results:
Connection succeeded

Additional info:

Comment 1 Ivan Romanov 2012-12-17 02:40:00 UTC
Where to connect?

Comment 2 Maurice James 2012-12-17 15:35:22 UTC
(In reply to comment #1)
> Where to connect?

I am connecting back to my firewall. I didnt want to put the address here

Comment 3 Ivan Romanov 2012-12-17 15:48:44 UTC
In this case I can't reproduce this error. I can only to redirect it to upstream. Or you might e-mail me your private data and I will work with them.

Comment 4 Maurice James 2012-12-18 16:27:43 UTC
I will create credentials for you. They should be complete by this afternoon. I will email you when complete

Comment 5 Ivan Romanov 2012-12-19 11:19:16 UTC
Ok.

Comment 6 Ivan Romanov 2012-12-19 17:20:51 UTC
Did you connect to this vpn-server before? How did you do this?

Comment 7 Maurice James 2012-12-19 17:33:25 UTC
(In reply to comment #6)
> Did you connect to this vpn-server before? How did you do this?


I could connect with Windows and Android but cant seem to do it with fedora

Comment 8 Ivan Romanov 2012-12-19 17:36:25 UTC
How do you connect with Windows?

Comment 9 Maurice James 2012-12-19 17:53:26 UTC
(In reply to comment #8)
> How do you connect with Windows?

Control Panel > Set up a connection or Network > Connect to a Workplace > Use my Internet connection (VPN) > Internet Address: "the address that I gave to you" >
User name: "the username that I gave to you"
Password: "same as above"


Connect

The connection will fail at this point because more modifications need to be made to the profile.

Click Set up the connection anyway.

Go to the properties of the new VPN adapter that you just created.
Click on the Security tab, click the Advanced settings button. Click the use preshared key for authentication.
Enter the preshared key and click ok

You will now be able to connect

Comment 10 Ivan Romanov 2012-12-19 18:07:07 UTC
did you try connect with ipsec on Fedora?

Comment 11 Maurice James 2012-12-19 18:43:46 UTC
(In reply to comment #10)
> did you try connect with ipsec on Fedora?

I did but maybe I got some settings wrong. Did you get it to work? if so can you share the settings that you used?

Comment 12 Ivan Romanov 2012-12-19 18:46:51 UTC
I didn't get it to work too.

Comment 13 Ivan Romanov 2012-12-19 19:07:42 UTC
you can try this http://sourceforge.net/projects/l2tp-ipsec-vpn/files/?source=navbar

Comment 14 Ivan Romanov 2012-12-19 20:24:49 UTC
for using NetworkManager-l2tp with IPSec you have enabled ipsec service. 
systemctl enable ipsec.service
systemctl start ipsec.service

also you need to add your pre shared key to /etc/ipsec.secrets
%any your_gateway: "your_pre_shared_key"

and something else ... I haven't found that yet.

Comment 15 Ivan Romanov 2012-12-19 20:37:44 UTC
Try it. Maybe it will work for you.

Comment 16 Maurice James 2012-12-20 15:13:45 UTC
(In reply to comment #15)
> Try it. Maybe it will work for you.

I tried and gets hung in Phase 2

Comment 17 Carl Byington 2012-12-24 21:21:36 UTC
Created attachment 668604 [details]
selinux policy for ipsec/l2tp

Possible selinux fix for ipsec/l2tp

Comment 18 Carl Byington 2012-12-24 21:22:42 UTC
If 'setenforce 0' allows your connection, it is just an selinux issue, and the above policy might fix it for you.

Comment 19 Ivan Romanov 2012-12-25 09:18:14 UTC
I don't use selinux.

Comment 20 Carl Byington 2012-12-26 16:01:12 UTC
Adding Daniel Walsh for selinux issues.

The current NetworkManager-l2tp needs permissive mode to establish ipsec/l2tp vpn connections. I built an selinux policy attached above that works for me connecting F17 to a Vyatta 6.5 ipsec/l2tp vpn server. I presume fedora policy is to add selinux policy to selinux-policy package, rather than having individual packages running semodule command in post or postun scripts.

Should the 'requires' for NetworkManager-l2tp include openswan? That is needed if you are doing ipsec/l2tp, but some folks may be using just raw l2tp, in which case openswan would probably not be a requirement. I don't have a test system for that.

What is Fedora policy on such package requires? There must be other packages that have package dependencies that depend on the configuration. Do the rpm 'requires' always include all the dependent packages that might be required by any configuration?

Comment 21 Daniel Walsh 2013-01-02 20:06:53 UTC
Carl, do you have the AVC's you used to create this policy?

Comment 22 Carl Byington 2013-01-02 20:49:34 UTC
No, but it was just built with something like

grep some.l2tp.regex /var/log/audit/audit.log | audit2allow

It took a few tries to get all the parts.

Comment 23 Daniel Walsh 2013-01-03 21:44:38 UTC
Well I need the AVC's to beable ot build the policy.

Comment 24 Ivan Romanov 2013-03-23 08:08:48 UTC
*** Bug 924840 has been marked as a duplicate of this bug. ***

Comment 25 darton 2013-03-25 12:06:06 UTC
(In reply to comment #23)
> Well I need the AVC's to beable ot build the policy.

Mar 22 18:37:33 mysystem kernel: [  552.972740] type=1400 audit(1363963053.616:4): avc:  denied  { name_bind } for  pid=1564 comm="nm-l2tp-service" src=1701 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:l2tp_port_t:s0 tclass=udp_socket
Mar 22 18:37:33 mysystem kernel: [  553.034018] type=1400 audit(1363963053.678:5): avc:  denied  { rename } for  pid=1564 comm="nm-l2tp-service" name="ipsec.secrets" dev="dm-1" ino=394807 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:ipsec_key_file_t:s0 tclass=file

Is this the information you need?

Comment 26 Gordon Messmer 2013-03-28 07:17:41 UTC
I've been debugging this issue, myself.  There are three things that need to be address for Fedora to connect to common L2TP/IPSec VPNs.

First, while NetworkManager will start the ipsec service for IPSec VPNs, it will not do so for L2TP/IPSec.  This should be considered a bug of its own.  It can be worked around by manually enabling the ipsec service, as suggested by Ivan:
 # systemctl enable ipsec.service
 # systemctl start ipsec.service
NetworkManager-0.9.8.0-1.fc18.x86_64
NetworkManager-l2tp-0.9.6-2.fc18.x86_64

Second, the standard configuration for xl2tpd includes the noccp option, which is used on Android devices.  As best I can tell, this option MUST be specified on both sides of a ppp connction when it is specified by either side.  Since it's used on Android, we can expect it to be used on virtually all servers, and we should specify that option in /var/run/nm-ppp-options.xl2tpd.xxxxx.  This can be worked around for now by adding "noccp" to /etc/ppp/options.
NetworkManager-0.9.8.0-1.fc18.x86_64
NetworkManager-l2tp-0.9.6-2.fc18.x86_64

Finally, the SELinux policy does not allow the connection.  I have a smaller policy than Carl suggested.  I used "tail -f" to gather only the AVCs during a successful connection in permissive mode.  I don't know if his policy is larger because he has captured unrelated AVCs or because his client configuration is different.  I'll attach both the policy and AVCs following this comment.
selinux-policy-3.11.1-86.fc18.noarch
selinux-policy-targeted-3.11.1-86.fc18.noarch

Comment 27 Gordon Messmer 2013-03-28 07:18:56 UTC
Created attachment 717465 [details]
selinux module for NetworkManager-l2tp

Comment 28 Gordon Messmer 2013-03-28 07:19:31 UTC
Created attachment 717466 [details]
selinux AVCs from connection

Comment 29 Ivan Romanov 2013-03-31 14:53:45 UTC
(In reply to comment #26)
> First, while NetworkManager will start the ipsec service for IPSec VPNs, it
> will not do so for L2TP/IPSec.  This should be considered a bug of its own. 
> It can be worked around by manually enabling the ipsec service, as suggested
> by Ivan:
>  # systemctl enable ipsec.service
>  # systemctl start ipsec.service
> NetworkManager-0.9.8.0-1.fc18.x86_64
> NetworkManager-l2tp-0.9.6-2.fc18.x86_64

Is NetworkManager-l2tp must start ipsec service when connecting?

Comment 30 Ivan Romanov 2013-03-31 15:05:03 UTC
NetworkManager-l2tp starts ipsec internally with 'ipsec setup restart'

Comment 31 Ivan Romanov 2013-03-31 15:16:11 UTC
It is mean than first step is passed. In really 'ipsec setup restart' uses /usr/libexec/ipsec/setup. This setup is regular System V service. Maybe it should be replaced with systemd service?

Comment 32 Sergey 2013-03-31 15:29:55 UTC
(In reply to comment #26)
> First, while NetworkManager will start the ipsec service for IPSec VPNs, it
> will not do so for L2TP/IPSec.  This should be considered a bug of its own. 
> It can be worked around by manually enabling the ipsec service, as suggested
> by Ivan:
>  # systemctl enable ipsec.service
>  # systemctl start ipsec.service
> NetworkManager-0.9.8.0-1.fc18.x86_64
> NetworkManager-l2tp-0.9.6-2.fc18.x86_64

As Ivan said, plugin issues command "ipsec setup restart" https://github.com/seriyps/NetworkManager-l2tp/blob/0.9.6/src/nm-l2tp-service.c#L903 and this is the ~equiualent of systemctl restart ipsec.service

> Second, the standard configuration for xl2tpd includes the noccp option,
> which is used on Android devices.  As best I can tell, this option MUST be
> specified on both sides of a ppp connction when it is specified by either
> side.  Since it's used on Android, we can expect it to be used on virtually
> all servers, and we should specify that option in
> /var/run/nm-ppp-options.xl2tpd.xxxxx.  This can be worked around for now by
> adding "noccp" to /etc/ppp/options.
> NetworkManager-0.9.8.0-1.fc18.x86_64
> NetworkManager-l2tp-0.9.6-2.fc18.x86_64

Are you really sure, it must be specified on both sides? If yes, I can add checkbox on PPP settings tab, but not add it by default.

(In reply to all)

For better debug output, please, use instructions from https://github.com/seriyps/NetworkManager-l2tp/wiki#how-to-report-bugs

PS: I'm upstream maintainer/developer

Comment 33 Gordon Messmer 2013-04-07 06:21:39 UTC
Sorry about the delay.  The ISP providing my former email address has apparently died.

> As Ivan said, plugin issues command "ipsec setup restart"
> https://github.com/seriyps/NetworkManager-l2tp/blob/0.9.6/src/nm-l2tp-
> service.c#L903 and this is the ~equiualent of systemctl restart ipsec.service

I'm not sure why that doesn't work, but you can easily verify that it does not:

# "sh", "-c", ". /var/run/pluto/ipsec.info;PATH=/usr/local/sbin:/usr/sbin:/sbin; export PATH;[ \"x$defaultrouteaddr\" = \"x\" ] && ipsec setup restart"
sh: /var/run/pluto/ipsec.info: No such file or directory

For some reason, sh does not process the additional commands, so ipsec setup restart will only actually happen if ipsec is already running (that is, if /var/run/pluto/ipsec.info exists.)

> Are you really sure, it must be specified on both sides? If yes, I can add
> checkbox on PPP settings tab, but not add it by default.

Well, I haven't gone through the source to find out why not, but I've tested this fairly thoroughly.  If the server does not specify "noccp" in its ppp options file, then Android clients will not be able to negotiate ppp.  Once the "noccp" option is added to the server, GNU clients will not negotiate ppp until they also specify it.

Given that, it really seems like overkill to include another option.  Unless there are real-world servers that properly support iOS and Android, and which don't require the "noccp" option, everyone's life will be easier if that's simply made the standard configuration and no new checkboxes are introduced.  The checkbox is useless if no one needs it.

Comment 34 Gordon Messmer 2013-04-07 06:34:55 UTC
http://www.gnu.org/software/bash/manual/html_node/Bash-POSIX-Mode.html

#12  Non-interactive shells exit if filename in . filename is not found. 

...so this is the documented behavior of bash in POSIX mode, which it will be for system()

Comment 35 Fedora End Of Life 2013-07-04 05:48:05 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 36 Gordon Messmer 2013-07-06 03:53:19 UTC
I've tested Fedora 19, and all of the problems are still present.  The options file requires "noccp", SELinux still needs an extended policy, and IPSec must be manually started.  Can someone bump the "version" on this bug entry?

Comment 37 Makoto Mizukami 2013-08-18 15:06:45 UTC
I was also suffered from the same issue in F19.x86_64.

After finding out the conversations above, I have prepared clean-installed Fedora 19 system and changed these settings:

1. # setenforce 0
2. # systemctl start ipsec

Then I tried to connect to my VPN server using NM; it went well. :)

After this try, I got the following:
# audit2allow -b -w
type=AVC msg=audit(1376835388.779:679): avc:  denied  { search } for  pid=18729 comm="sh" name="pluto" dev="tmpfs" ino=380054 scontext=system_u:system_r:l2tpd_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=dir

Thus, I can conclude that current F19 has (at least) these 2 problems concerning L2TP/IPsec VPN and NetworkManager:
1. IPsec daemon should be started before establishing L2TP connections, but it is not; it runs just "ipsec setup restart", which should fail if the deamon is not started.
2. There is a missing SELinux rule, which is needed to work properly, in the current policy package.

So, my conclusion is the same as others are discussing, isn't it? I belive preparing patches for the is not so difficult. Why is there no progress?

P.S. About the "ipsec setup restart", I think we just have to s/setup\ //; it should work fine, as long as reading the source of /usr/sbin/ipsec .

Comment 38 Ivan Romanov 2013-08-18 15:28:07 UTC
As I can remember ipsec required specific settings. 
[root@localhost ~]# ipsec setup restart
systemd: ipsec service is not running
What I am doing wrong?

Comment 39 Makoto Mizukami 2013-08-18 15:30:41 UTC
Try:
# ipsec restart

Comment 40 Makoto Mizukami 2013-08-18 15:52:35 UTC
Oh, it does not work again after rebooting... Still investigating.

Comment 41 Makoto Mizukami 2013-08-18 19:12:48 UTC
#40
This was a SELinux problem. When I run "# setenforce 0" regardless of custom SELinux policies which was generated in the prior steps, it worked.

The most incomprehensible thing is that there was no message about this in audit.log; there is no way for me to examine what is wrong with SELinux.



Although I got a log using journalctl saying:

Aug 19 02:22:39 dsk1.makotom.org pluto[6915]: initiating all conns with alias='nm-ipsec-l2tpd-6959'
Aug 19 02:22:39 dsk1.makotom.org NetworkManager[460]: 000 initiating all conns with alias='nm-ipsec-l2tpd-6959'
Aug 19 02:22:39 dsk1.makotom.org NetworkManager[460]: 021 no connection named "nm-ipsec-l2tpd-6959"

while in Permissive mode it was like:

Aug 19 02:34:29 dsk1.makotom.org pluto[8125]: loading secrets from "/etc/ipsec.secrets"
Aug 19 02:34:29 dsk1.makotom.org NetworkManager[460]: 002 loading secrets from "/etc/ipsec.secrets"
Aug 19 02:34:29 dsk1.makotom.org ipsec_starter[8190]: Warning: ignored obsolete keyword 'force_keepalive'
Aug 19 02:34:29 dsk1.makotom.org pluto[8125]: added connection description "nm-ipsec-l2tpd-8162"

However, running
# /bin/sh /usr/libexec/ipsec/auto --config /var/run/nm-ipsec-l2tp.6959/ipsec.conf --verbose --add nm-ipsec-l2tpd-6959
after it failed to establish IPsec connection worked as expected.

Therefore, it is obvious that SELinux prevents nm-l2tp-service run by NetworkManager to run ipsec binaries with custom configuration files in some manner.
That's all I was able to pull out with my knowledge about SELinux...



I am really sad to report that running /usr/lib/NetworkManager/nm-l2tp-service --debug as root suppresses this issue...

Comment 42 Ivan Romanov 2013-08-18 19:30:37 UTC
$ cat /etc/selinux/config 

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of these two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

Comment 43 Carl Byington 2013-08-18 20:37:11 UTC
(In reply to Makoto Mizukami from comment #41)
> #40

> The most incomprehensible thing is that there was no message about this in
> audit.log; there is no way for me to examine what is wrong with SELinux.

semodule -DB
  run some tests
semodule -B

Policy entries have a 'dontaudit' flag, the -D disables that so you get everything logged.

Comment 44 Makoto Mizukami 2013-08-18 21:35:01 UTC
(In reply to Carl Byington from comment #43)
> semodule -DB
Thanks! That's it!



Then I recreated a module with the following command:

# cat '
type=AVC msg=audit(1376835388.779:679): avc:  denied  { search } for  pid=18729 comm="sh" name="pluto" dev="tmpfs" ino=380054 scontext=system_u:system_r:l2tpd_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=dir
type=AVC msg=audit(1376858464.965:724): avc:  denied  { search } for  pid=6121 comm="addconn" name="nm-ipsec-l2tp.850" dev="tmpfs" ino=27374 scontext=system_u:system_r:ipsec_mgmt_t:s0 tcontext=system_u:object_r:l2tpd_var_run_t:s0 tclass=dir
' | audit2allow -M my-l2tp-ipsec

It looks like working well in Enforcing mode.

Comment 45 Gordon Messmer 2013-09-04 18:19:40 UTC
Created attachment 793782 [details]
Fixes ipsec restart and noccp options

I've tested F19 today and these seem to be the last required fixes.

First, /var/run/pluto/ipsec.info isn't sourced unless it exists.  That allows ipsec to be started when necessary.

Second, the noccp option is added to the ppp options file.  I mentioned previously that pppd+xl2tpd on Linux won't support Android and iOS without this option, and that pppd+NetworkManager-l2tp on Linux won't connect to such a server without a matching configuration.

Comment 46 Sergey 2013-09-09 00:47:47 UTC
(In reply to Gordon Messmer from comment #45)

Thanks.
Ipsec changes merged to upstream, but I didn't test if it works or no, because I have no IPSec server. https://github.com/seriyps/NetworkManager-l2tp/commit/cf9073df710b4c650b7617a88720d4d4cd0a51bf

noccp option by default merged too, I have tested it with my ISP VPN and it works good with and without that option. https://github.com/seriyps/NetworkManager-l2tp/commit/5fe98f70344e842faa28014be7ba259c2db7ae8b

> noccp  Disable  CCP  (Compression  Control  Protocol)  negotiation.   This  option should only be required if the peer is buggy and gets confused by
> requests from pppd for CCP negotiation.

But I still not sure - maybe add additional option for it in interface?

Comment 47 Gordon Messmer 2013-09-10 16:28:50 UTC
> But I still not sure - maybe add additional option for it in interface?

If I were you, I'd wait for someone to request it.  I'm not sure the option would benefit anyone.

Comment 48 Gordon Messmer 2013-09-10 17:06:34 UTC
Regarding SELinux, I wanted to confirm and follow up on Makoto's report.  These three should probably be added to the policy:

First, NetworkManager-l2tp runs sh and sources /var/run/pluto/ipsec.info to determine whether or not to restart ipsec, so that needs to be allowed:

type=AVC msg=audit(1378830567.245:1581): avc:  denied  { search } for  pid=16469 comm="sh" name="pluto" dev="tmpfs" ino=16321 scontext=system_u:system_r:l2tpd_t:s0 tcontext=system_u:object_r:ipsec_var_run_t:s0 tclass=dir

Second, NetworkManager-l2tp creates an ipsec configuration file at /var/run/nm-ipsec-l2tp.%d/ipsec.conf and runs addcon to start ipsec, which needs to be allowed.

type=AVC msg=audit(1378830911.583:1611): avc:  denied  { search } for  pid=16783 comm="addconn" name="nm-ipsec-l2tp.16747" dev="tmpfs" ino=391633 scontext=system_u:system_r:ipsec_mgmt_t:s0 tcontext=system_u:object_r:l2tpd_var_run_t:s0 tclass=dir

NetworkManger-l2tp doesn't run "ip" directly, so I'm not sure if this needs to be allowed or not:

type=AVC msg=audit(1378831022.548:1636): avc:  denied  { read write } for  pid=17036 comm="ip" path="socket:[392039]" dev="sockfs" ino=392039 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ipsec_t:s0 tclass=unix_stream_socket

Dan, can these be added to the policy?

Comment 49 Daniel Walsh 2013-09-11 14:28:17 UTC
40eba1fd4db6a69ca7e007221e53921f3812d6ec fixes this in git.

Comment 50 Fedora Update System 2013-09-23 07:52:26 UTC
NetworkManager-l2tp-0.9.8-4.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/NetworkManager-l2tp-0.9.8-4.fc19

Comment 51 Fedora Update System 2013-09-23 07:53:40 UTC
NetworkManager-l2tp-0.9.8-4.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/NetworkManager-l2tp-0.9.8-4.fc18

Comment 52 Fedora Update System 2013-09-24 00:27:47 UTC
Package NetworkManager-l2tp-0.9.8-4.fc18:
* should fix your issue,
* was pushed to the Fedora 18 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing NetworkManager-l2tp-0.9.8-4.fc18'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-17458/NetworkManager-l2tp-0.9.8-4.fc18
then log in and leave karma (feedback).

Comment 53 Fedora Update System 2013-09-30 00:27:31 UTC
NetworkManager-l2tp-0.9.8-4.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 54 Fedora Update System 2013-10-06 01:33:45 UTC
NetworkManager-l2tp-0.9.8-4.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 55 Fedora Update System 2013-10-22 19:56:59 UTC
NetworkManager-l2tp-0.9.8-4.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/NetworkManager-l2tp-0.9.8-4.fc20

Comment 56 Fedora Update System 2013-10-23 17:32:36 UTC
Package NetworkManager-l2tp-0.9.8-4.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing NetworkManager-l2tp-0.9.8-4.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-19778/NetworkManager-l2tp-0.9.8-4.fc20
then log in and leave karma (feedback).

Comment 57 Fedora Update System 2013-11-10 08:07:13 UTC
NetworkManager-l2tp-0.9.8-4.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 58 Jeremy Visser 2014-02-27 00:31:38 UTC
I believe I am still suffering from this bug.

Running NetworkManager-l2tp-0.9.8.5-1.fc20.x86_64 and connecting to an L2TP/IPsec VPN fails with:

  NetworkManager[818]: can not load config '/var/run/nm-ipsec-l2tp.12498/ipsec.conf': can't load file '/var/run/nm-ipsec-l2tp.12498/ipsec.conf'

Furthermore, after pluto fails like this, NetworkManager thinks it has succeeded, and proceeds to launch xl2tpd insecurely (i.e. my L2TP traffic starts going in plain text -- WTF):

  NetworkManager[818]: ** (nm-l2tp-service:12498): WARNING **: Possible error in IPSec setup.
  NetworkManager[818]: ** Message: ipsec ready for action
  NetworkManager[818]: ** Message: xl2tpd started with pid 12670
  NetworkManager[818]: xl2tpd[12670]: Connection established to 1.2.3.4, 1701.  Local: 7997, Remote: 11 (ref=0/0).

The above is a grave security problem. If IPsec is enabled, and it fails as above, it should refuse to connect.

After running "setenforce Permissive", pluto is happy to attempt to connect.

(In my case it does not actually work after that, because my VPN requires PFS of modp2048, but the plugin has modp1024 hardcoded in with no obvious way to change this, but that problem is outside the scope of this bug.)

Comment 59 Sergey 2014-02-27 02:39:22 UTC
(In reply to Jeremy Visser from comment #58)
> Furthermore, after pluto fails like this, NetworkManager thinks it has
> succeeded, and proceeds to launch xl2tpd insecurely (i.e. my L2TP traffic
> starts going in plain text -- WTF):
> 
>   NetworkManager[818]: ** (nm-l2tp-service:12498): WARNING **: Possible
> error in IPSec setup.
>   NetworkManager[818]: ** Message: ipsec ready for action
>   NetworkManager[818]: ** Message: xl2tpd started with pid 12670
>   NetworkManager[818]: xl2tpd[12670]: Connection established to 1.2.3.4,
> 1701.  Local: 7997, Remote: 11 (ref=0/0).
> 
> The above is a grave security problem. If IPsec is enabled, and it fails as
> above, it should refuse to connect.
> 

I fixed this https://github.com/seriyps/NetworkManager-l2tp/commit/73a30d4a0cc667a7fd9aadb91e84a5108a9ce698 Thanks! Now it stop attempting to connect if IPSec failed.

New version 0.9.8.6

Comment 61 Fabien Archambault 2014-04-25 11:03:45 UTC
Hi,
I would like to up this topic as I have an issue with my IPSEC/L2TP VPN connexion using the latest version: NetworkManager-l2tp-0.9.8.6-1.fc20.x86_64

When using the latest version I cannot connect to the VPN:
[root@evangelion-nerv log]# tail -f messages | grep -i networkmanager
Apr 25 13:01:59 evangelion-nerv yum[13903]: Updated: NetworkManager-l2tp-0.9.8.6-1.fc20.x86_64
Apr 25 13:02:20 evangelion-nerv NetworkManager[926]: <info> Starting VPN service 'l2tp'...
Apr 25 13:02:20 evangelion-nerv NetworkManager[926]: <info> VPN service 'l2tp' started (org.freedesktop.NetworkManager.l2tp), PID 13917
Apr 25 13:02:20 evangelion-nerv NetworkManager[926]: <info> VPN service 'l2tp' appeared; activating connections
Apr 25 13:02:20 evangelion-nerv NetworkManager[926]: <info> VPN plugin state changed: init (1)
Apr 25 13:02:21 evangelion-nerv NetworkManager[926]: <info> VPN connection 'IPsec/L2TP' (ConnectInteractive) reply received.
Apr 25 13:02:21 evangelion-nerv NetworkManager[926]: <info> VPN plugin state changed: starting (3)
Apr 25 13:02:21 evangelion-nerv NetworkManager: ** Message: Use '82.66.147.74' as a gateway
Apr 25 13:02:21 evangelion-nerv NetworkManager: ** Message: Check port 1701
Apr 25 13:02:21 evangelion-nerv NetworkManager: ** Message: ipsec enable flag: yes
Apr 25 13:02:21 evangelion-nerv NetworkManager: ** Message: starting ipsec
Apr 25 13:02:21 evangelion-nerv NetworkManager: systemd: ipsec service is not running
Apr 25 13:02:21 evangelion-nerv NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Apr 25 13:02:21 evangelion-nerv NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Apr 25 13:02:21 evangelion-nerv NetworkManager: Warning: ignored obsolete keyword 'force_keepalive'
Apr 25 13:02:21 evangelion-nerv NetworkManager: connect(pluto_ctl) failed: No such file or directory
Apr 25 13:02:21 evangelion-nerv NetworkManager: debugging mode enabled
Apr 25 13:02:21 evangelion-nerv NetworkManager: end of file /var/run/nm-ipsec-l2tp.13917/ipsec.conf
Apr 25 13:02:21 evangelion-nerv NetworkManager: Warning: ignored obsolete keyword 'force_keepalive'
Apr 25 13:02:21 evangelion-nerv NetworkManager: Loading conn nm-ipsec-l2tpd-13917
Apr 25 13:02:21 evangelion-nerv NetworkManager: connection's  policy label: (null)
Apr 25 13:02:21 evangelion-nerv NetworkManager: starter: case KH_DEFAULTROUTE: empty
Apr 25 13:02:21 evangelion-nerv NetworkManager: conn: "nm-ipsec-l2tpd-13917" loopback=0
Apr 25 13:02:21 evangelion-nerv NetworkManager: conn: "nm-ipsec-l2tpd-13917" labeled_ipsec=0
Apr 25 13:02:21 evangelion-nerv NetworkManager: conn: "nm-ipsec-l2tpd-13917" policy_label=(null)
Apr 25 13:02:21 evangelion-nerv NetworkManager: conn: "nm-ipsec-l2tpd-13917" modecfgdomain=(null)
Apr 25 13:02:21 evangelion-nerv NetworkManager: conn: "nm-ipsec-l2tpd-13917" modecfgbanner=(null)
Apr 25 13:02:21 evangelion-nerv NetworkManager: connect(pluto_ctl) failed: No such file or directory
Apr 25 13:02:21 evangelion-nerv NetworkManager: opening file: /var/run/nm-ipsec-l2tp.13917/ipsec.conf
Apr 25 13:02:21 evangelion-nerv NetworkManager: loading named conns: nm-ipsec-l2tpd-13917
Apr 25 13:02:21 evangelion-nerv NetworkManager: parse_src = 1, parse_gateway = 0, has_dst = 1
Apr 25 13:02:21 evangelion-nerv NetworkManager: dst 82.66.147.74 via 138.195.30.1 dev em1 src 138.195.30.44
Apr 25 13:02:21 evangelion-nerv NetworkManager: set addr: 138.195.30.44
Apr 25 13:02:21 evangelion-nerv NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Apr 25 13:02:21 evangelion-nerv NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Apr 25 13:02:21 evangelion-nerv NetworkManager[926]: <info> VPN connection 'IPsec/L2TP' (Connect) reply received.
Apr 25 13:02:21 evangelion-nerv NetworkManager[926]: <warn> VPN connection 'IPsec/L2TP' failed to connect: 'Possible error in IPSec setup.'.
Apr 25 13:02:21 evangelion-nerv NetworkManager[926]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.


When downgrading to previous version: 
Apr 25 13:03:08 evangelion-nerv yum[13977]: Installed: NetworkManager-l2tp-0.9.8-4.fc20.x86_64


Everything works well. Please reopen this case as it is not fixed!

Comment 62 Daniel Walsh 2014-05-25 10:08:49 UTC
Any new AVC information?

Comment 63 Fabien Archambault 2014-05-26 06:59:10 UTC
Hi,
Still no AVC info with latest updates:
May 26 08:54:09 Updated: selinux-policy-doc-3.12.1-166.fc20.noarch
May 26 08:54:31 Updated: selinux-policy-targeted-3.12.1-166.fc20.noarch

Using the latest NetworkManager-l2tp still cannot connect but with the previous I can:
$ sudo yum downgrade NetworkManager-l2tp 
Résolution des dépendances
--> Lancement de la transaction de test
---> Le paquet NetworkManager-l2tp.x86_64 0:0.9.8-4.fc20 sera une rétrogradation
---> Le paquet NetworkManager-l2tp.x86_64 0:0.9.8.6-1.fc20 sera effacé
--> Résolution des dépendances terminée

Dépendances résolues

================================================================================
 Package                   Architecture Version              Dépôt        Taille
================================================================================
Retour à la version précédente :
 NetworkManager-l2tp       x86_64       0.9.8-4.fc20         fedora        90 k

Résumé de la transaction
================================================================================
Retour à la version précédente  1 Paquet

Taille totale des téléchargements : 90 k
Is this ok [y/d/N]: y
Downloading packages:
NetworkManager-l2tp-0.9.8-4.fc20.x86_64.rpm                |  90 kB   00:00     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installation : NetworkManager-l2tp-0.9.8-4.fc20.x86_64                    1/2 
  Nettoyage    : NetworkManager-l2tp-0.9.8.6-1.fc20.x86_64                  2/2 
  Vérification : NetworkManager-l2tp-0.9.8-4.fc20.x86_64                    1/2 
  Vérification : NetworkManager-l2tp-0.9.8.6-1.fc20.x86_64                  2/2 

Supprimé :
  NetworkManager-l2tp.x86_64 0:0.9.8.6-1.fc20                                   

Installé :
  NetworkManager-l2tp.x86_64 0:0.9.8-4.fc20                                     

Terminé !

Comment 64 Gordon Messmer 2014-05-27 18:33:48 UTC
Dan, two of the three AVCs that I reported in comment 48 are still present on Fedora 20 with NetworkManager-l2tp-0.9.8-4.fc20.x86_64.  The newer version of NetworkManager-l2tp simply doesn't work, but that's not related to SELinux.

Comment 65 Gordon Messmer 2014-05-27 18:34:44 UTC
Saved too soon.  Thse are the two AVCs.

type=AVC msg=audit(1401215326.189:474): avc:  denied  { search } for  pid=5747 comm="addconn" name="nm-ipsec-l2tp.5589" dev="tmpfs" ino=75419 scontext=system_u:system_r:ipsec_mgmt_t:s0 tcontext=system_u:object_r:l2tpd_var_run_t:s0 tclass=dir
type=AVC msg=audit(1401215326.375:480): avc:  denied  { read write } for  pid=5774 comm="ip" path="socket:[75543]" dev="sockfs" ino=75543 scontext=system_u:system_r:ifconfig_t:s0 tcontext=system_u:system_r:ipsec_t:s0 tclass=unix_stream_socket

Comment 66 Daniel Walsh 2014-06-09 10:45:05 UTC
These are dontaudited in the Rawhide policy.
 audit2allow -i /tmp/t1


#============= ifconfig_t ==============

#!!!! This avc has a dontaudit rule in the current policy
allow ifconfig_t ipsec_t:unix_stream_socket { read write };

#============= ipsec_mgmt_t ==============

#!!!! This avc has a dontaudit rule in the current policy
allow ipsec_mgmt_t l2tpd_var_run_t:dir search;

Comment 67 Gordon Messmer 2014-06-11 05:32:52 UTC
Dan, I'm not sure how that's helpful.  I'm able to establish connections in permissive mode, but not in enforcing.

Am I reporting the wrong AVCs?  My understanding was that dontaudit rules are still denials, and in this case those need to be allowed in order for L2tp/Ipsec connections to work.

Comment 68 customercare 2014-06-20 16:17:53 UTC
Server ist a fedora 19 ipsec/xl2tpd/pptpd server with libreswan.

It's working via Android, SELINUX is disabled atm:

CLIENT: 

Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #1: initiating Main Mode
Jun 20 18:12:29 eve NetworkManager: 104 "nm-ipsec-l2tpd-9072" #1: STATE_MAIN_I1: initiate
Jun 20 18:12:29 eve NetworkManager: 003 "nm-ipsec-l2tpd-9072" #1: received Vendor ID payload [Dead Peer Detection]
Jun 20 18:12:29 eve NetworkManager: 003 "nm-ipsec-l2tpd-9072" #1: received Vendor ID payload [FRAGMENTATION]
Jun 20 18:12:29 eve NetworkManager: 003 "nm-ipsec-l2tpd-9072" #1: received Vendor ID payload [RFC 3947]
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
Jun 20 18:12:29 eve NetworkManager: 106 "nm-ipsec-l2tpd-9072" #1: STATE_MAIN_I2: sent MI2, expecting MR2
Jun 20 18:12:29 eve NetworkManager: 003 "nm-ipsec-l2tpd-9072" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #1: Not sending INITIAL_CONTACT
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
Jun 20 18:12:29 eve NetworkManager: 108 "nm-ipsec-l2tpd-9072" #1: STATE_MAIN_I3: sent MI3, expecting MR3
Jun 20 18:12:29 eve NetworkManager: 003 "nm-ipsec-l2tpd-9072" #1: received Vendor ID payload [CAN-IKEv2]
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #1: Main mode peer ID is ID_IPV4_ADDR: '83.246.80.153'
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4
Jun 20 18:12:29 eve NetworkManager: 004 "nm-ipsec-l2tpd-9072" #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024}
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #2: initiating Quick Mode PSK+ENCRYPT+UP+IKEv2ALLOW+SAREFTRACK+IKE_FRAG {using isakmp#1 msgid:248266fe proposal=3DES(3)_192-SHA1(2)_160 pfsgroup=no-pfs}
Jun 20 18:12:29 eve NetworkManager: 117 "nm-ipsec-l2tpd-9072" #2: STATE_QUICK_I1: initiate
Jun 20 18:12:29 eve NetworkManager: 002 "nm-ipsec-l2tpd-9072" #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2
Jun 20 18:12:29 eve NetworkManager: 004 "nm-ipsec-l2tpd-9072" #2: STATE_QUICK_I2: sent QI2, IPsec SA established transport mode {ESP/NAT=>0x975e29eb <0x80d7ad5d xfrm=3DES_0-HMAC_SHA1 NATOA=none NATD=83.246.80.153:4500 DPD=none}
Jun 20 18:12:29 eve NetworkManager[943]: <info> VPN connection 'vpn.evolution-hosting.eu' (Connect) reply received.
Jun 20 18:12:29 eve NetworkManager[943]: <warn> VPN connection 'vpn.evolution-hosting.eu' failed to connect: 'Possible error in IPSec setup.'.
Jun 20 18:12:29 eve NetworkManager[943]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
Jun 20 18:12:29 eve NetworkManager: 002 forgetting secrets
Jun 20 18:12:29 eve NetworkManager: 002 loading secrets from "/etc/ipsec.secrets"
Jun 20 18:12:32 eve NetworkManager: nm-pptp-service-8772 warn[open_inetsock:pptp_callmgr.c:352]: connect: Connection timed out
Jun 20 18:12:32 eve NetworkManager: nm-pptp-service-8772 fatal[callmgr_main:pptp_callmgr.c:134]: Could not open control connection to 83.246.80.153
Jun 20 18:12:35 eve NetworkManager[943]: <info> VPN service 'l2tp' disappeared


Server: 

Jun 20 18:11:03 vpn pluto[7117]: | cmd(   0):2>&1 PLUTO_VERB='up-host' PLUTO_VERSION='2.0' PLUTO_CONNECTION='roadwarrior2' PL:
Jun 20 18:11:03 vpn pluto[7117]: | executing prepare-host: 2>&1 PLUTO_VERB='prepare-host' PLUTO_VERSION='2.0' PLUTO_CONNECTION='roadwarrior2' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='83.246.80.129' PLUTO_ME='83.246.80.153' PLUTO_MY_ID='83.246.80.153' PLUTO_MY_CLIENT='83.246.80.153/32' PLUTO_MY_CLIENT_NET='83.246.80.153' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='1701' PLUTO_MY_PROTOCOL='17' PLUTO_SA_REQID='16392' PLUTO_PEER='62.226.149.39' PLUTO_PEER_ID='@GroupVPN' PLUTO_PEER_CLIENT='192.168.0.34/32' PLUTO_PEER_CLIENT_NET='192.168.0.34' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='17' PLUTO_PEER_CA='' PLUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+DONTREKEY+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNAME=''  PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' ipsec _updown
Jun 20 18:11:03 vpn pluto[7117]: | cmd(   0):2>&1 PLUTO_VERB='prepare-host' PLUTO_VERSION='2.0' PLUTO_CONNECTION='roadwarrior:
Jun 20 18:11:03 vpn pluto[7117]: | executing route-host: 2>&1 PLUTO_VERB='route-host' PLUTO_VERSION='2.0' PLUTO_CONNECTION='roadwarrior2' PLUTO_INTERFACE='eth0' PLUTO_NEXT_HOP='83.246.80.129' PLUTO_ME='83.246.80.153' PLUTO_MY_ID='83.246.80.153' PLUTO_MY_CLIENT='83.246.80.153/32' PLUTO_MY_CLIENT_NET='83.246.80.153' PLUTO_MY_CLIENT_MASK='255.255.255.255' PLUTO_MY_PORT='1701' PLUTO_MY_PROTOCOL='17' PLUTO_SA_REQID='16392' PLUTO_PEER='62.226.149.39' PLUTO_PEER_ID='@GroupVPN' PLUTO_PEER_CLIENT='192.168.0.34/32' PLUTO_PEER_CLIENT_NET='192.168.0.34' PLUTO_PEER_CLIENT_MASK='255.255.255.255' PLUTO_PEER_PORT='0' PLUTO_PEER_PROTOCOL='17' PLUTO_PEER_CA='' PLUTO_STACK='netkey'   PLUTO_CONN_POLICY='PSK+ENCRYPT+TUNNEL+DONTREKEY+IKEv2ALLOW+SAREFTRACK+IKE_FRAG' PLUTO_CONN_ADDRFAMILY='ipv4' XAUTH_FAILED=0 PLUTO_XAUTH_USERNAME=''  PLUTO_IS_PEER_CISCO='0' PLUTO_PEER_DNS_INFO='' PLUTO_PEER_DOMAIN_INFO='' PLUTO_PEER_BANNER='' PLUTO_NM_CONFIGURED='0' ipsec _updown
Jun 20 18:11:03 vpn pluto[7117]: | cmd(   0):2>&1 PLUTO_VERB='route-host' PLUTO_VERSION='2.0' PLUTO_CONNECTION='roadwarrior2':
Jun 20 18:11:03 vpn pluto[7117]: | route_and_eroute: instance "roadwarrior2"[10] 62.226.149.39, setting eroute_owner {spd=0xb84b477c,sr=0xb84b477c} to #10 (was #0) (newest_ipsec_sa=#0)
Jun 20 18:11:03 vpn pluto[7117]: | inI2: instance roadwarrior2[10], setting newest_ipsec_sa to #10 (was #0) (spd.eroute=#10)
Jun 20 18:11:03 vpn pluto[7117]: "roadwarrior2"[10] 62.226.149.39 #10: transition from state STATE_QUICK_R1 to state STATE_QUICK_R2
Jun 20 18:11:03 vpn pluto[7117]: "roadwarrior2"[10] 62.226.149.39 #10: STATE_QUICK_R2: IPsec SA established tunnel mode {ESP=>0x80d7ad5d <0x975e29eb xfrm=3DES_0-HMAC_SHA1 NATOA=192.168.0.34 NATD=62.226.149.39:34369 DPD=none}


both ends tell me, that the connection is established, but thats it. And the error messages are NOT HELPFUL. 

BTW: PPTP doesn't work either, where it worked via WinXP !

Comment 69 customercare 2014-07-30 11:01:26 UTC
sometimes i think bugreports get just addandoned by the maintainer :(

Comment 70 Sergey 2014-07-30 12:35:02 UTC
(In reply to customercare from comment #69)
> sometimes i think bugreports get just addandoned by the maintainer :(

Ok, you may try to send us more verbose log, as described in https://github.com/seriyps/NetworkManager-l2tp/wiki#how-to-report-bugs

And ipsec feature is quite unstable, no one of maintainers didn't uses it.

About not helpful error messages in GUI: that's true, but NM VPN plugin API doesn't provide any method to display custom error message.

Comment 71 customercare 2014-07-30 12:57:47 UTC
About the error messages: /var/log/messages is a good place for detailed error messages them.


Infos: 

Fedora release 20 (Heisenbug)
Linux eve.resellerdesktop.de 3.15.6-200.fc20.x86_64 #1 SMP Fri Jul 18 02:36:27 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux

rpm -q NetworkManager-l2tp xl2tpd ppp NetworkManager-openswan libreswan

NetworkManager-l2tp-0.9.8.6-1.fc20.x86_64
xl2tpd-1.3.6-1.fc20.x86_64
ppp-2.4.5-33.fc20.x86_64
Das Paket NetworkManager-openswan ist nicht installiert
libreswan-3.8-1.fc20.x86_64

Debuginfos: 

Jul 30 14:49:07 eve systemd: Started Hostname Service.
Jul 30 14:50:30 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:09 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:09 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:10 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:10 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:10 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:10 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:10 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:10 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:10 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:11 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:11 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:11 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:11 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:11 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:11 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:37 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:51:41 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:52:38 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:52:45 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:52:45 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:52:48 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:52:51 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:52:53 eve gnome-session: ** (gnome-control-center:32531): CRITICAL **: nm_setting_vpn_add_data_item: assertion 'strlen (item) > 0' failed
Jul 30 14:53:03 eve NetworkManager[3228]: <info> VPN plugin state changed: starting (3)
Jul 30 14:53:04 eve ipsec_starter[2022]: Warning: ignored obsolete keyword 'force_keepalive'
Jul 30 14:53:04 eve ipsec_starter[2022]: connect(pluto_ctl) failed: No such file or directory
Jul 30 14:53:04 eve NetworkManager[3228]: <info> VPN connection 'VPN 1' (Connect) reply received.
Jul 30 14:53:04 eve NetworkManager[3228]: <warn> VPN connection 'VPN 1' failed to connect: 'Possible error in IPSec setup.'.
Jul 30 14:53:04 eve NetworkManager[3228]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
Jul 30 14:53:24 eve NetworkManager[3228]: <info> VPN service 'l2tp' disappeared

#######################################################################################################################################################

** Message: nm-l2tp-service (version 0.9.8.5) starting...
connection
	name : "connection"
	id : "VPN 1" (s)
	uuid : "aaf7280f-a031-4443-a84f-f5a7a3b0b805" (s)
	interface-name : NULL (sd)
	type : "vpn" (s)
	permissions : user:{USERNAME}: (s)
	autoconnect : FALSE (s)
	timestamp : 0 (sd)
	read-only : FALSE (sd)
	zone : NULL (sd)
	master : NULL (sd)
	slave-type : NULL (sd)
	secondaries :  (sd)
	gateway-ping-timeout : 0 (sd)


vpn
	name : "vpn"
	service-type : "org.freedesktop.NetworkManager.l2tp" (s)
	user-name : "{USERNAME}" (s)
	data : gateway=vpn.evolution-hosting.eu,ipsec-group-name=GroupVPN,user={USERNAME},ipsec-enabled=yes,ipsec-psk={L2TP-USERPASSWORD},password-flags=1,refuse-pap=yes (s)
	secrets : password={IPSEC-TUNNELPASSWORD} (s)


ipv6
	name : "ipv6"
	method : "ignore" (s)
	dhcp-hostname : NULL (sd)
	dns :  (s)
	dns-search :  (sd)
	addresses :  (s)
	routes :  (s)
	ignore-auto-routes : FALSE (sd)
	ignore-auto-dns : FALSE (sd)
	never-default : FALSE (sd)
	may-fail : TRUE (sd)
	ip6-privacy : -1 (sd)


ipv4
	name : "ipv4"
	method : "auto" (s)
	dns :  (s)
	dns-search :  (sd)
	addresses :  (s)
	routes :  (s)
	ignore-auto-routes : FALSE (sd)
	ignore-auto-dns : TRUE (s)
	dhcp-client-id : NULL (sd)
	dhcp-send-hostname : TRUE (sd)
	dhcp-hostname : NULL (sd)
	never-default : FALSE (sd)
	may-fail : TRUE (sd)


** Message: Use '83.246.80.153' as a gateway
** Message: Check port 1701
** Message: ipsec enable flag: yes
** Message: starting ipsec
systemd: ipsec service is not running
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Warning: ignored obsolete keyword 'force_keepalive'
connect(pluto_ctl) failed: No such file or directory
opening file: /var/run/nm-ipsec-l2tp.32058/ipsec.conf
debugging mode enabled
end of file /var/run/nm-ipsec-l2tp.32058/ipsec.conf
Warning: ignored obsolete keyword 'force_keepalive'
Loading conn nm-ipsec-l2tpd-32058
connection's  policy label: (null)
starter: case KH_DEFAULTROUTE: empty
loading named conns: nm-ipsec-l2tpd-32058
parse_src = 1, parse_gateway = 0, has_dst = 1
dst 83.246.80.153 via 192.168.0.254 dev p4p1 src 192.168.0.34
set addr: 192.168.0.34
conn: "nm-ipsec-l2tpd-32058" loopback=0
conn: "nm-ipsec-l2tpd-32058" labeled_ipsec=0
conn: "nm-ipsec-l2tpd-32058" policy_label=(null)
conn: "nm-ipsec-l2tpd-32058" modecfgdomain=(null)
conn: "nm-ipsec-l2tpd-32058" modecfgbanner=(null)
connect(pluto_ctl) failed: No such file or directory
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")

Comment 72 customercare 2014-07-30 12:59:01 UTC
# cat /var/run/nm-ipsec-l2tp.32058/ipsec.conf
version 2.0
config setup
  nat_traversal=yes
  force_keepalive=yes
  protostack=netkey
  keep_alive=60

conn nm-ipsec-l2tpd-32058
  auto=add
  type=transport
  auth=esp
  pfs=no
  authby=secret
  keyingtries=0
  left=%defaultroute
  leftid=@GroupVPN
  right=83.246.80.153
  esp=3des-sha1
  keyexchange=ike
  ike=3des-sha1-modp1024
  aggrmode=no
  forceencaps=yes

Comment 73 customercare 2014-07-30 13:06:56 UTC
Just found this typo in the GNOME-GUI-Translation

[checkbox] use Point-to-Point Encryption (MPPE) 

in german, someone wrote "anjreuzfeld" he meant "Ankreuzfeld" (checkbox) in the hover tool tip message :)

Pls forward it to the translation team.

Comment 74 customercare 2014-07-30 13:13:11 UTC
Something changed :

** Message: Use '83.246.80.153' as a gateway
** Message: Check port 1701
** Message: ipsec enable flag: yes
** Message: starting ipsec
Redirecting to: systemctl stop+start ipsec.service
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
002 forgetting secrets
002 loading secrets from "/etc/ipsec.secrets"
Warning: ignored obsolete keyword 'force_keepalive'
opening file: /var/run/nm-ipsec-l2tp.10448/ipsec.conf
debugging mode enabled
end of file /var/run/nm-ipsec-l2tp.10448/ipsec.conf
Warning: ignored obsolete keyword 'force_keepalive'
Loading conn nm-ipsec-l2tpd-10448
connection's  policy label: (null)
starter: case KH_DEFAULTROUTE: empty
loading named conns: nm-ipsec-l2tpd-10448
parse_src = 1, parse_gateway = 0, has_dst = 1
dst 83.246.80.153 via 192.168.0.254 dev p4p1 src 192.168.0.34
set addr: 192.168.0.34
conn: "nm-ipsec-l2tpd-10448" loopback=0
conn: "nm-ipsec-l2tpd-10448" labeled_ipsec=0
conn: "nm-ipsec-l2tpd-10448" policy_label=(null)
conn: "nm-ipsec-l2tpd-10448" modecfgdomain=(null)
conn: "nm-ipsec-l2tpd-10448" modecfgbanner=(null)
002 "nm-ipsec-l2tpd-10448": deleting connection
002 added connection description "nm-ipsec-l2tpd-10448"
002 "nm-ipsec-l2tpd-10448" #1: initiating Main Mode
104 "nm-ipsec-l2tpd-10448" #1: STATE_MAIN_I1: initiate
003 "nm-ipsec-l2tpd-10448" #1: received Vendor ID payload [Dead Peer Detection]
003 "nm-ipsec-l2tpd-10448" #1: received Vendor ID payload [FRAGMENTATION]
003 "nm-ipsec-l2tpd-10448" #1: received Vendor ID payload [RFC 3947]
002 "nm-ipsec-l2tpd-10448" #1: enabling possible NAT-traversal with method RFC 3947 (NAT-Traversal)
002 "nm-ipsec-l2tpd-10448" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2
106 "nm-ipsec-l2tpd-10448" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "nm-ipsec-l2tpd-10448" #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed
002 "nm-ipsec-l2tpd-10448" #1: Not sending INITIAL_CONTACT
002 "nm-ipsec-l2tpd-10448" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3
108 "nm-ipsec-l2tpd-10448" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "nm-ipsec-l2tpd-10448" #1: received 1 malformed payload notifies
010 "nm-ipsec-l2tpd-10448" #1: STATE_MAIN_I3: retransmission; will wait 20s for response
002 "nm-ipsec-l2tpd-10448" #1: received 2 malformed payload notifies
003 "nm-ipsec-l2tpd-10448" #1: discarding duplicate packet; already STATE_MAIN_I3
010 "nm-ipsec-l2tpd-10448" #1: STATE_MAIN_I3: retransmission; will wait 40s for response
002 "nm-ipsec-l2tpd-10448" #1: received 3 malformed payload notifies
003 "nm-ipsec-l2tpd-10448" #1: discarding duplicate packet; already STATE_MAIN_I3

######################################################################

Jul 30 15:08:58 eve NetworkManager[3228]: <info> Starting VPN service 'l2tp'...
Jul 30 15:08:58 eve NetworkManager[3228]: <info> VPN service 'l2tp' started (org.freedesktop.NetworkManager.l2tp), PID 9929
Jul 30 15:08:58 eve NetworkManager[3228]: <info> VPN service 'l2tp' appeared; activating connections
Jul 30 15:09:02 eve NetworkManager[3228]: <info> VPN plugin state changed: starting (3)
Jul 30 15:09:02 eve NetworkManager: ** Message: Use '83.246.80.153' as a gateway
Jul 30 15:09:02 eve NetworkManager: ** Message: Check port 1701
Jul 30 15:09:02 eve NetworkManager: ** Message: ipsec enable flag: yes
Jul 30 15:09:02 eve NetworkManager: ** Message: starting ipsec
Jul 30 15:09:02 eve NetworkManager: Redirecting to: systemctl stop+start ipsec.service
Jul 30 15:09:02 eve systemd: Stopping Internet Key Exchange (IKE) Protocol Daemon for IPsec...
Jul 30 15:09:02 eve whack: 002 shutting down
Jul 30 15:09:02 eve systemd: Stopped Internet Key Exchange (IKE) Protocol Daemon for IPsec.
Jul 30 15:09:02 eve systemd: Starting Internet Key Exchange (IKE) Protocol Daemon for IPsec...
Jul 30 15:09:02 eve kernel: [22278.291365] AVX2 instructions are not detected.
Jul 30 15:09:02 eve kernel: AVX2 instructions are not detected.
Jul 30 15:09:02 eve kernel: [22278.324270] AVX2 or AES-NI instructions are not detected.
Jul 30 15:09:02 eve kernel: AVX2 or AES-NI instructions are not detected.
Jul 30 15:09:02 eve systemd: Started Internet Key Exchange (IKE) Protocol Daemon for IPsec.
Jul 30 15:09:02 eve NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Jul 30 15:09:02 eve NetworkManager: 002 forgetting secrets
Jul 30 15:09:02 eve NetworkManager: 002 loading secrets from "/etc/ipsec.secrets"
Jul 30 15:09:02 eve NetworkManager: can not load config '/var/run/nm-ipsec-l2tp.9929/ipsec.conf': can't load file '/var/run/nm-ipsec-l2tp.9929/ipsec.conf'
Jul 30 15:09:02 eve NetworkManager: debugging mode enabled
Jul 30 15:09:02 eve NetworkManager: can not load config '/var/run/nm-ipsec-l2tp.9929/ipsec.conf': can't load file '/var/run/nm-ipsec-l2tp.9929/ipsec.conf'
Jul 30 15:09:02 eve NetworkManager: opening file: /var/run/nm-ipsec-l2tp.9929/ipsec.conf
Jul 30 15:09:03 eve NetworkManager: 000 initiating all conns with alias='nm-ipsec-l2tpd-9929'
Jul 30 15:09:03 eve NetworkManager: 021 no connection named "nm-ipsec-l2tpd-9929"
Jul 30 15:09:03 eve NetworkManager: 002 forgetting secrets
Jul 30 15:09:03 eve NetworkManager: 002 loading secrets from "/etc/ipsec.secrets"
Jul 30 15:09:03 eve NetworkManager: 002 no secrets filename matched "/etc/ipsec.d/*.secrets"
Jul 30 15:09:03 eve NetworkManager[3228]: <info> VPN connection 'VPN 1' (Connect) reply received.
Jul 30 15:09:03 eve NetworkManager[3228]: <warn> VPN connection 'VPN 1' failed to connect: 'Possible error in IPSec setup.'.
Jul 30 15:09:03 eve NetworkManager[3228]: <warn> error disconnecting VPN: Could not process the request because no VPN connection was active.
Jul 30 15:09:08 eve NetworkManager[3228]: <info> VPN service 'l2tp' disappeared

BTW: 

        ├─sh───sh───pluto─┬─_pluto_adns
        │                 └─7*[{pluto}]

so , pluto is actually running.

Comment 75 customercare 2014-07-30 17:24:06 UTC
I configured the ipsec tunnel myself manually. 

Here is a hint how it works :

1. I had to reset send_redirects , accept_redirects accordingly to "ipsec verify" , which isn't done automatically (?)..

and interestingly, a network restart disabled those, but it still works. I guess you can skip this part :

# ipsec verify
Verifying installed system and configuration files

Version check and ipsec on-path                   	[OK]
Libreswan 3.8 (netkey) on 3.15.6-200.fc20.x86_64
Checking for IPsec support in kernel              	[OK]
 NETKEY: Testing XFRM related proc values
         ICMP default/send_redirects              	[OK]
         ICMP default/accept_redirects            	[OK]
         XFRM larval drop                         	[OK]
Pluto ipsec.conf syntax                           	[OK]
Hardware random device                            	[N/A]
Two or more interfaces found, checking IP forwarding	[FAILED]  *RED* 
Checking rp_filter                                	[ENABLED] *RED*
 /proc/sys/net/ipv4/conf/default/rp_filter        	[ENABLED] *RED*
 /proc/sys/net/ipv4/conf/ppp0/rp_filter           	[ENABLED] *RED* 
  rp_filter is not fully aware of IPsec and should be disabled
Checking that pluto is running                    	[OK]
 Pluto listening for IKE on udp 500               	[OK]
 Pluto listening for IKE/NAT-T on udp 4500        	[OK]
 Pluto ipsec.secret syntax                        	[OK]
Checking NAT and MASQUERADEing                    	[TEST INCOMPLETE]
Checking 'ip' command                             	[OK]
Checking 'iptables' command                       	[OK]
Checking 'prelink' command does not interfere with FIPS	[PRESENT]
Checking for obsolete ipsec.conf options          	[OK]
Opportunistic Encryption                          	[DISABLED]

ipsec verify: encountered 7 errors - see 'man ipsec_verify' for help


2. The Ips involved here:

83.246.80.153  VPN Server
192.168.0.254  local gateway
192.168.0.34   local ip       interface p4p1

3. Configs :

# /etc/ipsec.d/vpn.conf 

config setup
       virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
       nat_traversal=yes
       protostack=netkey
       oe=no
# Replace eth0 with your network interface
       plutoopts="--interface=p4p1"
conn L2TP-PSK
       authby=secret
       pfs=yes
       auto=add
       keyingtries=3
       dpddelay=30
       dpdtimeout=120
       dpdaction=clear
       rekey=yes
       ikelifetime=8h
       keylife=1h
       type=transport
# Replace IP address with your local IP (private, behind NAT IP is okay as well)
       left=192.168.0.34
       leftnexthop=%defaultroute
       leftprotoport=17/1701
# Replace IP address with your VPN server's IP
       right=83.246.80.153
       rightprotoport=17/1701

# /etc/ipsec.d/vpn.secrets 
%any 83.246.80.153 : PSK "<-----ENTER IPSEC PASSWORD HERE---->"

[root@eve marius]# cat /etc/xl2tpd/xl2tpd.conf 
;
; This is a minimal sample xl2tpd configuration file for use
; with L2TP over IPsec.

; .... skipping .... 

[global]

[lac vpn-connection]
lns = 83.246.80.153
ppp debug = yes
pppoptfile = /etc/ppp/options.l2tpd.client
length bit = yes


# /etc/ppp/options.l2tpd.client 
ipcp-accept-local
ipcp-accept-remote
refuse-eap
require-mschap-v2
noccp
noauth
idle 1800
mtu 1410
mru 1410
defaultroute
usepeerdns
debug
lock
connect-delay 5000
name <--- VPN USERNAME --->
password <---- VPN PASSWORD --->

# systemctl start ipsec xl2tpd
# ipsec auto --up L2TP-PSK
# echo "c vpn-connection" > /var/run/xl2tpd/l2tp-control

### Comment: there must be a better way to trigger the connection !!!

# ifconfig should show now a ppp0 

4. Routing :

ip route add 83.246.80.153 via 192.168.0.254 dev p4p1
ip route add default via 192.168.1.99 dev ppp0
ip route del default via 192.168.0.254 dev p4p1

5. Result

# route -n
Kernel IP Routentabelle
Ziel            Router          Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.99    0.0.0.0         UG    0      0        0 ppp0
83.246.80.153   192.168.0.254   255.255.255.255 UGH   0      0        0 p4p1
192.168.0.0     0.0.0.0         255.255.0.0     U     0      0        0 p4p1
192.168.1.99    0.0.0.0         255.255.255.255 UH    0      0        0 ppp0

# ifconfig

p4p1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.34  netmask 255.255.0.0  broadcast 192.168.255.255
        inet6 fe80::4216:7eff:fe24:a01  prefixlen 64  scopeid 0x20<link>
        ether 40:16:7e:24:0a:01  txqueuelen 1000  (Ethernet)
        RX packets 1297423  bytes 1303980487 (1.2 GiB)
        RX errors 0  dropped 17017  overruns 0  frame 0
        TX packets 912236  bytes 96503102 (92.0 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1410
        inet 83.246.x.x  netmask 255.255.255.255  destination 192.168.1.99
        ppp  txqueuelen 3  (Punkt-zu-Punkt Verbindung)
        RX packets 2359  bytes 2225340 (2.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2012  bytes 226762 (221.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I have no clue where "83.246.x.x" came from, as it's not involved at all.

###############################################################

@Ivan + Sergey:

If this does not help you finding the bug, i can't help you ;)

I should be very easy now to compare the generated configs and see whats different. So theres no excuse for another longterm silence in this bugreport. 

If you don't have time, send me the sources for x86_64, a few hints about the compile environment it needs and I debug it myself. 

Some questions I have:

- why is the config dynamically generated in /var/run/ instead of /etc/ipsec.d/ (or the according xl2tpd/pppd dirs ) ?

The NetworkManager is asking about a connection name, just use this as a filenamebasis to generate files as you need them. It will reduce complexity and makes less resource intensive starts possible , as the NM is no longer involved.

- how you wanne manage that only this users session can use a tunnel ?

Do i guess correctly, that netfilter will get a rule for the tunnel interface to match for the active uid ?

- Why is there an option "GroupID" in the IPSEC Gui settings ?

I removed it, but it got reinserted. I guess as a default .
I saw it in the created config file, but i didn't catch the purpose of it.

- short analyses of the created NM files:

created ipsec.conf :
  force_keepalive=yes    <-- obsolete
  type=transport         <-- not needed
  auth=esp               <-- what if the server does not support it ?
  pfs=no                 <-- PFS now rules the world, make an option for it to checkbox PFS
  left=%defaultroute     <-- does not work
  leftid=@GroupVPN       <-- how cares ?
  right=83.246.80.153    <-- was correct

### BTW : NM does not remove old sessions from /var/run/ . A bit more housekeeping is advised ###

created nm-xl2tpd.conf :

    name = <VPN USERNAME>     <-- completly unneeded
    autodial = yes            <-- didn't know my ethernetcard is a telephone modem :)

created nm-ppp-options.xl2tpd: 

ipparam nm-l2tp-service-XXXXXXX
nodetach                      <- not used by me
lock                          
usepeerdns
noipdefault                   <- i guess thats somehow usefull if you wanne keep up the default routing tables
nodefaultroute                <- same here
noauth
noccp
name <VPN USERNAME>           
lcp-echo-failure 0            <- does what excatly ?
lcp-echo-interval 0           <- 

Missing : 

ipcp-accept-local
ipcp-accept-remote
refuse-eap                    <- is it msising because it's a security problem ?
require-mschap-v2             <- I know I checked that in the gui !
idle 1800
password <---- VPN PASSWORD --->      

#### The VPN Password is missing, if it's not supplied via a pipe or option to a command, no chance that it will work.

I hope thats enough input ;)

Comment 76 Sergey 2014-07-30 19:10:24 UTC
(In reply to customercare from comment #75)
> I configured the ipsec tunnel myself manually. 
> 
> Here is a hint how it works :
> 
> 1. I had to reset send_redirects , accept_redirects accordingly to "ipsec
> verify" , which isn't done automatically (?)..
> 
> and interestingly, a network restart disabled those, but it still works. I
> guess you can skip this part :
> 
> # ipsec verify
> Verifying installed system and configuration files
> 
> Version check and ipsec on-path                   	[OK]
> Libreswan 3.8 (netkey) on 3.15.6-200.fc20.x86_64
> Checking for IPsec support in kernel              	[OK]
>  NETKEY: Testing XFRM related proc values
>          ICMP default/send_redirects              	[OK]
>          ICMP default/accept_redirects            	[OK]
>          XFRM larval drop                         	[OK]
> Pluto ipsec.conf syntax                           	[OK]
> Hardware random device                            	[N/A]
> Two or more interfaces found, checking IP forwarding	[FAILED]  *RED* 
> Checking rp_filter                                	[ENABLED] *RED*
>  /proc/sys/net/ipv4/conf/default/rp_filter        	[ENABLED] *RED*
>  /proc/sys/net/ipv4/conf/ppp0/rp_filter           	[ENABLED] *RED* 
>   rp_filter is not fully aware of IPsec and should be disabled
> Checking that pluto is running                    	[OK]
>  Pluto listening for IKE on udp 500               	[OK]
>  Pluto listening for IKE/NAT-T on udp 4500        	[OK]
>  Pluto ipsec.secret syntax                        	[OK]
> Checking NAT and MASQUERADEing                    	[TEST INCOMPLETE]
> Checking 'ip' command                             	[OK]
> Checking 'iptables' command                       	[OK]
> Checking 'prelink' command does not interfere with FIPS	[PRESENT]
> Checking for obsolete ipsec.conf options          	[OK]
> Opportunistic Encryption                          	[DISABLED]
> 
> ipsec verify: encountered 7 errors - see 'man ipsec_verify' for help
> 
> 
> 2. The Ips involved here:
> 
> 83.246.80.153  VPN Server
> 192.168.0.254  local gateway
> 192.168.0.34   local ip       interface p4p1
> 
> 3. Configs :
> 
> # /etc/ipsec.d/vpn.conf 
> 
> config setup
>        virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
>        nat_traversal=yes
>        protostack=netkey
>        oe=no
> # Replace eth0 with your network interface
>        plutoopts="--interface=p4p1"
> conn L2TP-PSK
>        authby=secret
>        pfs=yes
>        auto=add
>        keyingtries=3
>        dpddelay=30
>        dpdtimeout=120
>        dpdaction=clear
>        rekey=yes
>        ikelifetime=8h
>        keylife=1h
>        type=transport
> # Replace IP address with your local IP (private, behind NAT IP is okay as
> well)
>        left=192.168.0.34
>        leftnexthop=%defaultroute
>        leftprotoport=17/1701
> # Replace IP address with your VPN server's IP
>        right=83.246.80.153
>        rightprotoport=17/1701
> 
> # /etc/ipsec.d/vpn.secrets 
> %any 83.246.80.153 : PSK "<-----ENTER IPSEC PASSWORD HERE---->"
> 
> [root@eve marius]# cat /etc/xl2tpd/xl2tpd.conf 
> ;
> ; This is a minimal sample xl2tpd configuration file for use
> ; with L2TP over IPsec.
> 
> ; .... skipping .... 
> 
> [global]
> 
> [lac vpn-connection]
> lns = 83.246.80.153
> ppp debug = yes
> pppoptfile = /etc/ppp/options.l2tpd.client
> length bit = yes
> 
> 
> # /etc/ppp/options.l2tpd.client 
> ipcp-accept-local
> ipcp-accept-remote
> refuse-eap
> require-mschap-v2
> noccp
> noauth
> idle 1800
> mtu 1410
> mru 1410
> defaultroute
> usepeerdns
> debug
> lock
> connect-delay 5000
> name <--- VPN USERNAME --->
> password <---- VPN PASSWORD --->
> 
> # systemctl start ipsec xl2tpd
> # ipsec auto --up L2TP-PSK
> # echo "c vpn-connection" > /var/run/xl2tpd/l2tp-control
> 
> ### Comment: there must be a better way to trigger the connection !!!

Plugin launches separate xl2tpd instance with generated config - files.

> # ifconfig should show now a ppp0 
> 
> 4. Routing :
> 
> ip route add 83.246.80.153 via 192.168.0.254 dev p4p1
> ip route add default via 192.168.1.99 dev ppp0
> ip route del default via 192.168.0.254 dev p4p1
> 
> 5. Result
> 
> # route -n
> Kernel IP Routentabelle
> Ziel            Router          Genmask         Flags Metric Ref    Use Iface
> 0.0.0.0         192.168.1.99    0.0.0.0         UG    0      0        0 ppp0
> 83.246.80.153   192.168.0.254   255.255.255.255 UGH   0      0        0 p4p1
> 192.168.0.0     0.0.0.0         255.255.0.0     U     0      0        0 p4p1
> 192.168.1.99    0.0.0.0         255.255.255.255 UH    0      0        0 ppp0
> 
> # ifconfig
> 
> p4p1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
>         inet 192.168.0.34  netmask 255.255.0.0  broadcast 192.168.255.255
>         inet6 fe80::4216:7eff:fe24:a01  prefixlen 64  scopeid 0x20<link>
>         ether 40:16:7e:24:0a:01  txqueuelen 1000  (Ethernet)
>         RX packets 1297423  bytes 1303980487 (1.2 GiB)
>         RX errors 0  dropped 17017  overruns 0  frame 0
>         TX packets 912236  bytes 96503102 (92.0 MiB)
>         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
> 
> ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1410
>         inet 83.246.x.x  netmask 255.255.255.255  destination 192.168.1.99
>         ppp  txqueuelen 3  (Punkt-zu-Punkt Verbindung)
>         RX packets 2359  bytes 2225340 (2.1 MiB)
>         RX errors 0  dropped 0  overruns 0  frame 0
>         TX packets 2012  bytes 226762 (221.4 KiB)
>         TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
> 
> I have no clue where "83.246.x.x" came from, as it's not involved at all.
> 
> ###############################################################
> 
> @Ivan + Sergey:
> 
> If this does not help you finding the bug, i can't help you ;)
> 
> I should be very easy now to compare the generated configs and see whats
> different. So theres no excuse for another longterm silence in this
> bugreport. 
> 
> If you don't have time, send me the sources for x86_64, a few hints about
> the compile environment it needs and I debug it myself. 

To be honest, yes, I have no time, especialy for ipsec-related stuff, which I don't use personally and which was added by some other peoples long time ago...
If you may help somehow, sources are there https://github.com/seriyps/NetworkManager-l2tp

> Some questions I have:
> 
> - why is the config dynamically generated in /var/run/ instead of
> /etc/ipsec.d/ (or the according xl2tpd/pppd dirs ) ?
> 
> The NetworkManager is asking about a connection name, just use this as a
> filenamebasis to generate files as you need them. It will reduce complexity
> and makes less resource intensive starts possible , as the NM is no longer
> involved.
> 

Ideally (and this is confirmed by NM authors) VPN plugins shouldn't create anything on filesystem (and this is one of the reasons, why this plugin isn't oficial one).
This problem discussed, for example there: https://bugzilla.gnome.org/show_bug.cgi?id=554046#c32

> - how you wanne manage that only this users session can use a tunnel ?
> 
> Do i guess correctly, that netfilter will get a rule for the tunnel
> interface to match for the active uid ?
> 

Not sure, if I understand correctly, but, AFAIK, VPN connection, when established, available for all users. I mean, all routing apply to whole machine, but only one user can start and stop it (while there is still an option 'All users may connect to this network' at 'General' tab).

> - Why is there an option "GroupID" in the IPSEC Gui settings ?
> 
> I removed it, but it got reinserted. I guess as a default .
> I saw it in the created config file, but i didn't catch the purpose of it.

I don't know =)
It was inherited from previous author https://github.com/geocar/NetworkManager-l2tp/commit/f655c2fcd78495f7686bf9cbfff905a01e4f7f2d

> - short analyses of the created NM files:
> 
> created ipsec.conf :
>   force_keepalive=yes    <-- obsolete
>   type=transport         <-- not needed
>   auth=esp               <-- what if the server does not support it ?
>   pfs=no                 <-- PFS now rules the world, make an option for it
> to checkbox PFS
>   left=%defaultroute     <-- does not work
>   leftid=@GroupVPN       <-- how cares ?
>   right=83.246.80.153    <-- was correct
> 
> ### BTW : NM does not remove old sessions from /var/run/ . A bit more
> housekeeping is advised ###
> 

yeah, for some reason they are not removed. Sure, should be fixed.

> created nm-xl2tpd.conf :
> 
>     name = <VPN USERNAME>     <-- completly unneeded
>     autodial = yes            <-- didn't know my ethernetcard is a telephone
> modem :)
> 
> created nm-ppp-options.xl2tpd: 
> 
> ipparam nm-l2tp-service-XXXXXXX
> nodetach                      <- not used by me

nodetach is useful, in a way, that xl2tpd can kill pppd when exiting.

> lock                          
> usepeerdns
> noipdefault                   <- i guess thats somehow usefull if you wanne
> keep up the default routing tables
> nodefaultroute                <- same here
> noauth
> noccp
> name <VPN USERNAME>           
> lcp-echo-failure 0            <- does what excatly ?
> lcp-echo-interval 0           <- 

Last two options are controlled by checkbox 'Send PPP echo packets' in 'PPP settings' dialog.

> Missing : 
> 
> ipcp-accept-local
> ipcp-accept-remote
> refuse-eap                    <- is it msising because it's a security
> problem ?
> require-mschap-v2             <- I know I checked that in the gui !

auth methods options are controlled via GUI.

> idle 1800
> password <---- VPN PASSWORD --->      
> 
> #### The VPN Password is missing, if it's not supplied via a pipe or option
> to a command, no chance that it will work.
> 

Password supplied by pppd plugin via DBus, see https://github.com/seriyps/NetworkManager-l2tp/blob/master/src/nm-l2tp-pppd-plugin.c

> I hope thats enough input ;)


About all that default config options: I have an idea, that configs shouldn't be hardcoded in C code, but should be separate 'template' files with placeholders like

```
[global]

[lac vpn-connection]
lns = {{ lns }}
ppp debug = yes
```

So, user may add options they need without recompiling plugin.

And, as a resume: yes, I know about a lot of problems with ipsec and that configuration UI is very primitive and limited. But implementation was inherited from previous author, plus I don't use ipsec personally and have no IPSec-enabled VPN servers for tests, so I really don't like to touch anything ipsec - related in this plugin. Anyway, patches are always welcome!

Comment 77 Fabien Archambault 2014-12-22 08:25:46 UTC
Still not solved with 0.9.8.7-1.fc20

Comment 78 Carl Byington 2014-12-22 16:19:15 UTC
On Fedora20, NetworkManager-l2tp-0.9.8-4.fc20.x86_64.rpm works properly, but 0.9.8.7-1.fc20 fails.

On Fedora21, the only available version, NetworkManager-l2tp-0.9.8.7-3.fc21.x86_64 fails.

Comment 79 Carl Byington 2014-12-22 20:05:10 UTC
Created attachment 972147 [details]
modified spec file

Comment 80 Carl Byington 2014-12-22 20:07:01 UTC
The modified spec file above fixes this by reverting to a previously working upstream version. Source rpm is available at www.five-ten-sg.com/util/NetworkManager-l2tp-0.9.8.7-4.fc22.src.rpm

Comment 81 Ivan Romanov 2014-12-23 18:07:44 UTC
Such .spec is not correct. Should be used patches for the latest upstream version. If only way to fix it is use old version then need to use Epoch tag.

Comment 82 Carl Byington 2014-12-23 18:19:47 UTC
Ivan - I fully agree. It is a terrible quick and dirty patch to (re)enable l2tp connections here. I did not have time to produce patches for the latest (apparently broken) upstream. I left the version that way (no epoch) in the hope that some future proper fix will just update my systems cleanly.

Comment 83 Ioan 2015-01-01 08:56:18 UTC
Happy New Year to all of you! 

Hopefully NetworkManager-l2tp in Fedora will be fixed this year once for all!

I'd be an even happier user of Fedora 20 if this would work.

Comment 84 Ioan 2015-01-01 08:59:58 UTC
(In reply to Carl Byington from comment #78)
> On Fedora20, NetworkManager-l2tp-0.9.8-4.fc20.x86_64.rpm works properly, but
> 0.9.8.7-1.fc20 fails.
> 
> On Fedora21, the only available version,
> NetworkManager-l2tp-0.9.8.7-3.fc21.x86_64 fails.

For me, with NetworkManager-l2tp-0.9.8-4, indeed, the connection starts at least, but it fails after a while. I'm trying to connect to a L2tp server on CheckPoint 600 appliance.

Comment 86 Makoto Mizukami 2015-01-30 17:26:50 UTC
Please use Microsoft Windows instead, as I do now.
(Thus I am removing myself from the Cc. list.)

Comment 87 Carl Byington 2015-01-30 17:33:21 UTC
(In reply to redacted from comment #85)
> I have the same problem with Fedora 21 when connecting to our company VPN.
> Is there any easy way to test this fix on Fedora 21?

You should be able to rebuild it and install the resulting binary rpm.

wget http://www.five-ten-sg.com/util/NetworkManager-l2tp-0.9.8.7-4.fc22.src.rpm
rpmbuild --rebuild NetworkManager-l2tp-0.9.8.7-4.fc22.src.rpm
yum install ~/rpmbuild/RPMS/x86_64/NetworkManager-l2tp-0.9.8.7-4.fc21.x86_64.rpm

Comment 88 Redacted 001 2015-02-01 12:30:22 UTC
Thanks. This worked well. I noticed that fixed version is older than the one which is in fedora 21. Is there a plan to get this to latest version in into fedora for 22?

Comment 89 Redacted 001 2015-02-01 21:41:35 UTC
I tested this in a virtual environment and it worked. Now I installed fedora 21 as my primary system and I again have problems.

This is what log shows:

Feb 01 22:36:41 redacted.domain NetworkManager[985]: <info>  Starting VPN service 'l2tp'...
Feb 01 22:36:41 redacted.domain NetworkManager[985]: <info>  VPN service 'l2tp' started (org.freedesktop.NetworkManager.l2tp), PID 24088
Feb 01 22:36:41 redacted.domain NetworkManager[985]: <info>  VPN service 'l2tp' appeared; activating connections
Feb 01 22:36:41 redacted.domain firewall-config.desktop[20273]: (firewall-config:20273): Gtk-CRITICAL **: gtk_list_store_iter_next: assertion 'priv->stamp == iter->stamp' failed
Feb 01 22:36:41 redacted.domain org.gnome.Caribou.Daemon[1872]: ** (caribou:2131): WARNING **: AT-SPI: Error in GetItems, sender=org.freedesktop.DBus, error=The name :1.178 was not provided by any .service files
Feb 01 22:36:41 redacted.domain NetworkManager[985]: <info>  VPN connection 'VPN' (ConnectInteractive) reply received.
Feb 01 22:36:41 redacted.domain NetworkManager[985]: <info>  VPN plugin state changed: starting (3)
Feb 01 22:36:41 redacted.domain NetworkManager[985]: ** Message: Use 'IP_ADDR_REPLACE' as a gateway
Feb 01 22:36:41 redacted.domain NetworkManager[985]: ** Message: Check port 1701
Feb 01 22:36:41 redacted.domain NetworkManager[985]: ** Message: ipsec enable flag: yes
Feb 01 22:36:41 redacted.domain NetworkManager[985]: ** Message: starting ipsec
Feb 01 22:36:41 redacted.domain NetworkManager[985]: systemd: ipsec service is not running
Feb 01 22:36:41 redacted.domain NetworkManager[985]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Feb 01 22:36:41 redacted.domain NetworkManager[985]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Feb 01 22:36:41 redacted.domain NetworkManager[985]: debugging mode enabled
Feb 01 22:36:41 redacted.domain NetworkManager[985]: cannot load config '/var/run/nm-ipsec-l2tp.24088/ipsec.conf': can't load file '/var/run/nm-ipsec-l2tp.24088/ipsec.conf'
Feb 01 22:36:41 redacted.domain NetworkManager[985]: opening file: /var/run/nm-ipsec-l2tp.24088/ipsec.conf
Feb 01 22:36:41 redacted.domain NetworkManager[985]: debugging mode enabled
Feb 01 22:36:41 redacted.domain NetworkManager[985]: cannot load config '/var/run/nm-ipsec-l2tp.24088/ipsec.conf': can't load file '/var/run/nm-ipsec-l2tp.24088/ipsec.conf'
Feb 01 22:36:41 redacted.domain NetworkManager[985]: opening file: /var/run/nm-ipsec-l2tp.24088/ipsec.conf
Feb 01 22:36:41 redacted.domain NetworkManager[985]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Feb 01 22:36:41 redacted.domain NetworkManager[985]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Feb 01 22:36:41 redacted.domain NetworkManager[985]: ** (nm-l2tp-service:24088): WARNING **: Possible error in IPSec setup.
Feb 01 22:36:41 redacted.domain NetworkManager[985]: ** Message: ipsec ready for action
Feb 01 22:36:41 redacted.domain NetworkManager[985]: ** Message: xl2tpd started with pid 24121
Feb 01 22:36:41 redacted.domain NetworkManager[985]: <info>  VPN connection 'VPN' (Connect) reply received.
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Not looking for kernel SAref support.
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Using l2tp kernel support.
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: xl2tpd version xl2tpd-1.3.6 started on redacted.domain PID:24121
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Forked by Scott Balmos and David Stipp, (C) 2001
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Inherited by Jeff McAdams, (C) 2002
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Forked again by Xelerance (www.xelerance.com) (C) 2006
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Listening on IP address 0.0.0.0, port 1701
Feb 01 22:36:41 redacted.domain NetworkManager[985]: xl2tpd[24121]: Connecting to host IP_ADDR_REPLACE, port 1701
Feb 01 22:36:46 redacted.domain NetworkManager[985]: xl2tpd[24121]: Maximum retries exceeded for tunnel 26990.  Closing.
Feb 01 22:36:46 redacted.domain NetworkManager[985]: xl2tpd[24121]: Connection 0 closed to IP_ADDR_REPLACE, port 1701 (Timeout)
Feb 01 22:36:51 redacted.domain NetworkManager[985]: ** (nm-l2tp-service:24088): WARNING **: pppd timeout. Looks like pppd didn't initialize our dbus module
Feb 01 22:36:51 redacted.domain NetworkManager[985]: <warn>  VPN plugin failed: unknown (7)
Feb 01 22:36:51 redacted.domain NetworkManager[985]: xl2tpd[24121]: Unable to deliver closing message for tunnel 26990. Destroying anyway.
Feb 01 22:37:21 redacted.domain NetworkManager[985]: <warn>  VPN connection 'VPN' connect timeout exceeded.
Feb 01 22:37:21 redacted.domain NetworkManager[985]: (nm-l2tp-service:24088): GLib-CRITICAL **: Source ID 8 was not found when attempting to remove it
Feb 01 22:37:21 redacted.domain NetworkManager[985]: ** Message: Terminated l2tp daemon with PID 24121.
Feb 01 22:37:21 redacted.domain NetworkManager[985]: xl2tpd[24121]: death_handler: Fatal signal 15 received
Feb 01 22:37:21 redacted.domain NetworkManager[985]: ** (nm-l2tp-service:24088): WARNING **: xl2tpd exited with error code 1

Comment 90 Redacted 001 2015-02-01 22:00:50 UTC
I have got further by restarting services ipsec and xl2tpd.

But I still have problem connecting:

Feb 01 22:55:10 redacted.domain org.gnome.Caribou.Daemon[1872]: ** (caribou:2131): WARNING **: AT-SPI: Error in GetItems, sender=org.freedesktop.DBus, error=The name :1.246 was not provided by any .service files
Feb 01 22:55:10 redacted.domain NetworkManager[985]: <info>  VPN connection 'VPN' (ConnectInteractive) reply received.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: <info>  VPN plugin state changed: starting (3)
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** Message: Use 'IP_ADDR_REPLACE' as a gateway
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** Message: Check port 1701
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** Message: Can't bind to port 1701
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** (nm-l2tp-service:32118): WARNING **: Port 1701 is busy, use ephemeral.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** Message: ipsec enable flag: yes
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** Message: starting ipsec
Feb 01 22:55:10 redacted.domain NetworkManager[985]: Redirecting to: systemctl stop+start ipsec.service
Feb 01 22:55:10 redacted.domain pluto[32379]: shutting down
Feb 01 22:55:10 redacted.domain pluto[32379]: shutting down interface lo/lo ::1:500
Feb 01 22:55:10 redacted.domain pluto[32379]: shutting down interface lo/lo 127.0.0.1:4500
Feb 01 22:55:10 redacted.domain pluto[32379]: shutting down interface lo/lo 127.0.0.1:500
Feb 01 22:55:10 redacted.domain pluto[32379]: shutting down interface enp6s0/enp6s0 192.168.0.10:4500
Feb 01 22:55:10 redacted.domain pluto[32379]: shutting down interface enp6s0/enp6s0 192.168.0.10:500
Feb 01 22:55:10 redacted.domain whack[32469]: 002 shutting down
Feb 01 22:55:10 redacted.domain kernel: AVX2 instructions are not detected.
Feb 01 22:55:10 redacted.domain kernel: AVX2 or AES-NI instructions are not detected.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Feb 01 22:55:10 redacted.domain pluto[32718]: nss directory plutomain: /etc/ipsec.d
Feb 01 22:55:10 redacted.domain pluto[32718]: NSS Initialized
Feb 01 22:55:10 redacted.domain pluto[32718]: libcap-ng support [enabled]
Feb 01 22:55:10 redacted.domain pluto[32718]: FIPS HMAC integrity verification test passed
Feb 01 22:55:10 redacted.domain pluto[32718]: FIPS: pluto daemon NOT running in FIPS mode
Feb 01 22:55:10 redacted.domain pluto[32718]: Linux audit support [disabled]
Feb 01 22:55:10 redacted.domain pluto[32718]: Starting Pluto (Libreswan Version 3.12 XFRM(netkey) KLIPS NSS DNSSEC FIPS_CHECK LABELED_IPSEC LIBCAP_NG XAUTH_PAM NETWORKMANAGER KLIPS_MAST CURL(non-NSS) LDAP(non-NSS)) pid:32718
Feb 01 22:55:10 redacted.domain pluto[32718]: core dump dir: /var/run/pluto/
Feb 01 22:55:10 redacted.domain pluto[32718]: secrets file: /etc/ipsec.secrets
Feb 01 22:55:10 redacted.domain pluto[32718]: leak-detective disabled
Feb 01 22:55:10 redacted.domain pluto[32718]: SAref support [disabled]: Protocol not available
Feb 01 22:55:10 redacted.domain pluto[32718]: SAbind support [disabled]: Protocol not available
Feb 01 22:55:10 redacted.domain pluto[32718]: NSS crypto [enabled]
Feb 01 22:55:10 redacted.domain pluto[32718]: XAUTH PAM support [enabled]
Feb 01 22:55:10 redacted.domain pluto[32718]: NAT-Traversal support  [enabled]
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating DISABLED-OAKLEY_AES_CTR: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_hash(): Activating DISABLED-OAKLEY_AES_XCBC: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating DISABLED-OAKLEY_CAMELLIA_CBC: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating OAKLEY_CAMELLIA_CTR: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_hash(): Activating OAKLEY_SHA2_384: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: starting up 7 crypto helpers
Feb 01 22:55:10 redacted.domain pluto[32718]: started thread for crypto helper 0 (master fd 7)
Feb 01 22:55:10 redacted.domain pluto[32718]: started thread for crypto helper 1 (master fd 9)
Feb 01 22:55:10 redacted.domain pluto[32718]: started thread for crypto helper 2 (master fd 11)
Feb 01 22:55:10 redacted.domain pluto[32718]: started thread for crypto helper 3 (master fd 14)
Feb 01 22:55:10 redacted.domain pluto[32718]: started thread for crypto helper 4 (master fd 16)
Feb 01 22:55:10 redacted.domain pluto[32718]: started thread for crypto helper 5 (master fd 18)
Feb 01 22:55:10 redacted.domain pluto[32718]: started thread for crypto helper 6 (master fd 20)
Feb 01 22:55:10 redacted.domain pluto[32718]: Using Linux XFRM/NETKEY IPsec interface code on 3.18.3-201.fc21.x86_64
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating aes_ccm_8: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating aes_ccm_12: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating aes_ccm_16: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating aes_gcm_8: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating aes_gcm_12: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: ike_alg_register_enc(): Activating aes_gcm_16: Ok
Feb 01 22:55:10 redacted.domain pluto[32718]: | selinux support is enabled.
Feb 01 22:55:10 redacted.domain pluto[32718]: loading secrets from "/etc/ipsec.secrets"
Feb 01 22:55:10 redacted.domain NetworkManager[985]: 002 loading secrets from "/etc/ipsec.secrets"
Feb 01 22:55:10 redacted.domain NetworkManager[985]: debugging mode enabled
Feb 01 22:55:10 redacted.domain NetworkManager[985]: cannot load config '/var/run/nm-ipsec-l2tp.32118/ipsec.conf': can't load file '/var/run/nm-ipsec-l2tp.32118/ipsec.conf'
Feb 01 22:55:10 redacted.domain NetworkManager[985]: opening file: /var/run/nm-ipsec-l2tp.32118/ipsec.conf
Feb 01 22:55:10 redacted.domain NetworkManager[985]: debugging mode enabled
Feb 01 22:55:10 redacted.domain NetworkManager[985]: cannot load config '/var/run/nm-ipsec-l2tp.32118/ipsec.conf': can't load file '/var/run/nm-ipsec-l2tp.32118/ipsec.conf'
Feb 01 22:55:10 redacted.domain NetworkManager[985]: opening file: /var/run/nm-ipsec-l2tp.32118/ipsec.conf
Feb 01 22:55:10 redacted.domain NetworkManager[985]: 024 need --listen before --initiate
Feb 01 22:55:10 redacted.domain pluto[32718]: forgetting secrets
Feb 01 22:55:10 redacted.domain pluto[32718]: loading secrets from "/etc/ipsec.secrets"
Feb 01 22:55:10 redacted.domain pluto[32718]: no secrets filename matched "/etc/ipsec.d/*.secrets"
Feb 01 22:55:10 redacted.domain NetworkManager[985]: 002 forgetting secrets
Feb 01 22:55:10 redacted.domain NetworkManager[985]: 002 loading secrets from "/etc/ipsec.secrets"
Feb 01 22:55:10 redacted.domain NetworkManager[985]: 002 no secrets filename matched "/etc/ipsec.d/*.secrets"
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** (nm-l2tp-service:32118): WARNING **: Possible error in IPSec setup.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** Message: ipsec ready for action
Feb 01 22:55:10 redacted.domain NetworkManager[985]: ** Message: xl2tpd started with pid 307
Feb 01 22:55:10 redacted.domain NetworkManager[985]: <info>  VPN connection 'VPN' (Connect) reply received.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Not looking for kernel SAref support.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Using l2tp kernel support.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: xl2tpd version xl2tpd-1.3.6 started on redacted.domain PID:307
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Forked by Scott Balmos and David Stipp, (C) 2001
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Inherited by Jeff McAdams, (C) 2002
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Forked again by Xelerance (www.xelerance.com) (C) 2006
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Listening on IP address 0.0.0.0, port 47798
Feb 01 22:55:10 redacted.domain NetworkManager[985]: xl2tpd[307]: Connecting to host IP_ADDR_REPLACE, port 1701
Feb 01 22:55:11 redacted.domain pluto[32718]: listening for IKE messages
Feb 01 22:55:11 redacted.domain pluto[32718]: adding interface enp6s0/enp6s0 192.168.0.10:500
Feb 01 22:55:11 redacted.domain pluto[32718]: adding interface enp6s0/enp6s0 192.168.0.10:4500
Feb 01 22:55:11 redacted.domain pluto[32718]: adding interface lo/lo 127.0.0.1:500
Feb 01 22:55:11 redacted.domain pluto[32718]: adding interface lo/lo 127.0.0.1:4500
Feb 01 22:55:11 redacted.domain pluto[32718]: adding interface lo/lo ::1:500
Feb 01 22:55:11 redacted.domain pluto[32718]: loading secrets from "/etc/ipsec.secrets"
Feb 01 22:55:11 redacted.domain pluto[32718]: no secrets filename matched "/etc/ipsec.d/*.secrets"
Feb 01 22:55:15 redacted.domain NetworkManager[985]: xl2tpd[307]: Maximum retries exceeded for tunnel 57009.  Closing.
Feb 01 22:55:15 redacted.domain NetworkManager[985]: xl2tpd[307]: Connection 0 closed to IP_ADDR_REPLACE, port 1701 (Timeout)
Feb 01 22:55:20 redacted.domain NetworkManager[985]: ** (nm-l2tp-service:32118): WARNING **: pppd timeout. Looks like pppd didn't initialize our dbus module
Feb 01 22:55:20 redacted.domain NetworkManager[985]: <warn>  VPN plugin failed: unknown (7)
Feb 01 22:55:20 redacted.domain NetworkManager[985]: xl2tpd[307]: Unable to deliver closing message for tunnel 57009. Destroying anyway.
Feb 01 22:55:50 redacted.domain NetworkManager[985]: <warn>  VPN connection 'VPN' connect timeout exceeded.
Feb 01 22:55:50 redacted.domain NetworkManager[985]: (nm-l2tp-service:32118): GLib-CRITICAL **: Source ID 15 was not found when attempting to remove it
Feb 01 22:55:50 redacted.domain NetworkManager[985]: ** Message: Terminated l2tp daemon with PID 307.
Feb 01 22:55:50 redacted.domain NetworkManager[985]: xl2tpd[307]: death_handler: Fatal signal 15 received
Feb 01 22:55:50 redacted.domain NetworkManager[985]: ** (nm-l2tp-service:32118): WARNING **: xl2tpd exited with error code 1
Feb 01 22:56:10 redacted.domain NetworkManager[985]: <info>  VPN service 'l2tp' disappeared

Comment 91 Redacted 001 2015-02-02 17:39:40 UTC
OK, this is strange now. I wanted to test VPN again today and maybe help finding what could be wrong. But today VPN connection works without any issues. I didn't even edit connection. The only thing I did is power up computer.

I will gladly help with logs or anything which will help you getting this stable.

Comment 92 robberphex 2015-03-09 05:04:32 UTC
NetworkManager-l2tp-0.9.8.7-4.fc22.src.rpm(sha1:671cc5a1add7f6b512db2b6f228b7979cf2c3f3b)

It works for me. I just want to know why is v0.9.8.7-4 not in official repo?

Comment 93 Fabien Archambault 2015-03-23 08:55:49 UTC
Hi,

I just upgraded to Fedora 21 and now I cannot get my VPN working while it was working with the old version in F20. Please fix it!

Comment 94 Fabien Archambault 2015-03-23 13:57:50 UTC
Forgot to give the log of the connexion:
Mar 23 14:53:25 evangelion NetworkManager[926]: <info>  Starting VPN service 'l2tp'...
Mar 23 14:53:25 evangelion NetworkManager[926]: <info>  VPN service 'l2tp' started (org.freedesktop.NetworkManager.l2tp), PID 19838
Mar 23 14:53:25 evangelion NetworkManager[926]: <info>  VPN service 'l2tp' appeared; activating connections
Mar 23 14:53:25 evangelion NetworkManager[926]: <info>  VPN connection 'IPsec/L2TP' (ConnectInteractive) reply received.
Mar 23 14:53:25 evangelion NetworkManager[926]: <info>  VPN plugin state changed: starting (3)
Mar 23 14:53:25 evangelion NetworkManager: ** Message: Use 'XX.XX.XX.74' as a gateway
Mar 23 14:53:25 evangelion NetworkManager: ** Message: Check port 1701
Mar 23 14:53:25 evangelion NetworkManager: ** Message: ipsec enable flag: yes
Mar 23 14:53:25 evangelion NetworkManager: ** Message: starting ipsec
Mar 23 14:53:26 evangelion NetworkManager: systemd: ipsec service is not running
Mar 23 14:53:26 evangelion NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Mar 23 14:53:26 evangelion NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Mar 23 14:53:26 evangelion NetworkManager: debugging mode enabled
Mar 23 14:53:26 evangelion NetworkManager: end of file /var/run/nm-ipsec-l2tp.19838/ipsec.conf
Mar 23 14:53:26 evangelion NetworkManager: Warning: ignored obsolete keyword 'nat_traversal'
Mar 23 14:53:26 evangelion NetworkManager: Warning: ignored obsolete keyword 'force_keepalive'
Mar 23 14:53:26 evangelion NetworkManager: Loading conn nm-ipsec-l2tpd-19838
Mar 23 14:53:26 evangelion NetworkManager: starter: case KH_DEFAULTROUTE: empty
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" loopback=0
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" labeled_ipsec=0
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" policy_label=(null)
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" modecfgdomain=(null)
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" modecfgbanner=(null)
Mar 23 14:53:26 evangelion NetworkManager: connect(pluto_ctl) failed: No such file or directory
Mar 23 14:53:26 evangelion NetworkManager: opening file: /var/run/nm-ipsec-l2tp.19838/ipsec.conf
Mar 23 14:53:26 evangelion NetworkManager: loading named conns: nm-ipsec-l2tpd-19838
Mar 23 14:53:26 evangelion NetworkManager: seeking_src = 0, seeking_gateway = 1, has_dst = 1
Mar 23 14:53:26 evangelion NetworkManager: dst  via YY.YY.YY.1 dev em1 src  table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: set nexthop: YY.YY.YY.1
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.0 via  dev em1 src YY.YY.YY.12 table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 127.0.0.1 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 127.255.255.255 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.0 via  dev em1 src YY.YY.YY.12 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.12 via  dev em1 src YY.YY.YY.12 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst ZZ.ZZ.ZZ.255 via  dev em1 src YY.YY.YY.12 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.1 via  dev virbr0 src 192.168.122.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.255 via  dev virbr0 src 192.168.122.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: seeking_src = 1, seeking_gateway = 0, has_dst = 1
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.1 via  dev em1 src YY.YY.YY.12 table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: set addr: YY.YY.YY.12
Mar 23 14:53:26 evangelion NetworkManager: debugging mode enabled
Mar 23 14:53:26 evangelion NetworkManager: end of file /var/run/nm-ipsec-l2tp.19838/ipsec.conf
Mar 23 14:53:26 evangelion NetworkManager: Warning: ignored obsolete keyword 'nat_traversal'
Mar 23 14:53:26 evangelion NetworkManager: Warning: ignored obsolete keyword 'force_keepalive'
Mar 23 14:53:26 evangelion NetworkManager: Loading conn nm-ipsec-l2tpd-19838
Mar 23 14:53:26 evangelion NetworkManager: starter: case KH_DEFAULTROUTE: empty
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" loopback=0
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" labeled_ipsec=0
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" policy_label=(null)
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" modecfgdomain=(null)
Mar 23 14:53:26 evangelion NetworkManager: conn: "nm-ipsec-l2tpd-19838" modecfgbanner=(null)
Mar 23 14:53:26 evangelion NetworkManager: connect(pluto_ctl) failed: No such file or directory
Mar 23 14:53:26 evangelion NetworkManager: opening file: /var/run/nm-ipsec-l2tp.19838/ipsec.conf
Mar 23 14:53:26 evangelion NetworkManager: loading named conns: nm-ipsec-l2tpd-19838
Mar 23 14:53:26 evangelion NetworkManager: seeking_src = 0, seeking_gateway = 1, has_dst = 1
Mar 23 14:53:26 evangelion NetworkManager: dst  via YY.YY.YY.1 dev em1 src  table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: set nexthop: YY.YY.YY.1
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.0 via  dev em1 src YY.YY.YY.12 table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 127.0.0.1 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 127.255.255.255 via  dev lo src 127.0.0.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.0 via  dev em1 src YY.YY.YY.12 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.12 via  dev em1 src YY.YY.YY.12 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst ZZ.ZZ.ZZ.255 via  dev em1 src YY.YY.YY.12 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.1 via  dev virbr0 src 192.168.122.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: dst 192.168.122.255 via  dev virbr0 src 192.168.122.1 table 255
Mar 23 14:53:26 evangelion NetworkManager: seeking_src = 1, seeking_gateway = 0, has_dst = 1
Mar 23 14:53:26 evangelion NetworkManager: dst YY.YY.YY.1 via  dev em1 src YY.YY.YY.12 table 254 (ignored)
Mar 23 14:53:26 evangelion NetworkManager: set addr: YY.YY.YY.12
Mar 23 14:53:26 evangelion NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Mar 23 14:53:26 evangelion NetworkManager: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Mar 23 14:53:26 evangelion NetworkManager[926]: <info>  VPN connection 'IPsec/L2TP' (Connect) reply received.
Mar 23 14:53:26 evangelion NetworkManager[926]: <warn>  VPN connection 'IPsec/L2TP' failed to connect: 'Possible error in IPSec setup.'.
Mar 23 14:53:26 evangelion NetworkManager[926]: <warn>  error disconnecting VPN: Could not process the request because no VPN connection was active.
Mar 23 14:53:34 evangelion /etc/gdm/Xsession: Window manager warning: Log level 16: STACK_OP_LOWER_BELOW: window 0x3000047 not in stack
Mar 23 14:53:34 evangelion /etc/gdm/Xsession: Window manager warning: Log level 16: STACK_OP_LOWER_BELOW: sibling window 0x3000047 not in stack
Mar 23 14:53:46 evangelion NetworkManager: (nm-l2tp-service:19838): GLib-CRITICAL **: Source ID 7 was not found when attempting to remove it
Mar 23 14:53:46 evangelion NetworkManager[926]: <info>  VPN service 'l2tp' disappeared

Comment 95 Ivan Romanov 2015-03-23 18:05:41 UTC
I asked the developer. So waiting him.

Comment 96 Søni 2015-03-29 14:40:05 UTC
Hi, 

In fedora 21, a simple sleep after ipsec restart solves the problem for me. See https://github.com/zzsoni/NetworkManager-l2tp/commit/2bf12020b38ca5248482009052c1944da9e39c2c

Comment 97 Serge Droz 2015-06-10 09:10:45 UTC
(In reply to Carl Byington from comment #87)
> (In reply to redacted from comment #85)
> > I have the same problem with Fedora 21 when connecting to our company VPN.
> > Is there any easy way to test this fix on Fedora 21?
> 
> You should be able to rebuild it and install the resulting binary rpm.
> 
> wget
> http://www.five-ten-sg.com/util/NetworkManager-l2tp-0.9.8.7-4.fc22.src.rpm
> rpmbuild --rebuild NetworkManager-l2tp-0.9.8.7-4.fc22.src.rpm
> yum install
> ~/rpmbuild/RPMS/x86_64/NetworkManager-l2tp-0.9.8.7-4.fc21.x86_64.rpm

This RPM works for me too on fc21, after having struggled with the official one, and the suggested fix in Comment 96 (which did not work).

Comment 98 Fabien Archambault 2015-06-15 08:49:44 UTC
Tryed the RPM as said in #97 and it works as the default RPM from F21 repos does not work!

Comment 99 j.c 2015-06-15 14:33:51 UTC
one last research from today.

When I try to configure LTP client without Ipsec PSK, it is trying to connect for a longer time. It is doing something...

When I configure Ipsec with PSK - it ends very quickly with "unable to activate network connection".  Seems that it is doing nothing ;). 

Fedora 22, 64bit, workstation.

Comment 100 Jan Kurik 2015-07-15 14:54:51 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle.
Changing version to '23'.

(As we did not run this process for some time, it could affect also pre-Fedora 23 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23

Comment 101 Redacted 001 2015-08-24 12:41:07 UTC
This issue is happening again for me. I wasn't using VPN connection for last month or more. Now I wanted to use it and it doesn't work :(

Here is the relevant log for connection:
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: <info>  Starting VPN service 'l2tp'...
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: <info>  VPN service 'l2tp' started (org.freedesktop.NetworkManager.l2tp), PID 10256
Aug 24 14:39:30 redacted.domain gnome-session[1964]: (gnome-shell:1971): Gjs-WARNING **: JS ERROR: TypeError: a._connection is null
Aug 24 14:39:30 redacted.domain gnome-session[1964]: NMVPNSection<.setActiveConnections/<@resource:///org/gnome/shell/ui/status/network.js:1533
Aug 24 14:39:30 redacted.domain gnome-session[1964]: NMVPNSection<.setActiveConnections@resource:///org/gnome/shell/ui/status/network.js:1532
Aug 24 14:39:30 redacted.domain gnome-session[1964]: wrapper@resource:///org/gnome/gjs/modules/lang.js:169
Aug 24 14:39:30 redacted.domain gnome-session[1964]: NMApplet<._syncVPNConnections@resource:///org/gnome/shell/ui/status/network.js:1821
Aug 24 14:39:30 redacted.domain gnome-session[1964]: wrapper@resource:///org/gnome/gjs/modules/lang.js:169
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: <info>  VPN service 'l2tp' appeared; activating connections
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: <info>  VPN connection 'redacted' (ConnectInteractive) reply received.
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: <info>  VPN plugin state changed: starting (3)
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: ** Message: Use '...' as a gateway
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: ** Message: Check port 1701
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: ** Message: ipsec enable flag: yes
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: ** Message: starting ipsec
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: Redirecting to: systemctl stop+start ipsec.service
Aug 24 14:39:30 redacted.domain systemd[1]: Stopping Internet Key Exchange (IKE) Protocol Daemon for IPsec...
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down
Aug 24 14:39:30 redacted.domain pluto[10022]: "nm-ipsec-l2tpd-9412": deleting connection
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down interface lo/lo ::1:500
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down interface lo/lo 127.0.0.1:4500
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down interface lo/lo 127.0.0.1:500
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down interface wlp3s0/wlp3s0 192.168.55.192:4500
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down interface wlp3s0/wlp3s0 192.168.55.192:500
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down interface virbr0/virbr0 192.168.122.1:4500
Aug 24 14:39:30 redacted.domain pluto[10022]: shutting down interface virbr0/virbr0 192.168.122.1:500
Aug 24 14:39:30 redacted.domain whack[10265]: 002 shutting down
Aug 24 14:39:30 redacted.domain systemd[1]: Stopped Internet Key Exchange (IKE) Protocol Daemon for IPsec.
Aug 24 14:39:30 redacted.domain audit[1]: <audit-1131> pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipsec comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 24 14:39:30 redacted.domain systemd[1]: Starting Internet Key Exchange (IKE) Protocol Daemon for IPsec...
Aug 24 14:39:30 redacted.domain kernel: AVX2 instructions are not detected.
Aug 24 14:39:30 redacted.domain kernel: AVX2 or AES-NI instructions are not detected.
Aug 24 14:39:30 redacted.domain systemd[1]: Started Internet Key Exchange (IKE) Protocol Daemon for IPsec.
Aug 24 14:39:30 redacted.domain audit[1]: <audit-1130> pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipsec comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Aug 24 14:39:30 redacted.domain NetworkManager[1292]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Aug 24 14:39:31 redacted.domain pluto[10514]: nss directory plutomain: /etc/ipsec.d
Aug 24 14:39:31 redacted.domain pluto[10514]: NSS Initialized
Aug 24 14:39:31 redacted.domain pluto[10514]: libcap-ng support [enabled]
Aug 24 14:39:31 redacted.domain pluto[10514]: FIPS HMAC integrity verification test passed
Aug 24 14:39:31 redacted.domain pluto[10514]: FIPS: pluto daemon NOT running in FIPS mode
Aug 24 14:39:31 redacted.domain pluto[10514]: Linux audit support [disabled]
Aug 24 14:39:31 redacted.domain pluto[10514]: Starting Pluto (Libreswan Version 3.13 XFRM(netkey) KLIPS NSS DNSSEC FIPS_CHECK LABELED_IPSEC LIBCAP_NG XAUTH_PAM NETWORKMANAGER KLIPS_MAST CURL(non-NSS) LDAP(non-NSS)) pid:10514
Aug 24 14:39:31 redacted.domain pluto[10514]: core dump dir: /var/run/pluto/
Aug 24 14:39:31 redacted.domain pluto[10514]: secrets file: /etc/ipsec.secrets
Aug 24 14:39:31 redacted.domain pluto[10514]: leak-detective disabled
Aug 24 14:39:31 redacted.domain pluto[10514]: SAref support [disabled]: Protocol not available
Aug 24 14:39:31 redacted.domain pluto[10514]: SAbind support [disabled]: Protocol not available
Aug 24 14:39:31 redacted.domain pluto[10514]: NSS crypto [enabled]
Aug 24 14:39:31 redacted.domain pluto[10514]: XAUTH PAM support [enabled]
Aug 24 14:39:31 redacted.domain pluto[10514]:    NAT-Traversal support  [enabled]
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC_SSH: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating OAKLEY_TWOFISH_CBC: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating OAKLEY_SERPENT_CBC: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating DISABLED-OAKLEY_AES_CTR: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_hash(): Activating DISABLED-OAKLEY_AES_XCBC: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating DISABLED-OAKLEY_CAMELLIA_CBC: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating OAKLEY_CAMELLIA_CTR: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_hash(): Activating OAKLEY_SHA2_512: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_hash(): Activating OAKLEY_SHA2_384: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_hash(): Activating OAKLEY_SHA2_256: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: starting up 3 crypto helpers
Aug 24 14:39:31 redacted.domain pluto[10514]: started thread for crypto helper 0 (master fd 6)
Aug 24 14:39:31 redacted.domain pluto[10514]: started thread for crypto helper 1 (master fd 8)
Aug 24 14:39:31 redacted.domain pluto[10514]: started thread for crypto helper 2 (master fd 10)
Aug 24 14:39:31 redacted.domain pluto[10514]: Using Linux XFRM/NETKEY IPsec interface code on 4.1.5-200.fc22.x86_64
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating aes_ccm_8: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating aes_ccm_12: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating aes_ccm_16: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating aes_gcm_8: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating aes_gcm_12: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: ike_alg_register_enc(): Activating aes_gcm_16: Ok
Aug 24 14:39:31 redacted.domain pluto[10514]: | selinux support is enabled.
Aug 24 14:39:31 redacted.domain pluto[10514]: loading secrets from "/etc/ipsec.secrets"
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: 002 loading secrets from "/etc/ipsec.secrets"
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: debugging mode enabled
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: end of file /var/run/nm-ipsec-l2tp.10256/ipsec.conf
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: Warning: ignored obsolete keyword 'nat_traversal'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: Warning: ignored obsolete keyword 'force_keepalive'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: Loading conn nm-ipsec-l2tpd-10256
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: starter: case KH_DEFAULTROUTE: empty
Aug 24 14:39:31 redacted.domain pluto[10514]: added connection description "nm-ipsec-l2tpd-10256"
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" loopback=0
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" labeled_ipsec=0
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" policy_label=(null)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" modecfgdomain=(null)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" modecfgbanner=(null)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: opening file: /var/run/nm-ipsec-l2tp.10256/ipsec.conf
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: loading named conns: nm-ipsec-l2tpd-10256
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: seeking_src = 0, seeking_gateway = 1, has_dst = 1
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst  via 192.168.55.1 dev wlp3s0 src  table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: set nexthop: 192.168.55.1
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 92.37.89.183 via 192.168.55.1 dev wlp3s0 src 192.168.55.192 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.0 via  dev wlp3s0 src 192.168.55.192 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.0.0.1 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.255.255.255 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.0 via  dev wlp3s0 src 192.168.55.192 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.192 via  dev wlp3s0 src 192.168.55.192 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.255 via  dev wlp3s0 src 192.168.55.192 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.1 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.255 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: seeking_src = 1, seeking_gateway = 0, has_dst = 1
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.1 via  dev wlp3s0 src 192.168.55.192 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: set addr: 192.168.55.192
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: debugging mode enabled
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: end of file /var/run/nm-ipsec-l2tp.10256/ipsec.conf
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: Warning: ignored obsolete keyword 'nat_traversal'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: Warning: ignored obsolete keyword 'force_keepalive'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: Loading conn nm-ipsec-l2tpd-10256
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: starter: case KH_DEFAULTROUTE: empty
Aug 24 14:39:31 redacted.domain pluto[10514]: "nm-ipsec-l2tpd-10256": deleting connection
Aug 24 14:39:31 redacted.domain pluto[10514]: added connection description "nm-ipsec-l2tpd-10256"
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" loopback=0
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" labeled_ipsec=0
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" policy_label=(null)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" modecfgdomain=(null)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: conn: "nm-ipsec-l2tpd-10256" modecfgbanner=(null)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: opening file: /var/run/nm-ipsec-l2tp.10256/ipsec.conf
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: loading named conns: nm-ipsec-l2tpd-10256
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: seeking_src = 0, seeking_gateway = 1, has_dst = 1
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst  via 192.168.55.1 dev wlp3s0 src  table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: set nexthop: 192.168.55.1
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 92.37.89.183 via 192.168.55.1 dev wlp3s0 src 192.168.55.192 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.0 via  dev wlp3s0 src 192.168.55.192 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.0.0.1 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 127.255.255.255 via  dev lo src 127.0.0.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.0 via  dev wlp3s0 src 192.168.55.192 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.192 via  dev wlp3s0 src 192.168.55.192 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.255 via  dev wlp3s0 src 192.168.55.192 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.1 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.122.255 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: seeking_src = 1, seeking_gateway = 0, has_dst = 1
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: dst 192.168.55.1 via  dev wlp3s0 src 192.168.55.192 table 254 (ignored)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: set addr: 192.168.55.192
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: 024 need --listen before --initiate
Aug 24 14:39:31 redacted.domain pluto[10514]: forgetting secrets
Aug 24 14:39:31 redacted.domain pluto[10514]: loading secrets from "/etc/ipsec.secrets"
Aug 24 14:39:31 redacted.domain pluto[10514]: no secrets filename matched "/etc/ipsec.d/*.secrets"
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: 002 forgetting secrets
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: 002 loading secrets from "/etc/ipsec.secrets"
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: 002 no secrets filename matched "/etc/ipsec.d/*.secrets"
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** (nm-l2tp-service:10256): WARNING **: Possible error in IPSec setup.
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: ipsec ready for action
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: xl2tpd started with pid 10564
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Not looking for kernel SAref support.
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: <info>  VPN connection 'redacted' (Connect) reply received.
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Using l2tp kernel support.
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: xl2tpd version xl2tpd-1.3.6 started on redacted.domain PID:10564
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Forked by Scott Balmos and David Stipp, (C) 2001
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Inherited by Jeff McAdams, (C) 2002
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Forked again by Xelerance (www.xelerance.com) (C) 2006
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Listening on IP address 0.0.0.0, port 1701
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Connecting to host ..., port 1701
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Connection established to ..., 1701.  Local: 44824, Remote: 159 (ref=0/0).
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Calling on tunnel 44824
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Call established with ..., Local: 56834, Remote: 1, Serial: 1 (ref=0/0)
Aug 24 14:39:31 redacted.domain pppd[10566]: Plugin /usr/lib64/pppd/2.4.7/nm-l2tp-pppd-plugin.so loaded.
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (plugin_init): initializing
Aug 24 14:39:31 redacted.domain pppd[10566]: Plugin pppol2tp.so loaded.
Aug 24 14:39:31 redacted.domain pppd[10566]: pppd 2.4.7 started by root, uid 0
Aug 24 14:39:31 redacted.domain pppd[10566]: Using interface ppp0
Aug 24 14:39:31 redacted.domain pppd[10566]: Connect: ppp0 <-->
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 3 / phase 'serial connection'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 5 / phase 'establish'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 6 / phase 'authenticate'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (get_credentials): passwd-hook, requesting credentials...
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (get_credentials): got credentials from NetworkManager-l2tp
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: <info>  (ppp0): new Generic device (driver: 'unknown' ifindex: 22)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: <info>  (ppp0): exported as /org/freedesktop/NetworkManager/Devices/21
Aug 24 14:39:31 redacted.domain pppd[10566]: CHAP authentication succeeded
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 8 / phase 'network'
Aug 24 14:39:31 redacted.domain pppd[10566]: LCP terminated by peer (Encryption negotiation rejected)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 5 / phase 'establish'
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: result_code_avp: avp is incorrect size.  8 < 10
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: call_close: Call 56834 to ... disconnected
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: result_code_avp: avp is incorrect size.  8 < 10
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
Aug 24 14:39:31 redacted.domain pppd[10566]: Terminating on signal 15
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: xl2tpd[10564]: Connection 159 closed to ..., port 1701 (Result Code: expected at least 10, got 8)
Aug 24 14:39:31 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 10 / phase 'terminate'
Aug 24 14:39:32 redacted.domain pluto[10514]: listening for IKE messages
Aug 24 14:39:32 redacted.domain pluto[10514]: adding interface virbr0/virbr0 192.168.122.1:500
Aug 24 14:39:32 redacted.domain pluto[10514]: adding interface virbr0/virbr0 192.168.122.1:4500
Aug 24 14:39:32 redacted.domain pluto[10514]: adding interface wlp3s0/wlp3s0 192.168.55.192:500
Aug 24 14:39:32 redacted.domain pluto[10514]: adding interface wlp3s0/wlp3s0 192.168.55.192:4500
Aug 24 14:39:32 redacted.domain pluto[10514]: adding interface lo/lo 127.0.0.1:500
Aug 24 14:39:32 redacted.domain pluto[10514]: adding interface lo/lo 127.0.0.1:4500
Aug 24 14:39:32 redacted.domain pluto[10514]: adding interface lo/lo ::1:500
Aug 24 14:39:32 redacted.domain pluto[10514]: loading secrets from "/etc/ipsec.secrets"
Aug 24 14:39:32 redacted.domain pluto[10514]: no secrets filename matched "/etc/ipsec.d/*.secrets"
Aug 24 14:39:34 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 11 / phase 'disconnect'
Aug 24 14:39:34 redacted.domain pppd[10566]: Connection terminated.
Aug 24 14:39:34 redacted.domain NetworkManager[1292]: <warn>  VPN plugin failed: connect-failed (1)
Aug 24 14:39:34 redacted.domain pppd[10566]: Modem hangup
Aug 24 14:39:34 redacted.domain pppd[10566]: Exit.
Aug 24 14:39:34 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 1 / phase 'dead'
Aug 24 14:39:34 redacted.domain NetworkManager[1292]: ** Message: nm-l2tp-ppp-plugin: (nm_exit_notify): cleaning up
Aug 24 14:39:34 redacted.domain gnome-session[2448]: Gjs-Message: JS LOG: Removing a network device that was not added
Aug 24 14:39:34 redacted.domain gnome-session[1964]: Gjs-Message: JS LOG: Removing a network device that was not added
Aug 24 14:39:34 redacted.domain NetworkManager[1292]: <warn>  VPN plugin failed: connect-failed (1)

Comment 102 Redacted 001 2015-08-24 13:14:13 UTC
My company WIFI also stopped working. Maybe these two bugs are connected:

https://bugzilla.redhat.com/show_bug.cgi?id=1241930

Comment 103 Redacted 001 2015-08-24 17:05:40 UTC
I have finally enabled debug information for pppd service and here is what goes wrong.

Aug 24 18:59:55 redacted.domain pppd[11833]: CHAP authentication succeeded
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [IPCP ConfReq id=0x1 <addr 192.168.80.1>]
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [IPCP ConfAck id=0x1 <addr 192.168.80.1>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [proto=0x8281] 01 01 00 04
Aug 24 18:59:55 redacted.domain pppd[11833]: Unsupported protocol 'MPLSCP' (0x8281) received


It looks like it doesn't support the protocol we are using "Unsupported protocol 'MPLSCP' (0x8281) received".
I don't know why this stopped working, but from my perspective it looks like one of the upgrades broke this.

Here is also the whole log if it will help:
Aug 24 18:59:54 redacted.domain NetworkManager[1069]: <info>  Starting VPN service 'l2tp'...
Aug 24 18:59:54 redacted.domain NetworkManager[1069]: <info>  VPN service 'l2tp' started (org.freedesktop.NetworkManager.l2tp), PID 11510
Aug 24 18:59:54 redacted.domain NetworkManager[1069]: <info>  VPN service 'l2tp' appeared; activating connections
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: <info>  VPN connection '...' (ConnectInteractive) reply received.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: <info>  VPN plugin state changed: starting (3)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: Use '' as a gateway
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: Check port 1701
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: ipsec enable flag: yes
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: starting ipsec
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: Redirecting to: systemctl stop+start ipsec.service
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: 002 loading secrets from "/etc/ipsec.secrets"
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: debugging mode enabled
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: end of file /var/run/nm-ipsec-l2tp.11510/ipsec.conf
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: Warning: ignored obsolete keyword 'nat_traversal'
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: Warning: ignored obsolete keyword 'force_keepalive'
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: Loading conn nm-ipsec-l2tpd-11510
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: starter: case KH_DEFAULTROUTE: empty
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" loopback=0
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" labeled_ipsec=0
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" policy_label=(null)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" modecfgdomain=(null)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" modecfgbanner=(null)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: opening file: /var/run/nm-ipsec-l2tp.11510/ipsec.conf
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: loading named conns: nm-ipsec-l2tpd-11510
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: seeking_src = 0, seeking_gateway = 1, has_dst = 1
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst  via 192.168.0.1 dev enp7s0 src  table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: set nexthop: 192.168.0.1
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.0 via  dev enp7s0 src 192.168.0.10 table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.0.0.1 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.255.255.255 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.0 via  dev enp7s0 src 192.168.0.10 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.10 via  dev enp7s0 src 192.168.0.10 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.255 via  dev enp7s0 src 192.168.0.10 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.1 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.255 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: seeking_src = 1, seeking_gateway = 0, has_dst = 1
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.1 via  dev enp7s0 src 192.168.0.10 table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: set addr: 192.168.0.10
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: debugging mode enabled
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: end of file /var/run/nm-ipsec-l2tp.11510/ipsec.conf
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: Warning: ignored obsolete keyword 'nat_traversal'
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: Warning: ignored obsolete keyword 'force_keepalive'
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: Loading conn nm-ipsec-l2tpd-11510
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: starter: case KH_DEFAULTROUTE: empty
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" loopback=0
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" labeled_ipsec=0
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" policy_label=(null)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" modecfgdomain=(null)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: conn: "nm-ipsec-l2tpd-11510" modecfgbanner=(null)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: opening file: /var/run/nm-ipsec-l2tp.11510/ipsec.conf
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: loading named conns: nm-ipsec-l2tpd-11510
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: seeking_src = 0, seeking_gateway = 1, has_dst = 1
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst  via 192.168.0.1 dev enp7s0 src  table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: set nexthop: 192.168.0.1
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.0 via  dev enp7s0 src 192.168.0.10 table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.0.0.0 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.0.0.1 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 127.255.255.255 via  dev lo src 127.0.0.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.0 via  dev enp7s0 src 192.168.0.10 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.10 via  dev enp7s0 src 192.168.0.10 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.255 via  dev enp7s0 src 192.168.0.10 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.0 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.1 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.122.255 via  dev virbr0 src 192.168.122.1 table 255
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: seeking_src = 1, seeking_gateway = 0, has_dst = 1
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: dst 192.168.0.1 via  dev enp7s0 src 192.168.0.10 table 254 (ignored)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: set addr: 192.168.0.10
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: 024 need --listen before --initiate
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: 002 forgetting secrets
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: 002 loading secrets from "/etc/ipsec.secrets"
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: 002 no secrets filename matched "/etc/ipsec.d/*.secrets"
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** (nm-l2tp-service:11510): WARNING **: Possible error in IPSec setup.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: ipsec ready for action
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: xl2tpd started with pid 11831
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Not looking for kernel SAref support.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: <info>  VPN connection '...' (Connect) reply received.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Using l2tp kernel support.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: xl2tpd version xl2tpd-1.3.6 started on redacted.domain PID:11831
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Written by Mark Spencer, Copyright (C) 1998, Adtran, Inc.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Forked by Scott Balmos and David Stipp, (C) 2001
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Inherited by Jeff McAdams, (C) 2002
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Forked again by Xelerance (www.xelerance.com) (C) 2006
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Listening on IP address 0.0.0.0, port 1701
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Connecting to host ..., port 1701
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Connection established to ..., 1701.  Local: 14615, Remote: 172 (ref=0/0).
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Calling on tunnel 14615
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Call established with ..., Local: 57186, Remote: 1, Serial: 1 (ref=0/0)
Aug 24 18:59:55 redacted.domain pppd[11833]: Plugin /usr/lib64/pppd/2.4.7/nm-l2tp-pppd-plugin.so loaded.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (plugin_init): initializing
Aug 24 18:59:55 redacted.domain pppd[11833]: Plugin pppol2tp.so loaded.
Aug 24 18:59:55 redacted.domain pppd[11833]: pppd 2.4.7 started by root, uid 0
Aug 24 18:59:55 redacted.domain pppd[11833]: using channel 16
Aug 24 18:59:55 redacted.domain pppd[11833]: Using interface ppp0
Aug 24 18:59:55 redacted.domain pppd[11833]: Connect: ppp0 <-->
Aug 24 18:59:55 redacted.domain pppd[11833]: PPPoL2TP options: debugmask 0
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x5ee40bf0>]
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 3 / phase 'serial connection'
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 5 / phase 'establish'
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: <info>  (ppp0): new Generic device (driver: 'unknown' ifindex: 21)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: <info>  (ppp0): exported as /org/freedesktop/NetworkManager/Devices/20
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [LCP ConfReq id=0x1 <auth chap MS-v2> <mru 1460> <magic 0xaaa91204> <mrru 1614>]
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP ConfRej id=0x1 <mrru 1614>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [LCP ConfRej id=0x1 <asyncmap 0x0>]
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP ConfReq id=0x2 <magic 0x5ee40bf0>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [LCP ConfReq id=0x2 <auth chap MS-v2> <mru 1460> <magic 0xaaa91204>]
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP ConfAck id=0x2 <auth chap MS-v2> <mru 1460> <magic 0xaaa91204>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [LCP ConfAck id=0x2 <magic 0x5ee40bf0>]
Aug 24 18:59:55 redacted.domain pppd[11833]: PPPoL2TP options: debugmask 0
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP EchoReq id=0x0 magic=0x5ee40bf0]
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 6 / phase 'authenticate'
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [CHAP Challenge id=0x1 <09df5dc64f219a8b5a4a2725c1a0b083>, name = "GateKeeper"]
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (get_credentials): passwd-hook, requesting credentials...
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (get_credentials): got credentials from NetworkManager-l2tp
Aug 24 18:59:55 redacted.domain pppd[11833]: added response cache entry 0
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [CHAP Response id=0x1 <b26a1ba4d0157034e6bf90ce6f01edf300000000000000001146ecf935732c6974878339b1b0b320711dc3b23ba78c3700>, name = "redacted"]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [LCP EchoRep id=0x0 magic=0xaaa91204]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [CHAP Success id=0x1 "S=98FB00A06F54BCF13C820F3431582BB0BA9D2376"]
Aug 24 18:59:55 redacted.domain pppd[11833]: response found in cache (entry 0)
Aug 24 18:59:55 redacted.domain pppd[11833]: CHAP authentication succeeded
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns2 0.0.0.0>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [IPCP ConfReq id=0x1 <addr 192.168.80.1>]
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [IPCP ConfAck id=0x1 <addr 192.168.80.1>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [proto=0x8281] 01 01 00 04
Aug 24 18:59:55 redacted.domain pppd[11833]: Unsupported protocol 'MPLSCP' (0x8281) received
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP ProtRej id=0x3 82 81 01 01 00 04]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
Aug 24 18:59:55 redacted.domain pppd[11833]: Unsupported protocol 'Compression Control Protocol' (0x80fd) received
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP ProtRej id=0x4 80 fd 01 01 00 0a 12 06 01 00 00 40]
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 8 / phase 'network'
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [IPCP ConfNak id=0x1 <addr 192.168.80.89> <ms-dns1 192.168.41.250> <ms-dns2 192.168.41.251>]
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [IPCP ConfReq id=0x2 <addr 192.168.80.89> <ms-dns1 192.168.41.250> <ms-dns2 192.168.41.251>]
Aug 24 18:59:55 redacted.domain pppd[11833]: rcvd [LCP TermReq id=0x3 "Encryption negotiation rejected"]
Aug 24 18:59:55 redacted.domain pppd[11833]: LCP terminated by peer (Encryption negotiation rejected)
Aug 24 18:59:55 redacted.domain pppd[11833]: PPPoL2TP options: debugmask 0
Aug 24 18:59:55 redacted.domain pppd[11833]: sent [LCP TermAck id=0x3]
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 5 / phase 'establish'
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: result_code_avp: avp is incorrect size.  8 < 10
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: call_close: Call 57186 to ... disconnected
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: result_code_avp: avp is incorrect size.  8 < 10
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: handle_avps: Bad exit status handling attribute 1 (Result Code) on mandatory packet.
Aug 24 18:59:55 redacted.domain pppd[11833]: Terminating on signal 15
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: xl2tpd[11831]: Connection 172 closed to ..., port 1701 (Result Code: expected at least 10, got 8)
Aug 24 18:59:55 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 10 / phase 'terminate'
Aug 24 18:59:58 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 11 / phase 'disconnect'
Aug 24 18:59:58 redacted.domain pppd[11833]: Connection terminated.
Aug 24 18:59:58 redacted.domain NetworkManager[1069]: <warn>  VPN plugin failed: connect-failed (1)
Aug 24 18:59:58 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_phasechange): status 1 / phase 'dead'
Aug 24 18:59:58 redacted.domain pppd[11833]: Modem hangup
Aug 24 18:59:58 redacted.domain NetworkManager[1069]: <warn>  VPN plugin failed: connect-failed (1)
Aug 24 18:59:58 redacted.domain NetworkManager[1069]: ** Message: nm-l2tp-ppp-plugin: (nm_exit_notify): cleaning up

Comment 104 Ivan Romanov 2015-08-24 19:02:32 UTC
Sorry, but as I mentioned before network-manager-l2tp developer hasn't interesting with this app now. No new since previous year. I tried some times to ask the developer to do something with this problem but he did nothing. Personnaly I don't use l2tp I only made package and don't know nothing about the this plugin code or l2tp network. So I can't help here. Seems need somebody who will be care about network-manager-l2tp app.

Comment 105 Sergey 2015-08-24 19:56:31 UTC
Yep. I'm sorry, but I'm not yet able to continue development of this plugin. Mostly because I don't need to use it myself now.
Also, there is a lot of issues related to ipsec, which I never used myself either.
So, looking for a new maintainer.

Comment 106 Redacted 001 2015-08-25 17:54:30 UTC
Thanks to both. As it looks like nothing will change shortly, we changed to sstp for linux users.

Comment 107 damir13 2015-11-29 14:17:52 UTC
on fedora 23 the NetworkManager-l2tp source code needs at least 2 modifications of nm-l2tp-service.c:
1) there must be a delay between the execution of the command that restart the ipsec  and the execution of the "ipsec whack" command, else the what will be executed befor the daemon is ready. the suggestion of soni (comment 96) should work fine. my solution is a little different:
	"[ \"x$defaultrouteaddr\" = \"x\" ] && ipsec setup restart");
        system("sleep 1");
 	sys += system("PATH=/usr/local/sbin:/usr/sbin:/sbin ipsec whack"
 			" --listen");

but the result is the same.

2) as fedora 23 uses libreswan in place of openswan, at least 3 lines of the ipsec config file created by the plugin must be eliminated/commented as they are obsoleted by the libreswan daemon:

version 2.0
  nat_traversal=yes
  force_keepalive=yes

after these modification the l2tp/ipsec connection are executed as expected

the final result is:
@@ -903,6 +903,8 @@
 	"PATH=/usr/local/sbin:/usr/sbin:/sbin; export PATH;"
 	"[ \"x$defaultrouteaddr\" = \"x\" ] && ipsec setup restart");
 
+        system("sleep 1");
+
 	sys += system("PATH=/usr/local/sbin:/usr/sbin:/sbin ipsec whack"
 			" --listen");
 	sprintf(cmd1,"test -e /var/run/pluto/ipsec.info && . /var/run/pluto/ipsec.info;"
@@ -962,14 +964,6 @@
 
 	rename(tmp_secrets, "/etc/ipsec.secrets");
 	sys += system("PATH=\"/sbin:/usr/sbin:/usr/local/sbin:$PATH\" ipsec secrets");
-	if (sys != 0) {
-		g_set_error (error,
-		             NM_VPN_PLUGIN_ERROR,
-		             NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
-		             "%s",
-		             _("Possible error in IPSec setup."));
-		return FALSE;
-	}
 
 	g_message(_("ipsec ready for action"));
 	return TRUE;
@@ -1140,10 +1134,10 @@
 					 _("Could not write ipsec config."));
 		return FALSE;
 	}
-	write_config_option (ipsec_fd, "version 2.0\n"
+	write_config_option (ipsec_fd, "#version 2.0\n"
 "config setup\n"
-"  nat_traversal=yes\n"
-"  force_keepalive=yes\n"
+"#  nat_traversal=yes\n"
+"#  force_keepalive=yes\n"
 "  protostack=netkey\n"
 "  keep_alive=60\n"
 "\n");

Comment 108 Hedayat Vatankhah 2015-12-02 10:36:43 UTC
@Ivan: There is new development at: https://github.com/seriyps/NetworkManager-l2tp/commits/master 
with the version updated to at least 1.1.0. The repository is Sergey's but someone else (Lubomir Rintel) is continuing the development. Would you please consider updating the plugin?

Thanks

Comment 109 damir13 2015-12-06 02:09:53 UTC
I have downloaded the new version you indicated, but besides the generous updates to clean the code, the failing lines are still there, so no, even the 1.1.x version is destined to fail to activate an l2tp/ipsec connection. unfortunately I cannot verify the code, as I cannot run this latest version on my fedora 23 installation. 
what I can say is that besides the already proposed modifications of my previous comment, there are also another couple of lines that should be updated in the configuration of the ipsec daemon.
I'm proposing here the full changes (for NetworkManager-l2tp-master):

$ diff -Naru nm-l2tp-service.c.org nm-l2tp-service.c
--- nm-l2tp-service.c.org	2015-12-06 02:43:14.329691002 +0100
+++ nm-l2tp-service.c	2015-12-06 02:51:09.569872532 +0100
@@ -933,7 +933,7 @@
 	if (sys) {
 		return nm_l2tp_ipsec_error(error, "Could not restart the ipsec service.");
 	}
-
+	sys = system("sleep 1");
 	sys = system(PATH_PREFIX " ipsec whack --listen");
 	if (sys) {
 		return nm_l2tp_ipsec_error(error, "Could not talk to IPsec key exchange service.");
@@ -1157,10 +1157,10 @@
 	if (ipsec_fd == -1) {
 		return nm_l2tp_ipsec_error(error, "Could not write ipsec config.");
 	}
-	write_config_option (ipsec_fd, "version 2.0\n"
+	write_config_option (ipsec_fd, "#version 2.0\n"
 "config setup\n"
-"  nat_traversal=yes\n"
-"  force_keepalive=yes\n"
+"#  nat_traversal=yes\n"
+"#  force_keepalive=yes\n"
 "  protostack=netkey\n"
 "  keep_alive=60\n"
 "\n");
@@ -1168,7 +1168,7 @@
 	write_config_option (ipsec_fd,
 "  auto=add\n"
 "  type=transport\n"
-"  auth=esp\n"
+"#  auth=esp\n"
 "  pfs=no\n"
 "  authby=secret\n"
 "  keyingtries=0\n"
@@ -1182,11 +1182,11 @@
 	value = nm_setting_vpn_get_data_item (s_vpn, NM_L2TP_KEY_IPSEC_GATEWAY_ID);
 	if(value)write_config_option (ipsec_fd, "  rightid=@%s\n", value);
 	write_config_option (ipsec_fd,
-"  esp=3des-sha1\n"
-"  keyexchange=ike\n"
-"  ike=3des-sha1-modp1024\n"
-"  aggrmode=no\n"
-"  forceencaps=yes\n");
+"#  esp=3des-sha1\n"
+"#  keyexchange=ike\n"
+"#  ike=3des-sha1-modp1024\n"
+"#  aggrmode=no\n"
+"#  forceencaps=yes\n");

as before I have left the config strings commented out, instead of removing them, so the modifications are clear to understand (I hope).
with the proposed modifications the l2tp/ipsec client should never try to force a specific protocol/algorithm on the VPN server, but it will accept what the server suggests.
this modifications works with a Cisco VPN concentrator (identified as "Cisco VPN 3000 Series") with aes_128-sha/3des-sha1 and a Centos 7 Server with aes_256-sha/aes_128-sha1.

I'm sorry to propose these modification using this way, but I'm not a real programmer and I don't know what is the right process to follow.

thanks
damir

Comment 110 Hedayat Vatankhah 2015-12-06 07:45:28 UTC
Thanks! Please at least create an issue in the github project and propose your changes there. (BTW, instead of 'sys = system("sleep 1")' you should use 'sleep(1)'). The better is to fork the repo, apply the changes in your fork and create a pull request against the main repo, so that the developer(s) can accept your changes directly. But if you don't want to go through this, just create an issue there and propose your changes.

Comment 111 Andrew Cook 2016-01-17 10:00:55 UTC
Why does this exist in fedora if it's completely broken and no one is willing to maintain it?

Incredibly frustrating to spend time debugging vpn configuration only to find out the problem is a 4 year old unmaintained package

Comment 112 Blueowl 2016-01-25 13:55:17 UTC
*** Bug 1272767 has been marked as a duplicate of this bug. ***

Comment 113 Douglas Kosovic 2016-02-25 08:34:17 UTC
My workplace is using L2TP/IPsec with a preshared key and it was only Linux users (other than Android) having issues connecting. I have provided command-line and config file instructions, but most of our users prefer a GUI NetworkManager solution.

Consequently I've started fixing NetworkManager-l2tp with a new GitHub branch (which I hope to submit a pull request at some point) :
   https://github.com/dkosovic/NetworkManager-l2tp/tree/nm_0.9

A quick summary of the Fedora 23 issues encountered with the https://github.com/seriyps/NetworkManager-l2tp repo, nm-1-0 and master branches :

nm-1-0 branch no longer builds with NetworkManager-1.0.x as it is contaminated with NetworkManager 1.2 configure script and code updates. The master branch no longer builds either, but that is to be expected.

nm-1-0 and master branches contains an update to do runtime detection of strongswan and libreswan. Unfortunately it expects strongswan to be using /usr/sbin/ipsec instead of /usr/sbin/strongswan. On Fedora 23, /usr/sbin/ipsec is exclusively libreswan.


In my branch I forked before the NetworkManager 1.2 master branch updates, but cherry picked the strongswan/libreswan update, although I had to do bug fixes to get it to work with libreswan.

I'm still deciding how to handle both strongswan and libreswan , maybe introduce a --with-ipsec-stack configure time option to select between libreswan and strongswan, then maybe use an env variable to override which IPSec stack is used. 

I'm still doing testing, but hope to put up a scratch NetworkManager-l2tp RPM build available for testing soon.

Comment 114 Hedayat Vatankhah 2016-03-02 16:30:14 UTC
Thank you for sharing your work. I finally getting it to work. However, a few issues:
- The code doesn't compile for me, because of some errors about deprecated functions. I need to remove `-Werror` flag to get it compiled (however, the correct fix is certainly using the new API).

- I was still unable to connect until I added pfs=no option to ipsec.conf file; because the server I was trying to connect to doesn't support PFS. I think we should either add the options we find useful to the IPSec options UI, or add the possibility for the user to add any desired options to the config file. 

- Sometimes after restarting ipsec, it can't connect to pluto immediately and fails. When I retry connecting, it works. I think we should either add a small sleep before running 'ipsec --ready' as suggested by others, or we should retry it a few times if it fails.

- Instead of replacing ipsec.secrets, it is probably better to add a secrets file inside /etc/ipsec.d/. It'll allow the user to customize connection options by adding other files there too. But I think I should discuss about these on GitHub rather than here. I might add a pull request too.

Anyway, I wanted to mainly tell you that I got it working.

Comment 115 Douglas Kosovic 2016-03-03 04:42:27 UTC
> - The code doesn't compile for me, because of some errors about deprecated
> functions. I need to remove `-Werror` flag to get it compiled (however, the
> correct fix is certainly using the new API).

I agree about being the proper fix.

I was using the following like in the RPM spec file :
  ./configure --disable-static --enable-more-warnings=yes
which sidestepped the deprecated gnome_keyring issue.

But it was definitely something I wanted to get back to, but postponed after seeing Ubuntu build issues here:
  https://github.com/seriyps/NetworkManager-l2tp/pull/27

> - I was still unable to connect until I added pfs=no option to ipsec.conf
> file; because the server I was trying to connect to doesn't support PFS. I
> think we should either add the options we find useful to the IPSec options
> UI, or add the possibility for the user to add any desired options to the
> config file. 

Interesting, as pfs was taken out of the strongswan section of code, when I updated the libreswan section of code, I incorrectly assumed if pfs was left out it would default to pfs=yes.

I'm in the process of adding MRU and MTU options to the GUI, as I need to set them to 1200 to successfully connect to my workplace.

I agree that config file templates would be good solution, in particular with obscurer options. I previously had a look at other NetworkManager VPN plugins to see if they use template files, but couldn't find one that did.

> - Sometimes after restarting ipsec, it can't connect to pluto immediately
> and fails. When I retry connecting, it works. I think we should either add a
> small sleep before running 'ipsec --ready' as suggested by others, or we
> should retry it a few times if it fails.

I liked your solution (in the pull request) of trying a few times, with a sleep in between each time when it fails. It was something I was going to get back to, but glad you fixed it.

> - Instead of replacing ipsec.secrets, it is probably better to add a secrets
> file inside /etc/ipsec.d/. It'll allow the user to customize connection
> options by adding other files there too. But I think I should discuss about
> these on GitHub rather than here. I might add a pull request too.

Although I agree, there is an issues with doing that, /etc/ipsec.secrets might not contain (or may have commented out) the following line :
   include /etc/ipsec.d/*.secrets 

e.g. on Fedora 23 if strongswan is used instead of libreswan, /etc/strongswan/ipsec.secrets doesn't include /etc/strongswan/ipsec.d/*.secrets by default.

> Anyway, I wanted to mainly tell you that I got it working.

Thanks for the pull request, I don't see any issues with it from code reading, but just want to do a bit of hands-on testing before accepting.

Some other issues I want to fix include changing sprintf()s to snprintf()s, make sure the IPsec connection is really up before attempting the L2TP connection (which can be an issue with strongswan, but I need to check libreswan if it has similar issue in some scenarios).

I should have MTU/MRU support added soon and with the pull-request, I think it would make for a good initial scratch NetworkManager-l2tp RPM build.

Comment 116 Hedayat Vatankhah 2016-03-03 07:31:45 UTC
(In reply to Douglas Kosovic from comment #115)
> 
> I agree about being the proper fix.
>  ...
> But it was definitely something I wanted to get back to, but postponed after
> seeing Ubuntu build issues here:
>   https://github.com/seriyps/NetworkManager-l2tp/pull/27

My pull request contains a commit from another user which solves this issue. And it works fine for me in F23.


> 
> Interesting, as pfs was taken out of the strongswan section of code, when I
> updated the libreswan section of code, I incorrectly assumed if pfs was left
> out it would default to pfs=yes.
Your assumption is true: libreswan defaults to pfs=yes, and I needed the opposite to be able to connect. In my PR, I'll add pfs=no to config file if user unchecks the corresponding option.


> 
> I agree that config file templates would be good solution, in particular
> with obscurer options. I previously had a look at other NetworkManager VPN
> plugins to see if they use template files, but couldn't find one that did.
Yes. PPTP had decided to include many options in UI, and I think it is fine to add useful options to UI too. But I agree that letting the user provide additional options is a good thing in the long run. Instead of being able to provide a template file for each connection, we can also use the 'also' option (libreswan has it, I don't know about strongswan though). Then we can include a file which might contain additional options, e.g. nm-ipsec-<conn_name>. (if we have access to connection name inside the plugin, which I hope we have).


> 
> Although I agree, there is an issues with doing that, /etc/ipsec.secrets
> might not contain (or may have commented out) the following line :
>    include /etc/ipsec.d/*.secrets 
Yes, I was going to do that but didn't, because I thought that it might not be the case for other distributions (I thought that it is always like this in Fedora though!).


> Thanks for the pull request, I don't see any issues with it from code
> reading, but just want to do a bit of hands-on testing before accepting.
> 
> Some other issues I want to fix include changing sprintf()s to snprintf()s,
> make sure the IPsec connection is really up before attempting the L2TP
> connection (which can be an issue with strongswan, but I need to check
> libreswan if it has similar issue in some scenarios).
> 
> I should have MTU/MRU support added soon and with the pull-request, I think
> it would make for a good initial scratch NetworkManager-l2tp RPM build.
That's great, thanks for working on this. I hope merging the changes back to master will be easy enough, as you are actually developing the plugin in this branch :)

Comment 117 Douglas Kosovic 2016-03-06 05:46:42 UTC
Apologise for not make a scratch NetworkManager-l2tp RPMs available sooner. Had to do a minor libreswan compatibly fix, as it din't work with libreswan that ships with Fedora 23, but did with the newer libreswan from Fedora 23 Updates. Ended up replacing 'ipsec auto --start' with 'ipsec auto --add' and 'ipsec auto --up'.


If you want to test it, I've put up NetworkManager-l2tp-0.9.8.8-0.1.20160306.fc23.src.rpm and NetworkManager-l2tp-0.9.8.8-0.1.20160306.fc23.x86_64.rpm here :
  https://outbox.eait.uq.edu.au/uqdkosov/networkmanager-l2tp/

SELinux still needs to be set to permissive or disabled.

Ensure the L2TP kernel modules are available by installing the kernel-modules-extra RPM :

  sudo dnf install kernel-modules-extra

If there are issues, you can debug by doing :
  sudo /usr/libexec/nm-l2tp-service --debug
(but make sure to kill any existing nm-l2tp-service process if it is already running)

Comment 118 Hedayat Vatankhah 2016-03-06 07:39:25 UTC
Thanks. Why not adding updated libreswan as a dependency instead?
I do see SELinux alerts, but I can successfully connect even in enforcing mode. BTW, I've filled a bug report to fix SELinux issue too (#1313937).

Comment 119 Douglas Kosovic 2016-03-06 09:25:34 UTC
> Why not adding updated libreswan as a dependency instead?

For the upstream source code, I think it is better to be backwards compatible with older versions of libreswan. Plus what I was originally doing with 'ipsec auto --start' was a workaround for what I think is a libreswan bug, it was ignoring auto=add in the config file. As --start is a combination of -add followed by --up, I believe we should have been able to get away with just using --up (like with strongswan) if it didn't ignore auto=add.

Thanks regarding SELinux

Comment 120 Douglas Kosovic 2016-03-07 09:07:55 UTC
Forgot to mention, I put in a GitHub pull request :
  https://github.com/seriyps/NetworkManager-l2tp/pull/45
but wasn't certain how to do it for a new branch and ended up selecting the nm_0.8.1 branch for the pull.

Perhaps it might have been most appropriate for the pull request to use the nm-1.0 branch, but that branch has been contaminated with NetworkManager 1.1/1.2 updates and no longer builds with NetworkManager 1.0.


If it gets pulled, I'll start using Fedora RawHide and work on the master branch to cherry pick and merge changes.

There are a few other thing I would like to improve, but might leave that for the master branch.

Comment 121 Hedayat Vatankhah 2016-04-16 04:57:10 UTC
As Sergey isn't going to continue development, I think we should forget getting PR merged. I guess you can be the new maintainer Douglas (at least, currently, you are!).

Ivan, would you please package new l2tp plugin package from Douglas branch? It works, unlike the one currently is in Fedora.

Comment 122 Douglas Kosovic 2016-04-16 10:48:02 UTC
Rather than using my GitHub user account's repository as an upstream source, I think it's better to create a GitHub organisation account and people that want to be admins or members can be invited, I'm more than happy to invite previous maintainers.

I've tentatively created a nm-l2tp GitHub organisation account :
   https://github.com/nm-l2tp

If I get time tomorrow, I'll add the NetworkManager-l2tp repository there and do a bit of maintenace.

Hope I'm not stepping on anybody's toes.

Comment 123 Douglas Kosovic 2016-04-18 22:33:45 UTC
I've created a new GitHub repository and nm-1-0 branch in particular for NetworkManager 1.0 based Fedora 23 :
   https://github.com/nm-l2tp/network-manager-l2tp/tree/nm-1-0

NetworkManager-l2tp version 1.0.0 source tarball can be downloaded from:
   https://github.com/nm-l2tp/network-manager-l2tp/archive/1.0.0/NetworkManager-l2tp-1.0.0.tar.gz

So if it can be packaged up into a new NetworkManager-l2tp-1.0.0 RPM for Fedora 23 that would be great. 

I'll now start working on the master branch for the NetworkManger 1.2 based Fedora 24.


Some notes about the new GitHub repository:

The repository name has been renamed from NetworkManager-l2tp to network-manager-l2tp, so that it uses the same naming convention as other NetworkManager VPN plugins in the Gnome Git Repository. Note: URLs to the repository can contain either NetworkManager-l2tp or network-manager-l2tp as redirections are taken care of by GitHub. 

Similarly, the branches have been renamed to use the same naming convention as used in the Gnome Git Repository where the other NetworkManager VPN plugins are located.

Comment 124 Hedayat Vatankhah 2016-04-20 05:31:04 UTC
Thanks. Ivan, still there? :P

Comment 125 Ivan Romanov 2016-04-20 06:16:57 UTC
Yes, I'm here. I will check repo and update package.

Comment 126 Ivan Romanov 2016-04-20 08:12:56 UTC
Douglas I rebuilt package for F22 and F23. Please chech it in Koji http://koji.fedoraproject.org/koji/taskinfo?taskID=13729407 and http://koji.fedoraproject.org/koji/taskinfo?taskID=13729587 . Then I will update git.

Comment 127 Douglas Kosovic 2016-04-20 12:01:26 UTC
Thanks Ivan.

I've tested the RPM on a clean install of Fedora 23 with latest updates and can confirm the rebuilt RPM is working.

The only minor nitpick I have is that the RPM's requires dependency is on openswan instead of libreswan (which now provides the openswan RPM dependency on later Fedoras). But it doesn't bother me if the requires is modified or not.

I didn't test on F22, but as F22 is NetworkManage 1.0 based and has libreswan, I don't envisage any issues.

Comment 128 Douglas Kosovic 2016-05-12 22:54:19 UTC
Created attachment 1156937 [details]
NetworkManager-l2tp.spec for version 1.0.2

Ivan,

I've released a new NetworkManager-l2tp 1.0.2 :
https://github.com/nm-l2tp/network-manager-l2tp/archive/1.0.2/NetworkManager-l2tp-1.0.2.tar.gz

The changes for NetworkManager-l2tp 1.0.2 are only minor GUI cosmetic changes and a fix for another linux distribution.

As the previous 1.0.0 RPM hadn't been pushed out yet, please find attached a new NetworkManager-l2tp.spec file which I have tested on Fedora 22 & 23 and RHEL7.2 / EPEL7.

SPEC file changes include :
- creates a separate NetworkManager-l2tp-gnome RPM for GNOME files, like other NetworkManaager VPN plugins do for their RPMs.

- updated BuildRequires, Requires, URL and Source. The BR is mostly based on current NetworkManager-pptp.spec.

- replaced filter_provides macro with newer macros

Comment 129 Douglas Kosovic 2016-05-12 23:08:53 UTC
Minor correction to the SPEC file I attached, the following lines :

# Most of code uses GPLv2+ license.
# Only vpn-password-dialog has LGPLv2+.
License:   GPLv2+ and LGPLv2+

can be changed to:

License:   GPLv2+



As the vpn-password-dialog code was obsoleted and removed.

Comment 130 Fedora Update System 2016-05-30 16:50:29 UTC
NetworkManager-l2tp-1.0.2-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-54c8a74b61

Comment 131 Fedora Update System 2016-05-31 09:53:04 UTC
NetworkManager-l2tp-1.0.2-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-54c8a74b61

Comment 132 Fedora Update System 2016-06-02 14:55:42 UTC
NetworkManager-l2tp-1.0.2-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 133 Pablo Hinojosa 2019-07-16 11:33:36 UTC
I came here because error "result_code_avp: avp is incorrect size.  8 < 10"

Once I installed libreswan with

> dnf install libreswan.x86_64

now it is working.

I hope it helps


Note You need to log in before you can comment on or make changes to this bug.