Hello,
I'm trying to setup a von L2TP VPN connection between a Windows 10 machine and a Cisco 2910 router. The connection can be established sometimes, but fails at other times.
I've tried to find the cause of the problem by looking at the debug messages and noted the following.
This happens when the connection fails:
Oct 17 14:41:04.169: ISAKMP:(6233):Checking IPSec proposal 1
Oct 17 14:41:04.169: ISAKMP: transform 1, ESP_AES
Oct 17 14:41:04.169: ISAKMP: attributes in transform:
Oct 17 14:41:04.169: ISAKMP: encaps is 4 (Transport-UDP)
Oct 17 14:41:04.169: ISAKMP: key length is 128
Oct 17 14:41:04.169: ISAKMP: authenticator is HMAC-SHA
Oct 17 14:41:04.169: ISAKMP: SA life type in seconds
Oct 17 14:41:04.169: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10
Oct 17 14:41:04.169: ISAKMP: SA life type in kilobytes
Oct 17 14:41:04.169: ISAKMP: SA life duration (VPI) of 0x0 0x3 0xD0 0x90
Oct 17 14:41:04.169: ISAKMP:(6233):atts are acceptable.
Oct 17 14:41:04.169: IPSEC(ipsec_process_proposal): transform not supported by encryption hardware:
{esp-aes esp-sha-hmac }
Oct 17 14:41:04.169: ISAKMP:(6233): IPSec policy invalidated proposal with error 512
Oct 17 14:41:04.169: ISAKMP:(6233):Checking IPSec proposal 2
Oct 17 14:41:04.169: ISAKMP: transform 1, ESP_3DES
Oct 17 14:41:04.169: ISAKMP: attributes in transform:
Oct 17 14:41:04.169: ISAKMP: encaps is 4 (Transport-UDP)
Oct 17 14:41:04.169: ISAKMP: authenticator is HMAC-SHA
Oct 17 14:41:04.169: ISAKMP: SA life type in seconds
Oct 17 14:41:04.169: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10
Oct 17 14:41:04.173: ISAKMP: SA life type in kilobytes
Oct 17 14:41:04.173: ISAKMP: SA life duration (VPI) of 0x0 0x3 0xD0 0x90
Oct 17 14:41:04.173: ISAKMP:(6233):atts are acceptable.
Oct 17 14:41:04.173: IPSEC(ipsec_process_proposal): transform not supported by encryption hardware:
{esp-3des esp-sha-hmac }
Oct 17 14:41:04.173: ISAKMP:(6233): IPSec policy invalidated proposal with error 512
Oct 17 14:41:04.173: ISAKMP:(6233):Checking IPSec proposal 3
Oct 17 14:41:04.173: ISAKMP: transform 1, ESP_DES
Oct 17 14:41:04.173: ISAKMP: attributes in transform:
Oct 17 14:41:04.173: ISAKMP: encaps is 4 (Transport-UDP)
Oct 17 14:41:04.173: ISAKMP: authenticator is HMAC-SHA
Oct 17 14:41:04.173: ISAKMP: SA life type in seconds
Oct 17 14:41:04.173: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10
Oct 17 14:41:04.173: ISAKMP: SA life type in kilobytes
Oct 17 14:41:04.173: ISAKMP: SA life duration (VPI) of 0x0 0x3 0xD0 0x90
Oct 17 14:41:04.173: ISAKMP:(6233):atts are acceptable.
Oct 17 14:41:04.173: IPSEC(ipsec_process_proposal): transform not supported by encryption hardware:
{esp-des esp-sha-hmac }
Oct 17 14:41:04.173: ISAKMP:(6233): IPSec policy invalidated proposal with error 512
Oct 17 14:41:04.177: ISAKMP:(6233): phase 2 SA policy not acceptable! (local xxxxx remote xxxxx)
and this one if it succeeds:
Oct 17 14:39:59.069: ISAKMP:(6230):Checking IPSec proposal 1
Oct 17 14:39:59.069: ISAKMP: transform 1, ESP_AES
Oct 17 14:39:59.069: ISAKMP: attributes in transform:
Oct 17 14:39:59.069: ISAKMP: encaps is 2 (Transport)
Oct 17 14:39:59.069: ISAKMP: key length is 128
Oct 17 14:39:59.069: ISAKMP: authenticator is HMAC-SHA
Oct 17 14:39:59.069: ISAKMP: SA life type in seconds
Oct 17 14:39:59.069: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10
Oct 17 14:39:59.069: ISAKMP: SA life type in kilobytes
Oct 17 14:39:59.069: ISAKMP: SA life duration (VPI) of 0x0 0x3 0xD0 0x90
Oct 17 14:39:59.069: ISAKMP:(6230):atts are acceptable.
Settings of both sides do not change in between. It just happens if I try often enough.
Any idea what could be the reason for this behaviour?
Thank you
Stefan
