ISR L2TP VPN Phase 1 seems to be failing

[garrettc134]

I'm having a difficult time getting a clients Mac to create a VPN connection to their ISR.

It's a pretty basic configuration that worked for a few minutes then suddenly stopped. Goal is to send all traffic from the client to the ISR. Apple has a nice setting "Send all traffic over VPN Connection" that facilitates this in my other setups. I was testing it on wireshark, disconnected it and it never came back. Have tried rebooting with no luck.

Topology Details:

C1111-8P  IOS Version 16.12.6

Lan-ISR-Internet-Macbook

Configuration

aaa new-mod
aaa authentication ppp default local

vpdn enable
!
vpdn-group l2tpvpn
! Default L2TP VPDN group
 accept-dialin
  protocol l2tp
  virtual-template 1
 lcp renegotiation always
 l2tp tunnel hello 15
 no l2tp tunnel authentication
 l2tp tunnel receive-window 1024
 l2tp ip udp checksum
 ip pmtu
 ip mtu adjust
!
username dan privilege 15 password dan
!
crypto isakmp policy 1
 encr aes 256
 hash sha
 group 2
 authentication pre-share
 lifetime 3600

crypto isakmp key cisco address 0.0.0.0 0.0.0.0 no-xauth
crypto isakmp fragmentation
!
crypto ipsec transform-set L2TP-TS esp-aes 256 esp-sha-hmac
 mode transport
crypto ipsec transform-set L2TP-T1 esp-aes esp-sha-hmac
 mode transport
crypto ipsec transform-set L2TP-TS2 esp-aes esp-sha-hmac
 mode transport
crypto ipsec transform-set L2TP-TS3 esp-3des esp-md5-hmac
mode transport
!
crypto dynamic-map dynvpn 1
 set nat demux
 set transform-set L2TP-TS L2TP-T1 L2TP-TS2 L2TP-TS3

crypto map clientmap 30 ipsec-isakmp dynamic dynvpn
!
interface g0/0/0
 crypto map clientmap

interface Virtual-Template1
 ip nat inside
 ip unnumbered Vlan2
 ip mtu 1398
 peer default ip address pool VPN
 keepalive 5
 ppp mtu adaptive
 ppp authentication pap ms-chap ms-chap-v2 chap

!
ip local pool VPN 192.168.2.69 192.168.2.79

and the debug

Sep 14 23:11:27.689: ISAKMP-PAK: (0):received packet from 174.248.132.151 dport 500 sport 4952 Global (N) NEW SA
Sep 14 23:11:27.690: ISAKMP: (0):Created a peer struct for 174.248.132.151, peer port 4952
Sep 14 23:11:27.690: ISAKMP: (0):New peer created peer = 0x80007F57A21420 peer_handle = 0x80000040000003
Sep 14 23:11:27.690: ISAKMP: (0):Locking peer struct 0x80007F57A21420, refcount 1 for crypto_isakmp_process_block
Sep 14 23:11:27.690: ISAKMP: (0):local port 500, remote port 4952
Sep 14 23:11:27.690: ISAKMP: (0):insert sa successfully sa = 80007F64D27008
Sep 14 23:11:27.690: ISAKMP: (0):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Sep 14 23:11:27.690: ISAKMP: (0):Old State = IKE_READY  New State = IKE_R_MM1 

Sep 14 23:11:27.690: ISAKMP: (0):processing SA payload. message ID = 0
Sep 14 23:11:27.690: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.690: ISAKMP: (0):vendor ID seems Unity/DPD but major 69 mismatch
Sep 14 23:11:27.690: ISAKMP: (0):vendor ID is NAT-T RFC 3947
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 198 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 29 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 245 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID is NAT-T v7
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 114 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 227 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 250 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 157 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID is NAT-T v3
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 164 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID seems Unity/DPD but major 123 mismatch
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID is NAT-T v2
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):processing IKE frag vendor id payload
Sep 14 23:11:27.691: ISAKMP: (0):vendor ID is IKE Fragmentation
Sep 14 23:11:27.691: ISAKMP: (0):MM Fragmentation supported
Sep 14 23:11:27.691: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.692: ISAKMP: (0):vendor ID is DPD
Sep 14 23:11:27.692: ISAKMP: (0):found peer pre-shared key matching 174.248.132.151
Sep 14 23:11:27.692: ISAKMP: (0):local preshared key found
Sep 14 23:11:27.692: ISAKMP: (0):Scanning profiles for xauth ...
Sep 14 23:11:27.692: ISAKMP: (0):Checking ISAKMP transform 1 against priority 1 policy
Sep 14 23:11:27.692: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.692: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.692: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.692: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.692: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.692: ISAKMP: (0):      hash SHA256
Sep 14 23:11:27.692: ISAKMP: (0):      default group 14
Sep 14 23:11:27.692: ISAKMP-ERROR: (0):Hash algorithm offered does not match policy!
Sep 14 23:11:27.692: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.692: ISAKMP: (0):Checking ISAKMP transform 2 against priority 1 policy
Sep 14 23:11:27.692: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.692: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.692: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.692: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.693: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.693: ISAKMP: (0):      hash SHA
Sep 14 23:11:27.693: ISAKMP: (0):      default group 14
Sep 14 23:11:27.693: ISAKMP-ERROR: (0):Diffie-Hellman group offered does not match policy!
Sep 14 23:11:27.693: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.693: ISAKMP: (0):Checking ISAKMP transform 3 against priority 1 policy
Sep 14 23:11:27.693: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.693: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.693: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.693: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.693: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.693: ISAKMP: (0):      hash MD5
Sep 14 23:11:27.693: ISAKMP: (0):      default group 14
Sep 14 23:11:27.693: ISAKMP-ERROR: (0):Hash algorithm offered does not match policy!
Sep 14 23:11:27.693: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.693: ISAKMP: (0):Checking ISAKMP transform 4 against priority 1 policy
Sep 14 23:11:27.693: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.693: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.693: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.693: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.693: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.694: ISAKMP: (0):      hash SHA512
Sep 14 23:11:27.694: ISAKMP: (0):      default group 14
Sep 14 23:11:27.694: ISAKMP-ERROR: (0):Hash algorithm offered does not match policy!
Sep 14 23:11:27.694: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.694: ISAKMP: (0):Checking ISAKMP transform 5 against priority 1 policy
Sep 14 23:11:27.694: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.694: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.694: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.694: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.694: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.694: ISAKMP: (0):      hash SHA256
Sep 14 23:11:27.694: ISAKMP: (0):      default group 5
Sep 14 23:11:27.694: ISAKMP-ERROR: (0):Hash algorithm offered does not match policy!
Sep 14 23:11:27.694: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.694: ISAKMP: (0):Checking ISAKMP transform 6 against priority 1 policy
Sep 14 23:11:27.694: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.694: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.694: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.694: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.694: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.694: ISAKMP: (0):      hash SHA
Sep 14 23:11:27.694: ISAKMP: (0):      default group 5
Sep 14 23:11:27.694: ISAKMP-ERROR: (0):Diffie-Hellman group offered does not match policy!
Sep 14 23:11:27.694: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.694: ISAKMP: (0):Checking ISAKMP transform 7 against priority 1 policy
Sep 14 23:11:27.694: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.694: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.694: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.694: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.695: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.695: ISAKMP: (0):      hash MD5
Sep 14 23:11:27.695: ISAKMP: (0):      default group 5
Sep 14 23:11:27.695: ISAKMP-ERROR: (0):Hash algorithm offered does not match policy!
Sep 14 23:11:27.695: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.695: ISAKMP: (0):Checking ISAKMP transform 8 against priority 1 policy
Sep 14 23:11:27.695: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.695: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.695: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.695: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.695: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.695: ISAKMP: (0):      hash SHA256
Sep 14 23:11:27.695: ISAKMP: (0):      default group 2
Sep 14 23:11:27.695: ISAKMP-ERROR: (0):Hash algorithm offered does not match policy!
Sep 14 23:11:27.695: ISAKMP-ERROR: (0):atts are not acceptable. Next payload is 3
Sep 14 23:11:27.695: ISAKMP: (0):Checking ISAKMP transform 9 against priority 1 policy
Sep 14 23:11:27.695: ISAKMP: (0):      life type in seconds
Sep 14 23:11:27.695: ISAKMP: (0):      life duration (basic) of 3600
Sep 14 23:11:27.695: ISAKMP: (0):      encryption AES-CBC
Sep 14 23:11:27.695: ISAKMP: (0):      keylength of 256
Sep 14 23:11:27.695: ISAKMP: (0):      auth pre-share
Sep 14 23:11:27.695: ISAKMP: (0):      hash SHA
Sep 14 23:11:27.695: ISAKMP: (0):      default group 2
Sep 14 23:11:27.695: ISAKMP: (0):atts are acceptable. Next payload is 3
Sep 14 23:11:27.695: ISAKMP: (0):Acceptable atts:actual life: 3600
Sep 14 23:11:27.695: ISAKMP: (0):Acceptable atts:life: 0
Sep 14 23:11:27.695: ISAKMP: (0):Basic life_in_seconds:3600
Sep 14 23:11:27.696: ISAKMP: (0):Returning Actual lifetime: 3600
Sep 14 23:11:27.696: ISAKMP: (0):Started lifetime timer: 3600.

Sep 14 23:11:27.696: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.696: ISAKMP: (0):vendor ID seems Unity/DPD but major 69 mismatch
Sep 14 23:11:27.696: ISAKMP: (0):vendor ID is NAT-T RFC 3947
Sep 14 23:11:27.696: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.696: ISAKMP: (0):vendor ID seems Unity/DPD but major 198 mismatch
Sep 14 23:11:27.696: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.696: ISAKMP: (0):vendor ID seems Unity/DPD but major 29 mismatch
Sep 14 23:11:27.696: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.696: ISAKMP: (0):vendor ID seems Unity/DPD but major 245 mismatch
Sep 14 23:11:27.696: ISAKMP: (0):vendor ID is NAT-T v7
Sep 14 23:11:27.696: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.696: ISAKMP: (0):vendor ID seems Unity/DPD but major 114 mismatch
Sep 14 23:11:27.697: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.697: ISAKMP: (0):vendor ID seems Unity/DPD but major 227 mismatch
Sep 14 23:11:27.697: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.697: ISAKMP: (0):vendor ID seems Unity/DPD but major 250 mismatch
Sep 14 23:11:27.697: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.697: ISAKMP: (0):vendor ID seems Unity/DPD but major 157 mismatch
Sep 14 23:11:27.697: ISAKMP: (0):vendor ID is NAT-T v3
Sep 14 23:11:27.697: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.697: ISAKMP: (0):vendor ID seems Unity/DPD but major 164 mismatch
Sep 14 23:11:27.697: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.697: ISAKMP: (0):vendor ID seems Unity/DPD but major 123 mismatch
Sep 14 23:11:27.697: ISAKMP: (0):vendor ID is NAT-T v2
Sep 14 23:11:27.697: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.698: ISAKMP: (0):processing IKE frag vendor id payload
Sep 14 23:11:27.698: ISAKMP: (0):vendor ID is IKE Fragmentation
Sep 14 23:11:27.698: ISAKMP: (0):MM Fragmentation supported
Sep 14 23:11:27.698: ISAKMP: (0):processing vendor id payload
Sep 14 23:11:27.698: ISAKMP: (0):vendor ID is DPD
Sep 14 23:11:27.698: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Sep 14 23:11:27.698: ISAKMP: (0):Old State = IKE_R_MM1  New State = IKE_R_MM1 

Sep 14 23:11:27.698: ISAKMP: (0):sending IKE_FRAG vendor ID
Sep 14 23:11:27.699: ISAKMP: (0):constructed NAT-T vendor-rfc3947 ID
Sep 14 23:11:27.699: ISAKMP-PAK: (0):sending packet to 174.248.132.151 my_port 500 peer_port 4952 (R) MM_SA_SETUP
Sep 14 23:11:27.699: ISAKMP: (0):Sending an IKE IPv4 Packet.
Sep 14 23:11:27.699: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Sep 14 23:11:27.699: ISAKMP: (0):Old State = IKE_R_MM1  New State = IKE_R_MM2 

Sep 14 23:11:30.979: ISAKMP-PAK: (0):received packet from 174.248.132.151 dport 500 sport 4952 Global (R) MM_SA_SETUP
Sep 14 23:11:30.979: ISAKMP: (0):phase 1 packet is a duplicate of a previous packet.
Sep 14 23:11:30.979: ISAKMP: (0):retransmitting due to retransmit phase 1
Sep 14 23:11:31.477: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP...
Sep 14 23:11:31.477: ISAKMP: (0):: incrementing error counter on sa, attempt 1 of 5: retransmit phase 1
Sep 14 23:11:31.477: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP
Sep 14 23:11:31.477: ISAKMP-PAK: (0):sending packet to 174.248.132.151 my_port 500 peer_port 4952 (R) MM_SA_SETUP
Sep 14 23:11:31.477: ISAKMP: (0):Sending an IKE IPv4 Packet.
Sep 14 23:11:34.279: ISAKMP-PAK: (0):received packet from 174.248.132.151 dport 500 sport 4952 Global (R) MM_SA_SETUP
Sep 14 23:11:34.279: ISAKMP: (0):phase 1 packet is a duplicate of a previous packet.
Sep 14 23:11:34.279: ISAKMP: (0):retransmitting due to retransmit phase 1
Sep 14 23:11:34.777: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP...
Sep 14 23:11:34.777: ISAKMP: (0):: incrementing error counter on sa, attempt 2 of 5: retransmit phase 1
Sep 14 23:11:34.778: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP
Sep 14 23:11:34.778: ISAKMP-PAK: (0):sending packet to 174.248.132.151 my_port 500 peer_port 4952 (R) MM_SA_SETUP
Sep 14 23:11:34.778: ISAKMP: (0):Sending an IKE IPv4 Packet.
Sep 14 23:11:37.579: ISAKMP-PAK: (0):received packet from 174.248.132.151 dport 500 sport 4952 Global (R) MM_SA_SETUP
Sep 14 23:11:37.580: ISAKMP: (0):phase 1 packet is a duplicate of a previous packet.
Sep 14 23:11:37.580: ISAKMP: (0):retransmitting due to retransmit phase 1
Sep 14 23:11:38.078: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP...
Sep 14 23:11:38.078: ISAKMP: (0):: incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
Sep 14 23:11:38.078: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP
Sep 14 23:11:38.078: ISAKMP-PAK: (0):sending packet to 174.248.132.151 my_port 500 peer_port 4952 (R) MM_SA_SETUP
Sep 14 23:11:38.078: ISAKMP: (0):Sending an IKE IPv4 Packet.
Sep 14 23:11:48.078: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP...
Sep 14 23:11:48.078: ISAKMP: (0):: incrementing error counter on sa, attempt 4 of 5: retransmit phase 1
Sep 14 23:11:48.078: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP
Sep 14 23:11:48.079: ISAKMP-PAK: (0):sending packet to 174.248.132.151 my_port 500 peer_port 4952 (R) MM_SA_SETUP
Sep 14 23:11:48.079: ISAKMP: (0):Sending an IKE IPv4 Packet.
Sep 14 23:11:58.077: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP...
Sep 14 23:11:58.077: ISAKMP: (0):: incrementing error counter on sa, attempt 5 of 5: retransmit phase 1
Sep 14 23:11:58.077: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP
Sep 14 23:11:58.077: ISAKMP-PAK: (0):sending packet to 174.248.132.151 my_port 500 peer_port 4952 (R) MM_SA_SETUP
Sep 14 23:11:58.077: ISAKMP: (0):Sending an IKE IPv4 Packet.
% Bad IP address or host name% Unknown command or computer name, or unable to find computer address
Sep 14 23:12:08.077: ISAKMP: (0):retransmitting phase 1 MM_SA_SETUP...
Sep 14 23:12:08.077: ISAKMP: (0):peer does not do paranoid keepalives.
Sep 14 23:12:08.077: ISAKMP-ERROR: (0):deleting SA reason "Death by retransmission P1" state (R) MM_SA_SETUP (peer 174.248.132.151)
Sep 14 23:12:08.077: ISAKMP-ERROR: (0):deleting SA reason "Death by retransmission P1" state (R) MM_SA_SETUP (peer 174.248.132.151) 
Sep 14 23:12:08.078: ISAKMP: (0):Deleting the unauthenticated sa
Sep 14 23:12:08.078: ISAKMP: (0):Unlocking peer struct 0x80007F57A21420 for isadb_mark_sa_deleted(), count 0
Sep 14 23:12:08.078: ISAKMP: (0):Deleting the peer struct for unauthenticated sau
Sep 14 23:12:08.078: ISAKMP: (0):Deleting peer node by peer_reap for 174.248.132.151: 80007F57A21420
Sep 14 23:12:08.078: ISAKMP: (0):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL

[Mohammed al Baqari]

Hi,

You need to make sure that your peer is reachable. MM1 packet isn't
acknowledged

**** please remember to rate useful posts

[garrettc134]

Edited:

That does seem to be the issue.

When I hotspot my iPhone - Boom works like a charm.

When the client is connecting his mac to his Android hotspot - the response is never received on the macbook.

Android... this is going to be difficult to figure out

[MHM Cisco World]

Follow