Error VPN IPSec L2TP on Windows 11.

Question

Error VPN IPSec L2TP on Windows 11.

Erminio Di Marco 20

Sorry for my bad English.

I have an error when trying to make an IPSec L2TP VNP connection.
I have the same error using Windows 11, iPhone and Android as Client:
IPsec ERROR IPsec INFO INFO: NAT detected: PEER
IPsec ERROR IPsec INFO INFO: NAT-D payload #1 doesn't match
IPsec ERROR [217.171.76.137] ERROR: failed to pre-process ph2 packet (side: 1, status: 1).
IPsec ERROR ERROR: failed to get proposal for responder.
IPsec ERROR ERROR: no policy found: 10.46.215.59/32[0] MY DDNS/32[1701] proto=udp dir=in
What am I doing wrong?
Why does it indicate 2 different IP addresses (10.46.215.59/32 and 217.171.76.137) in the Client connection?
Thank you.

Accepted answer

1 additional answer

Your answer

Answer 1

Hi,

Check the confirmation and make sure that the certificate and pre-shared key are not misconfigured or missing. Also, please make sure the Network Address Translation (NAT) is not used (router device etc.).

If the problem persists, log collection and analyzing may be necessary for further troubleshooting.

How to troubleshoot a Microsoft L2TP/IPSec virtual private network client connection:

Troubleshoot L2TP/IPSec VPN client connection - Windows Client | Microsoft Learn

Answer 2

Thanks very much for the reply.

I tried using this VPN on my D-Link IPsec XAuth Aggressive and Main modem and it works.

I can't get the IPsec L2TP VPN to work, neither Aggressive nor Main.

I use a pre-shared key, the D-Link modem cannot use certificates.

Maybe I misunderstood, if I try to disable the NAT of the D-Link modem, I can't navigate.

I'll show you the entire D-Link modem log.

I don't know if this is correct, if you read the D-Link log it says, "NAT not detected"

INFO: respond new phase 1 negotiation: MY DDNS[500]<=>192.168.1.100[500]

INFO: begin Identity Protection mode.

INFO: received broken Microsoft ID: MS NT5 ISAKMPOAKLEY

INFO: received Vendor ID: RFC 3947

INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02

INFO: received Vendor ID: FRAGMENTATION

[192.168.1.100] INFO: Selected NAT-T version: RFC 3947

[MY DDNS] INFO: Hashing MY DDNS[500] with algo #2

INFO: NAT-D payload #0 verified

[192.168.1.100] INFO: Hashing 192.168.1.100[500] with algo #2

INFO: NAT-D payload #1 verified

INFO: NAT not detected

INFO: ISAKMP-SA established MY DDNS[500]-192.168.1.100[500] spi:7f6144d8978eeace:1772a095e9a5805b

INFO: respond new phase 2 negotiation: MY DDNS[500]<=>192.168.1.100[500]