Dear Maintainer,

since upgrading to 1.20.12-1, I cannot connect to my ipsec/l2tp vpn anymore.

I tried many things, but the only thing that works is disabling mppe,
or downgrading to 1.20.10-1

Here are the debug log for 1.20.12-1:

fév 20 20:04:02 sphax pppd[88301]: CHAP authentication succeeded
fév 20 20:04:02 sphax pppd[88301]: nm-l2tp[87948] <info>  [helper-88301] phasechange: status 8 / phase 'network'
fév 20 20:04:02 sphax pppd[88301]: sent [CCP ConfReq id=0x1 <mppe +H -M +S +L -D -C>]
fév 20 20:04:02 sphax pppd[88301]: rcvd [IPCP ConfReq id=0x1 <addr 192.168.50.1>]
fév 20 20:04:02 sphax pppd[88301]: sent [IPCP TermAck id=0x1]
fév 20 20:04:02 sphax pppd[88301]: rcvd [proto=0x8281] 01 01 00 04
fév 20 20:04:02 sphax pppd[88301]: Unsupported protocol 'MPLSCP' (0x8281) received
fév 20 20:04:02 sphax pppd[88301]: sent [LCP ProtRej id=0x3 82 81 01 01 00 04]
fév 20 20:04:02 sphax pppd[88301]: rcvd [LCP ProtRej id=0x2 80 fd 01 01 00 0a 12 06 01 00 00 60]
fév 20 20:04:02 sphax pppd[88301]: Protocol-Reject for 'Compression Control Protocol' (0x80fd) received
fév 20 20:04:02 sphax pppd[88301]: MPPE required but peer negotiation failed
fév 20 20:04:02 sphax pppd[88301]: nm-l2tp[87948] <info>  [helper-88301] phasechange: status 10 / phase 'terminate'
fév 20 20:04:02 sphax pppd[88301]: nm-l2tp[87948] <info>  [helper-88301] phasechange: status 5 / phase 'establish'
fév 20 20:04:02 sphax pppd[88301]: PPPoL2TP options: debugmask 0
fév 20 20:04:02 sphax pppd[88301]: sent [LCP TermReq id=0x4 "MPPE required but peer negotiation failed"]
fév 20 20:04:02 sphax pppd[88301]: rcvd [LCP TermAck id=0x4]
fév 20 20:04:02 sphax pppd[88301]: nm-l2tp[87948] <info>  [helper-88301] phasechange: status 11 / phase 'disconnect'
fév 20 20:04:02 sphax pppd[88301]: Connection terminated.


And here is the log with 1.20.10-1:

fév 20 20:02:00 sphax pppd[87014]: CHAP authentication succeeded
fév 20 20:02:00 sphax pppd[87014]: nm-l2tp[86623] <info>  [helper-87014] phasechange: status 8 / phase 'network'
fév 20 20:02:00 sphax pppd[87014]: sent [IPCP ConfReq id=0x1 <addr 0.0.0.0>]
fév 20 20:02:00 sphax pppd[87014]: sent [IPV6CP ConfReq id=0x1 <addr fe80::c09b:5a53:5fc8:54ac>]
fév 20 20:02:00 sphax pppd[87014]: rcvd [IPCP ConfReq id=0x1 <addr 192.168.50.1>]
fév 20 20:02:00 sphax pppd[87014]: sent [IPCP ConfAck id=0x1 <addr 192.168.50.1>]
fév 20 20:02:00 sphax pppd[87014]: rcvd [proto=0x8281] 01 01 00 04
fév 20 20:02:00 sphax pppd[87014]: Unsupported protocol 'MPLSCP' (0x8281) received
fév 20 20:02:00 sphax pppd[87014]: sent [LCP ProtRej id=0x3 82 81 01 01 00 04]
fév 20 20:02:00 sphax pppd[87014]: rcvd [IPCP ConfNak id=0x1 <addr 192.168.50.25>]
fév 20 20:02:00 sphax pppd[87014]: sent [IPCP ConfReq id=0x2 <addr 192.168.50.25>]
fév 20 20:02:00 sphax pppd[87014]: rcvd [LCP ProtRej id=0x2 80 57 01 01 00 0e 01 0a c0 9b 5a 53 5f c8 54 ac]
fév 20 20:02:00 sphax pppd[87014]: Protocol-Reject for 'IPv6 Control Protocol' (0x8057) received
fév 20 20:02:00 sphax pppd[87014]: rcvd [IPCP ConfAck id=0x2 <addr 192.168.50.25>]

I still have the «Unsupported protocol», but then the connection carries on and works.

Don't hesitate to ask for more information, and thanks for your work,

Hi Rémi,
...


That behaviour is a consequence of the following commit in version 1.20.12 which doesn't disable the Compression Control Protocol (CCP) when MPPE is enabled (as MPPE protocol negotiation happens within CPP) :

https://github.com/nm-l2tp/NetworkManager-l2tp/commit/fdf5d98e86c5f0a97f9649fa3e23b3c001a93340

MPPE protocol negotiation had been broken since 2013 with the following commit which disabled CCP :

https://github.com/nm-l2tp/NetworkManager-l2tp/commit/5fe98f70344e842faa28014be7ba259c2db7ae8b

I don't think any MPPE encryption is being used in your 1.20.10-1 log output, even though MPPE is enabled, or am I interpreting things wrong?

MPPE encryption is very weak and is typically only used with L2TP VPN connections, not L2TP/IPsec which use much stronger IPsec encryption.



Cheers,
Doug

Oh, strange, I didn't receive your answer by mail...

I actually have no idea if MPPE is used in my 1.20.10-1 log, I just
configured it as I was told and never thought about it :)

Now that I documented myself, it makes sense that IPSEC is much
stronger. The l2tp tunnel being protected by IPSEC, there is no need for
MPPE at the l2tp level.

So now I can upgrade and adapt my configurations, but it would probably
be interresting to disable the MPPE possibility if IPSEC is used: make
it unselectable in the gui, or not enforce it when the vpn is created.

Thanks,

Just for completeness, I believe when MPPE is successfully negotiated, the following should appear in the logs (or similar for MPPE 40 or 64-bit) :
   MPPE 128-bit stateless compression enabled

Regarding GUI modifications, there are at least 3 different GUI front-end implementations and I'm only the upstream maintainer for one of them, also many people prefer the non-GUI nmcli.

For the time being I prefer an error if MPPE is enable and the negotiation fails. For existing VPN config files and establishing the VPN connection with the nm-l2tp-service, I don't like the idea of ignoring the MPPE setting if IPsec is enabled as it can give a false impression MPPE is enabled like in previous versions. For the connection editor GUI, I do like the idea of disabling the MPPE tick box if IPsec is enabled, but there are complications for existing VPN config files that have MPPE enabled, e.g. if MPPE is ignored in the connection editor, a new VPN config without MPPE enabled won't be generated unless the user clicks save or apply.

I'll close this issue, but will consider doing something in the upstream source code for the next release of NetworkManager-l2tp



Cheers,
Doug