Can't connect to VPN (nexus s - ice cream sandwich) [36937101]

Fixed

Bug

[AOSP] assigned

[AOSP] Released

[AOSP] FutureRelease

Status Update

No update yet.

Description

or...@gmail.com

created issue #1

Dec 19, 2011 02:17AM

I can not connect to my VPN anymore with my nexus s since the update for ics (4.0.3).

I'm going in settings > wireless > VPN.
The VPN is using L2tp - Ipsec with preshared keys. The vpn is still working with my tab (honeycomb 3.1).

I have check (and recheck) the passwords. I have a "Timeout" answer.
I have check a little on the VPN side, it is using xl2tp on Debian. The log just says:
check_control: Received out of order control packet on tunnel -1 (got 1, expected 0)

Comments

le...@gmail.com <le...@gmail.com> #2Dec 19, 2011 02:44AM

Hi, i`m facing the same issue :(

ri...@gmail.com <ri...@gmail.com> #3Dec 19, 2011 03:16AM

Thanks for reporting this!

bs...@gmail.com <bs...@gmail.com> #4Dec 19, 2011 09:17PM

Same here, any update? Stuck at alpha02 for a long time.

br...@gmail.com <br...@gmail.com> #5Dec 20, 2011 02:29AM

A few notes:

Should be using viewLifecyclerOwner.lifecycleScope instead of just lifecycleScope in a Fragment.
Cancellation is happening as a result of the fragment automatically paging over when they are initially created / added to viewpager2 (this is expected as far as I can tell)
Right now RemoteMediator kind of acts as a dumb callback whenever PagingSource runs out of items to load, so REFRESH error doesn't prevent remote PREPEND / APPEND. It's not clear to me yet whether it should or if we should change guidance to just handle APPEND. This is due to us changing the behavior of Remote REFRESH after the codelab was produced, so I'm very sorry for that. REFRESH is meant to handle any init that needs to happen, technically the initial network page fetch happens as a result of running out of items on the APPEND side.

e.g., Here is a modified sample from the opening post / #1's repro project that fixes the issue:

PageKeyedRemoteMediator.kt

override suspend fun load(
    loadType: LoadType,
    state: PagingState<Int, RedditPost>
): MediatorResult {
    try {
        // Get the closest item from PagingState that we want to load data around.
        val loadKey = when (loadType) {
            REFRESH -> {
                db.withTransaction {
                    postDao.deleteBySubreddit(subredditName)
                    remoteKeyDao.deleteBySubreddit(subredditName)
                }

                return MediatorResult.Success(endOfPaginationReached = false)
            }
            PREPEND -> return MediatorResult.Success(endOfPaginationReached = true)
            APPEND -> {
                // Query DB for SubredditRemoteKey for the subreddit.
                // SubredditRemoteKey is a wrapper object we use to keep track of page keys we
                // receive from the Reddit API to fetch the next or previous page.
                val remoteKey = db.withTransaction {
                    remoteKeyDao.remoteKeyByPost(subredditName)
                }

                when {
                    remoteKey == null -> null
                    // We must explicitly check if the page key is null after initial load, since the
                    // Reddit API informs the end of the list by returning null for page key, but
                    // passing a null key to Reddit API will fetch the initial page.
                    remoteKey.nextPageKey == null -> {
                        return MediatorResult.Success(endOfPaginationReached = true)
                    }
                    else -> remoteKey.nextPageKey
                }
            }
        }

        val data = redditApi.getTop(
            subreddit = subredditName,
            after = loadKey,
            before = null,
            limit = state.config.pageSize * 3
        ).data

        val items = data.children.map { it.data }

        db.withTransaction {
            remoteKeyDao.insert(SubredditRemoteKey(subredditName, data.after))
            postDao.insertAll(items)
        }

        return MediatorResult.Success(endOfPaginationReached = items.isEmpty())
    } catch (e: IOException) {
        return MediatorResult.Error(e)
    } catch (e: HttpException) {
        return MediatorResult.Error(e)
    } catch (e: CancellationException) {
        Log.d("RemoteMediator","$subredditName $loadType canceled")
        throw e
    }
}

bs...@gmail.com <bs...@gmail.com> #6Dec 20, 2011 11:58PM

Will keep this bug open to track the decision on blocking RemoteMediator PREPEND / APPEND after remote REFRESH error and any possible updates to the Codelab / Github samples.

The inconvenience of blocking on REFRESH is going to surface via needing to call retry(), but it's possible there's something better we can do to handle cancellation more gracefully since we don't want to keep creating new PagingData and also support loading in the background. (the thing to change to control this is when you start collecting from Pager.flow, and the scope collection happens in).

yo...@gmail.com <yo...@gmail.com> #7Dec 27, 2011 12:45PM

I have a question about the modified sample. Shouldn't deleteByXXX be moved to after redditApi execute successfully?

The UI side will see blink twice in this sample: Show db cache first then disappeared, show data again after redditApi successful and insert data. The user experience is pretty bad.

fs...@gmail.com <fs...@gmail.com> #8Dec 29, 2011 03:48PM

To be clear the above sample is a workaround a deeper issue in Paging which isn't handling cancellation gracefully due to Remote REFRESH errors not blocking remote PREPEND / APPEND.

bh...@gmail.com <bh...@gmail.com> #9Jan 3, 2012 06:45PM

I found that if using fragment.lifecycleScope.launchWhenResume to collect each page data then it will work normally. ViewPager2 FragmentStatePager will move fragment to onResume/onPause.

jn...@gmail.com <jn...@gmail.com> #10Jan 4, 2012 12:12PM

Good to hear, I think we can still do a better job of handling cancellation and propagating remote state, e.g., if you have many pages in viewpager and flip back and forth I think you'll still eventually get stuck, since the collector on PagingData will get canceled and there's no invalidate signal to restart it without manually calling adapter.refresh().

ma...@gmail.com <ma...@gmail.com> #11Jan 5, 2012 11:24AM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit c97e21810e49b3f8043c8d7c3951b16e8b38e6db
Author: Yigit Boyar <yboyar@google.com>
Date: Fri Oct 16 10:39:22 2020

Add priority to single runner

This CL adds ability to accept priority to SingleRunner.
It will be necessary for the new remote mediator implementation
where it will rely on single runner to cancel lower priority
requests.

Bug: 162252536
Test: SingleRunnerTest
Change-Id: I01351ac385b252f80ab6079d42f2cf0edf8d6667

M paging/common/src/main/kotlin/androidx/paging/SingleRunner.kt
M paging/common/src/test/kotlin/androidx/paging/SingleRunnerTest.kt

https://android-review.googlesource.com/1464523

ya...@gmail.com <ya...@gmail.com> #12Jan 6, 2012 02:53AM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit f86129d60bb33243d06837291f0e2bd0f26f4bd3
Author: Yigit Boyar <yboyar@google.com>
Date: Fri Oct 09 11:34:07 2020

RemoteMediatorAccessor Refactor

This CL changes how remote mediator and snapshots interact.

Previously, all calls to remote mediator were done in a
snapshot's scope and snapshot was also responsible to track
load states.
It created a problem where remote mediator calls would be
cancelled when snapshot is replaced by a newer one. It also
made the load state logic fairly complicated in PageFetcherSnapshot.

This CL de-couples the two as much as possible.

With this change, RemoteMediatorAcccessor uses the scope of
the `Pager.flow` collection instead of the scope from the
PageFetcherSnapshot. PageFetcherSnapshot is now only responsible
to send events to the accessor when it needs more data.
RemoteMediatorAccessor manages its own loading state.

We still need some syncronization between the two to ensure certain
load events are not dispatched before data is loaded (e.g. after a
pull to refresh, you don't want refresh state to go idle before the
new local data is loaded for UI consistency). This logic is now
handled by the PageFetcher where it appends the load states to each
insert page and for other events (loading, error), directly sends them
to the downstream.

Bug: 162252536
Test: RemoteMediatorAccessorTest, PageFetcherSnapshotTest
Relnote: "Paging will no longer cancel a `RemoteMediator#load` call
due to a page invalidation. It will also no longer make an
append/prepend load request, *if REFRESH is required*, until REFRESH
request completes successfully."

Change-Id: I6390be0c0c1073005456f928a2a8afa81c16d3ef

M paging/common/api/current.txt
M paging/common/api/public_plus_experimental_current.txt
M paging/common/api/restricted_current.txt
M paging/common/src/main/kotlin/androidx/paging/CachedPageEventFlow.kt
M paging/common/src/main/kotlin/androidx/paging/LoadStates.kt
M paging/common/src/main/kotlin/androidx/paging/MutableLoadStateCollection.kt
M paging/common/src/main/kotlin/androidx/paging/PageEvent.kt
M paging/common/src/main/kotlin/androidx/paging/PageFetcher.kt
M paging/common/src/main/kotlin/androidx/paging/PageFetcherSnapshot.kt
M paging/common/src/main/kotlin/androidx/paging/PageFetcherSnapshotState.kt
M paging/common/src/main/kotlin/androidx/paging/PagingDataDiffer.kt
M paging/common/src/main/kotlin/androidx/paging/RemoteMediator.kt
M paging/common/src/main/kotlin/androidx/paging/RemoteMediatorAccessor.kt
M paging/common/src/test/kotlin/androidx/paging/PageEventTest.kt
M paging/common/src/test/kotlin/androidx/paging/PageFetcherSnapshotStateTest.kt
M paging/common/src/test/kotlin/androidx/paging/PageFetcherSnapshotTest.kt
M paging/common/src/test/kotlin/androidx/paging/RemoteMediatorAccessorTest.kt
M testutils/testutils-paging/src/main/java/androidx/paging/RemoteMediatorMock.kt

https://android-review.googlesource.com/1456190

fs...@gmail.com <fs...@gmail.com> #13Jan 6, 2012 02:56AM

PPTP worked? Interesting. What are you connecting to?

gv...@gmail.com <gv...@gmail.com> #14Jan 6, 2012 09:09AM

I confirm that my nexus one running gingerbread 2.3.6 works fine connecting via L2TP to a sonicwall firewall at work, but my galaxy nexus does not. I have not tried PPTP.

ph...@googlemail.com <ph...@googlemail.com> #15Jan 6, 2012 02:14PM

This is also a problem on both my galaxy nexus 4.0.1 and my xoom running 4.0.3. It worked just fine on my nexus one 2.3.7 and xoom 3.2.1. My VPN is L2TP IPSEC PSK

bs...@gmail.com <bs...@gmail.com> #16Jan 6, 2012 02:25PM

This is a major issue for business users. I'd hate to go back to my blackberry, however if I cannot get VPN access to my corporate environment; I have no choice but to go back to my BB. Does anyone know how to escalate this issue?

rs...@gmail.com <rs...@gmail.com> #17Jan 6, 2012 03:57PM

Same problm when will it be fixed

ji...@gmail.com <ji...@gmail.com> #18Jan 9, 2012 12:22PM

We need VPN!!!

ru...@gmail.com <ru...@gmail.com> #19Jan 9, 2012 02:57PM

I am having the same problem on my HSPA Galaxy Nexus running stock v4.0.2. Receive timeout message when pinging from Android terminal works and receives response from L2TP server.

Connecting from another Android phone v2.3.5 to the same L2TP w ipsec psk works just fine. Please fix this bug ASAP!

ji...@gmail.com <ji...@gmail.com> #20Jan 10, 2012 11:47AM

Tried again but instead of using the HEX key I used the ASCII key and it works!
It is IPsec Xauth with PSK. Nexus S GSM running v4.0.3.

ja...@gmail.com <ja...@gmail.com> #21Jan 14, 2012 05:13AM

Same issue with my Galaxy Nexus v4.0.2 when trying to connect with either PPTP or L2TP. The VPN is working on other devices without issue. I'm receiving the same timeout error as mentioned previously. Please fix this issue. :(

tt...@gmail.com <tt...@gmail.com> #22Jan 14, 2012 08:45PM

Same issue with Asus Transformer Prime - Ice Cream Sandwich. Works fine with my Moto Droid Razr with the exact same settings. This is a major issue.

em...@craigsherriff.co.uk <em...@craigsherriff.co.uk> #23Jan 16, 2012 12:04AM

[Comment deleted]

cr...@gmail.com <cr...@gmail.com> #24Jan 16, 2012 12:08AM

No L2TP/IPSEC on Nexus S running ICS 4.0.3 - timeout error
PPTP works fine but is obviously less secure.
All worked fine previously on 2.3.7
VPN Router is DrayTek Vigor 2830Vn plus.

pe...@gmail.com <pe...@gmail.com> #25Jan 16, 2012 07:01AM

I have the same problem on my galaxy nexus Verizon 4.0.2. But it works on my transformer prime with honeycomb.

sh...@gmail.com <sh...@gmail.com> #26Jan 18, 2012 04:07AM

My Transformer Prime with Honeycomb works fine, but as soon as I try to connect to our L2tp with IPSec psk on my Transformer Prime running ICS 4.0.3, the device instantaneously reboots. I have two colleagues running ICS on their tablets with the same problem.

bi...@gmail.com <bi...@gmail.com> #27Jan 19, 2012 03:59PM

Same problem with Xoom after installing official update from Motorola last night (2.6.39.4-gf03a679 kernel, build IML77). Yesterday, I was able to connect to ibVPN.com using L2TP on the Xoom (with 3.2) just fine. Now, it returns "Timeout".

I confirmed that I'm able to connect to the VPN just fine using my phone (still running Gingerbread) while connected to the same wi-fi router as the Xoom, so it's absolutely not a router or connectivity issue.

vs...@gmail.com <vs...@gmail.com> #28Jan 24, 2012 05:03AM

I am having the same problem. I have a Nexus 4.0.2 and trying to connect using PPTP. Same settings work on all other devices (PC, IPAD, IPOD) but not on Galaxy Nexus ICS.

fs...@gmail.com <fs...@gmail.com> #29Jan 24, 2012 05:06AM

[Comment deleted]

mi...@gmail.com <mi...@gmail.com> #30Jan 24, 2012 10:52PM

Running ICS on a Transformer Prime Checkpoint L2TP now fails. VPN does work from a Droid 2 2.3 no issues. Behind the same router terminating VPN on same set of gateways. Need a fix.

be...@gmail.com <be...@gmail.com> #31Jan 25, 2012 07:07PM

Seeing the same problems on a Transformer Prime running 4.0.3. Can connect fine with Galaxy Nexus on 4.0.2, but don't see anything in the ASA logs when the Transformer tries to connect.

nb...@gmail.com <nb...@gmail.com> #32Jan 26, 2012 03:42PM

Transformer prime runing 4.0.3 same problem. Connecting to l2tp fails showing timeout. Logs on firwall show multiple resends of packets from the ip of the device but looks like the android device is not processing the responces from the firewall correctly. Need a fix for this issue. Can't deploy the devices in a corporate enviornment without VPN. Is there a way to get back to honeycomb after upgrading, at least vpn worked on that version?

xb...@gmail.com <xb...@gmail.com> #33Jan 26, 2012 06:03PM

I was able to get this working, but I had to root and install tun.ko module.

be...@capitollien.com <be...@capitollien.com> #34Jan 26, 2012 07:28PM

Same problem with Transformer Prime running 4.0.3. Successfully setup transformer with honeycomb using the exact same settings.

er...@gmail.com <er...@gmail.com> #35Jan 27, 2012 07:10AM

xbgl...@gmail.com
rooted and tun.ko installed but no luck....

how did you install tun.ko?

xb...@gmail.com <xb...@gmail.com> #36Jan 27, 2012 07:32AM

I placed tun.ko in /data/local/kernel_modules ( had to create it first ).
You can either insmod the module or reboot to get it loaded. The tun.ko
made anyconnect work, but I also have some other modules in the same dir,
that are suppose to help with the native vpn options. A simple google
search will point you in the correct direction if my method doesn't help
you.
On Jan 26, 2012 11:10 PM, <android@googlecode.com> wrote:

sh...@gmail.com <sh...@gmail.com> #37Jan 27, 2012 01:18PM

[Comment deleted]

sh...@gmail.com <sh...@gmail.com> #38Jan 27, 2012 01:19PM

[Comment deleted]

sh...@gmail.com <sh...@gmail.com> #39Jan 27, 2012 01:20PM

[Comment deleted]

sh...@gmail.com <sh...@gmail.com> #40Jan 27, 2012 01:27PM

I have the same problem on galaxy nexus running android 4.0.2. I receive time out while trying to connect to PPTP VPNs.

[Deleted User] <[Deleted User]> #41Jan 29, 2012 10:38AM

Hardware: Transformer Prime
Same Issue: With Android 3.2.1 it has always been possible to establish a VPN connection (L2TP/IPSec with PSK), on Android 4.0.3 the connection is rejected with a timeout error. ... very annoying!

Is there any information available on how and especially when this error is going to be fixed?

sh...@gmail.com <sh...@gmail.com> #42Jan 30, 2012 12:38PM

I'm on the Galaxy Nexus and facing exactly the same issue. My L2TP connection keeps timing out no matter what I do. Switching to PPTP is not an option for me since it's blocked where I'm at.

nb...@gmail.com <nb...@gmail.com> #43Jan 30, 2012 12:45PM

HOw many instances need to be logged in order for google to look at this and fix it. I am having to rethink my entire deployment to my sales staff since I can't give them devices with ICS because they won't be able to connect to my network. I can't downgrade the deivces back to honeycomb either. This is a major issue for business users.

mt...@gmail.com <mt...@gmail.com> #44Jan 31, 2012 03:36PM

galaxy nexus not working with vpn. I thought this problem has been fixed in ICS

he...@gmail.com <he...@gmail.com> #45Feb 1, 2012 11:37AM

[Comment deleted]

he...@gmail.com <he...@gmail.com> #46Feb 1, 2012 11:40AM

After updating to ICS my Motorola Zoom cannot connect by Vpn to Sonicwall firewall appliance. I get a timeout response.

ro...@gmail.com <ro...@gmail.com> #47Feb 1, 2012 03:43PM

Nexus S same issue here. 4.0.3

mp...@googlemail.com <mp...@googlemail.com> #48Feb 3, 2012 10:07PM

I updated my HTC Desire with CM9 Beta (Android 4.0.3). There is the same issue. I checked the logs of my VPN installation and found:

syslog:
eb 3 13:15:01 neptun xl2tpd[1393]: Connection 4116 closed to 192.168.0.122, port 57384 (Timeout)
Feb 3 13:15:01 neptun xl2tpd[1393]: check_control: Received out of order control packet on tunnel -1 (got 1, expected 0)
Feb 3 13:15:01 neptun xl2tpd[1393]: handle_packet: bad control packet!
Feb 3 13:15:06 neptun xl2tpd[1393]: Maximum retries exceeded for tunnel 39949. Closing.
Feb 3 13:15:06 neptun xl2tpd[1393]: Unable to deliver closing message for tunnel 58809. Destroying anyway.

auth.log:
Feb 3 14:55:23 neptun pluto[1667]: "L2TP-PSK-NAT"[20] 192.168.0.122 #18: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Feb 3 14:55:23 neptun pluto[1667]: "L2TP-PSK-NAT"[20] 192.168.0.122 #18: malformed payload in packet
Feb 3 14:55:23 neptun pluto[1667]: | payload malformed after IV
Feb 3 14:55:23 neptun pluto[1667]: | ee 26 6c bb f8 0d e2 fe bf 11 0a aa ed 7e c7 98
Feb 3 14:55:23 neptun pluto[1667]: "L2TP-PSK-NAT"[20] 192.168.0.122 #18: sending notification PAYLOAD_MALFORMED to

192.168.0.122:4500

I use
openswan 1:2.6.23+dfsg-1ubuntu1
xl2tpd 1.2.5+dfsg-1

pa...@gmail.com <pa...@gmail.com> #49Feb 4, 2012 01:56AM

I can confirm the report in

comment #47

. The setup I experience the failure with is:

Server - behind NAT - running CentOS 6.2 x86_64 with Openswan-2.6.32-9.el6
Client - public IP - Nexus S with 4.0.3

Other reports of the same error on the Openswan mailinglist mentioned that their server was on a public IP address while their phone was behind NAT.

Here is the comment of Paul Wouters - one of the Openswan developers on the Openswan mailinglist:

Jan 18 13:27:38 vpnbox pluto[23572]: "ipsec-l2tp-roadwarrior"[135]
x.x.x.29 #69644: byte 7 of ISAKMP NAT-OA Payload must be zero, but is
not

There is either a bug in the openswan NAT-OA implementation, or one in
the android implementation. We have to check this on the RFC and see if
we can see what's going on there (

http://www.ietf.org/rfc/rfc3947.txt)

I hope you guys can fix this asap. If you have a fix I'll be happy to test it for you. Thanks!

la...@gmail.com <la...@gmail.com> #50Feb 4, 2012 01:18PM

Same here ICS 4.0.3 and cannot connect to IPSEC vpn timeout error. Is there a fix yet this is crippling!

jo...@gmail.com <jo...@gmail.com> #51Feb 4, 2012 07:08PM

me too.. same problem here.

ICS on Board VPN: Time out.
VPNC Widget from Android Market: Works great without problems...

I use the ICS-ROM form

sandvold.as on my HTC Desire and connect to the FRITZ!Box 7390. :)

(a soon fix would be REALLY great)

ga...@googlemail.com <ga...@googlemail.com> #52Feb 5, 2012 01:20PM

Is there any 3rd party app available as a workaround for ICS?

ma...@gmail.com <ma...@gmail.com> #53Feb 6, 2012 09:40PM

@jonny0

Thank you very much for recommending the VPNC Widget! I had a lot of issues connecting to our university IPSEC PSK auth (CISCO) VPN with the stock client. Strangely, stock VPN client did connect without any problems, but no data was transferred.

Now - with the VPNC Widget, everything works smooth! Awesome

Using Galaxy Nexus, ICS 4.0.3 AOPK Milestone 3, Francokernel 15.2

br...@gmail.com <br...@gmail.com> #54Feb 8, 2012 02:36AM

Updated my vzw gnex to ics 4.0.4. Still getting timeout using L2TP/psk with sonicwall router.

xm...@gmail.com <xm...@gmail.com> #55Feb 8, 2012 12:12PM

i got the same log as

comment #47

auth.log
Feb 8 20:10:16 localhost pluto[7325]: | payload malformed after IV
Feb 8 20:10:16 localhost pluto[7325]: | bb 4e aa 73 d8 7c 7f 3e 1b 69 a7 86 cb 95 90 cf
Feb 8 20:10:16 localhost pluto[7325]: "L2TP-PSK-NAT"[32] 121.0.29.206 #30: sending notification PAYLOAD_MALFORMED to

121.0.29.206:60138
Feb 8 20:10:19 localhost pluto[7325]: "L2TP-PSK-NAT"[32] 121.0.29.206 #30: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Feb 8 20:10:19 localhost pluto[7325]: "L2TP-PSK-NAT"[32] 121.0.29.206 #30: malformed payload in packet

syslog

Feb 8 20:10:52 localhost xl2tpd[7691]: check_control: Received out of order control packet on tunnel -1 (got 1, expected 0)
Feb 8 20:10:52 localhost xl2tpd[7691]: handle_packet: bad control packet!
Feb 8 20:10:57 localhost xl2tpd[7691]: Maximum retries exceeded for tunnel 7459. Closing

jo...@gmail.com <jo...@gmail.com> #56Feb 8, 2012 08:44PM

I have a Verizon Wireless Galaxy Nexus running ICS 4.0.2 and I'm getting errors (Payload processing failed - Payload Type: NATOA-RFC3947) using L2TP/psk with Sonicwall NSA 2400.

ma...@gmail.com <ma...@gmail.com> #57Feb 11, 2012 04:09PM

Same issue: Transformer Prime with 4.0.3 always get's Timeout error.

wa...@gmail.com <wa...@gmail.com> #58Feb 11, 2012 09:39PM

Same Issue Galaxy Nexus running 4.0.2 I have tried both PPTP and L2TP neither work on ICS but both work on My Honeycomb tab and my previous Gingerbread Phone.

wa...@gmail.com <wa...@gmail.com> #59Feb 11, 2012 10:05PM

I have found that when using my VPN providers DNS (StrongVPN)216.131.95.20 and not googles i can connect using pptp. I had to entered the DNS IP as the DNS server and search domain.

I hope this can help some I have not yet tried this when using L2TP.

n-...@naftolijacobs.com <n-...@naftolijacobs.com> #60Feb 14, 2012 07:09PM

Same issue with both my Galaxy Nexus and transformer Prime. PPTP will work but not L2TP.

re...@gmail.com <re...@gmail.com> #61Feb 16, 2012 07:24PM

Same issue here. Getting the same log data as xmxsuperstar a few posts above. This worked fine in Gingerbread, broke as soon as my Nexus S upgraded to ICS.

pe...@gmail.com <pe...@gmail.com> #62Feb 16, 2012 10:28PM

I can confirm the report (in

comment #47

and #48 for example). The setup I experience the failure with is:

Server - behind NAT - running Fedora 16 x86_64 with openswan-2.6.37-1.fc16
Client - public IP - Galaxy S with 4.0.3

pa...@gmail.com <pa...@gmail.com> #63Feb 21, 2012 10:43PM

Same issue on galaxy tab 10.1 running cm9 4.03 connecting to ms isa 2006.

Google need to fix this, I went back to Honeycomb, and won't be buying any ics devices until this is fixed.

ma...@gmail.com <ma...@gmail.com> #64Feb 21, 2012 11:05PM

It's my first time that I reported an issue here... How is the response time? Shouldn't this bugs state be changed from new to whatever after about 2 months?

ne...@gmail.com <ne...@gmail.com> #65Feb 23, 2012 10:34PM

I have the same problem. This should have some priority to be solved.
It's just annoying.

ba...@gmail.com <ba...@gmail.com> #66Feb 24, 2012 03:49AM

same issue on my galaxy nexus 4.0.2, I need this bug fixed or given a solution at least!

kr...@gmail.com <kr...@gmail.com> #67Feb 24, 2012 11:00AM

Not a solution, it's more a workaround: the VPN works fine if racoon (ipsec-tools) is used on the server instead of {open,strong}swan.
Otherwise I see the same behaviour reported in

comment #47

, with a Nexus S and ICS 4.0.3

ke...@gmail.com <ke...@gmail.com> #68Feb 24, 2012 09:15PM

Just upgraded my transformer and pptp vpn stopped working. It connects, sends and receives about 20 packets but then nothing happens.

I use vpn daily, and this is a major problem form me. HELP!!!!

ke...@gmail.com <ke...@gmail.com> #69Feb 24, 2012 09:15PM

[Comment deleted]

ke...@gmail.com <ke...@gmail.com> #70Feb 25, 2012 09:09AM

SOLVED ensure your subnet mask is not the same. Change my home subnet and started working again.

ke...@gmail.com <ke...@gmail.com> #71Feb 25, 2012 09:10AM

[Comment deleted]

gd...@gmail.com <gd...@gmail.com> #72Feb 25, 2012 10:00AM

Not the same? Not the same as what? Anyway, I have the same issue whenever I try on several different networks. I can't change the subnet on most of them.

Issue not solved.

st...@googlemail.com <st...@googlemail.com> #73Feb 26, 2012 01:43AM

Same problem on GNexus with Android 4.0.2 and OpenSwan 2.6.37. Same message as in #47.

ga...@gmail.com <ga...@gmail.com> #74Feb 26, 2012 06:01PM

My company is changing it's VPN to L2tp - Ipsec with pre shared keys, and the results I'm getting with an Asus Transformer Prime with ICS 4.0.3 are a disaster:Each time I try to connect to the VPN, it crashes and reboots.
I also have a ZTE Blade phone with 2.3.5 and the VPN works fine.

da...@gmail.com <da...@gmail.com> #75Feb 27, 2012 09:18AM

If anyone who has been able to get the ice cream sandwich vpn to work with racoon on the server could post a link to instructions as to how to configure the server side of things with racoon and whatever else is needed (l2tp, ppp?), it would be greatly appreciated, at least until this issues is resolved.

kr...@gmail.com <kr...@gmail.com> #76Feb 27, 2012 12:35PM

Debian + racoon + xl2tpd:

http://wiki.debian.org/HowTo/AndroidVPNServer
It's still WIP, but you should be able to figure it out especially if you already have a {open,strong}swan installation (the only difference is racoon).

ma...@gmail.com <ma...@gmail.com> #77Feb 27, 2012 10:00PM

@comment 75: what exactly has this to do with our problems?

ca...@gmail.com <ca...@gmail.com> #78Feb 29, 2012 08:45PM

Just upgraded my Transformer (TF101) to 4.0.3 and having the same problem.

ma...@beck.im <ma...@beck.im> #79Mar 1, 2012 07:00AM

Same Problem with 4.0.2 and Galaxy Nexus

bs...@gmail.com <bs...@gmail.com> #80Mar 1, 2012 08:36PM

For those of you that use a sonicwall routers, they just came out with a
VPN client called "mobile Connect". It was made specify for ICS 4.0 and
higher. It works great for us sonicwall users! It's available in the app
world for free.

Note, do not download the Net extender as it won't work on ICS.

Hope all you other users get a VPN solution soon. I know how bad it sucks
not having it.

Take care

ka...@gmail.com <ka...@gmail.com> #81Mar 2, 2012 07:10PM

@comment 79

This appears to be only a on network solution through SSL VPN, so if Im not on my companies network Im still SOL as far as connecting remotely to the VPN

jo...@ltjr.net <jo...@ltjr.net> #82Mar 3, 2012 04:47AM

[Comment deleted]

le...@ltjr.net <le...@ltjr.net> #83Mar 3, 2012 04:48AM

I'm also having this problem on my Transformer Prime. IPSEC / L2TP PSK.

Just loaded the latest OTA update 9.4.2.15, but hasn't fixed the problem.

Connecting to Sonicwall PRO 3060 running SonicOS Enhanced 4.2.1.3-4e

The Sonicwall logs indicate that phase 1 completes successfully. The Sonicwall receives a "Quick Mode request (phase 2)" and then receives another packet from the tablet. That packet generates an error: "Payload Processing failed ... VPN Policy: WAN GroupVPN; Payload Type: NATOA-RFC3947"

I see that there's an updated Sonicwall firmware available -- has anyone tried this with another Sonicwall firmware version?

For what it's worth, I can connect from my Mac and my Droid (Android 2.2) just fine.

I can't get VPNC to work either -- it completes phase 1, but then it just hangs. Any pointers on getting VPNC to work with Sonicwall?

al...@gmail.com <al...@gmail.com> #84Mar 3, 2012 02:05PM

Same problem after 4.0.2 on GSM Nexus upgrade...

dr...@emailaccount.nl <dr...@emailaccount.nl> #85Mar 4, 2012 06:49PM

Same problem here on Asus Transformer. PPTP does work, but somehow stops sending data after around 10 minutes so I manually have to disconnect/reconnect which is also not really an option.

de...@gmail.com <de...@gmail.com> #86Mar 14, 2012 03:39AM

same prob with IPsec Xauth PSK on 4.0.2 (Samsung Galaxy Nexus).

I get this in the syslog after connecting to an AVM Fritzbox 7170:

I/Vpn ( 194): Switched from [Legacy VPN] to [Legacy VPN]
I/Vpn ( 194): Switched from [Legacy VPN] to [Legacy VPN]
I/Vpn ( 194): Switched from [Legacy VPN] to [Legacy VPN]

V/LegacyVpnRunner( 194): Waiting
V/LegacyVpnRunner( 194): Executing
D/racoon (22949): Waiting for control socket
D/racoon (22949): Received 9 arguments
I/racoon (22949): ipsec-tools 0.8.0 (

http://ipsec-tools.sf.net)
W/JNIHelp ( 194): Discarding pending exception (java.io.IOException: Try again) to throw java/io/IOExceptionI/racoon (22949): 31.251.xxx.xxx[500] used for NAT-T
I/racoon (22949): 31.251.xxx.xxx[500] used as isakmp port (fd=10)
I/racoon (22949): 31.251.xxx.xxx[4500] used for NAT-T
I/racoon (22949): 31.251.xxx.xxx[4500] used as isakmp port (fd=11)
I/racoon (22949): initiate new phase 1 negotiation: 31.251.xxx.xxx[500]<=>79.228.xxx.xxx[500] I/racoon (22949): begin Aggressive mode.

I/LegacyVpnRunner( 194): AbortingI/LegacyVpnRunner( 194): java.lang.IllegalStateException: Time is up
I/LegacyVpnRunner( 194): at com.android.server.connectivity.Vpn$LegacyVpnRunner.checkpoint(Vpn.java:460)
I/LegacyVpnRunner( 194): at com.android.server.connectivity.Vpn$LegacyVpnRunner.execute(Vpn.java:571)
I/LegacyVpnRunner( 194): at com.android.server.connectivity.Vpn$LegacyVpnRunner.run(Vpn.java:447)
E/racoon (22949): Connection is closed I/racoon (22949): Bye

al...@gmail.com <al...@gmail.com> #87Mar 14, 2012 11:09AM

[Comment deleted]

al...@gmail.com <al...@gmail.com> #88Mar 14, 2012 11:11AM

Hello there,

Same bug on Samsung Galaxy S2 ICS 4.0.3

L2TP/IPSec Connection with PSK, on an OpenSwan server.

Here is what my auth.log says :

Mar 14 12:06:16 serverVpnIpsec pluto[24356]: "test"[15] 217.XXX.XXX.XXX #49: new NAT mapping for #49, was 217.XXX.XXX.XXX:44571, now 217.XXX.XXX.XXX:55271
Mar 14 12:06:16 serverVpnIpsec pluto[24356]: "test"[15] 217.XXX.XXX.XXX #49: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
Mar 14 12:06:16 serverVpnIpsec pluto[24356]: "test"[15] 217.XXX.XXX.XXX #49: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Mar 14 12:06:16 serverVpnIpsec pluto[24356]: "test"[15] 217.XXX.XXX.XXX #49: received and ignored informational message
Mar 14 12:06:17 serverVpnIpsec pluto[24356]: "test"[15] 217.XXX.XXX.XXX #49: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Mar 14 12:06:17 serverVpnIpsec pluto[24356]: "test"[15] 217.XXX.XXX.XXX #49: malformed payload in packet

And here is what rfc 3947 (

http://www.ietf.org/rfc/rfc3947.txt) concerning NAT-T says :

The format of the NAT-OA packet is

1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8
+---------------+---------------+---------------+---------------+
| Next Payload | RESERVED | Payload length |
+---------------+---------------+---------------+---------------+
| ID Type | RESERVED | RESERVED |
+---------------+---------------+---------------+---------------+
| IPv4 (4 octets) or IPv6 address (16 octets) |
+---------------+---------------+---------------+---------------+

The payload type for the NAT original address payload is 21.

The ID type is defined in the [RFC2407]. Only ID_IPV4_ADDR and
ID_IPV6_ADDR types are allowed. The two reserved fields after the ID
Type must be zero.

The 7th byte should be 0 according to the RFC. Android is apparently not following this, thus giving an error with OpenSwan implementation of NAT-T.
With a Cisco ASA gateway, I haven't encountered this issues, maybe Cisco implementation is more tolerant regarding RSERVED bytes.

du...@gmail.com <du...@gmail.com> #89Mar 15, 2012 01:53AM

Same issue: Samsung Nexus..

byte 7 of ISAKMP NAT-OA Payload must be zero, but is not

Please fix this ASAP!

o....@gmail.com <o....@gmail.com> #90Mar 16, 2012 02:40PM

Same issue: Reboot on TF201 from Asus

de...@gmail.com <de...@gmail.com> #91Mar 17, 2012 12:31PM

same here with a GalaxyS2 on 4.03. PPTP works fine, L2TP/Ipsec gives a timeout

sc...@gmail.com <sc...@gmail.com> #92Mar 17, 2012 04:25PM

same here nexus s 4.0.3..please fix

sc...@gmail.com <sc...@gmail.com> #93Mar 17, 2012 04:25PM

[Comment deleted]

ch...@android.com <ch...@android.com> #94Mar 19, 2012 05:34PM

Assigned to ch...@android.com.

Hmm, sounds like a bug in ipsec-tools 0.8.0.

ro...@gmail.com <ro...@gmail.com> #95Mar 20, 2012 10:39PM

I have the same issue on my SGS2, ics 4.0.3, the firewall side shows everithing fine, auth phase passed, etc. Using L2tp/ipsec psk

ch...@android.com <ch...@android.com> #96Mar 20, 2012 10:53PM

For people who know how to access system logs,

it seems that ipsec-tools 0.8.0 introduced several compatibility issues. For example, NAT-OA in RFC 3947 was added in isakmp_quick.c:quick_i1send() in version 0.8.0. It should only affect NAT cases. If anyone can make his device out of NAT, such as over 3G, could you give it a try and let me know how it works? Thanks.

Hi lee@ltjr.net,

SonicWALL uses DHCP over IPSec (RFC 3456), which is currently not supported by ipsec-tools. What we do right now is mode-config.

ca...@gmail.com <ca...@gmail.com> #97Mar 20, 2012 11:22PM

Have the problem over 3G as well on my SGS2 4.0.3...

ch...@android.com <ch...@android.com> #98Mar 21, 2012 12:01AM

Is anyone willing to let me test against your VPN server? Please contact me privately. Thanks.

ch...@android.com <ch...@android.com> #99Mar 21, 2012 12:13AM

In ipsec-tools 0.8.0, NAT-OA is filled using the address from phase 2 handler, whose port number is not guaranteed to be zero. That is why we are seeing this issue. The address from phase 2 handler was copied from phase 1 handler, and its port number is filled by the default value if not set. Maybe switching back to 0.7.3 is a more feasible fix...

ri...@gmail.com <ri...@gmail.com> #100Mar 21, 2012 01:55AM

well, where can I find ipsec-tools version 0.7.3? just replace the one in the phone?

ar...@gmail.com <ar...@gmail.com> #101Mar 21, 2012 07:09AM

@ comment 98

can you create a patch file to fix this problem ?
i don't know what are you talking about .

ch...@android.com <ch...@android.com> #102Mar 23, 2012 02:19AM

Thanks for everyone who allowed me to test against your VPN servers. So far I patched 3 places in 0.8.0 but it still cannot successfully connect to all the servers. I also finished porting 0.7.3 to ICS, but I need more time to test the new VPN types. Please stay tuned. Contact me privately if you want me to give your server a try. Thanks.

eq...@gmail.com <eq...@gmail.com> #103Mar 26, 2012 03:26AM

Please attached your patched 0.8.0 or porting 0.7.3, I will help you to verify, thanks.

eq...@gmail.com <eq...@gmail.com> #104Mar 26, 2012 08:28AM

[Comment deleted]

eq...@gmail.com <eq...@gmail.com> #105Mar 26, 2012 08:30AM

Or send attachment to me via Gmail. Thanks.

pa...@gmail.com <pa...@gmail.com> #106Mar 26, 2012 09:47AM

Hi, if you can send me either that 0.7.3 port for ics or the patched 0.8.0 I will test against Microsoft ISA Server LT2P/IPSec

Cheers

ch...@android.com <ch...@android.com> #107Mar 26, 2012 10:02PM

Marked as fixed.

I am done with testing. Thanks everyone.

eq...@gmail.com <eq...@gmail.com> #108Mar 27, 2012 02:48AM

[Comment deleted]

eq...@gmail.com <eq...@gmail.com> #109Mar 27, 2012 02:51AM

Hi, Chiachi

When do you give us a beta version to test? Thanks for your support.

mi...@gmail.com <mi...@gmail.com> #110Mar 27, 2012 04:43PM

with the latest KANG build, I still cannot connect to VPN (both PPTP and L2TP).
here is the associated log:

I/Vpn ( 190): Switched from [Legacy VPN] to [Legacy VPN]
V/LegacyVpnRunner( 190): Waiting
V/LegacyVpnRunner( 190): Executing
D/mtpd ( 4222): Waiting for control socket
I/LatinIME( 543): InputType.TYPE_NULL is specified
W/LatinIME( 543): Unexpected input class: inputType=0x00000000 imeOptions=0x00000000
D/mtpd ( 4222): Received 20 arguments
I/mtpd ( 4222): Using protocol pptp
I/mtpd ( 4222): Connecting to 72.28.97.3 port 1723 via eth0
I/mtpd ( 4222): Connection established (socket = 11)
D/mtpd ( 4222): Sending SCCRQ
D/mtpd ( 4222): Received SCCRP -> Sending OCRQ (local = 12191)
I/mtpd ( 4222): Tunnel established
D/mtpd ( 4222): Received OCRQ (remote = 46935)
I/mtpd ( 4222): Session established
I/mtpd ( 4222): Creating PPPoX socket
F/mtpd ( 4222): Socket() Protocol not supported
I/LegacyVpnRunner( 190): Aborting
I/LegacyVpnRunner( 190): java.lang.IllegalStateException: mtpd is dead
I/LegacyVpnRunner( 190): at com.android.server.connectivity.Vpn$LegacyVpnRunne r.execute(Vpn.java:569)
I/LegacyVpnRunner( 190): at com.android.server.connectivity.Vpn$LegacyVpnRunne r.run(Vpn.java:447)

ch...@android.com <ch...@android.com> #111Mar 27, 2012 05:18PM

Hi Michael,

Your build is broken. Both VPN drivers were missing in your kernel, as shown in:
I/mtpd ( 4222): Creating PPPoX socket
F/mtpd ( 4222): Socket() Protocol not supported

You need PPPOLAC and PPPOPNS drivers.

pr...@gmail.com <pr...@gmail.com> #112Mar 27, 2012 06:37PM

chia...@android.com,

PPPOPNS and PPPOLAC are included in the kernel along with TUN.

ICS 4.0.3.

mtpd service line is in init. Is there anything else needed to get this going?

pr...@gmail.com <pr...@gmail.com> #113Mar 27, 2012 06:40PM

chia...@android.com,

Here is the defconfig for the kernel that Michael is currently using:

https://github.com/pershoot/galaxy-2636/blob/ics/arch/arm/configs/pershoot_samsung_p4-ics_defconfig

ch...@android.com <ch...@android.com> #114Mar 27, 2012 06:44PM

Hi Prashsomash,

Are you seeing the same error as Michael? If you know how to build a kernel, please also make sure that if_pppnlac.h, if_pppopns.h, and if_pppox.h in the kernel tree match the ones in bionic.

pr...@gmail.com <pr...@gmail.com> #115Mar 27, 2012 06:47PM

That's my github staging area:)

Will log an attempt, and will also check those files out and reply back here (either tonight or tomorrow).

Thanks so much for the assistance.

ch...@android.com <ch...@android.com> #116Mar 27, 2012 06:59PM

Hi Prashsomash,

The drivers in your tree were out of date, so you got a mismatch between kernel space and user space. The latest drivers can be found from

https://android.googlesource.com/kernel/common.git.

pr...@gmail.com <pr...@gmail.com> #117Mar 27, 2012 07:04PM

yup, cool. will work on backporting the drivers tonight to my kernel revision.

de...@gmail.com <de...@gmail.com> #118Mar 28, 2012 05:28AM

May I ask how a generic user can patch his phone without unlocked bootloader?
Kinda annoying, no connection (even over wifi) to ANY VPN-server with the Galaxy Nexus and ICS 4.0.2

pr...@gmail.com <pr...@gmail.com> #119Mar 28, 2012 07:15AM

hi chia. i backported ppp.

pptp without encryption works without issue. with encryption is non working:

E/pppd ( 1981): MPPE required but peer negotiation failed
D/pppd ( 1981): Discarded non-LCP packet when LCP not open
D/pppd ( 1981): Discarded non-LCP packet when LCP not open
D/mtpd ( 1979): Recevied SLI
I/pppd ( 1981): Connection terminated.
W/Netd ( 111): No subsystem found in netlink event
D/NetlinkEvent( 111): Unexpected netlink message. type=0x11

l2tp with shared key is non working as well. l2tp is enabled.

D/mtpd ( 1963): Timeout -> Sending SCCRQ
I/racoon ( 1742): the packet is retransmitted by xx.xx.xx.x[500] (2).

and so on and so forth.

any thoughts? XFRM should be recent in my tree, and mppe falls under the backport.

thx.

pr...@gmail.com <pr...@gmail.com> #120Mar 28, 2012 03:58PM

hi chia.

please get back to me when you can. eager to get this fixed up.

thx.

te...@gmail.com <te...@gmail.com> #121Mar 28, 2012 05:35PM

When will the "future release" be available that patches ipsec-tools 0.8.0?
Thx,

pr...@gmail.com <pr...@gmail.com> #122Mar 28, 2012 11:00PM

hi chia.

l2tp over 3g works. l2tp over wifi doesnt work (timeout -> sccrq).

letting you know.

an...@gmail.com <an...@gmail.com> #123Mar 29, 2012 08:26AM

Same problem on SGS2 2.3.4.

ev...@gmail.com <ev...@gmail.com> #124Mar 29, 2012 02:56PM

Same issue: Reboot on TF201 from Asus. On ICS 4.0.3

ak...@gmail.com <ak...@gmail.com> #125Mar 30, 2012 02:43AM

Hope for solution as fast as quickly.

ya...@gmail.com <ya...@gmail.com> #126Apr 1, 2012 08:10AM

Hi, chia
Can I know when you will submit the patch and we can get the fix?

le...@ltjr.net <le...@ltjr.net> #127Apr 1, 2012 01:37PM

Glad to see progress on this issue. Am happy to help with testing if I can.

For what its worth, I just loaded the most recent OTA firmware upgrade from ASUS for my transformer prime (version 9.4.2.21) and still have this issue. Not surprised; seems like the work that Chia and others are doing is not fully baked yet.

Don't hesitte to email me if I can help.

Lee

hy...@gmail.com <hy...@gmail.com> #128Apr 1, 2012 06:06PM

[Comment deleted]

jm...@gmail.com <jm...@gmail.com> #129Apr 2, 2012 06:24AM

Having same exact issue as

comment #82

on a sonicwall device with both native ics vpn and vpnc. Would be glad to test.

ma...@gmail.com <ma...@gmail.com> #130Apr 2, 2012 04:49PM

Does this bug occur with ICS 4.0.4?

ti...@gmail.com <ti...@gmail.com> #131Apr 3, 2012 07:46AM

I have the same problem with ICS 4.0.4 (HTC Desire)...

[Deleted User] <[Deleted User]> #132Apr 3, 2012 08:36AM

Still having the problem with Google Nexus 4.0.4

sa...@gmail.com <sa...@gmail.com> #133Apr 5, 2012 05:18AM

4.0.4 still doesn't work

sh...@gmail.com <sh...@gmail.com> #134Apr 5, 2012 02:00PM

Accidentally posted in a new thread, but I'll add my voice here. Nexus S running 4.0.4 can't connect to my PPTP VPN over Wi-Fi or EDGE connection. All other devices connect without a problem.

bi...@gmail.com <bi...@gmail.com> #135Apr 5, 2012 04:31PM

me too the vpn l2tp/ipsec psk doesnt work after upgrading to android 4.0.4

eq...@gmail.com <eq...@gmail.com> #136Apr 6, 2012 06:23AM

hi chia.

When can we get the patch of your fixed? We have been troubled for a long time, need your help. Thanks.

my...@gmail.com <my...@gmail.com> #137Apr 8, 2012 04:50PM

why these problems still exist after upgrading to 4.0.4 ? Come on google!

xc...@gmail.com <xc...@gmail.com> #138Apr 9, 2012 07:28AM

hi chia,
please fix this bug ASOP, it is crucial for the people who behind GFW.
家齊，freedom is waiting for your push!

vb...@gmail.com <vb...@gmail.com> #139Apr 11, 2012 12:47PM

Hi chia,
I have the same problems as everyone else above, when do you think it will be fixed? Should we rollback to 3.2.1.

ya...@gmail.com <ya...@gmail.com> #140Apr 11, 2012 03:18PM

i won't move to 4.04 before this issue is fixed！

pi...@gmail.com <pi...@gmail.com> #141Apr 12, 2012 05:13AM

both my SE Xperia Arc with android 4.0.3 and my transformer with CM9 (4.0.4) suffer from this issue!

ae...@gmail.com <ae...@gmail.com> #142Apr 12, 2012 06:15AM

Connection to VPN with Transformer TF101G stopped to work a second after I installed the official long-waited 4.0.3
We bought tablets to access our servers in mobility... this is a CRUCIAL issue for us !

pa...@gmail.com <pa...@gmail.com> #143Apr 13, 2012 01:14AM

Asus TF201, Android 4.0.3. Every time that I try to connect to VPN (L2TP) the tablet reboots. I need the VPN to work!

te...@gmail.com <te...@gmail.com> #144Apr 13, 2012 12:07PM

I hear that VZW has the fixed/patched OS release in test. Watch for the new push and let the rest of know it works!

ne...@gmail.com <ne...@gmail.com> #145Apr 13, 2012 02:46PM

samsung galaxy tab pt-g7500 on ics 4.0.3 with the same problem (pptp and l2tp)

Hope it will get fixed soon!

sh...@googlemail.com <sh...@googlemail.com> #146Apr 17, 2012 07:23AM

Samsung Galaxy S2, 4.0.3

With my old version 2.3.5 it works without any problems, now with ICS I get a timeout

[Deleted User] <[Deleted User]> #147Apr 17, 2012 05:27PM

Galaxy Nexus running CM9 (4.0.4) chiming in to say it's broken here too. Work VPN doesn't connect and neither does VyprVPN. Heck I even set up OpenSwan on my VPS to test, it's broken there too.

I wonder if there's a way we could compile a flashable zip with a new ipsec-tools.

ch...@gmail.com <ch...@gmail.com> #148Apr 18, 2012 09:53PM

Same here: Timeout!

Samsung Nexus S - ICS 4.0.4 / SonicWall

Used to work flawlessly with GB 2.3.6!

ch...@gmail.com <ch...@gmail.com> #149Apr 19, 2012 02:52AM

hi ,always Timeout -> Sending SCCRQ when set up a connection by L2TP/IPSec PSK type.

logcat log:
I/racoon ( 2673): IPsec-SA request for 124.248.205.110 queued due to no phase1 found.
I/racoon ( 2673): initiate new phase 1 negotiation: 10.109.143.112[500]<=>124.248.205.110[500]
I/racoon ( 2673): begin Identity Protection mode.
D/mtpd ( 2913): Timeout -> Sending SCCRQ
I/racoon ( 2673): received Vendor ID: DPD
I/racoon ( 2673): received Vendor ID: RFC 3947
I/racoon ( 2673): Selected NAT-T version: RFC 3947
I/racoon ( 2673): Hashing 124.248.205.110[500] with algo #2
I/racoon ( 2673): Hashing 10.109.143.112[500] with algo #2
I/racoon ( 2673): Adding remote and local NAT-D payloads.
I/racoon ( 2673): Hashing 10.109.143.112[500] with algo #2
I/racoon ( 2673): NAT-D payload #0 doesn't match
I/racoon ( 2673): Hashing 124.248.205.110[500] with algo #2
I/racoon ( 2673): NAT-D payload #1 verified
I/racoon ( 2673): NAT detected: ME
I/racoon ( 2673): KA list add: 10.109.143.112[4500]->124.248.205.110[4500]
I/racoon ( 2673): ISAKMP-SA established 10.109.143.112[4500]-124.248.205.110[4500] spi:9a914198c3c32791:0668bf416d52cbfa
D/dalvikvm( 395): GC_CONCURRENT freed 490K, 13% free 7350K/8391K, paused 4ms+11ms
D/mtpd ( 2913): Timeout -> Sending SCCRQ
I/racoon ( 2673): initiate new phase 2 negotiation: 10.109.143.112[4500]<=>124.248.205.110[4500]
I/racoon ( 2673): NAT detected -> UDP encapsulation (ENC_MODE 2->4).
E/racoon ( 2673): none message must be encrypted
D/mtpd ( 2913): Timeout -> Sending SCCRQ
E/racoon ( 2673): none message must be encrypted
D/dalvikvm( 395): GC_CONCURRENT freed 410K, 13% free 7329K/8391K, paused 3ms+11ms
D/mtpd ( 2913): Timeout -> Sending SCCRQ
E/racoon ( 2673): none message must be encrypted
D/mtpd ( 2913): Timeout -> Sending SCCRQ
I/racoon ( 2673): IPsec-SA expired: ESP/Transport 124.248.205.110[500]->10.109.143.112[500] spi=253661069(0xf1e8f8d)
W/racoon ( 2673): PF_KEY EXPIRE message received from kernel for SA being negotiated. Stopping negotiation.
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/dalvikvm( 395): GC_CONCURRENT freed 409K, 13% free 7329K/8391K, paused 5ms+10ms
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/dalvikvm( 395): GC_CONCURRENT freed 410K, 13% free 7329K/8391K, paused 3ms+9ms
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/mtpd ( 2913): Timeout -> Sending SCCRQ
D/dalvikvm( 395): GC_CONCURRENT freed 409K, 13% free 7330K/8391K, paused 4ms+10ms
D/mtpd ( 2913): Timeout -> Sending SCCRQ
I/LegacyVpnRunner( 168): Aborting
I/LegacyVpnRunner( 168): java.lang.IllegalStateException: Time is up
I/LegacyVpnRunner( 168): at com.android.server.connectivity.Vpn$LegacyVpnRunner.checkpoint(Vpn.java:460)
I/LegacyVpnRunner( 168): at com.android.server.connectivity.Vpn$LegacyVpnRunner.execute(Vpn.java:572)
I/LegacyVpnRunner( 168): at com.android.server.connectivity.Vpn$LegacyVpnRunner.run(Vpn.java:447)
E/racoon ( 2673): Connection is closed
D/mtpd ( 2913): Timeout -> Sending SCCRQ

what's the problem with this

st...@gmail.com <st...@gmail.com> #150Apr 20, 2012 12:58PM

Confirmed on HTC Sensation, Android ICS 4.0.3. Both mobile terminal and (L2TP/IPSec PSK) VPN server are behind NAT. VPN server is OpenSWAN with xl2tpd on CentOS (RHEL) 6.2. I've seen the same logs when nat-traversal is not supported on the client. I urgently need to have this fixes ASAP.

Apr 20 14:55:59 corleone pluto[7179]: packet from

89.24.91.2:202: received Vendor ID payload [RFC 3947] method set to=109
Apr 20 14:55:59 corleone pluto[7179]: packet from

89.24.91.2:202: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109
Apr 20 14:55:59 corleone pluto[7179]: packet from

89.24.91.2:202: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 109
Apr 20 14:55:59 corleone pluto[7179]: packet from

89.24.91.2:202: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
Apr 20 14:55:59 corleone pluto[7179]: packet from

89.24.91.2:202: ignoring Vendor ID payload [FRAGMENTATION 80000000]
Apr 20 14:55:59 corleone pluto[7179]: packet from

89.24.91.2:202: received Vendor ID payload [Dead Peer Detection]
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: responding to Main Mode from unknown peer 89.24.91.2
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: STATE_MAIN_R1: sent MR1, expecting MI2
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): both are NATed
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: transition from state STATE_MAIN_R1 to state STATE_MAIN_R2
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: STATE_MAIN_R2: sent MR2, expecting MI3
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: Main mode peer ID is ID_IPV4_ADDR: '10.75.114.229'
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: transition from state STATE_MAIN_R2 to state STATE_MAIN_R3
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: new NAT mapping for #11, was

89.24.91.2:202, now

89.24.91.2:2251
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: STATE_MAIN_R3: sent MR3, ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=aes_256 prf=oakley_sha group=modp1024}
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: ignoring informational payload, type IPSEC_INITIAL_CONTACT msgid=00000000
Apr 20 14:55:59 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: received and ignored informational message
Apr 20 14:56:00 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:00 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:00 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:00 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:00 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:03 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:03 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:03 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:03 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:03 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:06 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:06 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:06 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:06 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:06 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:09 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:09 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:09 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:09 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:09 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:12 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:12 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:12 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:12 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:12 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:15 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:15 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:15 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:15 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:15 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:18 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:18 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:18 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:18 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:18 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:21 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:21 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:21 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:21 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:21 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:24 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:24 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:24 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:24 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:24 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:27 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:27 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:27 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:27 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:27 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:32 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:32 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:32 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:32 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:32 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:35 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:35 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:35 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:35 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:35 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:37 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:37 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:37 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:37 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:37 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:40 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:40 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:40 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:40 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:40 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:43 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:43 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:43 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:43 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:43 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:46 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:46 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:46 corleone pluto[7179]: | payload malformed after IV
Apr 20 14:56:46 corleone pluto[7179]: | 9c 25 f0 71 90 96 6d 89 96 12 19 d8 b0 cb 17 3e
Apr 20 14:56:46 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: sending notification PAYLOAD_MALFORMED to

89.24.91.2:2251
Apr 20 14:56:49 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
Apr 20 14:56:49 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: malformed payload in packet
Apr 20 14:56:49 corleone pluto[7179]: "L2TP-PSK"[10] 89.24.91.2 #11: too many (17) malformed payloads. Deleting state

st...@gmail.com <st...@gmail.com> #151Apr 20, 2012 01:23PM

It does not work even with public IP address on the mobile handset.

nb...@gmail.com <nb...@gmail.com> #152Apr 20, 2012 02:10PM

Is google even working to fix this. ICS has been available since january 3
months with no fix for a key feature for business users. I have deplyed new
tablets to my remote sales force with instructions not to install any
firmware updates due to this issue. If they install the tablet cannot be
used to access the network. Also the firmware updates include manufacturer
bug fixes so i cant get those either. If it installs i cannot restore back
to honeycomb making the tablet useless for my users and forcing me to buy a
new one. I can understand bugs but a key networking feature being down for
three months with no fix. What do you expect people to do give up using
vpns all together? This is going to force business users away from android.

Sent from my Verizon Wireless 4G LTE DROID

ho...@gmail.com <ho...@gmail.com> #153Apr 22, 2012 10:42AM

The very same problem. After HTC Sensation OS upgrade from 2.3.5 to 4.0.3 IPSec PSK VPN has stopped working. It worked perfectly before, it works perfectly also for Android 3.2.1. on HTC Flyer.

mp...@gmail.com <mp...@gmail.com> #154Apr 23, 2012 07:58PM

I have been trying to get my VPN working with 4.0.3 as well. Didn't. But seem to have found something. VpnCilla looks promising. Might give it a try soon.

ja...@gmail.com <ja...@gmail.com> #155Apr 24, 2012 05:16PM

Confirming the other CM9 reports here. Verizon Galaxy Nexus running CM9 (4.0.4, 4/22 nightly) can't connect to VyprVPN using IPSec PSK or PPTP.

n8...@gmail.com <n8...@gmail.com> #156Apr 25, 2012 10:35AM

Using an ASUS Transformer TF101 and finally got the 4.0.3 firmware update today - did not fix the issue connecting to L2TP VPN (to a Sonicwall). I too have told outside folks to avoid upgrading but since I already did my own device is essentially now useless for work. I realize this isn't an android issue, but rather something introduced upstream, but its critical for business.

te...@gmail.com <te...@gmail.com> #157Apr 25, 2012 06:07PM

[Comment deleted]

il...@gmail.com <il...@gmail.com> #158Apr 27, 2012 11:38AM

Can confirm the issue using custom MIUI-2.2.17 Kernel 2.6.35.12-gdf10700.
L2TP over IPSEC to our Draytec Vigor 3200n results in timeout as seen via LogCat.

al...@gmail.com <al...@gmail.com> #159Apr 29, 2012 02:16PM

Can't connect VPN with HTC ONE X(ICS 4.0.3)
The answer for L2TP is "Time out"

me...@gmail.com <me...@gmail.com> #160Apr 29, 2012 07:13PM

what the password? i can't open the VPN setup !

me...@gmail.com <me...@gmail.com> #161Apr 29, 2012 07:30PM

if you want to setup VPN why do you have to go to SECURITY and secure the phone using pattern/password etc?

sh...@gmail.com <sh...@gmail.com> #162Apr 30, 2012 12:45PM

Same problem with ICS on Galaxy SII. Using VPNC for a long time, works fine for me.

de...@coswayne.org <de...@coswayne.org> #163Apr 30, 2012 01:22PM

Just got a TF101 last week, ran the latest ICS (4.0.3) update and was pretty disappointing to find this un-resolved bug.

Can confirm two things with our L2TP/IPSEC-PSK VPN setup (Sonicwall):

1) VPN is NOT working from off-site: same Time-out error as others.
... however....
2) VPN connection IS working over on-site Wifi (Managed Sonicwall AP's)

af...@gmail.com <af...@gmail.com> #164Apr 30, 2012 02:45PM

I experienced the same issue (byte 7 of ISAKMP NAT-OA Payload must...) with OpenSWAN on CentOS when connecting with my Android 4.0.3 device. I solved the problem with a CentOS VPN server based on ipsec-tools/raccon. For those who are interested in I've written a Howto:

http://nikoforge.org/L2TP/IPSec_VPN_Setup_on_Centos_6_%2864-bit%29_for_use_with_Android_ICS_Clients

ro...@gmail.com <ro...@gmail.com> #165May 1, 2012 02:41AM

Priority-Medium??? I'm not connecting to my office VPN using my device updated to ICS... =(

bx...@gmail.com <bx...@gmail.com> #166May 2, 2012 06:13AM

When will google fix this bug?

cr...@gmail.com <cr...@gmail.com> #167May 7, 2012 08:49AM

This is a business feature. That must work.
When will google fix this bug?

ty...@gmail.com <ty...@gmail.com> #168May 7, 2012 02:53PM

Purchase a business device for business. Blackberry's still work great!

bx...@gmail.com <bx...@gmail.com> #169May 8, 2012 06:14AM

This issue's state is closed, I think google will not update it any more.
Is there some one who has resoled the issue?
If have, please share your method, thanks.

pe...@gmail.com <pe...@gmail.com> #170May 10, 2012 04:18PM

[Comment deleted]

pe...@gmail.com <pe...@gmail.com> #171May 10, 2012 04:23PM

last usable mobile operating system is wm 6.1 ... today we have superior hardware but system is useless.

ba...@gmail.com <ba...@gmail.com> #172May 11, 2012 08:26AM

ICS broke my l2tp vpn as well, its disgraceful with no apparent fix without rooting the device!!

But thankfully I found an alternative, OpenVPN below and it works well with NO need to root the device if using ICS.

http://forum.xda-developers.com/showthread.php?t=1591585

Hope this helps someone.

nb...@gmail.com <nb...@gmail.com> #173May 14, 2012 07:51PM

Finally some help from sonicwall. Those of you trying to connect to a sonicwall device please load the new Sonicwall mobile connect app available on the playstore. This is a replacement for the netextender app that is designed for ICS devices. It does not require a rooted device and so far works like a charm connecting to my SSL-VPN appliance from sonicwall. Thank you sonicwall for finally addressing this issue.
See the link below to the playstore app download.

https://play.google.com/store/apps/details?id=com.sonicwall.mobileconnect&hl=en

fr...@gmail.com <fr...@gmail.com> #174May 15, 2012 04:57PM

I installed a ICS mod from

http://download.cyanogenmod.com/ and my VPN works again.

le...@gmail.com <le...@gmail.com> #175May 20, 2012 07:23PM

Workaround for openswan to handle broken android:

http://people.redhat.com/pwouters/openswan-android-ics-natoa.patch

sy...@gmail.com <sy...@gmail.com> #176May 23, 2012 09:23PM

I have an AT&T HTC One X, and I am unable to connect into my L2TP vpn on my home network. My macbook pro has no issues connecting in. I would really love a solution to this problem some time soon, since I need my phone to have VPN access.

ch...@gmail.com <ch...@gmail.com> #177May 25, 2012 10:41PM

A big thanks to bakapa for the link he provided for OpenVPN on XDA!

It works like a charm on my Nexus S (not rooted)!

Thanks to the XDA community for this! Without them Android is completely useless!

Google you suck!

ou...@gmail.com <ou...@gmail.com> #178May 30, 2012 07:36AM

I have the same problem with LT18i/4.0.3
Both L2TP/PSK and IPSec Xauth PSK

go...@gmail.com <go...@gmail.com> #179May 30, 2012 08:41AM

I'm trying IPSec VPN Xauth with certificate mutual authentication on my Samsung Galaxy SII upgraded to ICS. I've loaded both certificates into the phone, but am unable to connect. The device doesn't even attempt to make the connection, it just shows "Unsuccessful" after a split second. Here's the relevant logcat:

V/LegacyVpnRunner( 2000): Waiting
V/LegacyVpnRunner( 2000): Executing
D/racoon (12505): Waiting for control socket
I/power ( 2000): *** release_dvfs_lock : lockType : 2
D/PowerManagerService( 2000): releaseDVFSLockLocked : all DVFS_MAX_LIMIT are released
D/PowerManagerService( 2000): mIsSipVisible : true
D/PowerManagerService( 2000): mIsSipVisible : false
D/racoon (12505): Received 10 arguments
I/racoon (12505): ipsec-tools 0.8.0 (

http://ipsec-tools.sf.net)
I/SurfaceFlinger( 1834): id=473 Removed idx=3 Map Size=5
I/SurfaceFlinger( 1834): id=473 Removed idx=-2 Map Size=5
I/racoon (12505): Bye
D/dalvikvm( 2118): GC_FOR_ALLOC freed 380K, 29% free 10252K/14279K, paused 20ms
D/PowerManagerService( 2000): onSensorChanged: light value: 1000
D/dalvikvm( 2118): GC_CONCURRENT freed 308K, 28% free 10379K/14279K, paused 2ms+2ms
I/SurfaceFlinger( 1834): id=474 Removed idx=3 Map Size=4
I/SurfaceFlinger( 1834): id=474 Removed idx=-2 Map Size=4
I/LegacyVpnRunner( 2000): Aborting
I/LegacyVpnRunner( 2000): java.lang.IllegalStateException: racoon is dead
I/LegacyVpnRunner( 2000): at com.android.server.connectivity.Vpn$LegacyVpnRunner.execute(Vpn.java:569)
I/LegacyVpnRunner( 2000): at com.android.server.connectivity.Vpn$LegacyVpnRunner.run(Vpn.java:447)

I tried L2TP and that at least tries to make a connection.

Seems like racoon has a problem (it's dead).

am...@gmail.com <am...@gmail.com> #180May 31, 2012 11:13PM

i have big problem in oficial 4.0.4 for arc
vpn conection made but never conected!!
anyone could conect vpn?
always say unsucces!!! pptp or l2tp
sorrry for google eith this update !!!!!!!!!!!!!1

pa...@gmail.com <pa...@gmail.com> #181Jun 5, 2012 11:51AM

Maybe useful to others suffering from this rather long standing bug...

If you are using Openswan on the server side then there is a solution thanks to Red Hat's Paul Wouters. He has created a patch that works around the Android ICS ipsec-tools bug so a connection from Android ICS using L2TP/IPsec VPN with pre-shared keys or certificates works with Openswan on the server side (thanks Paul!).

The patch is attached. You need to apply it to the Openswan 2.6.38 sources and build and install it.

Let's hope the Android team will soon release a proper fix together with TLS client certificate authentication for the IMAP client :-)

deleted

Restricted

0 B

jp...@gmail.com <jp...@gmail.com> #182Jun 18, 2012 01:39AM

Patch worked great, thank you

an...@gmail.com <an...@gmail.com> #183Jun 18, 2012 02:14AM

I have moved to using "openvpn". There is a great client available at this link on Google Play:

https://play.google.com/store/apps/details?id=de.blinkt.openvpn&rdid=de.blinkt.openvpn&rdot=1

al...@gmail.com <al...@gmail.com> #184Jun 19, 2012 01:09PM

Take a look at

https://breakwall.net/2012/05/android-ics-4-0-openvpn-made-easy
on how to use FeatVPN client. Instructions are customized for Breakwall VPN service (which I use) but should work with other services too. I have successfully setup this client on my Android 4 device.

ma...@gmail.com <ma...@gmail.com> #185Jun 25, 2012 05:07PM

Still having this issue, now on the RAZR/RAZR MAXX 4.0.4. A shame that Google didn't get this into the pipeline sooner so it would have been pulled by the manufacturers sooner.

tr...@gmail.com <tr...@gmail.com> #186Jun 26, 2012 01:29AM

Vpn issue fixed on my tf201 when an ota update came thru about two weeks ago.

Kernel - 2.6.39.4
Build - 9.4.2.28-20120525

Plus faceunlock works too

ov...@gmail.com <ov...@gmail.com> #187Jun 27, 2012 05:55PM

Status: FutureRelease

Is this fixed in Jelly Bean 4.1 ?

li...@gmail.com <li...@gmail.com> #188Jun 28, 2012 04:36AM

the same problem, l2tp vpn not working with 4.0.4 (AOKP ROM)

au...@gmail.com <au...@gmail.com> #189Jun 29, 2012 04:48AM

[Comment deleted]

au...@gmail.com <au...@gmail.com> #190Jun 29, 2012 04:50AM

[Comment deleted]

au...@gmail.com <au...@gmail.com> #191Jun 29, 2012 04:52AM

Apparantly Jelly Bean has fixed it.
I had a try yesterday and my L2TP VPN worked well.

sc...@googlemail.com <sc...@googlemail.com> #192Jul 8, 2012 08:59AM

same problem here.
But VPNCilla is a good solution until jelly bean is released.

he...@gmail.com <he...@gmail.com> #193Jul 9, 2012 10:35PM

Same problem here. Android 4.0.4 with ZTE Blade Custom Rom. This is not OK Google. I guess I put my trust in som hacker at XDA-DEVELOPERS putting some work into this major fail

vi...@gmail.com <vi...@gmail.com> #194Jul 16, 2012 01:23PM

Using Galaxy Nexus with Android 4.1.1
Native VPN connects in 1 of 10 times. Type of server L2TP/IPSec PSK. Am I alove with that kind of problem?

ch...@gmail.com <ch...@gmail.com> #195Jul 16, 2012 02:17PM

On Galaxy Nexus with Android 4.1.1 VPN L2TP/IPSec PSK can be reconnected only after phone rebooting

zi...@gmail.com <zi...@gmail.com> #196Jul 16, 2012 09:01PM

L2TP/IPSec PSK is OK after my Galaxy Nexus upgrade to Android 4.1.1

se...@gmail.com <se...@gmail.com> #197Jul 19, 2012 03:25AM

same problem,galaxy nexus,android 4.04,timeout

ka...@gmail.com <ka...@gmail.com> #198Jul 21, 2012 02:31AM

And this ICS is progress? I've nothing but headaches, with no resolution in sight. Disgraceful. iPhone will be my next phone, if this how problems are solved. Grrrr.........

he...@gmail.com <he...@gmail.com> #199Jul 21, 2012 10:13AM

COOOOOOME OOOOOON NOOOOOOW GOOOOOOGLE GOOD DAMN IT!!!!!!!!!!

pb...@gmail.com <pb...@gmail.com> #200Jul 24, 2012 02:46AM

Get problems on jelly Beans (Nexus 7). Connect with no problem the first time. But once disconnect, must delete the profile and make a new one.

st...@gmail.com <st...@gmail.com> #201Jul 27, 2012 01:31AM

For comment 199.
This issue is detected as the L2TP/IPSec VPN reconnect problem. Things are like this:
If you disconnect your L2TP/IPSec VPN for the first time, your VPN server might send you a 'informational' message but as racoon daemon dies too quickly once after the control socket is closed, this message could not be received for the last time connection. Your server keeps re-sending this 'informational' message with 'delete (SA)' command to your client for a short period (I tested with Cisco A5505 and found it keeps resending the message for 1.5 min), and within this time gap, if you kick start another connection, you would see failure... This is because the delete command would deletes your newly created SA negotiated by IKE ph2 immediately once your IPSec-SA is established.
I have fixed this issue myself with my racoon source code on both JellyBean and ICS (IPSec-tools 0.7.3 and 0.8.0).

bx...@gmail.com <bx...@gmail.com> #202Jul 27, 2012 06:47AM

To strawmanbobi@gmail.com :
Did you merge the JB racoon changes to ICS?

If you can share your source code, it will be very good, thanks.

cl...@gmail.com <cl...@gmail.com> #203Jul 30, 2012 09:10PM

Gigabyte Gsmart G1345 (2.3.4) and G1342 (4.0.3 and 4.0.4) same problem. PPTP - no problem L2TP - permanent error connection.

st...@gmail.com <st...@gmail.com> #204Jul 31, 2012 04:22AM

Hi, please try this executable on your ICS first to confirm if it has resolved this problem...
The way to try :
(1) make sure your phone is rooted
(2) adb push racoon /system/bin/
(3) adb shell chmod 777 /system/bin/racoon
(4) go ahead with your VPN connection.

This patch fixed 2 problems :
(a) Some VPN Server (eg.based on openswan) could not be connected using L2TP/IPSec VPN for ICS (JB has another solution and this is only for your ICS build)
(b) L2TP/IPSec VPN could not be RE-connected after last connection has been disconnected within a short while (about 1min) (This issue is still seen on both ICS and JB at present)

Thanks !

deleted

Restricted

0 B

st...@gmail.com <st...@gmail.com> #205Jul 31, 2012 04:25AM

BTW, for my last comment:
Please make sure you back up your origin executable racoon first to avoid any trouble brought by incompatibility...
run
adb pull /system/bin/racoon {somewhere on your computer}
firstly.
If you failed (or even crashed) with my patch, you can restore it with the backup one :)

iv...@gmail.com <iv...@gmail.com> #206Jul 31, 2012 09:27PM

To strawmanbobi@gmail.com :

Thank you! I tried patched racoon on Asus TF101G (ICS) with Checkpoint L2TP PSK vpn server and it resolved connection problem. Now I am able to use vpn again since I've upgraded to ICS.

gr...@gmail.com <gr...@gmail.com> #207Aug 10, 2012 02:33PM

Same issue here. Vpn won't connect under ice but was fine on GB prior to upgrade and is still fine in my HC tablet

jo...@gmail.com <jo...@gmail.com> #208Aug 16, 2012 02:19PM

Why can't Google fix this. I now consider to buy Ipad instead of Android Tablet since I really need the VPN.

sn...@gmail.com <sn...@gmail.com> #209Aug 17, 2012 04:16PM

Same problem in SGS3 (GT-I9300) with ICS (4.0.4).

ad...@gmail.com <ad...@gmail.com> #210Aug 20, 2012 05:24AM

After upgrading my Droid 4 to ICS (4.0.4) today, the issue was present there as well. The modified racoon binary posted in

comment #203

corrected the problem. Thank you very much, strawman!

do...@gmail.com <do...@gmail.com> #211Aug 20, 2012 09:48PM

For a 21st century product, this is absurd. Secure vpn is something utterly essential for enterprise work not to mention anyone fairly serious about privacy. It's election season in the US and there are more than a few people who need to keep their communications private. What on earth is going on at Google?

do...@gmail.com <do...@gmail.com> #212Aug 20, 2012 10:21PM

Here are the specific details of the problem in the communication with the current Android versions.

My device:
Samsung Galaxy S3
Model SPH-L710
Android Version: 4.0.4
Kernel Version: 3.0.8-618049-user
Build #: IMM760D.L710VPALG2

2012:08:20-14:31:18 wahine pluto[7999]: "S_for doug"[4]

66.87.112.8:16881 #3: sent MR3, ISAKMP SA established
2012:08:20-14:31:18 wahine pluto[7999]: "S_for doug"[4] <my ip address>:16881 #3: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2012:08:20-14:31:19 wahine pluto[7999]: "S_for doug"[4] <my ip address>:16881 #3: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
2012:08:20-14:31:19 wahine pluto[7999]: "S_for doug"[4] <my ip address>:16881 #3: malformed payload in packet
2012:08:20-14:31:19 wahine pluto[7999]: "S_for doug"[4] <my ip address>:16881 #3: sending encrypted notification PAYLOAD_MALFORMED

The Android is not following the VPN protocol and the connections fails.

iv...@gmail.com <iv...@gmail.com> #213Aug 21, 2012 06:32PM

As i posted before modified racoon binary from

comment #203

corrected the problem for me too, but now i've noticed that after a few minutes vpn connection is established it becames 'dead', no more packets can be transmitted to/from remote server. General internet connection over wi-fi becames 'dead' as well (i've specified subnet mask in vpn settings). After vpn connection is shut down everything works fine again and i am able to make new vpn connection. Looks like at the racoon level it can't affect other network connections, so i'm puzzled what's happening.
I am using ASUS TF101G, patched racoon and internet connection over wi-fi.

za...@gmail.com <za...@gmail.com> #214Aug 21, 2012 07:24PM

I have a client that uses L2TP/IPsec VPNs on Galaxy SII's connecting to a SonicWall TZ210 with latest firmware (SonicOS Enhanced 5.8.1.5-46o) I tried setting up SSL VPN and using the SonicWall mobile app, and it gives me the message the version of android does not support all the VPN features (vpnServices). Android 4.0.4. Is there ANY chance someone out there has figured this out?

ma...@gmail.com <ma...@gmail.com> #215Aug 27, 2012 10:20PM

strawmanbobi - Thanks for your new racoon file, it worked a treat on my RAZR!

bf...@gmail.com <bf...@gmail.com> #216Sep 4, 2012 12:22AM

I can't connect to my StrongVPN L2TP/Ipsec PSK account using android 4.0.3; worked only once same as comment n 199.
Any updates on this issue ?
Going to try the racoon file fix.

lu...@gmail.com <lu...@gmail.com> #217Sep 5, 2012 10:19AM

Hey, same problem... I try to connect to a PPTP VPN, but it doesnt work. I tried with 2 different vpn clients from play store, but is the same history. I tried the vpn server, user and pswrd in windows and works fine, so the problem is Android... any solution?

st...@gmail.com <st...@gmail.com> #218Sep 6, 2012 06:38AM

it's nice to see the patch resolved some of your problems，I will deliver another better patch working for JB and ICS as well，
Racoon is a good Ipsec solution，but it stopped maintaining for some time， however Android picked it as a daemon，I'm still working on it trying to introduce more features，like IKEV2，MOBIKE，etc...

ma...@gmail.com <ma...@gmail.com> #219Sep 6, 2012 04:59PM

[Comment deleted]

deleted

Restricted

0 B

ma...@gmail.com <ma...@gmail.com> #220Sep 6, 2012 05:02PM

Hello, I have read the entire tread and I am confused on how to resolve or at least put in work around for this problem. Here is the scenario: ASUS Transformer Infinity Pad running ICS v4.0.3. trying to connect via Andriod's built-in VPN client to a SonicWall Firewall/VPN Server (running SonicOS Enhanced 5.6.0.12-65o) using L2TP/IPSec PSK. The ICS VPN client reports "Timeout" upon failing to connect. Attached are the logs from the SonicWall that report a number of "Received packet retransmission. Drop duplicate packet" and a "Paylod processing failed" error. Clients from Anroid v2.3.4 using the built-in VPN client to same SonicWall work fine. The upgrade to ICS caused the problem. So is there any patch to apply to the Anroid ICS v4.0.3 clients that would resolve the problem? If so, where can it be located? Do not want to mess with the SonicWall since it is not broken and works fine with other non-ICS Android (and other OS) clients.

deleted

Restricted

0 B

n8...@gmail.com <n8...@gmail.com> #221Sep 10, 2012 12:16AM

Matt R: Just a note to say that I'm in exactly the same boat. Mine is an ASUS Transformer TF101 that came with Honeycomb and worked fine with L2TP and my Sonicwall with PSK. ICS borged it and I've been waiting patiently for ASUS to release a firmware update to fix it - so far none have. I've read that Jellybean may incude the fix (which seems to have been a bug introduced with ipsec-tools 8.0 which came with ICS) and there has been some talk on the ASUS boards that they may update my older device to JB but they may just orphan me. I think the work-arounds with racoon noted above require a rooted device, but I didn't want to resort to that just yet. Please correct me if I got any of this wrong.

jo...@gmail.com <jo...@gmail.com> #222Sep 17, 2012 08:25PM

I'm astonished that Google has not addressed this issue YET! Android 4.0.4 [Motorola Xoom and Galaxy S3] trying to connect to L2TP/IPSec using xl2tpd on CentOS 5.8, getting that same error of check_control: Received out of order control packet on tunnel -1 (got 1, expected 0)
in my VPN server logs. Two different Windows 7 PC's connect fine. This is not cool.

ma...@gmail.com <ma...@gmail.com> #223Sep 19, 2012 06:55AM

Thank you strawman...! Highstsreen Alfa GT Android 4.0.3
Do all your instructions (post number 203). It works! VPN L2TP IPSec PSK
Regards from Russia!

pd...@gmail.com <pd...@gmail.com> #224Oct 4, 2012 10:31AM

Thanks strawman

It works

We are able to use vpn again since we've upgraded to ICS with:

Galaxy S3 (GT-i9300) android 4.0.4
Galaxy Tab Note 10.1 (N8000) android 4.0.4

da...@gmail.com <da...@gmail.com> #225Oct 12, 2012 01:03PM

[Comment deleted]

da...@gmail.com <da...@gmail.com> #226Oct 12, 2012 01:04PM

[Comment deleted]

da...@gmail.com <da...@gmail.com> #227Oct 12, 2012 01:06PM

Thank you strawman (Comment 203), your patch works GREAT ! I am now able to connect to my L2TP/IpSec VPN (OpenSwan on Ubuntu) using my Samsung Galaxy S III (Android ICS 4.0.4)

I was having exactly the same problem as everyone above:
"L2TP-PSK-NAT"[16] 11.22.33.44#15: byte 7 of ISAKMP NAT-OA Payload must be zero, but is not
"L2TP-PSK-NAT"[16] 11.22.33.44#15: malformed payload in packet
| payload malformed after IV
| 7c 98 58 d1 bd 64 bd 43 6f c3 5d 7c 19 e3 23 ef
"L2TP-PSK-NAT"[16] 11.22.33.44#15: sending notification PAYLOAD_MALFORMED to

11.22.33.44:4500

But finally it works, thanks to you !!!! I just can't believe Google hasn't fixed that in ICS (I understand it seems to be fixed in JellyBean but many users do not have JB), VPN to L2TP/IpSec is a big deal for many business users.

fe...@googlemail.com <fe...@googlemail.com> #228Oct 12, 2012 09:58PM

OT: Strawman, as you mentioned racoon is no longer in development. Wouldn't it be a better alternative to switch to strongswan on stock android in the future? There are still some rough edges [1] but racoon doesn't seem to be the "have it all" as well.

[1]

http://wiki.strongswan.org/projects/strongswan/wiki/Android

gs...@bbxy.net <gs...@bbxy.net> #229Oct 13, 2012 01:32PM

Thanks to strawman, the patch works on my phone.

se...@gmail.com <se...@gmail.com> #230Oct 21, 2012 04:42PM

ICS works fine by this patch. Thanx.
But iPhone(iOS6) doesn't work .......

z....@gmail.com <z....@gmail.com> #231Oct 24, 2012 02:02AM

Galaxy Nexus with 4.1.2 still can't using L2TP/IPSec PSK.

bo...@gmail.com <bo...@gmail.com> #232Oct 24, 2012 02:18AM

All,

Received my ICS 4.0.4 upgrade today from VZ on my Droid Bionic and I ended up here for all the VPN issues I was experiencing. Having a custom IpCop setup I didn't want to change the server side but the forces led me down that road unfortunately for the better actually. In short I had to change the ike and esp values on the firewall as security 'always' gets better over time so my old 3des setting no long worked with the new firmware. Just to be clear I am using the default "Basic VPN" within ICS.

See more here: h.t.t.p.s.:.//

sites.google.com/site/bokohut/bo'sipcoptidbits

Hope it helps at least one person.

Bo

zy...@gmail.com <zy...@gmail.com> #233Oct 29, 2012 12:41PM

same issue. Samsung Galaxy 3 GT-9308. ICS 4.04

ca...@gmail.com <ca...@gmail.com> #234Oct 30, 2012 11:10AM

I have a Mobistel mCynus T1 with Android 4.0.4. I have made the change with racoon of #203 but i still can´t use L2TP/IPSEC PSK.

ca...@gmail.com <ca...@gmail.com> #235Oct 30, 2012 11:12AM

I have tried it with VPNC Widget and the logfile answers with " no response from Target".
I have tried to install tun.ko but no tun is aviable for my kernel.

ch...@gmail.com <ch...@gmail.com> #236Oct 31, 2012 04:29PM

Cisco Anyconnect is not for free, as any product coming from that trademark. So any company with old CISCO VPN implementation won't change it.

Is there any hope to have a simple vpn client on Android? Any IPhone owner has it, any linux distribution has it.

I'm running 4.1.1 : no luck.

Should we wait 5.1.1?

gb...@gmail.com <gb...@gmail.com> #237Nov 17, 2012 06:26PM

I can't connect in VPN with my tab10.1 to vpn since i have update to android 4!

ma...@gmail.com <ma...@gmail.com> #238Nov 20, 2012 08:19AM

[Comment deleted]

ri...@gmail.com <ri...@gmail.com> #239Nov 24, 2012 09:30AM

STRONGVPN Users when using the addon vpn for the extra 2USD a month, disable the PPP Encryption and it will work on 4.x Fw. i just worked on 4.0.4 for me.

ma...@gmail.com <ma...@gmail.com> #240Nov 25, 2012 12:44PM

Galaxy Nexus, Android 4.2: still not working

cd...@gmail.com <cd...@gmail.com> #241Dec 5, 2012 05:55PM

[Comment deleted]

cd...@gmail.com <cd...@gmail.com> #242Dec 5, 2012 05:56PM

Didn't work on Galaxy Nexus with 4.0. Worked on both Galaxy Nexus and Nexus 7 on 4.1. Now that 4.2 is here, it's no longer working on either device. This is kinda ridiculous. Google needs to get this sorted out if they're going to compete in the enterprise space.

gm...@gmail.com <gm...@gmail.com> #243Dec 26, 2012 11:53PM

I have tried several settings to get VPN connection on Nexus 7 and it doesn´t work, any idea to solve it?.

hk...@gmail.com <hk...@gmail.com> #244Jan 6, 2013 01:24PM

Any news? We need VPN in China - so much we can not do on Nexus tablet without it - makes it a very expensive game player now.....

sh...@gmail.com <sh...@gmail.com> #245Jan 21, 2013 01:16PM

Same issue. Unable to connect to VPN using IPSEC L2TP PSK.

Device: XOOM MZ604 running Android 4.0.4 (Not rooted)

ju...@gmail.com <ju...@gmail.com> #246Jan 22, 2013 09:07PM

Device Samsung Galaxy Tab P6810 with firmware P6810XXLPP (4.0.4)

After replacing racoon file with the one in coment #203 I still could not connect VPNs. I have assigned 777 permission to folder /data/misc/vpn and IT'S WORKING NOW

Thanks strawman

sh...@gmail.com <sh...@gmail.com> #247Jan 28, 2013 08:07AM

I am also having PPTP and L2TP/IPsec PSK problems on my known good VPN server that windows 7 connects to just fine. Verizon Galaxy Nexus on 4.1.1

pa...@gmail.com <pa...@gmail.com> #248Mar 17, 2013 01:08AM

I am having a problem getting my ICS thunderbolt to work in a regular Nat environment. It sounds like tgere is a very small chance this could be related as I dud nit have the problem with the orior version of android OS. Can anyone confirm similar problems? I'd like a fix that does not require rooting.

pa...@gmail.com <pa...@gmail.com> #249Apr 2, 2013 12:25PM

If PSK doesn't work in general, would other Ipsec/L2tpd RSA...etc. works?

jp...@gmail.com <jp...@gmail.com> #250Apr 5, 2013 11:50AM

It's Ok with Jelly Bean 4.1.2 to connect to VPN using L2TP/IPSec PSK

dh...@gmail.com <dh...@gmail.com> #251Apr 19, 2013 02:57AM

Thanks a lot Strawman!

Comment #203

solved my problem!

sa...@gmail.com <sa...@gmail.com> #252May 17, 2013 05:10PM

Dear All,

I tried implementing above patch on my Android MID- Mtk6575 Chinese Tablet.

Using ADB or terminal I was unable to chgrep hence i used root explorer to do so but still it is giving message unsuccessful.

I am connecting to Checkpoint VPN.
the error on the Firewall is as below:-
Information IKE: Main Mode Failed to match proposal:
Transform: AES-128, MD5, Pre-shared secret, Group 2 (1024 bit)
Reason: unsupported authentication method 65001

any help that can resolve this issue is highly appreciated, i am stuck with this from almost a week.

Best Regards
Sarfaraz

pa...@gmail.com <pa...@gmail.com> #253May 23, 2013 08:44AM

Nexus 4, Android 4.2.2. Not working.

za...@gmail.com <za...@gmail.com> #254Jun 23, 2013 06:42PM

Having same issue as described here.

Phone: Samsung Galaxy Nexus
Android Version: 4.2.2
Build: JDQ39

Ubuntu Server L2TP VPN
Ubuntu - 13.04
openswan - 2.6.37-1
xl2tpd - 1.3.1
Note: VPN is listening behind a NAT router and so has NAT-T enabled.

Windows, iOS devices etc all connect fine to VPN. First phase to establish IPSec SA tunnel works fine, but then I see the following in server logs and phone disconnects.

Jun 23 19:17:39 sam xl2tpd[19176]: control_finish: Peer requested tunnel 38838 twice, ignoring second one.
Jun 23 19:17:40 sam xl2tpd[19176]: check_control: Received out of order control packet on tunnel -1 (got 1, expected 0)
Jun 23 19:17:40 sam xl2tpd[19176]: handle_packet: bad control packet!
Jun 23 19:17:44 sam xl2tpd[19176]: Maximum retries exceeded for tunnel 22505. Closing.
Jun 23 19:17:44 sam xl2tpd[19176]: Connection 38838 closed to 82.xx.xxx.xxx, port 52693 (Timeout)
Jun 23 19:17:49 sam xl2tpd[19176]: Unable to deliver closing message for tunnel 22505. Destroying anyway.

See the following in the logcat logs:
D/mtpd (23534): Received 20 arguments
I/mtpd (23534): Using protocol l2tp
I/mtpd (23534): Connecting to xxx.xx port 1701 via rmnet0
I/mtpd (23534): Connection established (socket = 11)
D/mtpd (23534): Sending SCCRQ (local_tunnel = 46743)
I/racoon (23237): IPsec-SA request for xx.xx.xx.xx queued due to no phase1 found.
I/racoon (23237): initiate new phase 1 negotiation: xx.xx.xx.xx[500]<=>xx.xx.xx.xx[500]
I/racoon (23237): begin Identity Protection mode.
I/racoon (23237): received Vendor ID: DPD
I/racoon (23237): received Vendor ID: RFC 3947
I/racoon (23237): Selected NAT-T version: RFC 3947
I/racoon (23237): Hashing xx.xx.xx.xx[500] with algo #2
I/racoon (23237): Hashing xx.xx.xx.xx[500] with algo #2
I/racoon (23237): Adding remote and local NAT-D payloads.
I/racoon (23237): Hashing xx.xx.xx.xx[500] with algo #2
I/racoon (23237): NAT-D payload #0 doesn't match
I/racoon (23237): Hashing xx.xx.xx.xx[500] with algo #2
I/racoon (23237): NAT-D payload #1 doesn't match
I/racoon (23237): NAT detected: ME PEER
I/racoon (23237): KA list add: xx.xx.xx.xx[4500]->xx.xx.xx.xx[4500]
I/racoon (23237): ISAKMP-SA established xx.xx.xx.xx[4500]-xx.xx.xx.xx[4500] spi:5fc60b957f8829b0:9b0e32fde3d20a33
I/racoon (23237): initiate new phase 2 negotiation: xx.xx.xx.xx[4500]<=>xx.xx.xx.xx[4500]
I/racoon (23237): NAT detected -> UDP encapsulation (ENC_MODE 2->4).
I/racoon (23237): Adjusting my encmode UDP-Transport->Transport
I/racoon (23237): Adjusting peer's encmode UDP-Transport(4)->Transport(2)
I/racoon (23237): IPsec-SA established: ESP/Transport xx.xx.xx.xx[0]->xx.xx.xx.xx[0] spi=141298307(0x86c0a83)
I/racoon (23237): IPsec-SA established: ESP/Transport xx.xx.xx.xx[4500]->xx.xx.xx.xx[4500] spi=1224951881(0x49034849)
D/mtpd (23534): Timeout -> Sending SCCRQ
D/mtpd (23534): Timeout -> Sending SCCRQ
D/mtpd (23534): Received SCCRP without valid challenge response
E/mtpd (23534): Protocol error
D/mtpd (23534): Sending STOPCCN
I/mtpd (23534): Mtpd is terminated (status = 4)
I/LegacyVpnRunner( 936): Aborting
I/LegacyVpnRunner( 936): java.lang.IllegalStateException: mtpd is dead
I/LegacyVpnRunner( 936): at com.android.server.connectivity.Vpn$LegacyVpnRunner.execute(Vpn.java:792)
I/LegacyVpnRunner( 936): at com.android.server.connectivity.Vpn$LegacyVpnRunner.run(Vpn.java:671)
I/racoon (23237): Connection is closed
D/Vpn ( 936): setting state=DISCONNECTED, reason=exit

ya...@gmail.com <ya...@gmail.com> #255Jun 24, 2013 08:26AM

I'm facing a similar problem. I've been trying for a long time to connect to my VPN (Mountain Lion OS X Server) from my Android phone (Nexus 4 4.2.2).

The connection works fine when I use the internal IP address. But it will not connect when using it outside the network, although NAT is perfectly fine (it works with all my other devices, iOS, computers, etc). When using the external IP, it throws a timeout sending SCCRQ.

Here are both logs:

Using internal IP, connection is good

06-24 10:16:23.888 I/Vpn (495): Switched from [Legacy VPN] to [Legacy VPN]
06-24 10:16:23.888 D/Vpn (495): setting state=IDLE, reason=prepare
06-24 10:16:23.888 D/Vpn (495): setting state=CONNECTING, reason=startLegacyVpn
06-24 10:16:23.898 D/Vpn (495): setting state=CONNECTING, reason=execute
06-24 10:16:23.908 D/racoon (25845): Waiting for control socket
06-24 10:16:24.108 D/racoon (25845): Received 6 arguments
06-24 10:16:24.108 I/racoon (25845): ipsec-tools 0.7.3 (

http://ipsec-tools.sf.net)
06-24 10:16:24.198 I/racoon (25845): x.x.x.x[500] used as isakmp port (fd=10)
06-24 10:16:24.198 I/racoon (25845): x.x.x.x[500] used for NAT-T
06-24 10:16:24.198 I/racoon (25845): x.x.x.x[4500] used as isakmp port (fd=11)
06-24 10:16:24.198 I/racoon (25845): x.x.x.x[4500] used for NAT-T
06-24 10:16:24.228 D/mtpd (26140): Waiting for control socket
06-24 10:16:24.438 D/mtpd (26140): Received 20 arguments
06-24 10:16:24.438 I/mtpd (26140): Using protocol l2tp
06-24 10:16:24.438 I/mtpd (26140): Connecting to x.x.x.x port 1701 via wlan0
06-24 10:16:24.448 I/mtpd (26140): Connection established (socket = 11)
06-24 10:16:24.448 D/mtpd (26140): Sending SCCRQ (local_tunnel = 19498)
06-24 10:16:24.448 I/racoon (25845): IPsec-SA request for x.x.x.x queued due to no phase1 found.
06-24 10:16:24.448 I/racoon (25845): initiate new phase 1 negotiation: x.x.x.x[500]<=>x.x.x.x[500]
06-24 10:16:24.448 I/racoon (25845): begin Identity Protection mode.
06-24 10:16:24.458 I/racoon (25845): received Vendor ID: RFC 3947
06-24 10:16:24.458 I/racoon (25845): received Vendor ID: DPD
06-24 10:16:24.458 I/racoon (25845): received broken Microsoft ID: FRAGMENTATION
06-24 10:16:24.458 I/racoon (25845): Selected NAT-T version: RFC 3947
06-24 10:16:24.488 I/racoon (25845): Hashing x.x.x.x[500] with algo #2
06-24 10:16:24.488 I/racoon (25845): Hashing x.x.x.x[500] with algo #2
06-24 10:16:24.488 I/racoon (25845): Adding remote and local NAT-D payloads.
06-24 10:16:24.488 I/racoon (25845): Hashing x.x.x.126[500] with algo #2
06-24 10:16:24.488 I/racoon (25845): NAT-D payload #0 verified
06-24 10:16:24.488 I/racoon (25845): Hashing x.x.x.2[500] with algo #2
06-24 10:16:24.488 I/racoon (25845): NAT-D payload #1 verified
06-24 10:16:24.488 I/racoon (25845): NAT not detected
06-24 10:16:24.528 I/racoon (25845): ISAKMP-SA established x.x.x.126[500]-x.x.x.2[500] spi:4769f842e4c3cae7:7c4c07d502a809e4
06-24 10:16:25.529 I/racoon (25845): initiate new phase 2 negotiation: x.x.x.126[500]<=>x.x.x.2[500]
06-24 10:16:25.539 W/racoon (25845): ignore RESPONDER-LIFETIME notification.
06-24 10:16:25.539 I/racoon (25845): IPsec-SA established: ESP/Transport x.x.x.2[0]->x.x.x.126[0] spi=264567205(0xfc4f9a5)
06-24 10:16:25.539 I/racoon (25845): IPsec-SA established: ESP/Transport x.x.x.126[500]->x.x.x.2[500] spi=126150331(0x784e6bb)
06-24 10:16:26.450 D/mtpd (26140): Timeout -> Sending SCCRQ
06-24 10:16:26.781 D/mtpd (26140): Received SCCRP (remote_tunnel = 1280) -> Sending SCCCN
06-24 10:16:27.391 D/mtpd (26140): Received ACK -> Sending ICRQ (local_session = 37836)
06-24 10:16:27.391 I/mtpd (26140): Tunnel established
06-24 10:16:27.491 D/mtpd (26140): Received ICRP (remote_session = 8211) -> Sending ICCN
06-24 10:16:27.902 D/mtpd (26140): Received ACK
06-24 10:16:27.902 I/mtpd (26140): Session established
06-24 10:16:27.902 I/mtpd (26140): Creating PPPoX socket
06-24 10:16:27.902 I/mtpd (26140): Starting pppd (pppox = 12)
06-24 10:16:27.902 I/mtpd (26140): Pppd started (pid = 26146)
06-24 10:16:27.912 I/pppd (26146): Using PPPoX (socket = 12)
06-24 10:16:27.922 D/pppd (26146): using channel 3
06-24 10:16:27.922 I/pppd (26146): Using interface ppp0
06-24 10:16:27.922 I/pppd (26146): Connect: ppp0 <-->
06-24 10:16:30.965 I/pppd (26146): local IP address x.x.x.228
06-24 10:16:30.965 I/pppd (26146): remote IP address x.x.x.2
06-24 10:16:30.965 I/pppd (26146): primary DNS address x.x.x.2
06-24 10:16:30.965 I/pppd (26146): secondary DNS address 8.8.8.8
06-24 10:16:31.065 D/VpnJni (495): Route added on ppp0:

0.0.0.0/0
06-24 10:16:31.085 I/LegacyVpnRunner(495): Connected!
06-24 10:16:31.085 D/Vpn (495): setting state=CONNECTED, reason=execute
06-24 10:16:31.595 E/racoon (25845): unknown Informational exchange received.

Using external IP, no connection

06-24 10:07:33.504 D/Vpn (495): setting state=DISCONNECTED, reason=exit
06-24 10:07:33.504 I/Vpn (495): Switched from [Legacy VPN] to [Legacy VPN]
06-24 10:07:33.504 D/Vpn (495): setting state=IDLE, reason=prepare
06-24 10:07:33.504 I/Vpn (495): Switched from [Legacy VPN] to [Legacy VPN]
06-24 10:07:33.504 D/Vpn (495): setting state=IDLE, reason=prepare
06-24 10:07:33.504 D/Vpn (495): setting state=CONNECTING, reason=startLegacyVpn
06-24 10:07:33.504 D/Vpn (495): setting state=CONNECTING, reason=execute
06-24 10:07:33.514 D/racoon (24496): Waiting for control socket
06-24 10:07:33.714 D/racoon (24496): Received 6 arguments
06-24 10:07:33.714 I/racoon (24496): ipsec-tools 0.7.3 (

http://ipsec-tools.sf.net)
06-24 10:07:34.044 I/racoon (24496): x.x.x.x[500] used as isakmp port (fd=10)
06-24 10:07:34.044 I/racoon (24496): x.x.x.x[500] used for NAT-T
06-24 10:07:34.044 I/racoon (24496): x.x.x.x[4500] used as isakmp port (fd=11)
06-24 10:07:34.044 I/racoon (24496): x.x.x.x[4500] used for NAT-T
06-24 10:07:34.054 D/mtpd (24793): Waiting for control socket
06-24 10:07:34.275 D/mtpd (24793): Received 20 arguments
06-24 10:07:34.275 I/mtpd (24793): Using protocol l2tp
06-24 10:07:34.275 I/mtpd (24793): Connecting to

host.host.info port 1701 via wlan0
06-24 10:07:34.275 I/mtpd (24793): Connection established (socket = 11)
06-24 10:07:34.275 D/mtpd (24793): Sending SCCRQ (local_tunnel = 50517)
06-24 10:07:34.285 I/racoon (24496): IPsec-SA request for x.x.x.x queued due to no phase1 found.
06-24 10:07:34.285 I/racoon (24496): initiate new phase 1 negotiation: x.x.x.x[500]<=>x.x.x.x[500]
06-24 10:07:34.285 I/racoon (24496): begin Identity Protection mode.
06-24 10:07:34.295 I/racoon (24496): received Vendor ID: RFC 3947
06-24 10:07:34.295 I/racoon (24496): received Vendor ID: DPD
06-24 10:07:34.295 I/racoon (24496): received broken Microsoft ID: FRAGMENTATION
06-24 10:07:34.295 I/racoon (24496): Selected NAT-T version: RFC 3947
06-24 10:07:34.305 I/racoon (24496): Hashing x.x.x.x[500] with algo #2
06-24 10:07:34.305 I/racoon (24496): Hashing x.x.x.x[500] with algo #2
06-24 10:07:34.305 I/racoon (24496): Adding remote and local NAT-D payloads.
06-24 10:07:34.315 I/racoon (24496): Hashing x.x.x.x[500] with algo #2
06-24 10:07:34.315 I/racoon (24496): NAT-D payload #0 doesn't match
06-24 10:07:34.315 I/racoon (24496): Hashing x.x.x.x[500] with algo #2
06-24 10:07:34.315 I/racoon (24496): NAT-D payload #1 doesn't match
06-24 10:07:34.315 I/racoon (24496): NAT detected: ME PEER
06-24 10:07:34.315 I/racoon (24496): KA list add: x.x.x.x4500]->x.x.x.x[4500]
06-24 10:07:34.335 I/racoon (24496): ISAKMP-SA established x.x.x.x[4500]-x.x.x.x[4500] spi:36df33804849d65d:1e2eef6b0f125dfe
06-24 10:07:35.336 I/racoon (24496): initiate new phase 2 negotiation: x.x.x.x[4500]<=>x.x.x.x[4500]
06-24 10:07:35.336 I/racoon (24496): NAT detected -> UDP encapsulation (ENC_MODE 2->4).
06-24 10:07:35.346 E/racoon (24496): failed to pre-process packet.
06-24 10:07:36.287 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:37.888 E/racoon (24496): failed to pre-process packet.
06-24 10:07:38.288 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:38.899 E/racoon (24496): failed to pre-process packet.
06-24 10:07:40.280 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:40.861 E/racoon (24496): unknown Informational exchange received.
06-24 10:07:40.861 E/racoon (24496): failed to pre-process packet.
06-24 10:07:41.872 E/racoon (24496): failed to pre-process packet.
06-24 10:07:42.282 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:43.834 E/racoon (24496): failed to pre-process packet.
06-24 10:07:44.294 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:44.845 E/racoon (24496): failed to pre-process packet.
06-24 10:07:46.296 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:46.707 E/racoon (24496): failed to pre-process packet.
06-24 10:07:47.718 E/racoon (24496): failed to pre-process packet.
06-24 10:07:48.298 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:49.870 E/racoon (24496): failed to pre-process packet.
06-24 10:07:50.290 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:52.302 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:52.833 E/racoon (24496): failed to pre-process packet.
06-24 10:07:54.304 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:55.906 E/racoon (24496): failed to pre-process packet.
06-24 10:07:56.306 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:58.318 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:07:58.879 E/racoon (24496): failed to pre-process packet.
06-24 10:07:59.900 E/racoon (24496): failed to pre-process packet.
06-24 10:08:00.310 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:08:01.841 E/racoon (24496): failed to pre-process packet.
06-24 10:08:02.312 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:08:04.314 D/mtpd (24793): Timeout -> Sending SCCRQ
06-24 10:08:05.345 I/racoon (24496): IPsec-SA expired: ESP/Transport x.x.x.x[0]->x.x.x.x[0] spi=4241664(0x40b900)
06-24 10:08:05.345 W/racoon (24496): the expire message is received but the handler has not been established.
06-24 10:08:05.345 E/racoon (24496): x.x.x.x give up to get IPsec-SA due to time up to wait.
06-24 10:08:05.385 I/racoon (24496): Bye

ya...@gmail.com <ya...@gmail.com> #256Jun 24, 2013 11:38AM

Im in the same boat

I've been trying for a long time to connect to my VPN (based on OS X Server) from my Android phone.

I have a couple logs. The VPN works fine when I use the internal IP address. But it will not connect when using it outside the network, although NAT is perfectly fine (it works with all my other devices, iOS, computers, etc). When using the external IP, it throws a timeout sending SCCRQ.

Here are both logs:

Using internal IP, connection is good

06-24 10:16:23.888 I/Vpn (495): Switched from [Legacy VPN] to [Legacy VPN]
06-24 10:16:23.888 D/Vpn (495): setting state=IDLE, reason=prepare
06-24 10:16:23.888 D/Vpn (495): setting state=CONNECTING, reason=startLegacyVpn
06-24 10:16:23.898 D/Vpn (495): setting state=CONNECTING, reason=execute
06-24 10:16:23.908 D/racoon (25845): Waiting for control socket
06-24 10:16:24.108 D/racoon (25845): Received 6 arguments
06-24 10:16:24.108 I/racoon (25845): ipsec-tools 0.7.3 (

0.0.0.0/0
06-24 10:16:31.085 I/LegacyVpnRunner(495): Connected!
06-24 10:16:31.085 D/Vpn (495): setting state=CONNECTED, reason=execute
06-24 10:16:31.595 E/racoon (25845): unknown Informational exchange received.

Using external IP through DDNS, no connection. It does not matter if I do it connected to 3G or WiFi.

06-24 10:07:33.504 D/Vpn (495): setting state=DISCONNECTED, reason=exit
06-24 10:07:33.504 I/Vpn (495): Switched from [Legacy VPN] to [Legacy VPN]
06-24 10:07:33.504 D/Vpn (495): setting state=IDLE, reason=prepare
06-24 10:07:33.504 I/Vpn (495): Switched from [Legacy VPN] to [Legacy VPN]
06-24 10:07:33.504 D/Vpn (495): setting state=IDLE, reason=prepare
06-24 10:07:33.504 D/Vpn (495): setting state=CONNECTING, reason=startLegacyVpn
06-24 10:07:33.504 D/Vpn (495): setting state=CONNECTING, reason=execute
06-24 10:07:33.514 D/racoon (24496): Waiting for control socket
06-24 10:07:33.714 D/racoon (24496): Received 6 arguments
06-24 10:07:33.714 I/racoon (24496): ipsec-tools 0.7.3 (

sa...@gmail.com <sa...@gmail.com> #257Jun 28, 2013 07:05AM

[Comment deleted]

deleted

Restricted

0 B

deleted

Restricted

0 B

ya...@gmail.com <ya...@gmail.com> #258Jun 28, 2013 07:08AM

I'm in the same boat. Funny thing is I can connect when I'm in the same network (dumb) but it will throw a timeout error when trying to connect from 3G or any other WiFi.

It works perfectly fine with any other of my devices (computers, iOS, etc) but would fail with my Android phones (tested with 2.3.6, 4.1.2, 4.2.2).

Attached you can find logfiles for connections from inside and outside the network.

deleted

Restricted

0 B

deleted

Restricted

0 B

su...@surak.eti.br <su...@surak.eti.br> #259Jul 30, 2013 08:27AM

After replacing the racoon binary, I have the same problem as the others: Timeout -> Sending SCCRQ...

al...@gmail.com <al...@gmail.com> #260Aug 1, 2013 09:03AM

Same problem with Jelly Bean 4.3...

hi...@gmail.com <hi...@gmail.com> #261Aug 17, 2013 01:03AM

Try the following methods,

(1) switch your phone to "fly mode" if you use WiFi connection. Or
(2) use 3G connection

da...@gmail.com <da...@gmail.com> #262Oct 22, 2013 03:30PM

Galaxy note 10.1 with android 4.1.2.
Same problem? Google: Where are you?

b3...@gmail.com <b3...@gmail.com> #263Nov 6, 2013 01:31AM

[Comment deleted]

b3...@gmail.com <b3...@gmail.com> #264Nov 6, 2013 01:40AM

i was having the same issue on my galaxy s4, i rooted my phone, replaced the racoon file, ipsec psk still didn't work. So i went back to the stock racoon and tried something else.

when setting up the L2TP IPsec PSK connection i used the following settings
NAME: what ever you want to call it
type: L2TP/IPSec PSK
server address: the address of the vpn server your are connecting to
L2TP secret : IMPORTANT!! LEAVE THIS FIELD BLANK
IPSec Identifier: LEAVE BLANK
IPSec Pre-Shared Key: enter your pre-shared key

click save

now open your connection
enter your username for the connection
enter you L2TP password not your pre-shared password

tick the save box

click connect and see how that goes. THIS DID IT FOR ME.

if it still will not work try replace the racoon file, link in comment 203

let me know if this works and all your devices :)

b3...@gmail.com <b3...@gmail.com> #265Nov 6, 2013 01:42AM

i tested this connection with my mikrotik router running a L2TP sever

al...@gmail.com <al...@gmail.com> #266Nov 27, 2013 05:05AM

I wonder why this VPN problem is still here after 2 years. I have recently purchased a TP-Link TL-ER604W VPN wireless router. I can connect the VPN with my IOS and Windows using L2TP/IPSEC with PSK but it will timeout when I try to connect with S3 4.1.2. Today I updated to 4.3 and the error message change to disconnect instead.

I can't seem to find a way to contact Google, apparently the email contact are removed. It just doesn't feel right not being able to get a response from Google.

Someone please find a way to inform Google of this VPN issue! This topic has started since 2011 and the problem is still not solve!

cp...@gmail.com <cp...@gmail.com> #267Feb 23, 2014 03:06AM

Feb 22 2014 with 4.4.2 on Nexus 7. Just "disconnected" messages trying to access L2TP vpn on Mac OS X Server. All other devices and desktops ok to connect.

Sorry for the language but WTF is this still an issue after 3 years! Google, it's only hurting you not to address this as we are willing to allow Android devices at work but if we can't even connect to the VPN then forget it.

en...@gmail.com <en...@gmail.com> #268Apr 27, 2014 04:30AM

Same problem, Nexus 4, stock Android 4.4.2

Confirms the same problem.
Also confirm that #264 works!! Edit your VPN info, leave "L2TP Secret" blank, and it connects normally.

ma...@gmail.com <ma...@gmail.com> #269Apr 30, 2014 01:08PM

Much to long to solve a problem like this.

ph...@gmail.com <ph...@gmail.com> #270Sep 9, 2014 05:34AM

Same problem with android 4.4.2 and OSX 10.9.4. I have had it the way #264 suggests from the beginning and it still doesn't work. Is there a third party app that will connect? The only apps I seem to find are client apps for specific VPN providers. I have tried a 9 character password with no special characters even.

wi...@gmail.com <wi...@gmail.com> #271Oct 17, 2014 10:12AM

哎

[Deleted User] <[Deleted User]> #272Jan 26, 2015 09:09PM

Its well

ar...@gmail.com <ar...@gmail.com> #273Aug 18, 2015 07:54AM

VPN до сих пор не починили. Мда... Прошло 4 года, я в а*уе

vv...@gmail.com <vv...@gmail.com> #274Nov 16, 2015 12:28AM

I have upgraded to android 6.
VPN: L2TP/IPSec PSW

The IOS and OSX can connect to VPN perfectly. But the problem is still remaining in Android

qa...@gmail.com <qa...@gmail.com> #275Jan 19, 2016 02:08PM

i get the error "could not establish session on the ipsec daemon"

ba...@gmail.com <ba...@gmail.com> #276Apr 10, 2017 12:21AM

House fourth

po...@gmail.com <po...@gmail.com> #277Mar 7, 2019 03:25PM

Hello
I have the same problem of everybody here
I have Samsung galaxy note 5 version 7.0 and it impossible for me to set VPN on it !!
There is some issues?
Thank' s a lot.

Issue 36937101

Description

Issue summary

Comments

le...@gmail.com <le...@gmail.com> #2Dec 19, 2011 02:44AM

ri...@gmail.com <ri...@gmail.com> #3Dec 19, 2011 03:16AM

bs...@gmail.com <bs...@gmail.com> #4Dec 19, 2011 09:17PM

br...@gmail.com <br...@gmail.com> #5Dec 20, 2011 02:29AM

bs...@gmail.com <bs...@gmail.com> #6Dec 20, 2011 11:58PM

yo...@gmail.com <yo...@gmail.com> #7Dec 27, 2011 12:45PM

fs...@gmail.com <fs...@gmail.com> #8Dec 29, 2011 03:48PM

bh...@gmail.com <bh...@gmail.com> #9Jan 3, 2012 06:45PM

jn...@gmail.com <jn...@gmail.com> #10Jan 4, 2012 12:12PM

ma...@gmail.com <ma...@gmail.com> #11Jan 5, 2012 11:24AM

ya...@gmail.com <ya...@gmail.com> #12Jan 6, 2012 02:53AM

fs...@gmail.com <fs...@gmail.com> #13Jan 6, 2012 02:56AM

gv...@gmail.com <gv...@gmail.com> #14Jan 6, 2012 09:09AM

ph...@googlemail.com <ph...@googlemail.com> #15Jan 6, 2012 02:14PM

bs...@gmail.com <bs...@gmail.com> #16Jan 6, 2012 02:25PM

rs...@gmail.com <rs...@gmail.com> #17Jan 6, 2012 03:57PM

ji...@gmail.com <ji...@gmail.com> #18Jan 9, 2012 12:22PM

ru...@gmail.com <ru...@gmail.com> #19Jan 9, 2012 02:57PM

ji...@gmail.com <ji...@gmail.com> #20Jan 10, 2012 11:47AM

ja...@gmail.com <ja...@gmail.com> #21Jan 14, 2012 05:13AM

tt...@gmail.com <tt...@gmail.com> #22Jan 14, 2012 08:45PM

em...@craigsherriff.co.uk <em...@craigsherriff.co.uk> #23Jan 16, 2012 12:04AM

cr...@gmail.com <cr...@gmail.com> #24Jan 16, 2012 12:08AM

pe...@gmail.com <pe...@gmail.com> #25Jan 16, 2012 07:01AM

sh...@gmail.com <sh...@gmail.com> #26Jan 18, 2012 04:07AM

bi...@gmail.com <bi...@gmail.com> #27Jan 19, 2012 03:59PM

vs...@gmail.com <vs...@gmail.com> #28Jan 24, 2012 05:03AM

fs...@gmail.com <fs...@gmail.com> #29Jan 24, 2012 05:06AM

mi...@gmail.com <mi...@gmail.com> #30Jan 24, 2012 10:52PM

be...@gmail.com <be...@gmail.com> #31Jan 25, 2012 07:07PM

nb...@gmail.com <nb...@gmail.com> #32Jan 26, 2012 03:42PM

xb...@gmail.com <xb...@gmail.com> #33Jan 26, 2012 06:03PM

be...@capitollien.com <be...@capitollien.com> #34Jan 26, 2012 07:28PM

er...@gmail.com <er...@gmail.com> #35Jan 27, 2012 07:10AM

xb...@gmail.com <xb...@gmail.com> #36Jan 27, 2012 07:32AM

sh...@gmail.com <sh...@gmail.com> #37Jan 27, 2012 01:18PM

sh...@gmail.com <sh...@gmail.com> #38Jan 27, 2012 01:19PM

sh...@gmail.com <sh...@gmail.com> #39Jan 27, 2012 01:20PM

sh...@gmail.com <sh...@gmail.com> #40Jan 27, 2012 01:27PM

[Deleted User] <[Deleted User]> #41Jan 29, 2012 10:38AM

sh...@gmail.com <sh...@gmail.com> #42Jan 30, 2012 12:38PM

nb...@gmail.com <nb...@gmail.com> #43Jan 30, 2012 12:45PM

mt...@gmail.com <mt...@gmail.com> #44Jan 31, 2012 03:36PM

he...@gmail.com <he...@gmail.com> #45Feb 1, 2012 11:37AM

he...@gmail.com <he...@gmail.com> #46Feb 1, 2012 11:40AM

ro...@gmail.com <ro...@gmail.com> #47Feb 1, 2012 03:43PM

mp...@googlemail.com <mp...@googlemail.com> #48Feb 3, 2012 10:07PM

pa...@gmail.com <pa...@gmail.com> #49Feb 4, 2012 01:56AM

la...@gmail.com <la...@gmail.com> #50Feb 4, 2012 01:18PM

jo...@gmail.com <jo...@gmail.com> #51Feb 4, 2012 07:08PM

ga...@googlemail.com <ga...@googlemail.com> #52Feb 5, 2012 01:20PM

ma...@gmail.com <ma...@gmail.com> #53Feb 6, 2012 09:40PM

br...@gmail.com <br...@gmail.com> #54Feb 8, 2012 02:36AM

xm...@gmail.com <xm...@gmail.com> #55Feb 8, 2012 12:12PM

jo...@gmail.com <jo...@gmail.com> #56Feb 8, 2012 08:44PM

ma...@gmail.com <ma...@gmail.com> #57Feb 11, 2012 04:09PM

wa...@gmail.com <wa...@gmail.com> #58Feb 11, 2012 09:39PM

wa...@gmail.com <wa...@gmail.com> #59Feb 11, 2012 10:05PM

n-...@naftolijacobs.com <n-...@naftolijacobs.com> #60Feb 14, 2012 07:09PM

re...@gmail.com <re...@gmail.com> #61Feb 16, 2012 07:24PM

pe...@gmail.com <pe...@gmail.com> #62Feb 16, 2012 10:28PM

pa...@gmail.com <pa...@gmail.com> #63Feb 21, 2012 10:43PM

ma...@gmail.com <ma...@gmail.com> #64Feb 21, 2012 11:05PM

ne...@gmail.com <ne...@gmail.com> #65Feb 23, 2012 10:34PM

ba...@gmail.com <ba...@gmail.com> #66Feb 24, 2012 03:49AM

kr...@gmail.com <kr...@gmail.com> #67Feb 24, 2012 11:00AM

ke...@gmail.com <ke...@gmail.com> #68Feb 24, 2012 09:15PM

ke...@gmail.com <ke...@gmail.com> #69Feb 24, 2012 09:15PM

ke...@gmail.com <ke...@gmail.com> #70Feb 25, 2012 09:09AM

ke...@gmail.com <ke...@gmail.com> #71Feb 25, 2012 09:10AM

gd...@gmail.com <gd...@gmail.com> #72Feb 25, 2012 10:00AM

st...@googlemail.com <st...@googlemail.com> #73Feb 26, 2012 01:43AM

ga...@gmail.com <ga...@gmail.com> #74Feb 26, 2012 06:01PM

da...@gmail.com <da...@gmail.com> #75Feb 27, 2012 09:18AM

kr...@gmail.com <kr...@gmail.com> #76Feb 27, 2012 12:35PM

ma...@gmail.com <ma...@gmail.com> #77Feb 27, 2012 10:00PM