Draytek 2925L Site to Site achter NAT (4G)

[bento1]

Ik probeer vanaf een Draytek 2925L via een Vodafone 4G verbinding een Site to Site IPSec VPN op te zetten met ons datacentrum. In het DC draait een VyOS router in een VM.

Omdat de 4G verbinding van Vodafone geNAT is kan ik niet op basis van IP de verbinding maken, het moet dus op basis van een PeerID.

De Draytek is zo ingesteld:


Het popupje achter de knop Advanced zo:


Aan de VyOS kant krijg ik nu deze melding te zien (62.72.192.57 is het WAN IP van Vodafone en 10.118.x.x is het WAN IP van onze 4G router):

code:

Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: responding to Main Mode from unknown peer 62.72.192.57:8475
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: NAT-Traversal: Result using RFC 3947: peer is NATed
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: ignoring informational payload, type IPSEC_INITIAL_CONTACT
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: Peer ID is ID_IPV4_ADDR: '10.118.x.x'
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: no suitable connection for peer '10.118.x.x'
Aug 31 12:00:14 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: sending encrypted notification INVALID_ID_INFORMATION to 62.72.192.57:8475
Aug 31 12:00:17 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: ignoring informational payload, type IPSEC_INITIAL_CONTACT
Aug 31 12:00:17 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: Peer ID is ID_IPV4_ADDR: '10.118.x.x'
Aug 31 12:00:17 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: multiple ipsec.secrets entries with distinct secrets match endpoints: first secret used
Aug 31 12:00:17 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: no suitable connection for peer '10.118.x.x'
Aug 31 12:00:17 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: sending encrypted notification INVALID_ID_INFORMATION to 62.72.192.57:8475
Aug 31 12:00:20 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2549: max number of retransmissions (2) reached STATE_MAIN_R2
Aug 31 12:00:24 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: ignoring informational payload, type IPSEC_INITIAL_CONTACT
Aug 31 12:00:24 vyos pluto[17983]: "peer-REMOVED_NAME-parking-tunnel-1"[2] 62.72.192.57:8475 #2553: Peer ID is ID_IPV4_ADDR: '10.118.x.x'

De verbinding komt daar dus binnen met als PeerID het WAN adres van de Draytek 4G Router en niet het PeerID wat ik zelf heb ingesteld.

De Draytek zegt zelf ook:

code:

 [IPSEC/IKE][L2L][1:REMOVED_NAME][@87.xxx.xxx.xxx] err: infomational exchange message is invalid 'cos incomplete ISAKMP SA

Doe ik iets fout? Kan dit uberhaupt?

[bento1]

Contact gehad met Draytek. Dit kan alleen in Agressive Mode en VyOS kan dit niet.