MPPE required but not available

Question

MPPE required but not available

I'm trying to get VPN working through a FreeBSD NAT gateway. I've forwarded the ports that are listed in the Leopard Server documentation as well as one other one someone else mentioned:

# VPN
redirect_port udp 10.0.1.17:170 170
redirect_port udp 10.0.1.17:500 500
redirect_port udp 10.0.1.17:1701 1701
redirect_port tcp 10.0.1.17:1723 1723
redirect_port udp 10.0.1.17:4500 4500

When I setup an L2TP over IPsec VPN connection from home, it connects but then fails. The server logs show:

*MPPE required by not available*

Has anyone seen this?

The full logs are as follows:

2008-02-05 18:54:40 PST Incoming call... Address given to client = 10.0.1.241
Tue Feb 5 18:54:40 2008 : Directory Services Authentication plugin initialized
Tue Feb 5 18:54:40 2008 : Directory Services Authorization plugin initialized
Tue Feb 5 18:54:40 2008 : L2TP incoming call in progress from 'xxx.xxx.xxx.xxx'...
Tue Feb 5 18:54:40 2008 : L2TP received SCCRQ
Tue Feb 5 18:54:40 2008 : L2TP sent SCCRP
Tue Feb 5 18:54:40 2008 : L2TP received SCCCN
Tue Feb 5 18:54:40 2008 : L2TP received ICRQ
Tue Feb 5 18:54:40 2008 : L2TP sent ICRP
Tue Feb 5 18:54:40 2008 : L2TP received ICCN
Tue Feb 5 18:54:40 2008 : L2TP connection established.
Tue Feb 5 18:54:40 2008 : using link 0
Tue Feb 5 18:54:40 2008 : Using interface ppp0
Tue Feb 5 18:54:40 2008 : Connect: ppp0 <--> socket[34:18]
Tue Feb 5 18:54:40 2008 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xc7140cf4> <pcomp> <accomp>]
Tue Feb 5 18:54:40 2008 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x9178c2c0> <pcomp> <accomp>]
Tue Feb 5 18:54:40 2008 : lcp_reqci: returning CONFACK.
Tue Feb 5 18:54:40 2008 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x9178c2c0> <pcomp> <accomp>]
Tue Feb 5 18:54:40 2008 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0xc7140cf4> <pcomp> <accomp>]
Tue Feb 5 18:54:40 2008 : sent [LCP EchoReq id=0x0 magic=0xc7140cf4]
Tue Feb 5 18:54:40 2008 : sent [CHAP Challenge id=0x2c <eff32f5e4a2e7568fd6bf6e8554f0e98>, name = "ambrosia.xxxxxxx.com"]
Tue Feb 5 18:54:40 2008 : rcvd [LCP EchoReq id=0x0 magic=0x9178c2c0]
Tue Feb 5 18:54:40 2008 : sent [LCP EchoRep id=0x0 magic=0xc7140cf4]
Tue Feb 5 18:54:40 2008 : rcvd [LCP EchoRep id=0x0 magic=0x9178c2c0]
Tue Feb 5 18:54:40 2008 : rcvd [CHAP Response id=0x2c <537edd13c383e0138f6a42eba424261b0000000000000000aa78ba8820128550fdfc21aa8b6eb4 995c32f8e77bf0debb00>, name = "patrick"]
Tue Feb 5 18:54:41 2008 : sent [CHAP Success id=0x2c "S=9C7DED03592A3FFA3B7FE5ECECF03C8E6C3CC76A M=Access granted"]
Tue Feb 5 18:54:41 2008 : CHAP peer authentication succeeded for patrick
Tue Feb 5 18:54:41 2008 : DSAccessControl plugin: User 'patrick' authorized for access
Tue Feb 5 18:54:41 2008 : sent [IPCP ConfReq id=0x1 <addr 10.0.1.17>]
Tue Feb 5 18:54:41 2008 : sent [ACSCP] 01 01 00 04
Tue Feb 5 18:54:41 2008 : rcvd [LCP TermReq id=0x2 "MPPE required but not available"]
Tue Feb 5 18:54:41 2008 : LCP terminated by peer (MPPE required but not available)
Tue Feb 5 18:54:41 2008 : sent [LCP TermAck id=0x2]
Tue Feb 5 18:54:41 2008 : L2TP received CDN
Tue Feb 5 18:54:41 2008 : Connection terminated.
Tue Feb 5 18:54:41 2008 : Connect time 0.1 minutes.
Tue Feb 5 18:54:41 2008 : Sent 0 bytes, received 0 bytes.
Tue Feb 5 18:54:41 2008 : L2TP disconnecting...
Tue Feb 5 18:54:41 2008 : L2TP sent CDN
Tue Feb 5 18:54:41 2008 : L2TP sent StopCCN
Tue Feb 5 18:54:41 2008 : L2TP disconnected
2008-02-05 18:54:41 PST --> Client with address = 10.0.1.241 has hungup

MacBook 2.0GHz Core Duo, iMac 20" Core Duo, Mac OS X (10.5.1)

Posted on Feb 5, 2008 7:09 PM

Reply

Answer 1

Feb 5, 2008 9:57 PM in response to Patrick Gibson

If you want to get PPTP through you also need GRE protocol forwarded.

UDP port 170 shouldn't be needed (and maybe not UDP 1701 either).

Some other guy found that MPPE didn't start (Leopard) on the client end before he first tried PPTP VPN.

Reply

Answer 2

Feb 6, 2008 9:20 PM in response to Leif Carlsson

I've added "redirect_proto gre 10.0.1.17" to my natd.conf, but am still getting the same error. I should mention that from home, I'm connecting behind an Airport Extreme (802.11n) Base Station. My subnet at home is different, but I was reading in some other groups that the AEBS has problems with VPN. It seemed to more be the case with Cisco and other VPNs; I can't imagine that an a Mac connecting through a brand new Apple Base Station to a Leopard Server VPN would have this same problem. The solution in the forums is to enable the "default host" on the AEBS. I tried this, but I still get the same "MPPE required but not available" error.

Reply

Answer 3

Feb 6, 2008 9:43 PM in response to Patrick Gibson

Okay, I've noticed that the client writes to some local logs and have discovered the following line when I'm trying to connect:

02/06/08 21:35:38 pppd[60732] MPPE required, but kernel has no support.

Could it be that Leopard client does not have full support for Leopard server?

I have also tried connecting via PPTP but I get a connection refused message. I have it turned on in the server, and all of the necessary ports and protocols forwarded. I'd rather use L2TP any way, and things seem a lot closer there.

Reply

Answer 4

Feb 7, 2008 7:12 AM in response to Patrick Gibson

Had the same MPPE problem with some of the 10.5 clients when connectiong over l2tp, windows clients are not affected.

i changed the MPPE settings in the following plist.
/Library/Preferences/SystemConfiguration/preferences.plist

disabled these siblings (changing 1 to 0):
CCPMPPE128Enabled
CCPMPPE40Enabled

Reply

Answer 5

Feb 8, 2008 11:42 PM in response to Jean-Paul Scholten

I'm still getting the same error.

Though I have just learned that FreeBSD does not have IPSec support built-in to the kernel by default. Does it need to be supported there, or should natd be able to forward everything through?

Reply

Answer 6

Feb 9, 2008 11:22 AM in response to Patrick Gibson

I'm suffering the same issues with 10.5.1 server...

10.5 clients can connect fine, but I'm trying to use MPPE to authorize a linux PPTP client to connect and its failing big time. I know the linux client works, as it uses MPPE to connect to my 10.4 server just fine...

Hope Apple fix this in 10.5.2!

anyone got any hints? 🙂 the vpnaddkeyuser trick didn't work unfortunately.

Thanks
M.

Reply

Answer 7

Feb 10, 2008 8:50 AM in response to Patrick Gibson

Hi Patrick

May have a look at this Thread:

http://discussions.apple.com/thread.jspa?threadID=1286988&tstart=0

May this gives you some additional input...

Cheers Daniel

Reply