VPN doesn't connect on iPhone + iPad (L2TP PSK NAT on Windows Server 2008)

Question

VPN doesn't connect on iPhone + iPad (L2TP PSK NAT on Windows Server 2008)

Hi, because of iOS 10 not supporting PPTP VPN anymore, we were forced to change our VPN to L2TP/IPSec.

This was done and L2TP VPN works fine with our Windows laptops, but I can't get it to connect with my iPhone, neither my iPad. I'm trying to fix this on iOS 9 prior to upgrading, so I'm able to connect using PPTP, but my L2TP won't get through.

Our VPN Server is a Windows Server 2008, using a Pre-Shared-Key (not a certificate). VPN is behind a SonicWall TZ210 (router/firewall). We're doing NAT to get VPN through and I suspect that might be the reason our iPhone have a problem handling this.

All the appropriate ports are opened and forwarded to our VPN Server (UDP 500, 1701, 4500, ESP 50).

I tried with my iPhone connected to a home Wifi, our office WifI, LTE, and none of these allow the connection on L2TP (but PPTP always works)

Using a packet sniffer I can see that some packets get through to our VPN servers, but there usually are way more than what I see in a L2TP connection, so I have a feeling iOS doesn't handle well the VPN with NAT-ing.

Is there a setting I'm missing ?

Anyone have had a similar situation ?

Thanks for any help or advice, I've been working on this for a week now and I'm starting to lack ideas

Martin

iPhone 6, iOS 9.3.5

Posted on Oct 14, 2016 10:38 AM

Reply

Answer 1

Nov 3, 2016 5:43 AM in response to martin.lheureux

Just in case it might help someone, I gave up on my initial configuration and did setup the L2TP/IPSec VPN on our SonicWall

I discussed our problems with a few experts, and none of us were able to understand why it didn't work.

It's either the NAT-ing of the Firewall, or the Server/iOS IPSec encryptions that were not handling this properly

Nevertheless, after 3 weeks of trying, we move the VPN to our SonicWall.

From there on, it wasn't an easy road getting the right IPSec parameters, some of them work working for Windows, some for iOS. Turned out the only compatible SonicWall IPSec settings for both platform was AES-128 with SHA1

Might not be perfect, but I will leave it this was for now. This PPTP removal from iOS 10 resulted in a huge effort on our side to fix it up, so I thought I'd post my process in case someone else gets issues like we did.

Reply