Just spent a couple of hours trying to get a Mac OS X laptop connected to a Cisco IOS IPSEC/L2TP server. The existing configuration worked fine for windows and linux servers but the Mac just refused to establish a connection. The Cisco logs contained the usual cryptic message.
Dec 16 16:53:47.955: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 117.53.171.241, remote= 124.171.30.131,.
local_proxy= 117.53.171.241/255.255.255.255/17/1701 (type=1),.
remote_proxy= 124.171.30.131/255.255.255.255/17/1701 (type=1),
protocol= ESP, transform= esp-3des esp-sha-hmac (Transport-UDP),.
lifedur= 0s and 0kb,.
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x800
Dec 16 16:53:47.955: Crypto mapdb : proxy_match
src addr : 117.53.171.241
dst addr : 124.171.30.131
protocol : 17
src port : 1701
dst port : 49561
Dec 16 16:53:47.955: map_db_find_best did not find matching map
Dec 16 16:53:47.955: IPSEC(validate_transform_proposal): no IPSEC cryptomap exists for local address A.B.C.D
After much googling I discovered that the problem was dst port: 49561 . Unlike most other L2TP clients the Mac uses a random source port for the L2TP part of the connection. Most others use 1701 for source and destination.
So relaxing this
ip access-list extended L2TP permit udp host 117.53.171.241 eq 1701 any eq 1701
to this
ip access-list extended L2TP permit udp host 117.53.171.241 eq 1701 any
solved the problem.
It would now normally be the time for me to rant about how IPSEC has to be one of the most badly implemented protocols by all vendors and how getting two different implementations to talk to each other always takes a minimum of 2 hours even if you’ve done it before but it would just be too exhausting.