从iPad / iPhone连接到Sonicwall L2TP VPN时出错

客户有一台运行SonicOS 3.0的Sonicwall Pro 2040，他们希望能够使用iPad上的L2TP VPN客户端连接到内部服务（Citrix等）。我已经在Sonicwall上启用了L2TP VPN服务器，确保为阶段2设置AES-128，并在testingiPad上设置相应的用户名，密码和预共享密钥。当我尝试连接时，在Sonicwall的日志中收到一些相当神秘的错误消息：

2 03/29/2011 12:25:09.096 IKE Responder: IPSec proposal does not match (Phase 2) [My outbound IP address redacted] (admin) [WAN IP address redacted] 10.10.130.7/32 -> [WAN IP address redacted]/32 3 03/29/2011 12:25:09.096 IKE Responder: Received Quick Mode Request (Phase 2) [My outbound IP address redacted], 61364 (admin) [WAN IP address redacted], 500 4 03/29/2011 12:25:07.048 IKE Responder: IPSec proposal does not match (Phase 2) [My outbound IP address redacted] (admin) [WAN IP address redacted] 10.10.130.7/32 -> [WAN IP address redacted]/32 5 03/29/2011 12:25:07.048 IKE Responder: Received Quick Mode Request (Phase 2) [My outbound IP address redacted], 61364 (admin) [WAN IP address redacted], 500

iPad上的控制台日志看起来像这样：

 Mar 29 13:31:24 Daves-iPad racoon[519] <Info>: [519] INFO: ISAKMP-SA established 10.10.130.7[500]-[WAN IP address redacted][500] spi:5d705eb6c760d709:458fcdf80ee8acde Mar 29 13:31:24 Daves-iPad racoon[519] <Notice>: IPSec Phase1 established (Initiated by me). Mar 29 13:31:24 Daves-iPad kernel[0] <Debug>: launchd[519] Builtin profile: racoon (sandbox) Mar 29 13:31:25 Daves-iPad racoon[519] <Info>: [519] INFO: initiate new phase 2 negotiation: 10.10.130.7[500]<=>[WAN IP address redacted][500] Mar 29 13:31:25 Daves-iPad racoon[519] <Notice>: IPSec Phase2 started (Initiated by me). Mar 29 13:31:25 Daves-iPad racoon[519] <Info>: [519] ERROR: fatal NO-PROPOSAL-CHOSEN notify messsage, phase1 should be deleted. Mar 29 13:31:25 Daves-iPad racoon[519] <Info>: [519] ERROR: Message: '@ No proposal is chosen'. Mar 29 13:31:46 Daves-iPad racoon[519] <Info>: [519] ERROR: fatal NO-PROPOSAL-CHOSEN notify messsage, phase1 should be deleted. Mar 29 13:31:46 Daves-iPad racoon[519] <Info>: [519] ERROR: Message: '@ No proposal is chosen'. Mar 29 13:31:55 Daves-iPad pppd[518] <Notice>: IPSec connection failed

这是否提供了什么问题的线索？

首先，我强烈build议您（或您的客户）升级到更新版本的SonicOS，或更确切地说SonicOS增强。

关于您的问题，通过阅读错误消息，显示SonicWall和iPad上的第二阶段build议不匹配。我会看看使用的协议和身份validation。确保iPadconfiguration相应。

两个有用的链接：

configurationiPod / iPad / iPhone L2TP客户端以连接到SonicWALL UTM设备
如何在SonicWALL UTM设备上configurationL2TP服务器

尽pipeSonicWALL确实表示您的configuration应该可以正常工作，但您也可以尝试使用AES-256来查看是否有更好的运气。同时确保PFS未被选中。

http://www.fuzeqna.com/sonicwallkb/consumer/kbdetail.asp?kbid=8260