After a few of days googling and trying out innumerable combinations I managed to connect the two
barely. Many thanks to Brano for his howto (»
L2TP VPN on USG - quick how-to).
I hoped for a site-to-site tunnel, at least that's what I thought most suitable, but I can't get the machines to connect in that mode.
The Windows Server is a virtual host with a public IP. From it I can initiate a demand-dial L2TP/IPsec to the Zywall. I confirmed it by pinging resources on 192.168.17.0 network behind the Zywall from the Server. I could not however ping back.
It seemed however that there was some problem with the L2TP connection, the log continued to report it as deconnected and it never showed up in the VPN monitor on the Zywall.
Then I found a log entry on the server:
A connection has been established on port VPN0-127 using interface VPN_Zywall, but the remote side got no IP address.I did set it up the interface as instructed elsewhere with an IP range 192.168.100.100-199. It seems to be a case of
unnumbered connections (»
technet.microsoft.com/en ··· 0).aspx). So I tried to give the interface a static IP instead, but that created other problems.
Anyway, this is how the log looks right now:
notice - Firewall - priority:12, from WAN to ZyWALL, UDP, service VPN_IPSEC, ACCEPT - WinServer:500 - Zywall:500 - ACCESS FORWARD
info - IKE - The cookie pair is : 0x9c4b9982c0cd6b96 / 0x0000000000000000 - WinServer:500 - Zywall:500 - IKE_LOG
info - IKE - Recv Main Mode request from [WinServer] - WinServer:500 - Zywall:500 - IKE_LOG
info - IKE - The cookie pair is : 0xcd31df7f97646d9e / 0x9c4b9982c0cd6b96 [count=5] - WinServer:500 - Zywall:500 - IKE_LOG
info - IKE - Recv:[SA][VID][VID][VID][VID][VID][VID][VID][VID] - WinServer:500 - Zywall:500 - IKE_LOG
info - IKE - The cookie pair is : 0x9c4b9982c0cd6b96 / 0xcd31df7f97646d9e [count=9] - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - Send:[SA][VID][VID][VID][VID][VID][VID][VID][VID] - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - Recv:[KE][NONCE][PRV][PRV] - WinServer:500 - Zywall:500 - IKE_LOG
info - IKE - Send:[KE][NONCE][PRV][PRV] - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - Recv:[ID][HASH] - WinServer:500 - Zywall:500 - IKE_LOG
info - IKE - Send:[ID][HASH] - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - Phase 1 IKE SA process done - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - Recv:[HASH][SA][NONCE][ID][ID] - WinServer:500 - Zywall:500 - IKE_LOG
info - IKE - Send:[HASH][SA][NONCE][ID][ID] - Zywall:500 - WinServer:500 - IKE_LOG
notice - Firewall - priority:12, from WAN to ZyWALL, service VPN_IPSEC, ACCEPT - WinServer - Zywall - ACCESS FORWARD
error IPSec - SPI: 0x95fa2c28 (2516200488) SEQ: 0x1 (1) No rule found, Dropping ESP packet - WinServer - Zywall - ipsec
info - IKE - Recv:[HASH] - WinServer:500 - Zywall:500 - IKE_LOG
notice - Firewall - priority:13, from TUNNEL to ZyWALL, UDP, service L2TP-UDP, ACCEPT - - WinServer:1701 - Zywall:1701 - ACCESS FORWARD
info - IKE - [Responder:Zywall][Initiator:WinServer] - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - [Policy: ipv4(udp:1701,Zywall)-ipv4(udp:1701,WinServer)] - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - [ESP aes-cbc|hmac-sha1-96][SPI 0x95fa2c28|0xcdeb4262][Lifetime 250000 kilobytes 3640 seconds] - Zywall:500 - WinServer:500 - IKE_LOG
info - IKE - Dynamic Tunnel [L2TP_VPN_GW:L2TP_VPN_Connection:0xcdeb4262] built successfully - Zywall:500 - WinServer:500 - IKE_LOG
notice - User - - User lhvpn from l2tp has logged in ZyWALL - 192.168.100.1 - [empty] - Account: lhvpn
info - L2TP Over IPSec - User lhvpn has been granted an L2TP over IPSec session. - Zywall:1701 - WinServer:1701 - L2TP_LOG
notice - Firewall - priority:7, from TUNNEL to ANY, ICMP Type:8, service others, ICMP Type:8, ACCEPT [count=2] - 192.168.100.1 - 192.168.17.38 - ACCESS FORWARD
error - IPSec - SPI: 0x0 (0) SEQ: 0x0 (0) No rule found, Dropping Unknown(1) packet [count=2] - 192.168.17.34 - 192.168.100.100 - ipsec
The last dropped packet is me pinging from the Zywall LAN to the server.
If anybody has any ideas on how I should go about to solve this, please share your thoughts. I'm happy to provide screendumps or list of settings, but I don't know where to begin.
Thanks!