openfortivpn connection is broken with ppp 2.5.0
tobip opened this issue · comments
I am using openfortivpn to connect to my workplace.
Since ppp 2.5.0 the connection stopped working, giving the output:
Peer refused to agree to his IP address.
Downgrade back to 2.4.9 works for me.
Sorry, crystal ball is a bit cloudy at the moment, and I'm no good at reading minds. Could you run both the non-working and working cases with the 'debug' option and post the logs here?
in /etc/ppp/options, un-comment ipcp-accept-remote. - worked for me.
I'm assuming the fortinet hasn't changed?
Both log files looks pretty disturbing if you ask me, I'm surprised 2.4.9 works.
What's the carrier for ppp here? Are we talking l2tp? pptp? serial?
In both negotiations, the peers are unable to agree on an IP address, so in both cases ipcp-accept-remote is the right thing to use.
The behaviour in this situation, when the peers don't agree, was changed by commit 9fe8923 ("pppd: Fix enforcing peer IP address (#235)", 2021-01-26), with the comments:
pppd: Fix enforcing peer IP address (#235)
If peer address is specified and ipcp-accept-remote is not set then peer
address is enforced.
But there is bug in pppd which allows peer to not use supplied address when
it reply with empty IPCP ConfReq. In this case pppd thinks that peer
accepted its idea of remote/peer address even it is not truth.
So the new behaviour of failing to bring up the link when the two ends can't agree on an IP address and the ipcp-accept-remote option is not used is deliberate, and I think correct.
I'm assuming the fortinet hasn't changed?
Yes, nothing in the network has changed.
What's the carrier for ppp here? Are we talking l2tp? pptp? serial?
Unfortunately I don't know how to answer these questions...
I'm assuming the fortinet hasn't changed?
Yes, nothing in the network has changed.
"in the network" - that's quite a bold statement really. How do you definte "the network"? I specifically asked about fortinet.
What's the carrier for ppp here? Are we talking l2tp? pptp? serial?
Unfortunately I don't know how to answer these questions...
OK. That makes things harder.
Have you tried with ipcp-accept-remote option set?
@tobip did the discussion referred to in the previous comment help? Is this still an issue?
Yes thanks, I got it.