# VPN L2TP/Ipsec : Problème en rsasig (xl2tpd/racoon)

**URL:** <https://www.debian-fr.org/t/vpn-l2tp-ipsec-probleme-en-rsasig-xl2tpd-racoon/68193>\
**Category:** Support Debian\
**Created:** [Février 21, 2016, 10:17 UTC](https://www.debian-fr.org/t/vpn-l2tp-ipsec-probleme-en-rsasig-xl2tpd-racoon/68193 "2016-02-21T22:17:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![gazeka74](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/g/ecae2f/32.png) [@gazeka74](https://www.debian-fr.org/u/gazeka74)\
**Post date:** [Février 21, 2016, 10:17 UTC](https://www.debian-fr.org/t/vpn-l2tp-ipsec-probleme-en-rsasig-xl2tpd-racoon/68193/1 "2016-02-21T22:17:22Z")

</div>

Bonjour les gens 😃

Je viens vers vous car je suis bloqué sur mon serveur vpn : j’ai une erreur qui reviens en boucle quelque soit les manipulations que je fait dans mes fichiers de conf.  
Enfin, il s’agit du" racoon NOTIFY the packet is retransmitted by"

Sachant que j’utilise xl2tpd et racoon, et que j’ai suivi le tutoriel ci-contre :[https://wiki.debian.org/HowTo/AndroidVPNServer](https://wiki.debian.org/HowTo/AndroidVPNServer)

Je tiens à préciser que mon serveur fonctionne lorsqu’il est configuré en presharedkey mais pas en rsasig, et qu’il tourne sur une vm.

racoon.conf:

# 

# NOTE: This file will not be used if you use racoon-tool(8) to manage your

# IPsec connections. racoon-tool will process racoon-tool.conf(5) and

# generate a configuration (/var/lib/racoon/racoon.conf) and use it, instead

# of this file.

# 

# Simple racoon.conf

# 

# 

# Please look in /usr/share/doc/racoon/examples for

# examples that come with the source.

# 

# Please read racoon.conf(5) for details, and alsoread setkey(8).

# 

# 

# Also read the Linux IPSEC Howto up at

# [ipsec-howto.org/t1.html](http://www.ipsec-howto.org/t1.html)

# 

log notify;  
path certificate “/etc/racoon/certs”;  
path pre\_shared\_key “/etc/racoon/psk.txt”;  
#remote 172.31.1.1 {

# exchange\_mode main,aggressive;

# proposal {

# encryption\_algorithm 3des;

# hash\_algorithm sha1;

# authentication\_method pre\_shared\_key;

# dh\_group modp1024;

# }

# generate\_policy off;

#}

# 

#sainfo address 192.168.203.10[any] any address 192.168.22.0/24[any] any {

# pfs\_group modp768;

# encryption\_algorithm 3des;

# authentication\_algorithm hmac\_md5;

# compression\_algorithm deflate;

#}  
remote anonymous {  
exchange\_mode main;

```
verify_identifier off;
#my_identifier fqdn "ADLO SRV";

#certificats et clés

peers_certfile x509 "phone.pem";
certificate_type x509 "server.pem" "server_good.key";
ca_type x509 "ca.pem";

passive on;
generate_policy on;
nat_traversal on;
proposal_check obey;
dpd_delay 20;

proposal {
	encryption_algorithm aes;
	hash_algorithm md5;
	authentication_method rsasig;
	dh_group modp1024;
}

```

}  
sainfo anonymous {  
encryption\_algorithm aes,3des;  
authentication\_algorithm hmac\_sha1, hmac\_md5;  
compression\_algorithm deflate;  
}

xl2tpd.conf:

[global]  
access control = no  
debug avp = yes  
debug network = yes  
debug state = yes  
debug tunnel = yes

[lns default]  
ip range = 192.168.100.100-192.168.100.110  
local ip = 192.168.100.99  
require authentication = yes  
require chap = yes  
ppp debug = yes

refuse pap = yes  
length bit = yes  
name = l2tpd  
pppoptfile = /etc/ppp/xl2tpd-options

xl2tpd-options:

auth  
nodefaultroute  
lock  
proxyarp  
require-chap  
ms-dns 8.8.8.8  
ms-dns 8.8.4.4

syslog:

Feb 5 19:38:09 VPN-RSA racoon: INFO: Reading configuration from "/etc/racoon/racoon.conf"  
Feb 5 19:38:09 VPN-RSA racoon: DEBUG: call pfkey\_send\_register for AH  
Feb 5 19:38:09 VPN-RSA racoon: DEBUG: call pfkey\_send\_register for ESP  
Feb 5 19:38:09 VPN-RSA racoon: DEBUG: call pfkey\_send\_register for IPCOMP  
Feb 5 19:38:09 VPN-RSA racoon: DEBUG: reading config file /etc/racoon/racoon.conf  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.0[500] used for NAT-T  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.0[500] used as isakmp port (fd=8)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.0[4500] used for NAT-T  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.0[4500] used as isakmp port (fd=9)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.1[500] used for NAT-T  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=10)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.1[4500] used for NAT-T  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 127.0.0.1[4500] used as isakmp port (fd=11)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 192.168.0.26[500] used for NAT-T  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 192.168.0.26[500] used as isakmp port (fd=12)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 192.168.0.26[4500] used for NAT-T  
Feb 5 19:38:09 VPN-RSA racoon: INFO: 192.168.0.26[4500] used as isakmp port (fd=13)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: ::1[500] used as isakmp port (fd=14)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: ::1[4500] used as isakmp port (fd=15)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: fe80::a00:27ff:fede:17b7%eth0[500] used as isakmp port (fd=16)  
Feb 5 19:38:09 VPN-RSA racoon: INFO: fe80::a00:27ff:fede:17b7%eth0[4500] used as isakmp port (fd=17)  
Feb 5 19:38:16 VPN-RSA racoon: INFO: respond new phase 1 negotiation: 192.168.0.26[500]\<=\>192.168.0.12[500]  
Feb 5 19:38:16 VPN-RSA racoon: INFO: begin Identity Protection mode.  
Feb 5 19:38:16 VPN-RSA racoon: INFO: received Vendor ID: RFC 3947  
Feb 5 19:38:16 VPN-RSA racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02  
Feb 5 19:38:16 VPN-RSA racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-02#012  
Feb 5 19:38:16 VPN-RSA racoon: INFO: received Vendor ID: draft-ietf-ipsec-nat-t-ike-00  
Feb 5 19:38:16 VPN-RSA racoon: INFO: received broken Microsoft ID: FRAGMENTATION  
Feb 5 19:38:16 VPN-RSA racoon: INFO: received Vendor ID: DPD  
Feb 5 19:38:16 VPN-RSA racoon: [192.168.0.12] INFO: Selected NAT-T version: RFC 3947  
Feb 5 19:38:16 VPN-RSA racoon: [192.168.0.26] INFO: Hashing 192.168.0.26[500] with algo #1  
Feb 5 19:38:16 VPN-RSA racoon: INFO: NAT-D payload #0 verified  
Feb 5 19:38:16 VPN-RSA racoon: [192.168.0.12] INFO: Hashing 192.168.0.12[500] with algo #1  
Feb 5 19:38:16 VPN-RSA racoon: INFO: NAT-D payload #1 verified  
Feb 5 19:38:16 VPN-RSA racoon: INFO: NAT not detected  
Feb 5 19:38:16 VPN-RSA racoon: [192.168.0.12] INFO: Hashing 192.168.0.12[500] with algo #1  
Feb 5 19:38:16 VPN-RSA racoon: [192.168.0.26] INFO: Hashing 192.168.0.26[500] with algo #1  
Feb 5 19:38:16 VPN-RSA racoon: INFO: Adding remote and local NAT-D payloads.  
Feb 5 19:38:16 VPN-RSA racoon: INFO: ISAKMP-SA established 192.168.0.26[500]-192.168.0.12[500] spi:cfbcff8391d4836d:be920ce807abe37b  
Feb 5 19:38:19 VPN-RSA racoon: NOTIFY: the packet is retransmitted by 192.168.0.12[500] (1).  
Feb 5 19:38:22 VPN-RSA racoon: NOTIFY: the packet is retransmitted by 192.168.0.12[500] (1).  
Feb 5 19:38:25 VPN-RSA racoon: NOTIFY: the packet is retransmitted by 192.168.0.12[500] (1).  
Feb 5 19:38:27 VPN-RSA racoon: NOTIFY: the packet is retransmitted by 192.168.0.12[500] (1).  
Feb 5 19:38:30 VPN-RSA racoon: NOTIFY: the packet is retransmitted by 192.168.0.12[500] (1).  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: network\_thread: recv packet from 192.168.0.12, size = 69, tunnel = 0, call = 0 ref=0 refhim=0  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: get\_call: allocating new tunnel for host 192.168.0.12, port 60929.  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: handle\_avps: handling avp’s for tunnel 26838, call 16676  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: message\_type\_avp: message type 1 (Start-Control-Connection-Request)  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: protocol\_version\_avp: peer is using version 1, revision 0.  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: hostname\_avp: peer reports hostname 'anonymous’  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: framing\_caps\_avp: supported peer frames: async sync  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: assigned\_tunnel\_avp: using peer’s tunnel 18430  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: receive\_window\_size\_avp: peer wants RWS of 1. Will use flow control.  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: control\_finish: message type is Start-Control-Connection-Request(1). Tunnel is 18430, call is 0.  
Feb 5 19:38:46 VPN-RSA xl2tpd[2953]: control\_finish: sending SCCRP  
Feb 5 19:38:48 VPN-RSA xl2tpd[2953]: network\_thread: recv packet from 192.168.0.12, size = 36, tunnel = 0, call = 0 ref=0 refhim=0  
Feb 5 19:38:48 VPN-RSA xl2tpd[2953]: get\_call: allocating new tunnel for host 192.168.0.12, port 60929.  
Feb 5 19:38:48 VPN-RSA xl2tpd[2953]: check\_control: Received out of order control packet on tunnel -1 (got 1, expected 0)  
Feb 5 19:38:48 VPN-RSA xl2tpd[2953]: handle\_packet: bad control packet!  
Feb 5 19:38:48 VPN-RSA xl2tpd[2953]: network\_thread: bad packet  
Feb 5 19:38:48 VPN-RSA xl2tpd[2953]: build\_fdset: closing down tunnel 9227  
Feb 5 19:38:49 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:50 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:51 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:52 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:53 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:53 VPN-RSA xl2tpd[2953]: Maximum retries exceeded for tunnel 26838. Closing.  
Feb 5 19:38:53 VPN-RSA xl2tpd[2953]: Connection 18430 closed to 192.168.0.12, port 60929 (Timeout)  
Feb 5 19:38:54 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:55 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:56 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:57 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:58 VPN-RSA xl2tpd[2953]: network\_thread: select timeout  
Feb 5 19:38:58 VPN-RSA xl2tpd[2953]: Unable to deliver closing message for tunnel 26838. Destroying anyway.  
Feb 5 19:39:01 VPN-RSA racoon: [192.168.0.12] INFO: DPD: remote (ISAKMP-SA spi=cfbcff8391d4836d:be920ce807abe37b) seems to be dead.  
Feb 5 19:39:01 VPN-RSA racoon: INFO: purging ISAKMP-SA spi=cfbcff8391d4836d:be920ce807abe37b.  
Feb 5 19:39:01 VPN-RSA racoon: INFO: purged ISAKMP-SA spi=cfbcff8391d4836d:be920ce807abe37b.  
Feb 5 19:39:01 VPN-RSA racoon: INFO: ISAKMP-SA deleted 192.168.0.26[500]-192.168.0.12[500] spi:cfbcff8391d4836d:be920ce807abe37b

Merci d’avance à tous ceux qui essayerons de m’aider en tout cas ^^

---

<div class="post-metadata">

**Author:** ![gazeka74](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/g/ecae2f/32.png) [@gazeka74](https://www.debian-fr.org/u/gazeka74)\
**Post date:** [Février 21, 2016, 10:17 UTC](https://www.debian-fr.org/t/vpn-l2tp-ipsec-probleme-en-rsasig-xl2tpd-racoon/68193/2 "2016-02-21T22:17:44Z")

</div>

Petit up svp ^^

---

<div class="post-metadata">

**Author:** ![PierrePetit](https://www.debian-fr.org/letter_avatar_proxy/v4/letter/p/e95f7d/32.png) [@PierrePetit](https://www.debian-fr.org/u/PierrePetit)\
**Post date:** [Septembre 14, 2026, 9:49 UTC](https://www.debian-fr.org/t/vpn-l2tp-ipsec-probleme-en-rsasig-xl2tpd-racoon/68193/3 "2026-09-14T09:49:49Z")

</div>

Ça a l’air vraiment bien! L’erreur « racoon NOTIFY the packet is retransmitted by » revient souvent avec les certificats RSA quand il y a un souci de clés ou de configuration sur la VM.  
Vu que ça marche en presharedkey mais pas en rsasig, je regarderais d’abord les certificats et les droits sur les fichiers.

Sinon, si tu veux comparer d’autres solutions VPN plus simples ou des avis sur des setups stables, je jette un œil de temps en temps sur [https://comparora.fr](https://comparora.fr/).

Bon courage !

---

<div class="post-metadata">

**Author:** ![vbreton](https://www.debian-fr.org/user_avatar/www.debian-fr.org/vbreton/32/11400_2.png) [@vbreton](https://www.debian-fr.org/u/vbreton)\
**Post date:** [Septembre 14, 2026, 10:15 UTC](https://www.debian-fr.org/t/vpn-l2tp-ipsec-probleme-en-rsasig-xl2tpd-racoon/68193/4 "2026-09-14T10:15:17Z")

</div>

@PierrePetit, sans autre information je suppose que vous voulez parler d’AndroidVPN Server et de son «&nbsp;tutoriel&nbsp;». Je me permet de le mentionner ci dessous même si depuis 10 ans déjà il existe peut-être d’autres solutions.

> [@gazeka74](#):
>
> j’ai suivi le tutoriel ci-contre :[https://wiki.debian.org/HowTo/AndroidVPNServer](https://wiki.debian.org/HowTo/AndroidVPNServer)

---

<div class="post-metadata">

**Author:** ![Clochette](https://www.debian-fr.org/user_avatar/www.debian-fr.org/clochette/32/8757_2.png) [@Clochette](https://www.debian-fr.org/u/Clochette)\
**Post date:** [Septembre 14, 2026, 10:32 UTC](https://www.debian-fr.org/t/vpn-l2tp-ipsec-probleme-en-rsasig-xl2tpd-racoon/68193/5 "2026-09-14T10:32:18Z")

</div>

A fermé ce sujet (le Septembre 14, 2026, 10:32 UTC)