I have been given some details of a VPN I am meant to connect to, and can't for the life of me get it to work under Kubuntu.

The info I have been given is (fake values substituted where appropriate of course):

I have configured a new VPN account for you on our server.

Your login details are as follows:

IP address:
username: myfullname
password: wordpass
shared secret: XXXXXXXXXX

The connection type is L2TP.

Ensure that you select the option to send all traffic over the VPN.

I have tried 2 routes:

1) Using the KDE widget to configure this

2) Using config files to configure this

Using the widget:

I add the https://launchpad.net/~seriy-pr/+archive/network-manager-l2tp PPA, and install network-manager-l2tp.

Then, I add an L2TP connection and I come across the following fields (which I fill in): Gateway ( User name: (myfullname) Password: (wordpass)

Then I go into IPsec Settings, and (after checking "Enable IPSec tunnel to L2TP host): Group Name Gateway ID Pre-shared Key

I fill in Pre-shared Key with XXXXXXXXXX, and click OK.

Then I try to connect, and get the following error:

"Necessary secrets for the VPN connection were not provided."

Using config files, and using https://www.elastichosts.com/support/tutorials/linux-l2tpipsec-vpn-client/ as a guide, I do the following:

I add the following to /etc/ipsec.conf:

config setup
conn tab-vpn

I add the following to /etc/ipsec.secrets:


Then when I restart ipsec with:

sudo ipsec auto --up tab-vpn

I get:

104 "tab-vpn" #1: STATE_MAIN_I1: initiate
003 "tab-vpn" #1: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
003 "tab-vpn" #1: received Vendor ID payload [RFC 3947] method set to=115 
003 "tab-vpn" #1: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] meth=106, but already using method 115
003 "tab-vpn" #1: ignoring Vendor ID payload [FRAGMENTATION]
003 "tab-vpn" #1: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
003 "tab-vpn" #1: ignoring Vendor ID payload [IKE CGA version 1]
106 "tab-vpn" #1: STATE_MAIN_I2: sent MI2, expecting MR2
003 "tab-vpn" #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): both are NATed
108 "tab-vpn" #1: STATE_MAIN_I3: sent MI3, expecting MR3
003 "tab-vpn" #1: we require peer to have ID '', but peer declares ''

I and the server in question are behind the same firewall.

It SHOULD allow me to connect so I can move onto setting up the xl2tpd.conf options, but I don't get that far.


  • Are you trying to put any number in for the IP? (where you have %any That seems to be where you are having issues
    – No Time
    May 30, 2014 at 2:43
  • 1
    IP address ( in your case) is not the Gateway info. It is the ip address of a VPN dial-in point (remote VPN server). Once you login with your credentials, most probably DHCP will automatically give you an appropriate IP address and the Gateway info.
    – Mladen B.
    Jun 1, 2014 at 9:11
  • Unfortunately, I've left the place of work where I needed this, so I have no way of testing it. If a few people can confirm that any of the techniques work, I'll accept the best answer. Jun 2, 2014 at 9:57

1 Answer 1



conn tab-vpn

in /etc/ipsec.conf

The rightid parameter can be used to specify the IP address that the server identifies itself as (ie. it's LAN IP address rather than the public IP address of the router).

If the expected IP address and the IP address that the server identifies as don't match then ipsec abandons the connection attempt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.