Learn L2TP IPsec - Tools & Troubleshooting

#Introduction

VPN connections are almost never perfect on the first attempt. Episode 8 equips you with the tools to see what is happening at every layer — from IKE negotiation to PPP negotiation — so you can find the root cause, not just the symptoms. This is the episode you will reopen most often throughout this series.

Each daemon has its own tools: Libreswan uses ipsec, strongSwan uses swanctl, and xl2tpd uses xl2tp-control. We dissect all three, then close with troubleshooting patterns for the most common problems.

#Libreswan Tools

#statusall: The Full Picture

ipsec statusall displays every defined connection, SA status, agreed algorithms, and the active configuration. This is the first tool when a connection fails:

sudo ipsec statusall

Look at the Security Associations (1 up, 0 connecting) section, then the lines starting with ESP that contain the SPI, algorithms, and encapsulation mode. If the SA reads encrypted using ESP and state TRANSPORT, the IPsec layer is healthy.

#barf: Complete Debug Dump

ipsec barf produces a thorough dump — including configuration, secrets (sensitive!), recent logs, and kernel tables. Use it when you need maximum information:

sudo ipsec barf > /tmp/ipsec-barf.txt

Because it contains sensitive material, do not share ipsec barf output without cleaning the PSK and keys. Send it to parties you trust for analysis.

#whack: Interactive Control

ipsec whack gives direct control over the pluto daemon — bringing connections up and down, reloading configuration, and fetching status. The two most useful commands:

sudo ipsec whack --status
sudo ipsec auto --up L2TP-PSK

#strongSwan Tools

#swanctl: Modern Control

In strongSwan 6.x, swanctl is the modern interface replacing ipsec auto. View all active SAs and loaded connections:

sudo swanctl --list-sas
sudo swanctl --list-conns

swanctl --list-sas displays the IKE SA and CHILD SA with state ESTABLISHED, including peer address and algorithms. If the daemon runs as a daemon (not a starter), its configuration is loaded with:

sudo swanctl --load-all

#charon Logs

Charon writes detailed logs to /var/log/charon.log or the journal. To watch IKE exchanges live:

sudo journalctl -u strongswan -f
sudo tail -f /var/log/charon.log

#xl2tpd Tools

#xl2tp-control: Display Tunnels

To inspect L2TP tunnels and sessions, use xl2tp-control. Its interactive mode accepts the show tunnel and show session commands:

echo "show tunnel" | sudo xl2tp-control

The output shows the active tunnels, their state, and the number of sessions. Also check the daemon logs and statistics from the pppd side:

sudo journalctl -u xl2tpd -f
ip addr show ppp0

#Common Failure Patterns

#Connection Stalls at the IPsec Layer

Symptom: the IPsec SA never forms and the IKE log shows no acceptable proposal. The cause is usually mismatched algorithms or IKE versions. The fix: match the ike= and phase2alg= suites on both sides, and make sure ikev2= is consistent.

#The L2TP Tunnel Fails After IPsec

Symptom: the IPsec SA forms but the tunnel does not work. Check whether UDP 1701 is open in the firewall and whether xl2tpd is listening:

sudo ss -ulnp | grep 1701

#PPP Authentication Rejected

Symptom: pppd rejects and the log shows MS-CHAPv2 authentication failed. The most common causes: wrong password, or the user is not registered in /etc/ppp/chap-secrets. Make sure the username * password format is used with an asterisk in the server column.

#Closing

Episode 8 equipped you with the full troubleshooting toolkit: ipsec statusall, ipsec barf, and whack in Libreswan; swanctl --list-sas and charon logs in strongSwan; xl2tp-control and logs in xl2tpd; plus the common IKE, L2TP, and PPP failure patterns.

Key takeaways:

• ipsec statusall is the first tool for checking Libreswan SAs.
• ipsec barf creates a complete but sensitive debug dump.
• swanctl --list-sas shows strongSwan SAs with state ESTABLISHED.
• xl2tp-control with the show tunnel command inspects L2TP tunnels.
• Read the logs in layer order: IKE, then L2TP, then PPP.
• PPP authentication failures most often come from a wrong chap-secrets.

In the next episode, episode 9, we will discuss Libreswan in depth: configuration and features — the anatomy of ipsec.conf and ipsec.secrets, the role of each column such as left and right, and the NAT-T, DPD, and XAUTH features.