17.03.2017, aktualisiert um 20:10:58 Uhr

2470

VPN IPSec mit Linksys Router funktioniert nicht

Hallo Liebes Forum,

ich habe ein Netzwerk mit einem Linksys WRV200 Router. Der Router hat die aktuelle Firmware Version. Provider ist Unitymedia mit öffentlicher dynamischer IPv4 IP.
Einziges Gerät im Netz ist ein Macbook (über WLAN).

Internet funktioniert einwandfrei, aber den VPN-IPSec-Servers vom Router bekomme ich nicht ans Laufen.

Folgende Einstellungen habe ich am Router vorgenommen:

WAN und DHCP:

__a setup bildschirmfoto 2017-03-17 um 09.57.18

VPN-Beutzer:

__b user bildschirmfoto 2017-03-17 um 09.57.56

IPSec Einstellungen:

__c ipsec vers bildschirmfoto 2017-03-17 um 11.30.51

VPN-Client auf dem Phone 6S:

Beim Versuch die VPN-Verbindung mit dem iPhone aufzubauen, erscheint die Meldung:
"Der VPN-Server antwortet nicht"

Das Log vom Linksys sieht so aus:

[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: responding to Main Mode from unknown peer 89.204.155.175  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: no acceptable Oakley Transform  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175 #9: sending notification NO_PROPOSAL_CHOSEN to 89.204.155.175:41267  
[Fri 12:00:25] "TunnelA"[9] 89.204.155.175: deleting connection "TunnelA" instance with peer 89.204.155.175 {isakmp=#0/ipsec=#0}  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: responding to Main Mode from unknown peer 89.204.155.175  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:28] "TunnelA"[10] 89.204.155.175 #10: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:29] "TunnelA"[10] 89.204.155.175 #10: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:29] "TunnelA"[10] 89.204.155.175 #10: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:29] "TunnelA"[10] 89.204.155.175 #10: no acceptable Oakley Transform  
[Fri 12:00:29] "TunnelA"[10] 89.204.155.175 #10: sending notification NO_PROPOSAL_CHOSEN to 89.204.155.175:41267  
[Fri 12:00:29] "TunnelA"[10] 89.204.155.175: deleting connection "TunnelA" instance with peer 89.204.155.175 {isakmp=#0/ipsec=#0}  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: responding to Main Mode from unknown peer 89.204.155.175  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: no acceptable Oakley Transform  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175 #11: sending notification NO_PROPOSAL_CHOSEN to 89.204.155.175:41267  
[Fri 12:00:32] "TunnelA"[11] 89.204.155.175: deleting connection "TunnelA" instance with peer 89.204.155.175 {isakmp=#0/ipsec=#0}  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: responding to Main Mode from unknown peer 89.204.155.175  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder). Attribute OAKLEY_AUTHENTICATION_METHOD  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: OAKLEY_DES_CBC is not supported. Attribute OAKLEY_ENCRYPTION_ALGORITHM  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: no acceptable Oakley Transform  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175 #12: sending notification NO_PROPOSAL_CHOSEN to 89.204.155.175:41267  
[Fri 12:00:35] "TunnelA"[12] 89.204.155.175: deleting connection "TunnelA" instance with peer 89.204.155.175 {isakmp=#0/ipsec=#0}  

Ich kenne mich leider zu wenig aus, um das Log interpretieren zu können. Hab mir schon die Finger wund gegoogelt.
Am Log kann man wohl gut erkennen, dass das Problem irgendwie mit der Authentifizierung zu tun haben muss (wenn man sich denn auskennt).

Gibts hier einen Fachmann, der das deuten kann und weiß was zu tun ist?

Bitte markiere auch die Kommentare, die zur Lösung des Beitrags beigetragen haben

Content-ID: 332475

Url: https://administrator.de/contentid/332475

Ausgedruckt am: 23.11.2024 um 01:11 Uhr

5 Kommentare

Neuester Kommentar

Deine IPsec Einstellungen sind wieder falsch !!

NAT Traversal MUSS zwingend auf enabled ! Du musst ja die NAT Firewall des Routers überwinden !
Type Subnet ist falsch ! Hier muss dein lokales Subnet rein und das lautet ja nun mal 10.0.1.0 255.255.255.0 !!
Statt MD5 Authentication kannst du besser SHA nehmen aber vermutlich macht er das automatisch, da es ausgegraut ist und die Methode auf "Auto" steht.

Die Fehlermeldungen lassen allerdings vermuten das der Router nur 3DES kann und die neuen von Apple vorgeschriebenen Schlüsselalgorythmen nicht supportet weil er doch schon zu alt ist und sehr lange keine FW Aktualisierung mehr bekommen hat. Der WRV200 ist End of Life
Poste mal die Log Meldungen mit den angepassten Settings.

Was ist mit den Einstellungen unter "VPN Client Access" und "VPN Summary" ??? Hier fehlen die Screenshots. Gerade der Client Access mit der Group Einstellung ist wichtig !

Alternativ kannst du den Zugriff mal mit dem MacBook testen ob der native IKE2 Client dort die verbindung aufbauen kann.
Internet Dokus sind sehr spärlich

http://www.lobotomo.com/products/IPSecuritas/howto/Linksys%20WRV200%20H ...
Ggf. hilft vielleicht noch die FritzBox Doku:
https://avm.de/service/vpn/tipps-tricks/vpn-verbindung-zur-fritzbox-unte ...

* NAT Traversal MUSS zwingend auf enabled ! Du musst ja die NAT Firewall des Routers überwinden !

Type Subnet ist falsch ! Hier muss dein lokales Subnet rein und das lautet ja nun mal 10.0.1.0 255.255.255.0 !!

ok, habe ich beides geändert.

Beim Verbindungsversuch mit dem iPhone kommt immer noch "Der VPN-Server antwortet nicht".
Das Log sieht jetzt so aus:

 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: responding to Main Mode from unknown peer 89.204.154.192  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: no acceptable Oakley Transform  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192 #5: sending notification NO_PROPOSAL_CHOSEN to 89.204.154.192:35703  
 [Fri 22:17:49]  "TunnelA"[5] 89.204.154.192: deleting connection "TunnelA" instance with peer 89.204.154.192 {isakmp=#0/ipsec=#0}  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: responding to Main Mode from unknown peer 89.204.154.192  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: no acceptable Oakley Transform  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192 #6: sending notification NO_PROPOSAL_CHOSEN to 89.204.154.192:35703  
 [Fri 22:17:52]  "TunnelA"[6] 89.204.154.192: deleting connection "TunnelA" instance with peer 89.204.154.192 {isakmp=#0/ipsec=#0}  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: responding to Main Mode from unknown peer 89.204.154.192  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: no acceptable Oakley Transform  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192 #7: sending notification NO_PROPOSAL_CHOSEN to 89.204.154.192:35703  
 [Fri 22:17:55]  "TunnelA"[7] 89.204.154.192: deleting connection "TunnelA" instance with peer 89.204.154.192 {isakmp=#0/ipsec=#0}  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: responding to Main Mode from unknown peer 89.204.154.192  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: policy does not allow Extended Authentication (XAUTH) of initiator (we are responder).  Attribute OAKLEY_AUTHENTICATION_METHOD  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: OAKLEY_DES_CBC is not supported.  Attribute OAKLEY_ENCRYPTION_ALGORITHM  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: no acceptable Oakley Transform  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192 #8: sending notification NO_PROPOSAL_CHOSEN to 89.204.154.192:35703  
 [Fri 22:17:58]  "TunnelA"[8] 89.204.154.192: deleting connection "TunnelA" instance with peer 89.204.154.192 {isakmp=#0/ipsec=#0}  

* Statt MD5 Authentication kannst du besser SHA nehmen aber vermutlich macht er das automatisch, da es ausgegraut ist und die Methode auf "Auto" steht.

Zu den Einstellungen Key Management:

Key Exchange Method:
in dem Pulldownmenü gibt es nur diese eine Auswahlmöglichkeit "Auto (IKE)"

Bei ISAKMP Encryption Method gibt es 5 Möglichkeiten:
- Auto
- 3DES
- AES 128
- AES 192
- AES 256
Wenn ich dort statt Auto eines der 3 anderen auswähle, habe ich beim
ISAKMP Authentication Method die Möglichkeit zwischen MD5 und SHA1.

Was ist mit den Einstellungen unter "VPN Client Access" und "VPN Summary" ??? Hier fehlen die Screenshots. Gerade der Client Access mit der Group Einstellung ist wichtig !

Unter "VPN Client Access" kann man nicht viel machen. Außer VPN-Benutzer + Passwörter angelegen.

user bildschirmfoto 2017-03-17 um 22.22.39

"VPN Summary" habe ich benutzt, um das VPN-Log einzusehen

sum bildschirmfoto 2017-03-17 um 22.24.54

Wenn Du es jetzt noch für sinnvoll hält, kann ich auch noch mal mit dem Mac probieren eine VPN-Vebidung aufzubauen. Mittels Hotspot über LTE auf dem iPhone.

Und wenn der WRT200 die notwendigen von Apple vorgeschriebenen Schlüsselalgorythmen nicht supportet, weil er einfach überholt und veraltet ist, kann ich mal vesuchen dd-wrt aufzuspielen. Allerdings ist der WRT200 in der Liste "Supported Devices" nicht aufgeführt.
Lieber wäre mir, einfach ein neues Gerät anzuschaffen, dass aus dem aktuellen Stand ist.

Wenn ich dort statt Auto eines der 3 anderen auswähle,

Wieso 3...ich zähle 4

Apple schreibt m.W. AES 256 vor. Also wenn du das aus Auto lässt sollte das OK sein dann kaspern die Beteiligten das dynamisch aus.
Die Fehlermeldungen im Log sagen aber aus das der WRT200 kein XAUTH supportet. Damit wirst du dann mit aktuellen IPsec Clients nix mehr

Wenn du mal nach der Fehlermeldung suchst "policy does not allow Extended Authentication xauth" dann findet man viele Einträge dazu.
Vermutlich bist du mit einer kleinen aktuellen Firewall oder einer FritzBox besser bedient:
Preiswerte, VPN fähige Firewall im Eigenbau oder als Fertiggerät
Die kann das alles problemlos umsetzen:
IPsec VPN Praxis mit Standort Vernetzung Cisco, Mikrotik, pfSense, FritzBox u.a

Ich habe es jetzt so gelöst, dass ich eine Fritzbox als Router konfiguriert habe, ich den VPN-Server der FritzBox nutze und die Timecapsule als Access-Point laufen habe.

Vielen Dank für die Hilfe und vor allem für die zahlreichen Tipps und Links. Ich habe wirklich viel gelernt.