L2TP VPN Stopped Working (encountered processing error during initial negotiations)

Question

We have an SG230 UTM and we're using L2TP/IPSec VPN to allow remote users to connect to the network. This has been working flawlessly for about 2 years now but we've suddenly started having issues. 
 When trying to connect from Windows clients we get the error message: "The L2TP connection attempt failed because the security layer encountered a processing error during initial negotiations with the remote computer". 
 Here is the IPSec VPN log from the UTM: 
 2022:01:23-20:11:09 remote pluto[6460]: "L_for test"[436] 81.1.1.1 #2824: max number of retransmissions (2) reached STATE_MAIN_R1
2022:01:23-20:11:09 remote pluto[6460]: | HA System: can not delete ha_state #2824
2022:01:23-20:11:09 remote pluto[6460]: | ICOOKIE: 0e dd b9 ab 1e fc fc 1f
2022:01:23-20:11:09 remote pluto[6460]: | RCOOKIE: 0a 39 10 66 e6 2b a3 fa
2022:01:23-20:11:09 remote pluto[6460]: | peer: 56 01 74 21
2022:01:23-20:11:09 remote pluto[6460]: | state hash entry 31
2022:01:23-20:11:09 remote pluto[6460]: "L_for test"[436] 81.1.1.1: deleting connection "L_for test"[436] instance with peer 81.1.1.1 {isakmp=#0/ipsec=#0}
2022:01:23-20:11:09 remote pluto[6460]: | certs and keys locked by 'delete_connection'
2022:01:23-20:11:09 remote pluto[6460]: | certs and keys unlocked by 'delete_connection'
2022:01:23-20:11:09 remote pluto[6460]: | next event EVENT_REINIT_SECRET in 3197 seconds
2022:01:23-20:11:13 remote pluto[6460]: |
2022:01:23-20:11:13 remote pluto[6460]: | *received 408 bytes from 81.1.1.1:500 on eth1
2022:01:23-20:11:13 remote pluto[6460]: | **parse ISAKMP Message:
2022:01:23-20:11:13 remote pluto[6460]: | initiator cookie:
2022:01:23-20:11:13 remote pluto[6460]: | e7 b5 8a 9c b2 03 62 c7
2022:01:23-20:11:13 remote pluto[6460]: | responder cookie:
2022:01:23-20:11:13 remote pluto[6460]: | 00 00 00 00 00 00 00 00
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_SA
2022:01:23-20:11:13 remote pluto[6460]: | ISAKMP version: ISAKMP Version 1.0
2022:01:23-20:11:13 remote pluto[6460]: | exchange type: ISAKMP_XCHG_IDPROT
2022:01:23-20:11:13 remote pluto[6460]: | flags: none
2022:01:23-20:11:13 remote pluto[6460]: | message ID: 00 00 00 00
2022:01:23-20:11:13 remote pluto[6460]: | length: 408
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Security Association Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 212
2022:01:23-20:11:13 remote pluto[6460]: | DOI: ISAKMP_DOI_IPSEC
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 24
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 24
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 20
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 20
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 20
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 20
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | length: 20
2022:01:23-20:11:13 remote pluto[6460]: | ***parse ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_NONE
2022:01:23-20:11:13 remote pluto[6460]: | length: 20
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: ignoring Vendor ID payload [01528bbbc00696121849ab9a1c5b2a5100000001]
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: received Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000009]
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: received Vendor ID payload [RFC 3947]
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: ignoring Vendor ID payload [FRAGMENTATION]
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: ignoring Vendor ID payload [MS-Negotiation Discovery Capable]
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: ignoring Vendor ID payload [Vid-Initial-Contact]
2022:01:23-20:11:13 remote pluto[6460]: packet from 81.1.1.1:500: ignoring Vendor ID payload [IKE CGA version 1]
2022:01:23-20:11:13 remote pluto[6460]: | ****parse IPsec DOI SIT:
2022:01:23-20:11:13 remote pluto[6460]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
2022:01:23-20:11:13 remote pluto[6460]: | ****parse ISAKMP Proposal Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_NONE
2022:01:23-20:11:13 remote pluto[6460]: | length: 200
2022:01:23-20:11:13 remote pluto[6460]: | proposal number: 1
2022:01:23-20:11:13 remote pluto[6460]: | protocol ID: PROTO_ISAKMP
2022:01:23-20:11:13 remote pluto[6460]: | SPI size: 0
2022:01:23-20:11:13 remote pluto[6460]: | number of transforms: 5
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_T
2022:01:23-20:11:13 remote pluto[6460]: | length: 40
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 1
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 7
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_KEY_LENGTH
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 256
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 20
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_TYPE
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_DURATION (variable length)
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 4
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_T
2022:01:23-20:11:13 remote pluto[6460]: | length: 40
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 2
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 7
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_KEY_LENGTH
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 128
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 19
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_TYPE
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_DURATION (variable length)
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 4
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_T
2022:01:23-20:11:13 remote pluto[6460]: | length: 40
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 3
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 7
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_KEY_LENGTH
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 256
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 14
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_TYPE
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_DURATION (variable length)
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 4
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_T
2022:01:23-20:11:13 remote pluto[6460]: | length: 36
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 4
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 5
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 14
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_TYPE
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_DURATION (variable length)
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 4
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_NONE
2022:01:23-20:11:13 remote pluto[6460]: | length: 36
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 5
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 5
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_TYPE
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_DURATION (variable length)
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 4
2022:01:23-20:11:13 remote pluto[6460]: | preparse_isakmp_policy: peer requests PSK authentication
2022:01:23-20:11:13 remote pluto[6460]: | instantiated "L_for test" for 81.1.1.1
2022:01:23-20:11:13 remote pluto[6460]: | creating state object #2825 at 0x93da580
2022:01:23-20:11:13 remote pluto[6460]: | ICOOKIE: e7 b5 8a 9c b2 03 62 c7
2022:01:23-20:11:13 remote pluto[6460]: | RCOOKIE: c7 e6 c3 45 2f 07 07 57
2022:01:23-20:11:13 remote pluto[6460]: | peer: 56 01 74 21
2022:01:23-20:11:13 remote pluto[6460]: | state hash entry 3
2022:01:23-20:11:13 remote pluto[6460]: | inserting event EVENT_SO_DISCARD, timeout in 0 seconds for #2825
2022:01:23-20:11:13 remote pluto[6460]: "L_for test"[437] 81.1.1.1 #2825: responding to Main Mode from unknown peer 81.1.1.1
2022:01:23-20:11:13 remote pluto[6460]: | **emit ISAKMP Message:
2022:01:23-20:11:13 remote pluto[6460]: | initiator cookie:
2022:01:23-20:11:13 remote pluto[6460]: | e7 b5 8a 9c b2 03 62 c7
2022:01:23-20:11:13 remote pluto[6460]: | responder cookie:
2022:01:23-20:11:13 remote pluto[6460]: | c7 e6 c3 45 2f 07 07 57
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_SA
2022:01:23-20:11:13 remote pluto[6460]: | ISAKMP version: ISAKMP Version 1.0
2022:01:23-20:11:13 remote pluto[6460]: | exchange type: ISAKMP_XCHG_IDPROT
2022:01:23-20:11:13 remote pluto[6460]: | flags: none
2022:01:23-20:11:13 remote pluto[6460]: | message ID: 00 00 00 00
2022:01:23-20:11:13 remote pluto[6460]: | ***emit ISAKMP Security Association Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | DOI: ISAKMP_DOI_IPSEC
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_T
2022:01:23-20:11:13 remote pluto[6460]: | length: 40
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 1
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 7
2022:01:23-20:11:13 remote pluto[6460]: | [7 is AES_CBC]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_KEY_LENGTH
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 256
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | [2 is HMAC_SHA1]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 20
2022:01:23-20:11:13 remote pluto[6460]: | [20 is ECP_384]
2022:01:23-20:11:13 remote pluto[6460]: "L_for test"[437] 81.1.1.1 #2825: ECP_384 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_T
2022:01:23-20:11:13 remote pluto[6460]: | length: 40
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 2
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 7
2022:01:23-20:11:13 remote pluto[6460]: | [7 is AES_CBC]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_KEY_LENGTH
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 128
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | [2 is HMAC_SHA1]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 19
2022:01:23-20:11:13 remote pluto[6460]: | [19 is ECP_256]
2022:01:23-20:11:13 remote pluto[6460]: "L_for test"[437] 81.1.1.1 #2825: ECP_256 is not supported. Attribute OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | *****parse ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_T
2022:01:23-20:11:13 remote pluto[6460]: | length: 40
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 3
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_ENCRYPTION_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 7
2022:01:23-20:11:13 remote pluto[6460]: | [7 is AES_CBC]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_KEY_LENGTH
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 256
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_HASH_ALGORITHM
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 2
2022:01:23-20:11:13 remote pluto[6460]: | [2 is HMAC_SHA1]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_GROUP_DESCRIPTION
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 14
2022:01:23-20:11:13 remote pluto[6460]: | [14 is MODP_2048]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_AUTHENTICATION_METHOD
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | [1 is pre-shared key]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_TYPE
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 1
2022:01:23-20:11:13 remote pluto[6460]: | [1 is OAKLEY_LIFE_SECONDS]
2022:01:23-20:11:13 remote pluto[6460]: | ******parse ISAKMP Oakley attribute:
2022:01:23-20:11:13 remote pluto[6460]: | af+type: OAKLEY_LIFE_DURATION (variable length)
2022:01:23-20:11:13 remote pluto[6460]: | length/value: 4
2022:01:23-20:11:13 remote pluto[6460]: | long duration: 28800
2022:01:23-20:11:13 remote pluto[6460]: | Oakley Transform 3 accepted
2022:01:23-20:11:13 remote pluto[6460]: | ****emit IPsec DOI SIT:
2022:01:23-20:11:13 remote pluto[6460]: | IPsec DOI SIT: SIT_IDENTITY_ONLY
2022:01:23-20:11:13 remote pluto[6460]: | ****emit ISAKMP Proposal Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_NONE
2022:01:23-20:11:13 remote pluto[6460]: | proposal number: 1
2022:01:23-20:11:13 remote pluto[6460]: | protocol ID: PROTO_ISAKMP
2022:01:23-20:11:13 remote pluto[6460]: | SPI size: 0
2022:01:23-20:11:13 remote pluto[6460]: | number of transforms: 1
2022:01:23-20:11:13 remote pluto[6460]: | *****emit ISAKMP Transform Payload (ISAKMP):
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_NONE
2022:01:23-20:11:13 remote pluto[6460]: | transform number: 3
2022:01:23-20:11:13 remote pluto[6460]: | transform ID: KEY_IKE
2022:01:23-20:11:13 remote pluto[6460]: | emitting 32 raw bytes of attributes into ISAKMP Transform Payload (ISAKMP)
2022:01:23-20:11:13 remote pluto[6460]: | attributes 80 01 00 07 80 0e 01 00 80 02 00 02 80 04 00 0e
2022:01:23-20:11:13 remote pluto[6460]: | 80 03 00 01 80 0b 00 01 00 0c 00 04 00 00 70 80
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Transform Payload (ISAKMP): 40
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Proposal Payload: 48
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Security Association Payload: 60
2022:01:23-20:11:13 remote pluto[6460]: | out_vendorid(): sending [strongSwan]
2022:01:23-20:11:13 remote pluto[6460]: | ***emit ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2022:01:23-20:11:13 remote pluto[6460]: | V_ID 88 2f e5 6d 6f d2 0d bc 22 51 61 3b 2e be 5b eb
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Vendor ID Payload: 20
2022:01:23-20:11:13 remote pluto[6460]: | out_vendorid(): sending [Cisco-Unity]
2022:01:23-20:11:13 remote pluto[6460]: | ***emit ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2022:01:23-20:11:13 remote pluto[6460]: | V_ID 12 f5 f2 8c 45 71 68 a9 70 2d 9f e2 74 cc 01 00
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Vendor ID Payload: 20
2022:01:23-20:11:13 remote pluto[6460]: | out_vendorid(): sending [XAUTH]
2022:01:23-20:11:13 remote pluto[6460]: | ***emit ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | emitting 8 raw bytes of V_ID into ISAKMP Vendor ID Payload
2022:01:23-20:11:13 remote pluto[6460]: | V_ID 09 00 26 89 df d6 b7 12
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Vendor ID Payload: 12
2022:01:23-20:11:13 remote pluto[6460]: | out_vendorid(): sending [Dead Peer Detection]
2022:01:23-20:11:13 remote pluto[6460]: | ***emit ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_VID
2022:01:23-20:11:13 remote pluto[6460]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2022:01:23-20:11:13 remote pluto[6460]: | V_ID af ca d7 13 68 a1 f1 c9 6b 86 96 fc 77 57 01 00
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Vendor ID Payload: 20
2022:01:23-20:11:13 remote pluto[6460]: | out_vendorid(): sending [RFC 3947]
2022:01:23-20:11:13 remote pluto[6460]: | ***emit ISAKMP Vendor ID Payload:
2022:01:23-20:11:13 remote pluto[6460]: | next payload type: ISAKMP_NEXT_NONE
2022:01:23-20:11:13 remote pluto[6460]: | emitting 16 raw bytes of V_ID into ISAKMP Vendor ID Payload
2022:01:23-20:11:13 remote pluto[6460]: | V_ID 4a 13 1c 81 07 03 58 45 5c 57 28 f2 0e 95 45 2f
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Vendor ID Payload: 20
2022:01:23-20:11:13 remote pluto[6460]: | emitting length of ISAKMP Message: 180
2022:01:23-20:11:13 remote pluto[6460]: | inserting event EVENT_RETRANSMIT, timeout in 10 seconds for #2825
2022:01:23-20:11:13 remote pluto[6460]: | next event EVENT_RETRANSMIT in 10 seconds for #2825
2022:01:23-20:11:23 remote pluto[6460]: |
2022:01:23-20:11:23 remote pluto[6460]: | *time to handle event
2022:01:23-20:11:23 remote pluto[6460]: | event after this is EVENT_REINIT_SECRET in 3183 seconds
2022:01:23-20:11:23 remote pluto[6460]: | handling event EVENT_RETRANSMIT for 81.1.1.1 "L_for test" #2825
2022:01:23-20:11:23 remote pluto[6460]: | inserting event EVENT_RETRANSMIT, timeout in 20 seconds for #2825
2022:01:23-20:11:23 remote pluto[6460]: | next event EVENT_RETRANSMIT in 20 seconds for #2825
2022:01:23-20:11:36 remote pluto[6460]: |
2022:01:23-20:11:36 remote pluto[6460]: | *received whack message
2022:01:23-20:11:36 remote pluto[6460]: | next event EVENT_RETRANSMIT in 7 seconds for #2825
2022:01:23-20:11:43 remote pluto[6460]: |
2022:01:23-20:11:43 remote pluto[6460]: | *time to handle event
2022:01:23-20:11:43 remote pluto[6460]: | event after this is EVENT_REINIT_SECRET in 3163 seconds
2022:01:23-20:11:43 remote pluto[6460]: | handling event EVENT_RETRANSMIT for 81.1.1.1 "L_for test" #2825
2022:01:23-20:11:43 remote pluto[6460]: | inserting event EVENT_RETRANSMIT, timeout in 40 seconds for #2825
2022:01:23-20:11:43 remote pluto[6460]: | next event EVENT_RETRANSMIT in 40 seconds for #2825
2022:01:23-20:12:21 remote pluto[6460]: |
2022:01:23-20:12:21 remote pluto[6460]: | *received whack message
2022:01:23-20:12:21 remote pluto[6460]: | next event EVENT_RETRANSMIT in 2 seconds for #2825
2022:01:23-20:12:23 remote pluto[6460]: |
2022:01:23-20:12:23 remote pluto[6460]: | *time to handle event
2022:01:23-20:12:23 remote pluto[6460]: | event after this is EVENT_REINIT_SECRET in 3123 seconds
2022:01:23-20:12:23 remote pluto[6460]: | handling event EVENT_RETRANSMIT for 81.1.1.1 "L_for test" #2825
2022:01:23-20:12:23 remote pluto[6460]: "L_for test"[437] 81.1.1.1 #2825: max number of retransmissions (2) reached STATE_MAIN_R1
2022:01:23-20:12:23 remote pluto[6460]: | HA System: can not delete ha_state #2825
2022:01:23-20:12:23 remote pluto[6460]: | ICOOKIE: e7 b5 8a 9c b2 03 62 c7
2022:01:23-20:12:23 remote pluto[6460]: | RCOOKIE: c7 e6 c3 45 2f 07 07 57
2022:01:23-20:12:23 remote pluto[6460]: | peer: 56 01 74 21
2022:01:23-20:12:23 remote pluto[6460]: | state hash entry 3
2022:01:23-20:12:23 remote pluto[6460]: "L_for test"[437] 81.1.1.1: deleting connection "L_for test"[437] instance with peer 81.1.1.1 {isakmp=#0/ipsec=#0}
2022:01:23-20:12:23 remote pluto[6460]: | certs and keys locked by 'delete_connection'
2022:01:23-20:12:23 remote pluto[6460]: | certs and keys unlocked by 'delete_connection'
2022:01:23-20:12:23 remote pluto[6460]: | next event EVENT_REINIT_SECRET in 3123 seconds
2022:01:23-20:13:06 remote pluto[6460]: |
2022:01:23-20:13:06 remote pluto[6460]: | *received whack message
2022:01:23-20:13:06 remote pluto[6460]: | next event EVENT_REINIT_SECRET in 3080 seconds
2022:01:23-20:13:51 remote pluto[6460]: |
2022:01:23-20:13:51 remote pluto[6460]: | *received whack message
2022:01:23-20:13:51 remote pluto[6460]: | next event EVENT_REINIT_SECRET in 3035 seconds
2022:01:23-20:14:36 remote pluto[6460]: |
2022:01:23-20:14:36 remote pluto[6460]: | *received whack message
2022:01:23-20:14:36 remote pluto[6460]: | next event EVENT_REINIT_SECRET in 2990 seconds
2022:01:23-20:15:21 remote pluto[6460]: |
2022:01:23-20:15:21 remote pluto[6460]: | *received whack message
2022:01:23-20:15:21 remote pluto[6460]: | next event EVENT_REINIT_SECRET in 2945 seconds
2022:01:23-20:16:06 remote pluto[6460]: |
2022:01:23-20:16:06 remote pluto[6460]: | *received whack message
2022:01:23-20:16:06 remote pluto[6460]: | next event EVENT_REINIT_SECRET in 2900 seconds 
 
 Initially I thought maybe a certificate had expired but doesn't appear so. I can't work out why it suddenly stopped working. I'm wondering if a recent windows update has caused it? 
 Can anyone advise some troubleshooting steps?

Amodin · Answer

There were some Windows Updates ~10 days ago that screwed up these VPN connections. 
 KB5009543 was the one that broke it. KB5010793 was the fix apparently, but this out of band update appeared to have actually solved the issue: 
 January 17, 2022&mdash;KB5010789 (OS Build 10240.19179) Out-of-band (microsoft.com)