The Client Log Contains "Unrecognized option or missing or extra parameter(s) in xxx.ovpn:108: data-ciphers (2.4.12)"

Applicable Client

Linux

Symptom

A client cannot connect to the VPN gateway, and the client log contains the following error message:

Unrecognized option or missing or extra parameter(s) in xxx.ovpn:108: data-ciphers (2.4.12) 

Possible Causes

The client OpenVPN 2.4.12 cannot identify the configuration items data-ciphers and disable-dco.

Procedure

1. On Windows, log in to the management console.
2. Click in the upper left corner and select the desired region and project.
3. Click in the upper left corner, and choose Networking > Virtual Private Network.
4. In the navigation pane on the left, choose Virtual Private Network > Enterprise – VPN Gateways.
5. Click the P2C VPN Gateways tab, and click Download Client Configuration in the Operation column of the target VPN gateway.

   The downloaded client configuration file is client_config.zip.

6. Decompress client_config.zip to a specified directory, for example, D:\.

   After the decompression, the client_config.ovpn and client_config.conf files are generated.

7. Open the client_config.conf file using Notepad or Notepad++.
8. Configure the client configuration file.
   1. Add the client certificate and private key to the file.
      Enter the client certificate content and the corresponding private key in between <cert></cert> and <key></key> tags, respectively. An example is as follows:

      <cert>
      -----BEGIN CERTIFICATE-----
      Client certificate content
      -----END CERTIFICATE-----
      </cert>
      
      <key>
      -----BEGIN PRIVATE KEY-----
      Client private key
      -----END PRIVATE KEY-----
      </key>

   2. Enter # in front of the lines where data-ciphers and disable-dco are located to comment out the lines.

      ...
      ...
      # data-ciphers AES-XXX-XXX   
      ...
      ...
      # disable-dco
      ...
      ...

9. Save the .conf configuration file.
10. Upload the .conf configuration file to the Linux operating system using Xftp. In this example, the file is uploaded to the /opt/ directory.
11. On Linux, run the following command to go to the directory where the client configuration file is stored:

    cd /opt/

12. Run the following command to start the OpenVPN client and connect to the VPN gateway:

    openvpn --config /opt/openvpn_config_user-01.conf

    If the following information in bold is displayed, the OpenVPN connection is successfully established:

    2025-02-27 19:22:41 Note: Kernel support for ovpn-dco missing, disabling data channel offload.
    2025-02-27 19:22:41 OpenVPN 2.6.12 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] [DCO]
    2025-02-27 19:22:41 library versions: OpenSSL 3.3.1 4 Jun 2024, LZO 2.10
    ...
    ...
    ...
    2025-02-27 19:22:42 Initialization Sequence Completed
    ...
    ...

13. 

    XX.XX.XX.XX indicates the private IP address of the ECS to be connected. Replace it with the actual private IP address.

    If information similar to the following is displayed, the client can communicate with the ECS:

    64 bytes from XX.XX.XX.XX: icmp_seq=1 ttl=63 time=1.27 ms
    64 bytes from XX.XX.XX.XX: icmp_seq=2 ttl=63 time=1.36 ms
    64 bytes from XX.XX.XX.XX: icmp_seq=3 ttl=63 time=1.40 ms
    64 bytes from XX.XX.XX.XX: icmp_seq=4 ttl=63 time=1.29 ms
    64 bytes from XX.XX.XX.XX: icmp_seq=5 ttl=63 time=1.35 ms
    64 bytes from XX.XX.XX.XX: icmp_seq=6 ttl=63 time=1.52 ms