8.3 (1) ASA Cisco VPN Client and IP Communicator - one-way communication

Similar Questions

• Cisco VPN Client and Windows XP VPN Client IPSec to ASA

  I configured ASA for IPSec VPN via Cisco VPN Client and XP VPN client communications. I can connect successfully with Cisco VPN Client, but I get an error when connecting with the XP client. Debugging said "misconfigured groups and transport/tunneling mode" I know, they use different methods of transport and tunneling, and I think that I have configured both. Take a look at the config.

  PS a funny thing - when I connect with client VPN in Windows Server 2003, I have no error. The only difference is that client XP is behind an ADSL router and client server is directly connected to the Internet on one of its public IP of interfaces. NAT in the case of XP can cause problems?

  Config is:

  !

  interface GigabitEthernet0/2.30

  Description remote access

  VLAN 30

  nameif remote access

  security-level 0

  IP 85.*. *. 1 255.255.255.0

  !

  access-list 110 scope ip allow a whole

  NAT list extended access permit tcp any host 10.254.17.10 eq ssh

  NAT list extended access permit tcp any host 10.254.17.26 eq ssh

  access-list extended ip allowed any one sheep

  access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh

  sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0

  tunnel of splitting allowed access list standard 192.168.121.0 255.255.255.0

  flow-export destination inside-Bct 192.168.1.27 9996

  IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0

  ARP timeout 14400

  global (outside-Baku) 1 interface

  global (outside-Ganja) interface 2

  NAT (inside-Bct) 0 access-list sheep-vpn

  NAT (inside-Bct) 1 access list nat

  NAT (inside-Bct) 2-nat-ganja access list

  Access-group rdp on interface outside-Ganja

  !

  Access remote 0.0.0.0 0.0.0.0 85.*. *. 1 2

  Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1

  Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1

  Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1

  Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1

  Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1

  Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1

  Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1

  Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1

  dynamic-access-policy-registration DfltAccessPolicy

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  Crypto ipsec transform-set newset aes - esp esp-md5-hmac

  Crypto ipsec transform-set esp-3des esp-md5-hmac vpnclienttrans

  Crypto ipsec transform-set vpnclienttrans transport mode

  Crypto ipsec transform-set esp-3des esp-md5-hmac raccess

  life crypto ipsec security association seconds 214748364

  Crypto ipsec kilobytes of life security-association 214748364

  raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

  vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1

  card crypto interface for remote access vpnclientmap

  crypto isakmp identity address

  ISAKMP crypto enable vpntest

  ISAKMP crypto enable outside-Baku

  ISAKMP crypto enable outside-Ganja

  crypto ISAKMP enable remote access

  ISAKMP crypto enable Interior-Bct

  crypto ISAKMP policy 30

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  No encryption isakmp nat-traversal

  No vpn-addr-assign aaa

  Telnet timeout 5

  SSH 192.168.1.0 255.255.255.192 outside Baku

  SSH 10.254.17.26 255.255.255.255 outside Baku

  SSH 10.254.17.18 255.255.255.255 outside Baku

  SSH 10.254.17.10 255.255.255.255 outside Baku

  SSH 10.254.17.26 255.255.255.255 outside-Ganja

  SSH 10.254.17.18 255.255.255.255 outside-Ganja

  SSH 10.254.17.10 255.255.255.255 outside-Ganja

  SSH 192.168.1.0 255.255.255.192 Interior-Bct

  internal vpn group policy

  attributes of vpn group policy

  value of DNS-server 192.168.1.3

  Protocol-tunnel-VPN IPSec l2tp ipsec

  Split-tunnel-policy tunnelspecified

  Split-tunnel-network-list value split tunnel

  BCT.AZ value by default-field

  attributes global-tunnel-group DefaultRAGroup

  raccess address pool

  Group-RADIUS authentication server

  Group Policy - by default-vpn

  IPSec-attributes tunnel-group DefaultRAGroup

  pre-shared-key *.

  Hello

  For the Cisco VPN client, you would need a tunnel-group name configured on the ASA with a pre-shared key.

  Please see configuration below:

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  or

  http://tinyurl.com/5t67hd

  Please see the section of tunnel-group config of the SAA.

  There is a tunnel-group called "rtptacvpn" and a pre-shared key associated with it. This group name is used by the VPN Client Group name.

  So, you would need a specific tunnel-group name configured with a pre-shared key and use it on the Cisco VPN Client.

  Secondly, because you are behind a router ADSL, I'm sure that's configured for NAT. can you please activate NAT - T on your ASA.

  "crypto isakmp nat-traversal.

  Thirdly, change the transformation of the value

  raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

  Let me know the result.

  Thank you

  Gilbert

• Cisco VPN Client and 64-Bit OS Support

  I'm in the stages of planning/testing of migrating users to the Cisco VPN client. Problem that I came across well is that I can't find a version that supports 64-bit operating systems. I looked through the Download Center with no luck. I'm a little more looking for a version out there? Thanks in advance.

  As much as I know there is no 64-bit support and is not yet on the roadmap of IPSEC VPN Client. For more details, see:

  http://www.Cisco.com/en/us/docs/security/ASA/compatibility/ASA-VPN-compatibility.html

  Concerning

  Farrukh

• Cisco VPN Client connected, but no secure way.

  Hello

  I can connect to a VPN server smoothly, but once connected, I'm not able to reach all local resources. When I looked at the stats of customer VPN, it shows only a single route in 'Details of the route--> secure routes', 1.1.1.1 255.255.255.255. This is the reason why I can't access any resource. This could be the cause of this problem? How can I secure roads announcing cisco customer? I don't have access to the server, but I will ask the person who can make changes.

  Thank you.

  Kind regards

  Shivani

  Shivani,

  Split tunneling is what you're looking for, it will affect your secure routes.

  Marcin

• LAN ASA 5505 VPN client access issue

  Hello

  I'm no expert in ASA and routing so I ask support the following case.

  There is a (running on Windows 7) Cisco VPN client and an ASA5505.

  The objectives are client can use the gateway remote on SAA for Skype and able to access devices in SAA within the interface.

  The Skype works well, but I can't access devices in the interface inside through a VPN connection.

  Can you please check my following config and give me any advice to fix NAT or VPN settings?

  ASA Version 7.2 (4)

  !

  ciscoasa hostname

  domain default.domain.invalid

  activate wDnglsHo3Tm87.tM encrypted password

  2KFQnbNIdI.2KYOU encrypted passwd

  names of

  !

  interface Vlan1

  nameif inside

  security-level 100

  IP 192.168.1.1 255.255.255.0

  !

  interface Vlan2

  nameif outside

  security-level 0

  IP address dhcp setroute

  !

  interface Vlan3

  prior to interface Vlan1

  nameif dmz

  security-level 50

  no ip address

  !

  interface Ethernet0/0

  switchport access vlan 2

  !

  interface Ethernet0/1

  !

  interface Ethernet0/2

  !

  interface Ethernet0/3

  !

  interface Ethernet0/4

  !

  interface Ethernet0/5

  !

  interface Ethernet0/6

  !

  interface Ethernet0/7

  !

  passive FTP mode

  DNS server-group DefaultDNS

  domain default.domain.invalid

  permit same-security-traffic inter-interface

  permit same-security-traffic intra-interface

  inside_access_in list extended access permitted tcp 192.168.1.0 255.255.255.0 any

  inside_access_in list extended access permitted udp 192.168.1.0 255.255.255.0 any

  outside_access_in list of allowed ip extended access entire 192.168.1.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  MTU 1500 dmz

  local pool VPNPOOL 10.0.0.200 - 10.0.0.220 255.255.255.0 IP mask

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 524.bin

  don't allow no asdm history

  ARP timeout 14400

  NAT-control

  Global 1 interface (outside)

  NAT (inside) 1 10.0.0.0 255.255.255.0

  NAT (inside) 1 192.168.1.0 255.255.255.0

  NAT (outside) 1 10.0.0.0 255.255.255.0

  inside_access_in access to the interface inside group

  Access-group outside_access_in in interface outside

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  the ssh LOCAL console AAA authentication

  Enable http server

  http 192.168.1.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown cold start

  Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

  Crypto-map dynamic outside_dyn_map pfs set 20 Group1

  Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

  map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

  outside_map interface card crypto outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  Telnet timeout 5

  SSH 192.168.1.0 255.255.255.0 inside

  SSH timeout 5

  SSH version 2

  Console timeout 0

  dhcpd outside auto_config

  !

  dhcpd address 192.168.1.2 - 192.168.1.33 inside

  dhcpd dns xx.xx.xx.xx interface inside

  dhcpd allow inside

  !

  attributes of Group Policy DfltGrpPolicy

  No banner

  WINS server no

  value of server DNS 84.2.44.1

  DHCP-network-scope no

  VPN-access-hour no

  VPN - connections 3

  VPN-idle-timeout 30

  VPN-session-timeout no

  VPN-filter no

  Protocol-tunnel-VPN IPSec l2tp ipsec webvpn

  disable the password-storage

  disable the IP-comp

  Re-xauth disable

  Group-lock no

  disable the PFS

  IPSec-udp disable

  IPSec-udp-port 10000

  Split-tunnel-policy tunnelall

  Split-tunnel-network-list no

  by default no

  Split-dns no

  Disable dhcp Intercept 255.255.255.255

  disable secure authentication unit

  disable authentication of the user

  user-authentication-idle-timeout 30

  disable the IP-phone-bypass

  disable the leap-bypass

  allow to NEM

  Dungeon-client-config backup servers

  MSIE proxy server no

  MSIE-proxy method non - change

  Internet Explorer proxy except list - no

  Disable Internet Explorer-proxy local-bypass

  disable the NAC

  NAC-sq-period 300

  NAC-reval-period 36000

  NAC-by default-acl no

  address pools no

  enable Smartcard-Removal-disconnect

  the firewall client no

  rule of access-client-none

  WebVPN

  url-entry functions

  HTML-content-filter none

  Home page no

  4 Keep-alive-ignore

  gzip http-comp

  no filter

  list of URLS no

  value of customization DfltCustomization

  port - forward, no

  port-forward-name value access to applications

  SSO-Server no

  value of deny message connection succeeded, but because some criteria have not been met, or because of a specific group policy, you are not allowed to use the VPN features. Contact your administrator for more information

  SVC no

  SVC Dungeon-Installer installed

  SVC keepalive no

  generate a new key SVC time no

  method to generate a new key of SVC no

  client of dpd-interval SVC no

  dpd-interval SVC bridge no

  deflate compression of SVC

  internal group XXXXXX strategy

  attributes of XXXXXX group policy

  Protocol-tunnel-VPN IPSec

  Split-tunnel-policy tunnelall

  Split-tunnel-network-list no

  XXXXXX G910DDfbV7mNprdR encrypted privilege 15 password username

  username password encrypted XXXXXX privilege 0 5p9CbIe7WdF8GZF8

  attributes of username XXXXXX

  Strategy Group-VPN-XXXXXX

  username privilege 15 encrypted password cRQbJhC92XjdFQvb XXXXX

  tunnel-group XXXXXX type ipsec-ra

  attributes global-tunnel-group XXXXXX

  address VPNPOOL pool

  Group Policy - by default-XXXXXX

  tunnel-group ipsec-attributes XXXXXX

  pre-shared-key *.

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  inspect the icmp

  !

  global service-policy global_policy

  context of prompt hostname

  Cryptochecksum:a8fbb51b0a830a4ae823826b28767f23

  : end

  ciscoasa #.

  Thanks in advance!

  fbela

  config #no nat (inside) 1 10.0.0.0 255.255.255.0< this="" is="" not="">

  Add - config #same-Security-permit intra-interface

  #access - extended list allowed sheep ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

  #nat (inside) 0 access-list sheep

  Please add and test it.

  Thank you

  Ajay

• Cannot access network resources - Cisco VPN client

  Please see attached the network topology.

  I can connect using the Cisco VPN client and access to all resources of the 192.168.3.0 network

  I can't ping / access to all hosts on the network 192.168.5.0.

  Any ideas?

  Thanks for the help in advance

  AD

  Quite correct.

  Please add has the access list:

  CPA list standard access allowed 192.168.5.0 255.255.255.0

• Slow initial connection using Cisco VPN Client

  I am currently using Cisco VPN Client v5.0.07.0290.  Whenever I start my connection, it takes me about 90 seconds for the prompt to display authentication and another ~ 90 seconds to finish the auth. and connect successfully.  I have another computer laptop w / the same WIN7 OS and version of Cisco VPN Client and he ends the connection to<30 sec. ="" why="" is="" this? ="" any="" suggestions="">

  Hi Sergio,

  You import the .pcf for the VPN Client file? If so, please try to recreate a new file .pcf locally on the machine itself and try to connect. Let me know how it goes.

  Thank you

  Delvallée

• Cisco VPN Client

  Hello

  I would like to know why when it failed to connect to the private network through the Cisco VPN client and trying to establish an Internet connection, the connection Internet.

  Thanks in advance,

  SK

  Which would be configured on the vpn, firewall/router endpoint etc..

• Cisco VPN Client 2801 router

  Hello

  I installed a router cisco 2801 to accept vpn connections, I use the cisco vpn client and the tunnel is created and is being created of the its.

  However, I cannot ping my vlan (only those who have a nat inside the ACL, those who have not said I can ping), so I have a NAT problem, just don't know where.

  Heres part of my setup on the ACL,

  IP local pool ippool 192.168.100.10 192.168.100.100

  by default-gateway IP X.X.X.X (ISP GATEWAY)

  IP forward-Protocol ND

  IP http server

  no ip http secure server

  IP http flash path:

  !

  !

  IP nat inside source list 1 interface FastEthernet0/1 overload

  IP nat inside source list 2 interface FastEthernet0/1 overload

  IP nat inside source list 3 interface FastEthernet0/1 overload

  IP nat inside source list 6 interface FastEthernet0/1 overload

  overload of IP nat inside source list 20 interface FastEthernet0/1

  IP nat inside source map route SHEEP interface FastEthernet0/1 overload

  IP route 0.0.0.0 0.0.0.0 X.X.X.X (external IP)

  Route IP 192.168.10.0 255.255.255.0 192.168.90.2

  IP route 192.168.20.0 255.255.255.0 192.168.90.2

  IP route 192.168.30.0 255.255.255.0 192.168.90.2

  IP route 192.168.40.0 255.255.255.0 192.168.90.2

  IP route 192.168.50.0 255.255.255.0 192.168.90.2

  IP route 192.168.60.0 255.255.255.0 192.168.90.2

  IP route 192.168.200.0 255.255.255.0 192.168.90.2

  !

  NAT extended IP access list

  deny ip 192.168.10.0 0.0.0.255 192.168.100.0 0.0.0.255

  deny ip 192.168.20.0 0.0.0.255 192.168.100.0 0.0.0.255

  deny ip 192.168.30.0 0.0.0.255 192.168.100.0 0.0.0.255

  deny ip 192.168.60.0 0.0.0.255 192.168.100.0 0.0.0.255

  deny ip 192.168.90.0 0.0.0.255 192.168.100.0 0.0.0.255

  permit ip 192.168.10.0 0.0.0.255 any

  ip licensing 192.168.20.0 0.0.0.255 any

  IP 192.168.30.0 allow 0.0.0.255 any

  IP 192.168.60.0 allow 0.0.0.255 any

  IP 192.168.90.0 allow 0.0.0.255 any

  !

  access-list 1 permit 192.168.90.0 0.0.0.255

  access-list 2 allow to 192.168.10.0 0.0.0.255

  access-list 3 allow 192.168.30.0 0.0.0.255

  access-list 6 permit 192.168.60.0 0.0.0.255

  access-list 20 allow 192.168.200.0 0.0.0.255

  !

  SHEEP allowed 10 route map

  corresponds to the IP NAT

  !

  The 192.168.90.2 address is my switch L3 (Cisco 3750)

  Any pointer is more than welcome,

  Concerning

  Miranda,

  Have you tried to remove the following lines:

  IP nat inside source list 1 interface FastEthernet0/1 overload

  IP nat inside source list 2 interface FastEthernet0/1 overload

  IP nat inside source list 3 interface FastEthernet0/1 overload

  IP nat inside source list 6 interface FastEthernet0/1 overload

  overload of IP nat inside source list 20 interface FastEthernet0/1

  And simply let this one:

  IP nat inside source map route SHEEP interface FastEthernet0/1 overload

  ?

  I have all the neceary allowed in the ACL of NAT, so you do not have individual lines for each network.

  Also, I noticed that your ACL 20 reads

  access-list 20 allow 192.168.200.0 0.0.0.255

  But your NAT ACL bed

  ip licensing 192.168.20.0 0.0.0.255 any

  I think you have a typo in there, you have a 200 on 20 and on the other.

  Check it out and let me know how it goes. Don't forget to clear the NAT table after deleting these lines:

  clear the ip nat trans *.

  I hope this helps!

  Raga

• Cisco VPN client 3.5.1 and Cisco ASA 5.2 (2)

  Hello

  I have a strange problem about Cisco VPN client (IPSec) with Cisco ASA. The Cisco ASA runs software version 5.2 (2). The Cisco VPN client version is 3.5.1.

  The problem is the customer able Cisco VPN to authenticate successfully with Cisco ASA, but could not PING to any LAN behind the Cisco ASA. In any case, the problem disappeared when we used the Cisco VPN version 4.6 or 4.8 of the customer. All parameters are exactly the same. What has happened? What is the cause of this problem? How can I solve this problem?

  Please advice.

  Thank you

  Nitass

  I understand your problem, I never used 3.5.1 so I thought that maybe nat - t is not enabled by default as 4.x.

• AnyConnect + possible PSK (pre-shared key) as under with cisco vpn client ikev1 and ikev2

  Is it possible to create a VPN Anyconnect of RA with just the name of user and password + pre-shared key (Group) for the connection, as could do for ikev1 with cisco VPN client? I am running 8.4.X ASA code and looks like tunnel-group commands have 8.2.X somewhat change. If you change the group type of the tunnel for remote access, now there is no option for IKEv2 PSK. This is only available when you choose the type

  Type of TG_TEST FW1 (config) # tunnel - group?

  set up the mode commands/options:
  Site IPSec IPSec-l2l group
  Remote access using IPSec-IPSec-ra (DEPRECATED) group
  remote access remote access (IPSec and WebVPN) group
  WebVPN WebVPN Group (DEPRECATED)

  FW1(config-tunnel-General) # tunnel - group TG_TEST ipsec-attributes
  FW1(config-tunnel-IPSec) #?

  configuration of the tunnel-group commands:
  any required authorization request users to allow successfully in order to
  Connect (DEPRECATED)
  Allow chain issuing of the certificate
  output attribute tunnel-group IPSec configuration
  mode
  help help for group orders of tunnel configuration
  IKEv1 configure IKEv1
  ISAKMP policy configure ISAKMP
  not to remove a pair of attribute value
  by the peer-id-validate Validate identity of the peer using the peer
  certificate
  negotiation to Enable password update in RADIUS RADIUS with expiry
  authentication (DEPRECATED)

  FW1(config-tunnel-IPSec) # ikev1?

  the tunnel-group-ipsec mode commands/options:
  pre-shared key associate a key shared in advance with the connection policy

  I'm getting old so I hope that it is not in another complaint curmudgeonly on the loss of functionality. :)

  Many small businesses do not want to invest in the PKI. It is usually a pain to deploy, backup, make redundant, etc..

  But it would be nice to have a bit more security on VPN other than just the connections of username and password.

  If this is not possible, it is possible to configure the Anyconnect customer to IKEv1 with PSK and name at the level of the Group client?

  If this is not possible, WTH did cisco end customer VPN cisco as a choice of VPN connection (other than to get more fresh mail of license)?

  I really hope that something like this exists still!

  THX,

  WR

  You are welcome

  In addition to two factors, you can also do double authentication (ie the two using the user name and password). Each set of credentials can come from a Bank of different identities.

  With this scheme, you can can configure a local user name (common) with password on the SAA (think of it as your analog PSK) and the other be the AD user identification information.

• All necessary licenses on ASA 5510 for old Cisco VPN Client

  We're trying to migrate our firewall Watchguard to a Cisco ASA 5510, who bought some time ago. For some reason, all of our users have already installed the old Cisco VPN client. I think it will work. Are there licensing issues on the 5510 I had to be concerned with?  No matter what special config that needs to be done on the 5510?

  Fix. You don't require licensing of AnyConnect of any type of configuration and the use of IKEv1 IPsec remote access VPN (which use the old Cisco VPN client).

  You will be limited to 250 active IPsec peers (remote access more no matter what VPN site-to-site) by the platform (hardware) device capabilities that are enforced by the software.

• Configuration of Cisco for Cisco VPN Client ASA 5505

  Our firm has finally made the move from Sonicwall Cisco for our SMB customers. Got our first customer with a VPN site-to site solid and you have configured the main router for connections via the Cisco VPN Client VPN Wizard.

  When I install the VPN Client on desktop computers that does not capture all the necessary options (unless you have a SSL VPN). I guess that there is a process that I am missing to export a connection profile that Cisco VPN Client users can import for their connection.

  There step by step guides to create the connection profile file to distribute to customers?

  Hello

  The ASDM wizard is for the configuration on the SAA. This wizard will help you complete the VPN configuration on the end of the ASA.

  You will need to set the same in the client, so that they can negotiate and connect.

  Input connection in the client field, that's what you want to be seen that on the VPN client - it can be any name

  Host will be the external ip address of the ASA.

  Group options:

  name - same tunnel as defined on the ASA group
  Password - pre-shared as on ASA.

  Confirm password - same pre-shared key.

  Once this is over, you will see the customer having an entry same as a login entry. You must click on connect there. He will be a guest user and the password. Please enter the login crendentials. VPN connects.

  You can distribute the .pcf file that is formed at the place mentioned in the post above. Once the other client receive the .pcf, they need to import it by clicking this tab on the VPN client.

  Kind regards

  Anisha

• Cisco VPN client (ASA) password expiry messages

  Hi all

  I am looking for a way to change the message displayed on the Cisco VPN client, when a password change is required. This configuration uses an ASA 5520 with Windows 2003 IAS radius for authentication server.

  I have configured the option 'password-management' under the tunnel-group, but when the password expires the vpn client prompts you to "enter a new pin code.

  This customizable message, for example "Please enter a new password to 8 characters etc.

  The original message communicates enough information for the user.

  Thank you

  Hi Matt,

  This is a known defect CSCeh13180 (when using RADIUS with expiry) and there is currently no plan to fix this bug.

  But you can try this for one of your VPN client and see if that helps.

  you need to change the VPNClient.ini on the PC that installed the VPN Client. Here are the settings you will need...

  [RadiusSDI]

  NewPinSubStr = "" enter the new password: ""

  HTH

  Kind regards

  JK

• connect Cisco VPN client v5 to asa 5505

  I have remote vpn configuration issues between ASA5505 and Cisco VPN client v5. Successfully, I can establish a connection between the client Vpn and ASA and receive the IP address of the ASA. Statistical customer VPN windows shows that packets are sent and encrypted but none of the packages is received/decrypted.

  Cannot ping asa 5505

  Any ideas on what I missed?

  Try adding...

  ISAKMP nat-traversal crypto

  In addition, you cannot ping the inside interface of the ASA vpn without this command...

  management-access inside

  Please evaluate the useful messages.