Card Cisco VPN is disabled

I have a user with a disabled Cisco VPN adapter. Does anyone else have this problem?

Thank you.

This discussion has been reposted ideas from the community to the VPN community.

Tags: Cisco Security

Similar Questions

Cannot use Cisco vpn client

Dear all,

I have cisco vpn client v5.0.05.

1 / when I lunch the customer, it connect to the asa, so I can't reach the network behind my ASA

2 / when connected to the vpn client, I can not use my access to the internet, I configured splitunnel, but does not.

3 / sometimes, cisco vpn client disable my network ip of the gateway card.

Please, can someone help me?

Concerning

Can you please share the configuration of the SAA. There is no specific configuration that must be done on the vpn client.

AnyConnect VPN Mobile disabled 5505 SEC no more questions

Hi all

I have a 5505-SEC-BUN-K9, must purchase a license of Mobile Anyconnect vpn.

For the question now, I was able to active the anyconnect for mobile but the sec as well as features all failed. How can I check the question?

The devices allowed for this platform:

The maximum physical Interfaces: 8 perpetual

VLAN: 20 unrestricted DMZ

Double ISP: Activated perpetual

VLAN Trunk Ports: 8 perpetual

Guests of the Interior: perpetual unlimited

Failover: Active / standby perpetual

Encryption - A: enabled perpetual

AES-3DES-Encryption: activated perpetual

AnyConnect Premium peers: 2 perpetual

AnyConnect Essentials: 25 perpetual

Counterparts in other VPNS: 25 perpetual

Total VPN counterparts: 25 perpetual

Shared license: disabled perpetual

AnyConnect for Mobile: 76 days allowed

AnyConnect Cisco VPN phone: disabled perpetual

Assessment of Advanced endpoint: disabled perpetual

Proxy UC phone sessions: 2 perpetual

Proxy total UC sessions: 2 perpetual

Botnet traffic filter: disabled perpetual

Intercompany Media Engine: Disabled perpetual

Cluster: Disabled perpetual

Internal guests: 10

Failover: disabled

Encryption - A: enabled

Encryption-3DES-AES: enabled

Security contexts: by default

GTP/GPRS: disabled

Premium AnyConnect peers: by default

Other VPN peers: by default

Assessment of Advanced endpoint: disabled

AnyConnect for Mobile: enabled

AnyConnect Cisco VPN phone: disabled

Shared license Premium AnyConnect server: disabled

Sharing license: disabled

Proxy sessions for the UC phone: by default

Total number of Sessions of Proxy UC: default

AnyConnect Essentials: enabled

Botnet traffic filter: disabled

Intercompany media engine: disabled

Cluster license: disabled

Have you tried to re-apply your activation key for the license of security more?

If you don't have it available, you may need to open a TAC case to get worldwide license team to regenerate it for you.

Cisco VPN and TOSHIBA 3G cards

Hello

Since the introduction of WIN7 there was a big problem with the Cisco VPN client and 3G cards.
See the next on the Cisco support forum thread: https://supportforums.cisco.com/thread/2017102

The interesting part is this post:
https://supportforums.Cisco.com/message/3166246#3166246
It seems that Cisco uses what is called Citrix DNE.

So I Googled it and came up with this link:
http://www.Citrix.com/lang/English/LP/lp_1680845.asp

On this page it says:
DNE now supports the WWAN devices in Win7. Before you download the latest version of DNEUpdate from the links below, make sure you have the latest drivers for your network card by downloading from the websites of sellers.

It might be a long shot, but someone can it there with a card 3 G TOSHIBA, win7, and cisco VPN access, try this new version of Citrix DNE?

You have Toshiba laptop with 3G card?
Can you test for us and post the result?

I n t have Win7 on my machine.

Problem with VPN connection via a wireless card broadband Verizon Cisco VPN air

I can't access any device on my network via RDP or applications via the host file - forwarded servers from my 64 bit Windows 7 laptop using wireless broadband Verizon and customer VPN Cisco 64 bit 5.0.7.290. I can connect easily via a LAN wired connection from home using the same laptop computer and client VPN and RDP.

The VPN client connects to the server VPN (easy VPN on Cisco 2821 router) on the broadband wireless connection (I can see it in the GPMC on the router) but it will pass no data. I can't ping anything in the field, or external IP address. When I try to ping the laptop, it drops off the VPN (completed peer connection).

The laptop is a Dell M4500 running Windows 7 Ultimate 64 bit OS. The VPN client is stated, rev 5.0.7.290. The card internal wireless broadband is a QualCom 5620 (EV-DO-HSPA) system (Gobi 2).

What must I do to get this configuration to perform and log as does the wired connection?

Tim Carlisle

The Systems Manager

Post edited by: Timothy Carlisle recently I discovered that the Cisco 64 bit client VPN running on my Dell Precision M6500 (Windows 7 64-bit OS) was able to connect properly using the WiFi on my iPhone 4S (Verizon Wireless). It will also connect when attached to the laptop via a USB cable. Once I discovered this, I was then able to do the same thing on the laptop that spawned this discussion, by attachment for Blackberry "BOLD" from the boss after the download and installation of a new Verizon Wireless Access Manager utility that has allowed to select the device (Blackberry) for installation. I think that enabled us to bypass the wireless cards Gobi2 on two laptops and the factory installed Dell Connection Manager software which was not compatible with the Cisco VPN 64 bit client software. As much as I fear here, this new method (hotspot of Smartphone and attachment) is the way to go for us and has solved all the problems of connectivity distance for us. Thank you to all who have contributed to this discussion. Tim Carlisle

The Solution to the debate has been captured in this Document: -.

https://supportforums.Cisco.com/docs/doc-18721

We fought with the same question for quite awhile before finding that there seems to be a default setting in the Verizon Access Manager software that plays well with the Cisco Client.

In VZAccess Manager, select Options | Preferences. Connectivity options, the default setting for "NDIS Mode - connect manually" was chosen. Change this option to "Modem Mode - connect manually" seems to have completely addressed the issue. We can now connect to the WWAN, establish a Cisco VPN session and have connectivity.

T61, Vista Business with Cisco VPN problem since the last update on the Lenovo site.

Hello

I use a T61, Vista Business, Cisco VPN Client v.5.0.02.0090. Since my last update, October 2, 2008 on the Lenovo ThinkVantage Productivity Center site, I can't connect to my VPN Office. It was working perfectly before this software update. The only thing I remember is the update of the driver for Intel 4965AGN card v.12.x. I went to v.11.5 but it's not better.

When I try to connect, I get the message "secure VPN connection terminated by a peer. "433 reason: (reason unspecified peer). I did a test with 'ping' IP address of the VPN and the response of the address.

Usually, when the VPN Client is able to make the connection in the network connection window, I see "connection to the network space 2 (the Cisco VPN system map)" enabling / disabling Disable to activate the State. But there in my case, turn it off.

I can connect with another PC using Windows XP. Thus, the VPN works.

Any ideas?

Thank you

I met a very similar problem with my X61s. I was able to fix this by removing the print reading software for which an update was also installed on 2 Oct. As I barely use the fingerprint reader, it wasn't a problem for me. The Cisco VPN worked never better...

Another problem with the configuration of Cisco VPN Client access VPN Site2site

We have a Cisco ASA 5505 at our CORP. branch I configured the VPN Site2Site to our COLO with a Juniper SRX220h, to another site works well, but when users access the home Cisco VPN client, they cannot ping or SSH through the Site2Site. JTACS contacted and they said it is not on their end, so I tried to contact Cisco TAC, no support. So here I am today, after for the 3 days (including Friday of last week) of searching the Internet for more than 6 hours per day and try different examples of other users. NO LUCK. The VPN client shows the route secure 10.1.0.0

Sorry to post this, but I'm frustrated and boss breathing down my neck to complete it.

CORP netowrk 192.168.1.0

IP VPN 192.168.12.0 pool

Colo 10.1.0.0 internal ip address

Also, here's an example of my config ASA

: Saved

:

ASA Version 8.2 (1)

!

hostname lwchsasa

names of

name 10.1.0.1 colo

!

interface Vlan1

nameif inside

security-level 100

IP 192.168.1.1 255.255.255.0

!

interface Vlan2

backup interface Vlan12

nameif outside_pri

security-level 0

IP 64.20.30.170 255.255.255.248

!

interface Vlan12

nameif backup

security-level 0

IP 173.165.159.241 255.255.255.248

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

switchport access vlan 12

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

permit same-security-traffic inter-interface

permit same-security-traffic intra-interface

object-group network NY

object-network 192.168.100.0 255.255.255.0

BSRO-3387 tcp service object-group

port-object eq 3387

BSRO-3388 tcp service object-group

port-object eq 3388

BSRO-3389 tcp service object-group

EQ port 3389 object

object-group service tcp OpenAtrium

port-object eq 8100

object-group service Proxy tcp

port-object eq 982

VOIP10K - 20K udp service object-group

10000 20000 object-port Beach

the clientvpn object-group network

object-network 192.168.12.0 255.255.255.0

APEX-SSL tcp service object-group

Description of Apex Dashboard Service

port-object eq 8586

object-group network CHS-Colo

object-network 10.1.0.0 255.255.255.0

the DM_INLINE_NETWORK_1 object-group network

object-network 192.168.1.0 255.255.255.0

host of the object-Network 64.20.30.170

object-group service DM_INLINE_SERVICE_1

the purpose of the ip service

ICMP service object

service-object icmp traceroute

the purpose of the service tcp - udp eq www

the tcp eq ftp service object

the purpose of the tcp eq ftp service - data

the eq sqlnet tcp service object

EQ-ssh tcp service object

the purpose of the service udp eq www

the eq tftp udp service object

object-group service DM_INLINE_SERVICE_2

the purpose of the ip service

ICMP service object

EQ-ssh tcp service object

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 clientvpn object-group

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY

inside_nat0_outbound to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo

inside_nat0_outbound list of allowed ip extended access any 192.168.12.0 255.255.255.0

outside_pri_1_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group NY

outside_pri_access_in list extended access permit tcp any interface outside_pri eq www

outside_pri_access_in list extended access permit tcp any outside_pri eq https interface

outside_pri_access_in list extended access permit tcp any interface outside_pri eq 8100

outside_pri_access_in list extended access permit tcp any outside_pri eq idle ssh interface

outside_pri_access_in list extended access permit icmp any any echo response

outside_pri_access_in list extended access permit icmp any any source-quench

outside_pri_access_in list extended access allow all unreachable icmp

outside_pri_access_in list extended access permit icmp any one time exceed

outside_pri_access_in list extended access permit tcp any 64.20.30.168 255.255.255.248 eq 8586

levelwingVPN_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0

levelwingVPN_splitTunnelAcl list standard access allowed 10.1.0.0 255.255.255.0

outside_pri_cryptomap to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo

backup_nat0_outbound list extended access allowed object-group DM_INLINE_NETWORK_1 192.168.12.0 ip 255.255.255.0

outside_pri_cryptomap_1 list extended access allow DM_INLINE_SERVICE_2 of object-group 192.168.1.0 255.255.255.0 10.1.0.0 255.255.255.0

outside_19_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0

inside_nat0_outbound_1 to access ip 192.168.1.0 scope list allow 255.255.255.0 object-group CHS-Colo

VPN-Corp-Colo extended access list permits object-group DM_INLINE_SERVICE_1 192.168.12.0 255.255.255.0 10.1.0.0 255.255.255.0

Note to OUTSIDE-NAT0 NAT0 customer VPN remote site access-list

OUTSIDE-NAT0 192.168.12.0 ip extended access list allow 255.255.255.0 10.1.0.0 255.255.255.0

L2LVPN to access extended list ip 192.168.12.0 allow 255.255.255.0 10.1.0.0 255.255.255.0

pager lines 24

Enable logging

debug logging in buffered memory

exploitation forest asdm warnings

record of the rate-limit unlimited level 4

destination of exports flow inside 192.168.1.1 2055

timeout-rate flow-export model 1

Within 1500 MTU

outside_pri MTU 1500

backup of MTU 1500

local pool LVCHSVPN 192.168.12.100 - 192.168.12.254 255.255.255.0 IP mask

no failover

ICMP unreachable rate-limit 100 burst-size 5

ICMP allow any inside

ICMP allow any outside_pri

don't allow no asdm history

ARP timeout 14400

NAT-control

interface of global (outside_pri) 1

Global 1 interface (backup)

NAT (inside) 0-list of access inside_nat0_outbound

NAT (inside) 0 inside_nat0_outbound_1 list of outdoor access

NAT (inside) 1 0.0.0.0 0.0.0.0

NAT (outside_pri) 0-list of access OUTSIDE-NAT0

backup_nat0_outbound (backup) NAT 0 access list

static TCP (inside outside_pri) interface https 192.168.1.45 https netmask 255.255.255.255 dns

static TCP (inside outside_pri) interface 192.168.1.45 www www netmask 255.255.255.255 dns

static TCP (inside outside_pri) interface 8586 192.168.1.45 8586 netmask 255.255.255.255 dns

static (inside, inside) tcp interface 8100 192.168.1.45 8100 netmask 255.255.255.255 dns

Access-group outside_pri_access_in in the outside_pri interface

Route 0.0.0.0 outside_pri 0.0.0.0 64.20.30.169 1 track 1

Backup route 0.0.0.0 0.0.0.0 173.165.159.246 254

Timeout xlate 03:00

Conn Timeout 0:00:00 half-closed 0:30:00 udp icmp from 01:00 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 01:00 uauth uauth absolute inactivity from 01:00

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

AAA authentication enable LOCAL console

AAA authentication http LOCAL console

the ssh LOCAL console AAA authentication

http server enable 981

http 192.168.1.0 255.255.255.0 inside

http 0.0.0.0 0.0.0.0 outside_pri

http 0.0.0.0 0.0.0.0 backup

SNMP server group Authentication_Only v3 auth

SNMP-server host inside 192.168.1.47 survey community lwmedia version 2 c

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Sysopt connection tcpmss 1200

monitor SLA 123

type echo protocol ipIcmpEcho 216.59.44.220 interface outside_pri

Annex ALS life monitor 123 to always start-time now

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set esp-3des-sha1 esp-3des esp-sha-hmac

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto ipsec df - bit clear-df outside_pri

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 pfs Group1 set

Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

card crypto outside_pri_map 1 match address outside_pri_1_cryptomap

card crypto outside_pri_map 1 set pfs

peer set card crypto outside_pri_map 1 50.75.217.246

card crypto outside_pri_map 1 set of transformation-ESP-AES-256-MD5

card crypto outside_pri_map 2 match address outside_pri_cryptomap

peer set card crypto outside_pri_map 2 216.59.44.220

card crypto outside_pri_map 2 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

86400 seconds, duration of life card crypto outside_pri_map 2 set security-association

card crypto outside_pri_map 3 match address outside_pri_cryptomap_1

peer set card crypto outside_pri_map 3 216.59.44.220

outside_pri_map crypto map 3 the value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

outside_pri_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

card crypto outside_pri_map interface outside_pri

crypto isakmp identity address

ISAKMP crypto enable outside_pri

crypto ISAKMP policy 5

preshared authentication

3des encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 10

preshared authentication

the Encryption

sha hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

aes-256 encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 50

preshared authentication

aes encryption

md5 hash

Group 2

life 86400

!

track 1 rtr 123 accessibility

Telnet timeout 5

SSH 192.168.1.0 255.255.255.0 inside

SSH timeout 5

Console timeout 0

management-access inside

dhcpd auto_config outside_pri

!

dhcpd address 192.168.1.51 - 192.168.1.245 inside

dhcpd dns 8.8.8.8 8.8.4.4 interface inside

rental contract interface 86400 dhcpd inside

dhcpd field LM inside interface

dhcpd allow inside

!

a basic threat threat detection

statistical threat detection port

Statistical threat detection Protocol

Statistics-list of access threat detection

a statistical threat detection host number rate 2

no statistical threat detection tcp-interception

WebVPN

port 980

allow inside

Select outside_pri

enable SVC

attributes of Group Policy DfltGrpPolicy

VPN-idle-timeout no

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

internal GroupPolicy2 group strategy

attributes of Group Policy GroupPolicy2

Protocol-tunnel-VPN IPSec svc

internal levelwingVPN group policy

attributes of the strategy of group levelwingVPN

Protocol-tunnel-VPN IPSec svc webvpn

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list levelwingVPN_splitTunnelAcl

username password encrypted Z74.JN3DGMNlP0H2 privilege 0 aard

aard attribute username

VPN-group-policy levelwingVPN

type of remote access service

rcossentino 4UpCXRA6T2ysRRdE encrypted password username

username rcossentino attributes

VPN-group-policy levelwingVPN

type of remote access service

bcherok evwBWqKKwrlABAUp encrypted password username

username bcherok attributes

VPN-group-policy levelwingVPN

type of remote access service

rscott nIOnWcZCACUWjgaP encrypted password privilege 0 username

rscott username attributes

VPN-group-policy levelwingVPN

sryan 47u/nJvfm6kprQDs password encrypted username

sryan username attributes

VPN-group-policy levelwingVPN

type of nas-prompt service

username, password cbruch a8R5NwL5Cz/LFzRm encrypted privilege 0

username cbruch attributes

VPN-group-policy levelwingVPN

type of remote access service

apellegrino yy2aM21dV/11h7fR password encrypted username

username apellegrino attributes

VPN-group-policy levelwingVPN

type of remote access service

username rtuttle encrypted password privilege 0 79ROD7fRw5C4.l5

username rtuttle attributes

VPN-group-policy levelwingVPN

username privilege 15 encrypted password vJFHerTwBy8dRiyW levelwingadmin

username password nbrothers Amjc/rm5PYhoysB5 encrypted privilege 0

username nbrothers attributes

VPN-group-policy levelwingVPN

clong z.yb0Oc09oP3/mXV encrypted password username

clong attributes username

VPN-group-policy levelwingVPN

type of remote access service

username, password finance 9TxE6jWN/Di4eZ8w encrypted privilege 0

username attributes finance

VPN-group-policy levelwingVPN

Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn

type of remote access service

IPSec-attributes tunnel-group DefaultL2LGroup

Disable ISAKMP keepalive

tunnel-group 50.75.217.246 type ipsec-l2l

IPSec-attributes tunnel-group 50.75.217.246

pre-shared-key *.

Disable ISAKMP keepalive

type tunnel-group levelwingVPN remote access

tunnel-group levelwingVPN General-attributes

address LVCHSVPN pool

Group Policy - by default-levelwingVPN

levelwingVPN group of tunnel ipsec-attributes

pre-shared-key *.

tunnel-group 216.59.44.221 type ipsec-l2l

IPSec-attributes tunnel-group 216.59.44.221

pre-shared-key *.

tunnel-group 216.59.44.220 type ipsec-l2l

IPSec-attributes tunnel-group 216.59.44.220

pre-shared-key *.

Disable ISAKMP keepalive

!

!

!

Policy-map global_policy

!

context of prompt hostname

Cryptochecksum:ed7f4451c98151b759d24a7d4387935b

: end

Hello

It seems to me that you've covered most of the things.

You however not "said" Configuring VPN L2L that traffic between the pool of VPN and network camp should be in tunnel

outside_pri_cryptomap to access extended list ip 192.168.12.0 allow 255.255.255.0 object-group CHS-Colo

Although naturally the remote end must also the corresponding configurations for users of VPN clients be able to pass traffic to the site of the camp.

-Jouni

Error of customer Cisco VPN connection ASA 5505

I am unable to connect to the vpn I created on my ASA 5505 using the Cisco VPN Client on a Windows machine. The log of the vpn client and the config of the ASA 5505 is lower. Any help to solve this is appreciated.

CISCO VPN CLIENT LOG

Cisco Systems VPN Client Version 5.0.06.0160

Copyright (C) 1998-2009 Cisco Systems, Inc.. All rights reserved.

Customer type: Windows, Windows NT

Running: 6.1.7600

Config files directory: C:\Program Cisco Systems Client\

1 09:34:23.030 13/04/11 Sev = Info/4 CM / 0 x 63100002

Start the login process

2 09:34:23.061 13/04/11 Sev = Info/4 CM / 0 x 63100004

Establish a secure connection

3 09:34:23.061 13/04/11 Sev = Info/4 CM / 0 x 63100024

Attempt to connect with the server "71.xx.xx.253".

4 09:34:23.061 13/04/11 Sev = Info/6 IKE/0x6300003B

Attempts to establish a connection with 71.xx.xx.253.

5 09:34:23.061 13/04/11 Sev = Info/4 IKE / 0 x 63000001

From IKE Phase 1 negotiation

6 09:34:23.077 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK AG (SA, KE, NO, ID, VID (Xauth), VID (dpd), VID (Frag), VID(Nat-T), VID (Unity)) at 71.xx.xx.253

7 09:34:23.170 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

8 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" ag="" (sa,="" ke,="" non,="" id,="" hash,="" vid(unity),="" vid(xauth),="" vid(dpd),="" vid(nat-t),="" nat-d,="" nat-d,="" vid(frag),="" vid(?))="" from="">

9 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer is a compatible peer Cisco-Unity

10 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports XAUTH

11 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports the DPD

12 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports NAT - T

13 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000001

Peer supports fragmentation IKE payloads

14 09:34:23.170 13/04/11 Sev = Info/6 IKE / 0 x 63000001

IOS Vendor ID successful construction

15 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SENDING > ISAKMP OAK AG * (HASH, NOTIFY: NAT - D, NAT - D, VID (?), STATUS_INITIAL_CONTACT, VID (Unity)) at 71.xx.xx.253

16 09:34:23.170 13/04/11 Sev = Info/6 IKE / 0 x 63000055

Sent a keepalive on the IPSec Security Association

17 09:34:23.170 13/04/11 Sev = Info/4 IKE / 0 x 63000083

IKE port in use - Local Port = 0xEB07, Remote Port = 0 x 1194

18 09:34:23.170 13/04/11 Sev = Info/5 IKE / 0 x 63000072

Automatic NAT detection status:

Remote endpoint is NOT behind a NAT device

This effect is behind a NAT device

19 09:34:23.170 13/04/11 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 0 IKE SA authenticated user in the system

20 09:34:23.170 13/04/11 Sev = Info/4 CM/0x6310000E

ITS established Phase 1. 1 crypto IKE Active SA, 1 IKE SA authenticated user in the system

21 09:34:23.186 13/04/11 Sev = Info/5 IKE/0x6300005E

Customer address a request from firewall to hub

22 09:34:23.186 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK TRANS *(HASH, ATTR) to 71.xx.xx.253

23 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

24 09:34:23.248 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" trans="" *(hash,="" attr)="" from="">

25 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_ADDRESS:, value = 172.26.6.1

26 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_NETMASK:, value = 255.255.0.0

27 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (1):, value = 172.26.0.250

28 09:34:23.248 13/04/11 Sev = Info/5 IKE / 0 x 63000010

MODE_CFG_REPLY: Attribute = INTERNAL_IPV4_DNS (2):, value = 172.26.0.251

29 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SAVEPWD:, value = 0x00000000

30 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_DEFDOMAIN:, value = TLCUSA

31 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_PFS:, value = 0x00000000

32 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000E

MODE_CFG_REPLY: Attribute = APPLICATION_VERSION, value = Cisco Systems, Inc. ASA5505 Version 8.2 (1) built by manufacturers on Wednesday 5 May 09 22:45

33 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = MODECFG_UNITY_SMARTCARD_REMOVAL_DISCONNECT:, value = 0x00000001

34 09:34:23.248 13/04/11 Sev = Info/5 IKE/0x6300000D

MODE_CFG_REPLY: Attribute = received and by using the NAT - T port number, value = 0 x 00001194

35 09:34:23.248 13/04/11 Sev = Info/4 CM / 0 x 63100019

Data in mode Config received

36 09:34:23.264 13/04/11 Sev = Info/4 IKE / 0 x 63000056

Received a request from key driver: local IP = 172.26.6.1, GW IP = 71.xx.xx.253, Remote IP = 0.0.0.0

37 09:34:23.264 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > QM ISAKMP OAK * (HASH, SA, NO, ID, ID) to 71.xx.xx.253

38 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

39 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:status_resp_lifetime)="" from="">

40 09:34:23.326 13/04/11 Sev = Info/5 IKE / 0 x 63000045

Answering MACHINE-LIFE notify has value of 86400 seconds

41 09:34:23.326 13/04/11 Sev = Info/5 IKE / 0 x 63000047

This AA is already living from 0 seconds, setting the expiration to 86400 seconds right now

42 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

43 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(hash,="" notify:no_proposal_chosen)="" from="">

44 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000013

SEND to > ISAKMP OAK INFO *(HASH, DEL) to 71.xx.xx.253

45 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000049

IPsec security association negotiation made scrapped, MsgID = 89EE7032

46 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000017

Marking of IKE SA delete (I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED

47 09:34:23.326 13/04/11 Sev = Info/5 IKE/0x6300002F

Received packet of ISAKMP: peer = 71.xx.xx.253

48 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000058

Received an ISAKMP for a SA message no assets, I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8

49 09:34:23.326 13/04/11 Sev = Info/4 IKE / 0 x 63000014

RECEIVING< isakmp="" oak="" info="" *(dropped)="" from="">

50 09:34:26.696 13/04/11 Sev = Info/4 IKE/0x6300004B

IKE negotiation to throw HIS (I_Cookie = 2617522400DC1763 R_Cookie = 029325381036CCD8) reason = DEL_REASON_IKE_NEG_FAILED

51 09:34:26.696 13/04/11 Sev = Info/4 CM / 0 x 63100012

ITS phase 1 deleted before first Phase 2 SA is caused by "DEL_REASON_IKE_NEG_FAILED". Crypto 0 Active IKE SA, 0 IKE SA authenticated user in the system

52 09:34:26.696 13/04/11 Sev = Info/5 CM / 0 x 63100025

Initializing CVPNDrv

53 09:34:26.696 13/04/11 Sev = Info/6 CM / 0 x 63100046

Set indicator established tunnel to register to 0.

54 09:34:26.696 13/04/11 Sev = Info/4 IKE / 0 x 63000001

Signal received IKE to complete the VPN connection

----------------------------------------------------------------------------------------

ASA 5505 CONFIG

: Saved

:

ASA Version 8.2 (1)

!

ciscoasa hostname

domain masociete.com

activate tdkuTUSh53d2MT6B encrypted password

2KFQnbNIdI.2KYOU encrypted passwd

names of

!

interface Vlan1

nameif inside

security-level 100

IP 172.26.0.252 255.255.0.0

!

interface Vlan2

nameif outside

security-level 0

IP address 71.xx.xx.253 255.255.255.240

!

interface Ethernet0/0

switchport access vlan 2

Speed 100

full duplex

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

passive FTP mode

clock timezone IS - 5

clock to summer time EDT recurring

DNS server-group DefaultDNS

domain masociete.com

access-list LIMU_Split_Tunnel_List note the network of the company behind the ASA

Standard access list LIMU_Split_Tunnel_List allow 172.26.0.0 255.255.0.0

outside_access_in list extended access permit icmp any one

outside_access_in list extended access udp allowed any any eq 4500

outside_access_in list extended access udp allowed any any eq isakmp

outside_access_in list extended access permit tcp any host 71.xx.xxx.251 eq ftp

outside_access_in list extended access permit tcp any host 71.xx.xxx.244 eq 3389

inside_outbound_nat0_acl list of allowed ip extended access all 172.26.5.192 255.255.255.240

inside_outbound_nat0_acl list of allowed ip extended access all 172.26.6.0 255.255.255.128

pager lines 24

Enable logging

asdm of logging of information

Outside 1500 MTU

Within 1500 MTU

local pool VPN_POOL 172.26.6.1 - 172.26.6.100 255.255.0.0 IP mask

ICMP unreachable rate-limit 1 burst-size 1

enable ASDM history

ARP timeout 14400

Global 1 interface (outside)

NAT (inside) 0-list of access inside_outbound_nat0_acl

NAT (inside) 1 0.0.0.0 0.0.0.0

static (inside, outside) 71.xx.xxx.251 172.26.5.9 netmask 255.255.255.255

static (inside, outside) 71.xx.xxx.244 172.26.0.136 netmask 255.255.255.255

Access-group outside_access_in in interface outside

Route outside 0.0.0.0 0.0.0.0 71.xx.xxx.241 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-registration DfltAccessPolicy

GANYMEDE + Protocol Ganymede + AAA-server

RADIUS Protocol RADIUS AAA server

Enable http server

http 172.26.0.0 255.255.0.0 inside

No snmp server location

No snmp Server contact

Server enable SNMP traps snmp authentication linkup, linkdown cold start

Crypto ipsec transform-set esp-3des esp-md5-hmac TRANS_ESP_3DES_MD5

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_MD5

Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA

Crypto ipsec transform-set transit mode TRANS_ESP_3DES_SHA

Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

life crypto ipsec security association seconds 28800

Crypto ipsec kilobytes of life - safety 4608000 association

Crypto-map dynamic outside_dyn_map 20 game of transformation-TRANS_ESP_3DES_MD5

map outside_map 65535-isakmp ipsec crypto dynamic outside_dyn_map

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

3des encryption

sha hash

Group 2

life 86400

Telnet timeout 5

SSH timeout 5

Console timeout 0

dhcpd outside auto_config

!

no basic threat threat detection

no statistical access list - a threat detection

no statistical threat detection tcp-interception

WebVPN

internal DefaultRAGroup group strategy

attributes of Group Policy DefaultRAGroup

value of server WINS 172.26.0.250 172.26.0.251

value of 172.26.0.250 DNS server 172.26.0.251

Protocol-tunnel-VPN IPSec l2tp ipsec svc

value by default-field TLCUSA

internal LIMUVPNPOL1 group policy

LIMUVPNPOL1 group policy attributes

value of 172.26.0.250 DNS server 172.26.0.251

VPN-idle-timeout 30

Protocol-tunnel-VPN IPSec l2tp ipsec

Split-tunnel-policy tunnelspecified

value of Split-tunnel-network-list LIMU_Split_Tunnel_List

the address value VPN_POOL pools

internal TLCVPNGROUP group policy

TLCVPNGROUP group policy attributes

value of 172.26.0.250 DNS server 172.26.0.251

Protocol-tunnel-VPN IPSec l2tp ipsec svc

Re-xauth disable

enable IPSec-udp

value by default-field TLCUSA

barry.julien YCkQv7rLwCSNRqra06 + QXg password user name is nt encrypted privilege 0

username barry.julien attributes

VPN-group-policy TLCVPNGROUP

Protocol-tunnel-VPN IPSec l2tp ipsec

bjulien bhKBinDUWhYqGbP4 encrypted password username

username bjulien attributes

VPN-group-policy TLCVPNGROUP

attributes global-tunnel-group DefaultRAGroup

address VPN_POOL pool

Group Policy - by default-DefaultRAGroup

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared-key *.

tunnel-group DefaultRAGroup ppp-attributes

no authentication ms-chap-v1

ms-chap-v2 authentication

type tunnel-group TLCVPNGROUP remote access

attributes global-tunnel-group TLCVPNGROUP

address VPN_POOL pool

Group Policy - by default-TLCVPNGROUP

IPSec-attributes tunnel-group TLCVPNGROUP

pre-shared-key *.

ISAKMP ikev1-user authentication no

tunnel-group TLCVPNGROUP ppp-attributes

PAP Authentication

ms-chap-v2 authentication

!

class-map inspection_default

match default-inspection-traffic

!

!

type of policy-card inspect dns preset_dns_map

parameters

message-length maximum 512

Policy-map global_policy

class inspection_default

inspect the preset_dns_map dns

inspect the ftp

inspect h323 h225

inspect the h323 ras

inspect the rsh

inspect the rtsp

inspect esmtp

inspect sqlnet

inspect the skinny

inspect sunrpc

inspect xdmcp

inspect the sip

inspect the netbios

inspect the tftp

!

global service-policy global_policy

context of prompt hostname

Cryptochecksum:b94898c163c59cee6c143943ba87e8a4

: end

enable ASDM history

can you try to change the transformation of dynamic value ESP-3DES-SHA map.

for example

remove the encryption scheme dynamic-map outside_dyn_map 20 transform-set TRANS_ESP_3DES_MD5

and replace with

Crypto-map dynamic outside_dyn_map 20 the value transform-set ESP-3DES-SHA

Professional Windows Vista crashes when you use Cisco VPN Client 5.05.0290

I have a Dell Latitude E6400 Windows Vista Business (32 bit) operating system. When I go to turn on the VPN client, I get invited to my username / password and once entered, the system just hangs. The only way to answer, it's a re-start. I took action:

1 disabled UAC in Windows
2 tried an earlier version of the VPN client
3. by the representative of Cisco, I put the application runs as an administrator

If there are any suggestions or similar stories, I would be grateful any offereings.

It IS the COMODO Firewall with the 5.0.x CISCO VPN client that causes the gel. The last update of COMODO has caused some incompatibility. I tried to install COMODO without the built in Zonealerm, but it is still frozen. The only way to solve it is to uninstall COMODOD. Since then, my CISCO VPN client works again...

problem Cisco VPN, X100e

Hi, I have my new x100e for a few days, and I'm trying to make it work with Cisco VPN client to connect remotely to my work. Cisco is works perfectly if connected via WiFi or LAN, but not working not not via integrated UMTS modem. When I start Cisco VPN and attempt to connect, I wonder login and pwd, everything works OK, after that, trying to open the web page you requested does not charge.

When I tried external USB modem with its own pilots etc everyting was working properly. If I try UMTS modem built to normal when web pages not connected to the VPN, everything works OK also.

Can someone help me solve this problem? I bought this laptop specially for this integrated modem.

Thank you very much

"The potential compatibility issues" you will find this:
The VPN Client on Windows 7 does not support devices WWAN (also called wireless data cards).

If the problem is the customer himself who don't recognize connection of data card (strange but possible), the HSDPA connection made to the old (via dialup) can be a solution.

Just make a modem connection to the number * 99 * 1 # and put the usual initialization string in the modem of the advanced properties at + cgdcont = 1, "IP", 'your apn'

Map of gobi works both as a network adapter or a modem.

It's worth a try

SafeNet and Cisco VPN Client Compatible?

I have been using the Cisco VPN for quite awhile with no problems. Recently, we have added a Watchguard Firebox somewhere else and have installed the Client of Watchguard MUVPN, otherwise known as a customer of Safenet.

Since the installation, I could not yet properly use the Cisco Client. If I disable the two Services of Safenet, I invited to my user id and password and connect to the Cisco Concentrator and get an ip, etc. However, I can't ping anything on the network.

My solution is to completely uninstall both clients and reinstall the Cisco by itself. This is not very practical.

If anyone know a fix for this I'd appreciate comments.

Thank you

Patrick Dunnigan

Hi Patrick,

I only got lucky with the SafeNet customer brand Watchguard with the 4.0.x releases of the Cisco client. I think Cisco 4.6 clients use a newer driver from the DNE or else that plays well with SafeNet.

In any case, here's how to set up PC that requires both clients:

First, install the Cisco VPN client. Restart the application, and then stop and disable the Windows service.

Install the client for Watchguard, reboot as requested.

Then, stop and set to manual both SafeNet services, then start and set to automatic the Cisco service.

Delete the shortcut in your Start menu Startup group safecfg.exe (or the key of HKLM\MS\Windows\CurrentVer\Run, where he gets set.)

Delete the shortcut to start for the Cisco VPN client as well.

Whenever you want to use the Cisco customer, you can just launch the Dialer to IPSec. If you want to run the SafeNet client, stop the Cisco service, start the services of SafeNet, then run safecfg.exe. A few batch files facilitate this process for users.

Hope that helps,

Chris

Please ME TELL WHAT Cisco VPN internal Service Module

I do not know what is the internal service of cisco vpn module, how it words, and where we can use it.

Hello

Cisco internal VPN Service Module is a Cisco ISR G2.

I would say that the main goal is the ability to offload the encryption to a dedicated service module. Dedicated encryption protects performance when CPU utilization for other services.

You can find the data sheet here:

http://www.Cisco.com/en/us/prod/collateral/modules/ps2706/ps12202/data_sheet_c78-682436.html

Also on the card you will find what routers support this module.

Please evaluate the useful messages

Best regards

Eugene

Cisco VPN client to 837

I try to get the Cisco VPN client 4.8 v to connect to a 837. The tunnels come but I'm unable to pass traffic. Joined a config. Any help is appreciated

Hello

I think your problem is the implementation of your crypto card. Your traffic must pass tru map encryption while going out. Place it on the dialer interface and if you use the loopback as a source interface in your installation, use

map (mapname) crypto address-local (interface)

command.

Cisco VPN Site to Site with a static and dynamic does not

Hello

I have ASA 5510 in Headquarters with static, IP and ASA 5505 in the remote site behind ADSL router trying to establish VPN, but its failure in phase 1

Config of the headquarters

interface Ethernet0/0

Description link to router LeaseLine

nameif outside

security-level 0

IP x.x.x.x 255.255.255.248

!

interface Ethernet0/1

Description link to LAN internal

nameif inside

security-level 100

IP 172.17.1.15 255.255.255.0

access extensive list ip 172.17.1.0 inside_nat0_outbound_1 allow 255.255.255.0 172.20.1.0 255.255.255.0

access extensive list ip 172.17.1.0 inside_nat0_outbound_1 allow 255.255.255.0 172.19.1.0 255.255.255.0

access extensive list ip 172.17.1.0 vpn_to_remote allow 255.255.255.0 172.19.1.0 255.255.255.0

extended VPN ip 172.17.1.0 access list allow 255.255.255.0 172.20.1.0 255.255.255.0

Global 1 interface (outside)

NAT (inside) 0-list of access inside_nat0_outbound_1

NAT (inside) 1 0.0.0.0 0.0.0.0

Route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

Crypto ipsec transform-set esp-aes-256-md5 esp-aes-256 esp-md5-hmac

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

correspondence address 1 crypto dynamic-map cisco VPN

Crypto dynamic-map cisco 1 set of transformation-ESP-AES-256-SHA

card crypto outside_map 10 correspondence address vpn_to_remote

card crypto outside_map 10 set pfs

card crypto outside_map 10 peers set y.y.y.y

card crypto outside_map 10 transform-set esp-aes-256-md5

outside_map crypto 10 card value reverse-road

dynamic outside_map 30-isakmp ipsec crypto map Cisco

outside_map interface card crypto outside

crypto isakmp identity address

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

aes-256 encryption

md5 hash

Group 5

life 86400

crypto ISAKMP policy 20

preshared authentication

aes encryption

md5 hash

Group 2

life 86400

crypto ISAKMP policy 30

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

Crypto isakmp nat-traversal 20

tunnel-group y.y.y.y type ipsec-l2l

tunnel-group ipsec-attributes y.y.y.y

pre-shared-key *.

tunnel-group parkplace type ipsec-l2l

tunnel-group ipsec-attributes parkplace

pre-shared-key *.

The Remote Site configuration

interface Vlan1

nameif inside

security-level 100

address 172.20.1.1 IP 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

IP 192.168.1.2 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

ICMP list extended access permit icmp any one

access-list SHEEP extended ip 172.20.1.0 allow 255.255.255.0 172.17.1.0 255.255.255.0

extended VPN 172.20.1.0 ip access list allow 255.255.255.0 172.17.1.0 255.255.255.0

Global 1 interface (outside)

NAT (inside) 0 access-list SHEEP

NAT (inside) 1 0.0.0.0 0.0.0.0 outdoors

Access-group ICMP in interface outside

Route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

crypto map outside_map 1 is the VPN address

peer set card crypto outside_map 1 83.111.252.242

card crypto outside_map 1 set of transformation-ESP-AES-256-SHA

outside_map interface card crypto outside

crypto ISAKMP allow outside

crypto ISAKMP policy 10

preshared authentication

aes-256 encryption

sha hash

Group 2

life 86400

Crypto isakmp nat-traversal 20

tunnel-group fairmount type ipsec-l2l

tunnel-group fairmount ipsec-attributes

pre-shared-key *.

Best regards / Asfar

Hello

Have you tried to replace the names of 'tunnel-group' entry with Ip address on both ends... ?

Thank you

MS

Cisco VPN Client and Windows XP VPN Client IPSec to ASA

I configured ASA for IPSec VPN via Cisco VPN Client and XP VPN client communications. I can connect successfully with Cisco VPN Client, but I get an error when connecting with the XP client. Debugging said "misconfigured groups and transport/tunneling mode" I know, they use different methods of transport and tunneling, and I think that I have configured both. Take a look at the config.

PS a funny thing - when I connect with client VPN in Windows Server 2003, I have no error. The only difference is that client XP is behind an ADSL router and client server is directly connected to the Internet on one of its public IP of interfaces. NAT in the case of XP can cause problems?

Config is:

!

interface GigabitEthernet0/2.30

Description remote access

VLAN 30

nameif remote access

security-level 0

IP 85.*. *. 1 255.255.255.0

!

access-list 110 scope ip allow a whole

NAT list extended access permit tcp any host 10.254.17.10 eq ssh

NAT list extended access permit tcp any host 10.254.17.26 eq ssh

access-list extended ip allowed any one sheep

access list nat-ganja extended permit tcp any host 10.254.17.18 eq ssh

sheep-vpn access-list extended permits all ip 192.168.121.0 255.255.255.0

tunnel of splitting allowed access list standard 192.168.121.0 255.255.255.0

flow-export destination inside-Bct 192.168.1.27 9996

IP local pool raccess 192.168.121.60 - 192.168.121.120 mask 255.255.255.0

ARP timeout 14400

global (outside-Baku) 1 interface

global (outside-Ganja) interface 2

NAT (inside-Bct) 0 access-list sheep-vpn

NAT (inside-Bct) 1 access list nat

NAT (inside-Bct) 2-nat-ganja access list

Access-group rdp on interface outside-Ganja

!

Access remote 0.0.0.0 0.0.0.0 85.*. *. 1 2

Route outside Baku 10.254.17.24 255.255.255.248 10.254.17.10 1

Route outside Baku 192.1.1.0 255.255.255.0 10.254.17.10 1

Outside-Baku route 192.168.39.0 255.255.255.0 10.254.17.10 1

Route outside-Ganja 192.168.45.0 255.255.255.0 10.254.17.18 1

Route outside-Ganja 192.168.69.0 255.255.255.0 10.254.17.18 1

Route outside-Ganja 192.168.184.0 255.255.255.0 10.254.17.18 1

Route outside Baku 192.168.208.16 255.255.255.240 10.254.17.10 1

Route outside-Ganja 192.168.208.112 255.255.255.240 10.254.17.18 1

dynamic-access-policy-registration DfltAccessPolicy

Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

Crypto ipsec transform-set newset aes - esp esp-md5-hmac

Crypto ipsec transform-set esp-3des esp-md5-hmac vpnclienttrans

Crypto ipsec transform-set vpnclienttrans transport mode

Crypto ipsec transform-set esp-3des esp-md5-hmac raccess

life crypto ipsec security association seconds 214748364

Crypto ipsec kilobytes of life security-association 214748364

raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

vpnclientmap 30 card crypto ipsec-isakmp dynamic dyn1

card crypto interface for remote access vpnclientmap

crypto isakmp identity address

ISAKMP crypto enable vpntest

ISAKMP crypto enable outside-Baku

ISAKMP crypto enable outside-Ganja

crypto ISAKMP enable remote access

ISAKMP crypto enable Interior-Bct

crypto ISAKMP policy 30

preshared authentication

3des encryption

md5 hash

Group 2

life 86400

No encryption isakmp nat-traversal

No vpn-addr-assign aaa

Telnet timeout 5

SSH 192.168.1.0 255.255.255.192 outside Baku

SSH 10.254.17.26 255.255.255.255 outside Baku

SSH 10.254.17.18 255.255.255.255 outside Baku

SSH 10.254.17.10 255.255.255.255 outside Baku

SSH 10.254.17.26 255.255.255.255 outside-Ganja

SSH 10.254.17.18 255.255.255.255 outside-Ganja

SSH 10.254.17.10 255.255.255.255 outside-Ganja

SSH 192.168.1.0 255.255.255.192 Interior-Bct

internal vpn group policy

attributes of vpn group policy

value of DNS-server 192.168.1.3

Protocol-tunnel-VPN IPSec l2tp ipsec

Split-tunnel-policy tunnelspecified

Split-tunnel-network-list value split tunnel

BCT.AZ value by default-field

attributes global-tunnel-group DefaultRAGroup

raccess address pool

Group-RADIUS authentication server

Group Policy - by default-vpn

IPSec-attributes tunnel-group DefaultRAGroup

pre-shared-key *.

Hello

For the Cisco VPN client, you would need a tunnel-group name configured on the ASA with a pre-shared key.

Please see configuration below:

http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

or

http://tinyurl.com/5t67hd

Please see the section of tunnel-group config of the SAA.

There is a tunnel-group called "rtptacvpn" and a pre-shared key associated with it. This group name is used by the VPN Client Group name.

So, you would need a specific tunnel-group name configured with a pre-shared key and use it on the Cisco VPN Client.

Secondly, because you are behind a router ADSL, I'm sure that's configured for NAT. can you please activate NAT - T on your ASA.

"crypto isakmp nat-traversal.

Thirdly, change the transformation of the value

raccess 1 set transform-set vpnclienttrans crypto dyn1 dynamic-map

Let me know the result.

Thank you

Gilbert

Card Cisco VPN is disabled

Similar Questions

Maybe you are looking for