Error of tunneling to ASA 5505 using "Software VPN Client"

Here's my current network:

I'm VPN tunnel in the ASA using the Cisco VPN Client software.

Here is my config ASA config: http://pastebin.com/raw.php?i=ad6p1Zac

Here's my entry for the VPN Client connection information:

(Password: cisco)

When I try to connect, I get the message error "the received HASH load cannot be verified.

What is this error and how can I solve it?

I think you need to enter this information in the fields of group authentiation:

(Just below "Group authentication")

Name: vpnclientgroup

Password: [just what you entered as a pre shared key below]

tunnel-group vpnclientgroup ipsec-attributes pre-shared-key *****

After the establishmet tunnel you will get a password pop up, that you enter "David" and the associated password.

Tags: Cisco Security

Similar Questions

  • CISCO ASA 5505 no cisco VPN Client

    Hello

    I'm looking for after a firewall Cisco ASA 5505 and want to watch all the owners of it with remote access in but none of us have a support contract with Cisco.

    Is it possible to set up a VPN client not as Microsoft built the client to connect to the ASA?

    Thank you

    Alamb200

    Hello

    Looking for a PPTP on ASA connection?

    The following document provides the following:

    ASA q support PPTP client?

    A. number of the

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_qanda_item09186a00805b87d8.shtml#supportfeat

    But we can configure ASA to allow the PPTP connection:

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080094a5a.shtml

    I hope this helps.

    Kind regards

    Anisha

    P.S.: Please mark this thread as answered if you feel that your request is answered. Note the useful messages.

  • IP address connection sets using the VPN Client

    Hello world. I'm using a VPN Client when I establish a VPN Tunnel with a 1600 router, and I have a question.

    Can I assign a fixed IP address in the client, instead the router send to random addresses from customer?

    What I would he do this?

    It would be in the configuration of the VPN client, or in the configuration of the router?

    If so, I'm doing this?

    Do I need another tool, or other software or hardware to do?

    any help is hope...

    Thank you...

    Hello

    I don't think that there is a simple way to do this.

    However, if you create a different groupname for the user who needs a static IP address, I think you should be good to go

    So what you need to do, create a new pool of addresses. Make the start and end ip address be the same (this is the address to which you want to assign to the VPN user)

    Configure another ipsec on the router group and bind the new pool to this group

    Ask your VPN client to connect to this group

    Hope that helps

    Jean Marc

  • ASA problem inside the VPN client routing

    Hello

    I have a problem where I can't reach the VPN clients with their vpn IP pool from the inside or the asa itself. Connect VPN clients can access internal network very well. I have no nat configured for the pool of vpn and packet trace crypt packages and puts it into the tunnel. I'm not sure what's wrong.

    Here are a few relevant config:

    network object obj - 192.168.245.0

    192.168.245.0 subnet 255.255.255.0

    192.168.245.1 - 192.168.245.50 vpn IP local pool

    NAT (inside, outside) static source any any destination static obj - 192.168.245.0 obj - 192.168.245.0 no-proxy-arp-search to itinerary

    Out of Packet trace:

    Firewall # entry packet - trace inside the x.x.x.x icmp 8 0 192.168.245.33

    Phase: 1

    Type: ACCESS-LIST

    Subtype:

    Result: ALLOW

    Config:

    Implicit rule

    Additional information:

    MAC access list

    Phase: 2

    Type:-ROUTE SEARCH

    Subtype: entry

    Result: ALLOW

    Config:

    Additional information:

    in 192.168.245.33 255.255.255.255 outside

    Phase: 3

    Type: ACCESS-LIST

    Subtype: Journal

    Result: ALLOW

    Config:

    Access-group acl-Interior interface inside

    access list acl-Interior extended icmp permitted an echo

    Additional information:

    Phase: 4

    Type: IP-OPTIONS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 5

    Type: INSPECT

    Subtype: np - inspect

    Result: ALLOW

    Config:

    Additional information:

    Phase: 6

    Type:

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    Phase: 7

    Type: NAT

    Subtype:

    Result: ALLOW

    Config:

    NAT (inside, outside) static source any any destination static obj - 192.168.245.0

    obj - 192.168.245.0 no-proxy-arp-search to itinerary

    Additional information:

    Definition of static 0/x.x.x.x-x.x.x.x/0

    Phase: 8

    Type: VPN

    Subtype: encrypt

    Result: ALLOW

    Config:

    Additional information:

    Phase: 9

    Type: CREATING STREAMS

    Subtype:

    Result: ALLOW

    Config:

    Additional information:

    New workflow created with the 277723432 id, package sent to the next module

    Result:

    input interface: inside

    entry status: to the top

    entry-line-status: to the top

    output interface: outside

    the status of the output: to the top

    output-line-status: to the top

    Action: allow

    There is no route to the address pool of vpn. Maybe that's the problem? I don't know than that used to work before we went to 8.4.

    Check if the firewall is enabled on your host from the client ravpn and blocking your pings.

  • Different classes using Cisco VPN Client VPN

    Hello

    on a cisco ASA 5510, I defined a vpn group used for remote teleworkers who have access to the entire LAN using Cisco VPN Client 4.8.

    I would give to others of this client, but I need to limit their access to LAN resources, which means that I have to have two types of users:

    Remote LAN access

    access to only certain IP addresses

    Both must use the Cisco VPN client.

    How can I do?

    Thank you

    This link should help.

    http://www.Cisco.com/en/us/products/HW/vpndevc/ps2030/products_configuration_example09186a0080641a52.shtml

  • Using Cisco VPN Client in Windows 7 Professional 64 bit

    Hi all!
    I need to use Cisco VPN Client to connect to my server in the company, because my company uses lotus notes Server, I have to connect Cisco VPN to access e-mail. But now my windows version is Windows 7 Pro 64 bits that cannot directly install this application, I already installed XP Mode and creatde shortcut to Windows 7, I plugged the Cisco VPN to my Cisco VPN server, but I can not access the server, Pls help me and show me how to solve this problem

    Open the XP VM itself, do not use the shortcut that was published in
    the W7 boot menu. You need to install Outlook / your email client
    Inside the virtual machine, as well as on the side of W7. You can point to the same
    PST files if you have local PST files, but you just can't open them in
    at the same time of W7 and XP VM.

    There is no way to bridge using the shortcut of publishing app

    Some people have reported success with the third party IPSec
    replacements as customer universal shrew or the NCP. Your IT Department.
    would like to know if these are supported

    :

    > Hello all! I need to use Cisco VPN Client to connect to my server in the company, because my company uses lotus notes Server, I have to connect Cisco VPN to access e-mail. But now my windows version is Windows 7 Pro 64 bits that cannot directly install this application, I already installed XP Mode and creatde shortcut to Windows 7, I plugged the Cisco VPN to my Cisco VPN server, but I can not access the server, Pls help me and show me how to solve this problem
    Barb Bowman www.digitalmediaphile.com

  • Slow initial connection using Cisco VPN Client

    I am currently using Cisco VPN Client v5.0.07.0290.  Whenever I start my connection, it takes me about 90 seconds for the prompt to display authentication and another ~ 90 seconds to finish the auth. and connect successfully.  I have another computer laptop w / the same WIN7 OS and version of Cisco VPN Client and he ends the connection to<30 sec. ="" why="" is="" this? ="" any="" suggestions="">

    Hi Sergio,

    You import the .pcf for the VPN Client file? If so, please try to recreate a new file .pcf locally on the machine itself and try to connect. Let me know how it goes.

    Thank you

    Delvallée

  • LAN to Lan tunnel between ASA 5505 and 3030.

    I am unable to build a tunnel vpn site-to-site between an ASA 5505 and our Cisco 3030.  I tried all possible combinations except one that will work.  I am able to ping each peer on the other site.  Someone at - it a config between two tunnels of Lan to Lan to work between a 5505 and 3030 that works.  Thank you

    Hello

    Please visit this link using config:

    http://www.Cisco.com/c/en/us/support/docs/security/VPN-3000-series-conce...

    Kind regards

    Aditya

    Please evaluate the useful messages.

  • ASA 5505 - remote access VPN to access various internal networks

    Hi all

    A customer has an ASA 5505 with a remote access vpn. They are moving their internal network to a new regime and that you would be the users who come on the vpn to access the existing and new networks. Currently can only access the existing. When users connect to access remote vpn, the asa gave them the address 192.168.199.x. The current internal network is 200.190.1.x and that they would reach their new network of 10.120.110.x.

    Here is the config:

    :

    ASA Version 8.2 (5)

    !

    ciscoasa hostname

    enable encrypted password xxx

    XXX encrypted passwd

    names of

    !

    interface Ethernet0/0

    switchport access vlan 2

    !

    interface Ethernet0/1

    !

    interface Ethernet0/2

    !

    interface Ethernet0/3

    !

    interface Ethernet0/4

    !

    interface Ethernet0/5

    !

    interface Ethernet0/6

    !

    interface Ethernet0/7

    !

    interface Vlan1

    nameif inside

    security-level 100

    IP 200.190.1.15 255.255.255.0

    !

    interface Vlan2

    nameif outside

    security-level 0

    IP address 255.255.255.0 xxxxxxx

    !

    exec banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

    connection of the banner the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

    banner asdm the ACCESS NOT AUTHORIZED IS STRICTLY PROHIBITED

    passive FTP mode

    access extensive list ip 200.190.1.0 inside_access_in allow 255.255.255.0 any

    outside_access_in list extended access permit icmp any external interface

    access extensive list ip 192.168.199.0 outside_access_in allow 255.255.255.192 host 10.120.110.0

    Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 200.190.1.0 255.255.255.0

    MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0

    access extensive list ip 200.190.1.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192

    inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192

    pager lines 24

    Enable logging

    asdm of logging of information

    Within 1500 MTU

    Outside 1500 MTU

    mask 192.168.199.10 - 192.168.199.50 255.255.255.0 IP local pool Remote_IPSEC_VPN_Pool

    IP verify reverse path to the outside interface

    ICMP unreachable rate-limit 1 burst-size 1

    ICMP allow any inside

    ICMP allow all outside

    don't allow no asdm history

    ARP timeout 14400

    Global 1 interface (outside)

    NAT (inside) 0-list of access inside_nat0_outbound

    NAT (inside) 1 200.190.1.0 255.255.255.0

    inside_access_in access to the interface inside group

    Access-group outside_access_in in interface outside

    Route outside 0.0.0.0 0.0.0.0 190.213.43.1 1

    Route inside 10.120.110.0 255.255.255.0 200.190.1.50 1

    Route inside 192.168.50.0 255.255.255.0 200.190.1.56 1

    Route inside 192.168.60.0 255.255.255.0 200.190.1.56 1

    Timeout xlate 03:00

    Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

    Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

    Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

    Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

    timeout tcp-proxy-reassembly 0:01:00

    Floating conn timeout 0:00:00

    dynamic-access-policy-registration DfltAccessPolicy

    http server enable 10443

    http server idle-timeout 5

    Server of http session-timeout 30

    HTTP 200.190.1.0 255.255.255.0 inside

    No snmp server location

    No snmp Server contact

    Server enable SNMP traps snmp authentication linkup, linkdown cold start

    Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

    Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac

    Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

    Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac

    Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

    Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac

    life crypto ipsec security association seconds 28800

    Crypto ipsec kilobytes of life - safety 4608000 association

    Dynamic crypto map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

    Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA MD5-ESP-3DES ESP-DES-SHA ESP-DES-MD5

    outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP

    outside_map interface card crypto outside

    Crypto ca trustpoint _SmartCallHome_ServerCA

    Configure CRL

    Crypto ca certificate chain _SmartCallHome_ServerCA

    certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

    (omitted)

    quit smoking

    crypto ISAKMP allow outside

    crypto ISAKMP policy 10

    preshared authentication

    3des encryption

    sha hash

    Group 2

    life 86400

    Crypto isakmp nat-traversal 3600

    Telnet timeout 5

    SSH 200.190.1.0 255.255.255.0 inside

    SSH timeout 5

    SSH version 2

    Console timeout 5

    dhcpd outside auto_config

    !

    a basic threat threat detection

    scanning-threat shun threat detection

    Statistics-list of access threat detection

    no statistical threat detection tcp-interception

    WebVPN

    allow outside

    internal MD_SSL_Gp_Pol group strategy

    attributes of Group Policy MD_SSL_Gp_Pol

    VPN-tunnel-Protocol webvpn

    WebVPN

    list of URLS no

    disable the port forward

    hidden actions no

    disable file entry

    exploration of the disable files

    disable the input URL

    internal MD_IPSEC_Tun_Gp group strategy

    attributes of Group Policy MD_IPSEC_Tun_Gp

    value of banner welcome to remote VPN

    VPN - connections 1

    VPN-idle-timeout 5

    Protocol-tunnel-VPN IPSec webvpn

    Split-tunnel-policy tunnelspecified

    value of Split-tunnel-network-list MD_IPSEC_Tun_Gp_splitTunnelAcl

    the address value Remote_IPSEC_VPN_Pool pools

    WebVPN

    value of the RDP URL-list

    attributes of username (omitted)

    VPN-group-policy MD_IPSEC_Tun_Gp

    type of remote access service

    type tunnel-group MD_SSL_Profile remote access

    attributes global-tunnel-group MD_SSL_Profile

    Group Policy - by default-MD_SSL_Gp_Pol

    type tunnel-group MD_IPSEC_Tun_Gp remote access

    attributes global-tunnel-group MD_IPSEC_Tun_Gp

    address pool Remote_IPSEC_VPN_Pool

    Group Policy - by default-MD_IPSEC_Tun_Gp

    IPSec-attributes tunnel-group MD_IPSEC_Tun_Gp

    pre-shared key *.

    !

    !

    context of prompt hostname

    : end

    The following ACL and NAT exemption ACL split tunnel is incorrect:

    MD_IPSEC_Tun_Gp_splitTunnelAcl list standard access allowed host 10.120.110.0

    inside_nat0_outbound list extended access allowed host ip 10.120.110.0 192.168.199.0 255.255.255.192

    It should have been:

    Standard access list MD_IPSEC_Tun_Gp_splitTunnelAcl allow 10.120.110.0 255.255.255.0

    access extensive list ip 10.120.110.0 inside_nat0_outbound allow 255.255.255.0 192.168.199.0 255.255.255.192

    Then 'clear xlate' and reconnect with the VPN Client.

    Hope that helps.

  • Cisco asa 5505 and centos VPN server connection

    Hi all

    Please I want to set up a VPN between Cisco asa 5505 and centos server.

    Here's my senerio

    -------------------------

    ASA 5505

    Public IP 155.155.155.2

    Local NETWORK: 192.168.6.X

    CentOS Server

    ------------------

    Public ip address: 155.155.155.6

    Thank you guys

    Apology, do you mean access remote VPN Client of hundred BONE for Cisco ASA 5505?

    If the remote access, here are the sample configuration:

    http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008060f25c.shtml

  • Using Cisco VPN Client VPN

    Is it possible to use a private network virtual created with the WRVS4400N router with VPN Client from Cisco Systems (ver 5) software? (Although QuickVPN works very well.)

    Is it possible to use with Account customer VPN mode? Or is it possible to use with IPSec VPN (Tunnel) mode? If so, please provide together how to client-side and the router. Thank you!

    Unfortunately Small Business routers are not compatible with the Cisco VPN Clients. The Cisco VPN Clients have more parameters that are not available in the materials of the series of small businesses, so all we can use is the application of QVPN.

  • ASA 5510 &amp; Windows XP VPN Client

    I want to use the VPN in Windows XP client to connect to the ASA

    VPN access
    .  I read the document after document, and I just can't get to work.  It seems what Phase 1 but I can't get the Phase 2.  In the logs ASDM, it shows that I get some QM WSF Errorsand on the Windows XP computer, I get an error 789.  I put the pre-shared on the XP machine as a result and another j.4 measures.

    I am quite new to the method of L2TP VPN, I've always used Windows Server for the VPN and now I am to find out why.  In any case, I'm sure I'm missing some info that is needed to diagnose, but here's a copy of my config.

    I hope someone can point me in the right direction to understand this because I am pulling my hair out!

    Thanks in advance!

    This set of transformation is fixed for the transport mode but not used.

    Crypto ipsec transform-set esp-3des esp-sha-hmac TRANS_ESP_3DES_SHA ikev1
    transport mode encryption ipsec transform-set TRANS_ESP_3DES_SHA ikev1

    First, it must ensure that it is used in the list of games to turn in 'dynamic crypto-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 define ikev1 transform-set... ». L2TP/IPSec requires this mode.

    If it still fails, try to get him debugs following during the connection to your customer.

    Debug crypto isa 127

    Debug crypto ipsec

    Debug aaa 127 Commons

    SPSP

  • Itineraries other nets will be lost when using the vpn client?

    I have a very general question. I intend to implement a security solution for the extranet partners to connect to our intranet using VPN client. IPSec will close on the external interface of the Cisco PIX firewall v6.3.

    Now, my consirn is, I downloaded the vpn client to test but I saw no advance settings to define what network traffic will pass through the IPSec tunnel and which will be routed normally. Is it by default all traffic passing through VPN? Is that what it means if there are other networks using their default route, they will not be able to achieve? (i.e. the Internet).

    Thank you.

    That would depend on how you set up the PIX. You can allow the VPN to your site and access to the Internet at the same time. This is called the split tunneling. It is configurable on the PIX, not the customer.

    This link might help you get started, but I'm sure that there stronger links.

    http://www.Cisco.com/en/us/customer/products/sw/secursw/ps2120/products_command_reference_chapter09186a00800ec9ec.html

  • Cannot use Cisco vpn client

    Dear all,

    I have cisco vpn client v5.0.05.

    1 / when I lunch the customer, it connect to the asa, so I can't reach the network behind my ASA

    2 / when connected to the vpn client, I can not use my access to the internet, I configured splitunnel, but does not.

    3 / sometimes, cisco vpn client disable my network ip of the gateway card.

    Please, can someone help me?

    Concerning

    Can you please share the configuration of the SAA. There is no specific configuration that must be done on the vpn client.

  • configuration problem pix515 to access remote vpn using the vpn client

    Hello

    My chart is simple:

    a client pc with customer vpn cisco 3.X

    try to connect to a remote site via a pix 515E.

    What happened:

    the pc can connect, the pix give it an ip address, but no traffic not encrypted so no access to the remote network.

    My config is:

    ---------------------------------------

    START THE CONFIG

    --------------------------------------

    access-list 102 permit ip 192.168.80.0 255.255.255.0 10.10.10.0 255.255.255.0

    IP local pool clientpool 10.10.10.5 - 10.10.10.50

    NAT (inside) - 0 102 access list

    Permitted connection ipsec sysopt

    Crypto ipsec transform-set robust esp - esp-md5-hmac

    Crypto-map dynmap 10 transform-set robust Dynamics

    map mymap 10-isakmp ipsec crypto dynamic dynmap

    mymap outside crypto map interface

    ISAKMP allows outside

    ISAKMP identity address

    part of pre authentication ISAKMP policy 10

    encryption of ISAKMP policy 10

    ISAKMP policy 10 md5 hash

    10 2 ISAKMP policy group

    ISAKMP life duration strategy 10 86400

    vpngroup address clientpool pool vpn30002

    vpngroup password 123daniel456789 vpn30002

    vpngroup split tunnel 102 vpn30002

    -------------------------------------

    END CONFIG

    -------------------------------------

    Please help me!

    Concerning

    Can you upgrade to a new vpn client or try to disable the firewall in XP sp 2? I think the problem is that this old clients are not supported on xp sp2 or will have problems with the firewall in SP2. Try to run a higher customer or 4.0 x.

Maybe you are looking for