VOIP through ipsec

Similar Questions

• Intercept-dhcp works to tunnel L2TP through IPsec ASA?

  Hello

  Is there anyone in the world operating a tunnel L2TP through IPsec on Cisco ASA for the native Windows clients and a Tunnel Split Configuration fully functional?

  I created a tunnel L2TP through IPsec on the ASA 5520 9.1 (6) Version of the software running. My configuration is:

  mask 172.23.32.1 - 172.23.33.255 255.255.252.0 IP local pool VPN_Users

  ROUTING_SPLIT list standard access allowed 192.168.0.0 255.255.0.0
  ROUTING_SPLIT list standard access allowed 172.16.0.0 255.248.0.0

  Crypto ipsec transform-set esp-aes-256 WIN10, esp-sha-hmac ikev1
  transport mode encryption ipsec transform-set WIN10 ikev1
  Crypto ipsec transform-set esp-3des esp-sha-hmac WIN7 ikev1
  Crypto ipsec transform-set transport WIN7 using ikev1
  Dynamic crypto map DYNMAP 10 set transform-set WIN10 WIN7 ikev1
  Crypto dynamic-map DYNMAP 10 the value reverse-road
  card crypto CMAP 99-isakmp dynamic ipsec DYNMAP
  CMAP interface ipsec crypto map

  Crypto isakmp nat-traversal 29
  crypto ISAKMP disconnect - notify
  Ikev1 enable ipsec crypto
  IKEv1 crypto policy 10
  preshared authentication
  aes-256 encryption
  sha hash
  Group 2
  life 86400
  output
  IKEv1 crypto policy 20
  preshared authentication
  3des encryption
  sha hash
  Group 2
  life 86400
  output

  internal EIK_USERS_RA group policy
  EIK_USERS_RA group policy attributes
  value of 12.34.56.7 DNS Server 12.34.56.8
  VPN - connections 2
  L2TP ipsec VPN-tunnel-Protocol ikev1
  disable the password-storage
  enable IP-comp
  enable PFS
  Split-tunnel-policy tunnelspecified
  value of Split-tunnel-network-list ROUTING_SPLIT
  ad.NYME.Hu value by default-field
  Intercept-dhcp enable
  the authentication of the user activation
  the address value VPN_Users pools
  output

  attributes global-tunnel-group DefaultRAGroup
  authentication-server-group challenger
  accounting-server-group challenger
  Group Policy - by default-EIK_USERS_RA
  IPSec-attributes tunnel-group DefaultRAGroup
  IKEv1 pre-shared-key *.
  tunnel-group DefaultRAGroup ppp-attributes
  No chap authentication
  no authentication ms-chap-v1
  ms-chap-v2 authentication
  output

  Now, the native Windows clients can connect using this group of tunnel:

  our - asa # show remote vpn-sessiondb

  Session type: IKEv1 IPsec

  User name: w10vpn Index: 1
  Assigned IP: 172.23.32.2 public IP address: 12.34.56.9
  Protocol: IKEv1 IPsecOverNatT L2TPOverIPsecOverNatT
  License: Another VPN
  Encryption: IKEv1: (1) 3DES IPsecOverNatT: (1) L2TPOverIPsecOverNatT AES256: (1) no
  Hash: IKEv1: (1) IPsecOverNatT SHA1: (1) L2TPOverIPsecOverNatT SHA1: (1) no
  TX Bytes: 1233 bytes Rx: 10698
  Group Policy: Group EIK_USERS_RA Tunnel: DefaultRAGroup
  Connect time: 15:12:29 UTC Friday, April 8, 2016
  Duration: 0: 00: 01:00
  Inactivity: 0 h: 00 m: 00s
  Result of the NAC: unknown
  Map VLANS: VLAN n/a: no

  However, real communication takes place above the tunnel if I 'Gateway on remote network use default'. If I disable this option among the preferences of the IPv4 of the virtual interface of VPN in Control Panel as described in the section 'Configuration of Tunnel of Split' of This DOCUMENT then Windows sends all packets through the channel, because it fails to extract from the ASA routing table. Split routing works perfectly when using legacy Cisco VPN Client with the same group policy, but does not work with L2TP over IPsec.

  As far as I can see, the 'intercept-dhcp' option is inefficient somehow. I even managed to intercept packets of the PPP virtual machine Windows XP interface, and I saw that windows sends its DHCP INFORM requests, but the ASA does not. My question is why?

  -J' made a mistake in the above configuration?

  -Can there be one option somewhere else in my config running that defuses intercept-dhcp?

  - Or is there a software bug in my version of firmware ASA? (BTW, I tried with several versions of different software without success?

  Hi, I have the same problem you have, but I was lucky enough to be able to install version 9.2 (4) on which this feature works very well. I'm suspecting that it is a bug, but I need to dig a little deeper. If I find something interesting I'll share it here.

• Pass through IPSEC on Cisco 857

  Hello people!

  I have gained reciently a Cisco 857 router. I want to do a site-to-site VPN.

  I set up the ATM0.1 with "ip unnumbered" VLAN 1 interface. I have not configured the router to enable NAT or PAT. VLAN 1 is configured with a public Ip of my ISP address. Behind the cisco router, I have a Zywall 5, this device is my VPN gateway. Initially, it works very well with the other soho router but it blocks often, for this reason, I decided to change it for a cisco router.

  My problem now is that the cisco router does not allow the implementation of VPN.

  Need to activate the IPSEC pass-through?, how can I do this?

  Thanks in advance!

  If you connect through the console:

  recording console 7

  If you connect via telnet:

  farm forestry monitor 7

  monitor terminal

  Concerning

  Farrukh

• Failover of VPN for data/VoIP through ASA 5520 or 7204 VXR

  I would like to install a VPN failover for my remote sites using broadband 3dn/1up.  They are mainly 2800 routers.    I like options for end hub a pair of Cisco ASA active / standby and a 7204 VXR.  Voice and data will travel down the VPN failover and I intend to have QOS/Traffic shaping in place to better meet the needs for VoIP as possible.  I need to do it on about 150 sites. My questions are:

  1. What is the best why the ASA or the 7204

  2 Will VoIP packets pass through the two in the same way

  3 as far as redistributing routes can I use GRE on an ASA or should I keep all static. NH on the SAA is an L3 switch.

  4. an ASA with 100 mg of bandwithd through metro E supports 150 tunnels making VoIP and data. 1 to 3 calls per site max.

  Thank you

  J R

  To answer your questions: -.

  1. who is better for this, the ASA or the 7204 - ASA, is what is designed to do.

  2 packages VoIP Will cross both the same way - Yes

  3 as far as redistributing routes can I use GRE on an ASA or should I keep all static. NH on the SAA is an L3 switch. -l'ASA does not support GRE tunnels.

  4. an ASA with 100 mg of bandwithd through metro E supports 150 tunnels making VoIP and data. 1 to 3 calls per site max. -It depends on the model of the SAA, see the below matrix for thru-put http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html

  HTH >

• external access through ipsec site-to-site tunnel

  Hi all

  I configured n/b site VPN ipsec Cisco ASA5510 router (site1) and router sonicwall (site2).  I can access two LAN subnets.

  But what I need is, routing traffic from site2 to a public ip specific to ipsec tunnel and then to internet through router cisco.

  I updated the IPSec in sonicwall, so that traffic to this ip address will be routed to ipsec and all other traffic will go through the default gateway (sonicwall).

  Then, I watched the packets on ASA5510 router Cisco ASDM and found that the packets intended for that particular ip address reached router cisco.

  But still I can't access that intellectual property of site2. I think there must be some rules to allow that IP. And also I do not know it is possible to

  access to the internet through the ipsec tunnel. ? I searched a lot and could not find useful advice. And I don't want all internet traffic to ipsec.

  Thank you

  Hans

  It is what some similar to the only difference in the example below, it is the clients vpn access must be provided for users, but in your EAC, internet access is for some ip of an asite at the tunnel site

  you will be interested in cross section

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a00805734ae.shtml

  to give a brief idea

  NAT (outside) 1

  Global 1 interface (outside)

  permit same-security-traffic intra interface

• AnyConnect SSL VPN through IPSEC Tunnel

  Everyone was able to set up and connect using Cisco anyconnect vpn ssl on a Cisco IPSEC's tunnel. I used this in the past from a Windows XP system in the past but its not working now. None of my users are able to cooect using the Anyconnect on IPSEC. IPSEC on its own works very well.

  The Anyconnect is also able to create the connection to its ASA firewall however its not able to route all traffic through. Do you have any suggestions?

  Thanks for the update.

• I can't do FTP through IPsec Tunnel

  users at the branch office (perth) cannot do FTP to a server on the internet. We simply want to change on NAT/rules to get there.

  We have head office is in Sydney that this router's IPsec VPN to other areas including Melbourne, Perth,...

  we want just difficulty centimeters FTP for users of Perth not on all the other branches.

  All things are IPsec router to router. routers to perth and sydney, I ping address FTP (203.171.5.4) but from a client in perth, I can't ping or telnet to this IP address.

  I downloaded routers routers from sydney and perth configs.

  Please ask me for more picture of the environment.

  Thanks in advance,

  Reza

  Reza,

  Is because we are dealing with two different concepts of the ACL here.
  160 ACL is applied to an interface (path to Ethernet0), so this ACL is permit/deny traffic).
  The 150 ACL is applied to a NAT rule (you cannot delete it because you will lose Internet).

  I asked remove ACL filtering which is only 160.

  The test I was asking was to remove the 160 ACL or add a line like this:
  access ip-list 160 allow a whole
  And check if everything works.

  Federico.

• Unable to Ping hosts through IPSec Tunnel

  I have a configuration of lab home with a PIX 515 running code 8.03.  I've made several changes over the last week and now when I finish a VPN connection to the external interface, I'm unable to hit all internal resources.  My VPN connection comes from a 10.22.254.0/24 trying to knock the internal nodes to 10.22.1.0/24, see below.  When I finish a VPN connection with the inside interface works, so I guess that I'm dealing with a NAT problem?   I have not idea why Phase 9 is a failure:-------.  Any help would be great!

  -------

  IP 10.22.254.0 allow Access-list extended sheep 255.255.255.0 10.22.1.0 255.255.255.0

  NAT (inside) 0 access-list sheep

  -------

  Global 1 interface (outside)

  -------

  access-list extended split allow ip 10.22.1.0 255.255.255.0 10.22.254.0 255.255.255.0

  -------

  Packet-trace entry inside tcp 10.22.1.15 1025 10.22.254.15 3389 detailed

  Phase: 1

  Type: FLOW-SEARCH

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Not found no corresponding stream, creating a new stream

  Phase: 2

  Type:-ROUTE SEARCH

  Subtype: entry

  Result: ALLOW

  Config:

  Additional information:

  in 0.0.0.0 0.0.0.0 outdoors

  Phase: 3

  Type: IP-OPTIONS

  Subtype:

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0x2bb3450, priority = 0, sector = option-ip-enabled, deny = true

  hits = 17005, user_data = 0 x 0, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  Phase: 4

  Type: VPN

  Subtype: ipsec-tunnel-flow

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0x304ae48, priority = 12, area = ipsec-tunnel-flow, deny = true

  hits = 17005, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  Phase: 5

  Type: NAT-FREE

  Subtype:

  Result: ALLOW

  Config:

  NAT (inside) 0 access-list sheep

  NAT-control

  is the intellectual property inside 10.22.1.0 outside 10.22.254.0 255.255.255.0 255.255.255.0

  Exempt from NAT

  translate_hits = 6, untranslate_hits = 5

  Additional information:

  Direct flow from returns search rule:

  ID = 0x2be2a00, priority = 6, free = area of nat, deny = false

  Hits = 5, user_data is 0x2be2960, cs_id = 0 x 0, use_real_addr, flags = 0 x 0 = 0 protocol

  SRC ip = 10.22.1.0, mask is 255.255.255.0, port = 0

  DST ip = 10.22.254.0, mask is 255.255.255.0, port = 0

  Phase: 6

  Type: NAT

  Subtype: host-limits

  Result: ALLOW

  Config:

  static (inside, DMZ) 10.22.1.0 10.22.1.0 netmask 255.255.255.0

  NAT-control

  is the intellectual property inside 10.22.1.0 255.255.255.0 DMZ all

  static translation at 10.22.1.0

  translate_hits = 10, untranslate_hits = 0

  Additional information:

  Direct flow from returns search rule:

  ID = 0x2d52800, priority = 5, area = host, deny = false

  hits = 21654, user_data = 0x2d51dc8, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  SRC ip = 10.22.1.0, mask is 255.255.255.0, port = 0

  DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  Phase: 7

  Type: NAT

  Subtype:

  Result: ALLOW

  Config:

  NAT (inside) 1 0.0.0.0 0.0.0.0

  NAT-control

  is the intellectual property inside everything outside of any

  dynamic translation of hen 1 (192.168.20.20 [Interface PAT])

  translate_hits = 2909, untranslate_hits = 9

  Additional information:

  Direct flow from returns search rule:

  ID = 0x2d4a7d0, priority = 1, sector = nat, deny = false

  hits = 16973, user_data = 0x2d4a730, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  Phase: 8

  Type: VPN

  Subtype: encrypt

  Result: ALLOW

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0 x 3328000, priority = 70, domain = encrypt, deny = false

  hits = 0, user_data is 0x1efa0cc, cs_id = 0 x 0, reverse, flags = 0 x 0 = 0 protocol

  SRC ip = 10.22.1.0, mask is 255.255.255.0, port = 0

  DST ip = 10.0.0.0, mask is 255.0.0.0, port = 0

  Phase: 9

  Type: ACCESS-LIST

  Subtype: ipsec-user

  Result: DECLINE

  Config:

  Additional information:

  Direct flow from returns search rule:

  ID = 0x3329a48, priority = 69, domain = ipsec - user, deny = true

  Hits = 37, user_data = 0 x 0, cs_id = 0 x 0, flags = 0 x 0 = 0 protocol

  SRC ip = 0.0.0.0 mask 0.0.0.0, port = 0 =

  DST ip = 10.0.0.0, mask is 255.0.0.0, port = 0

  Result:

  input interface: inside

  entry status: to the top

  entry-line-status: to the top

  output interface: outside

  the status of the output: to the top

  output-line-status: to the top

  Action: drop

  Drop-reason: flow (acl-drop) is denied by the configured rule

  No, the sheep ACL requires that defining the internal network traffic to the

  Pool VPN.  You must remove the other entries.

  Delete:

  allowed to Access-list sheep line 8 extended ip 10.22.254.0 255.255.255.0 DM_INLINE_NETWORK_18 object-group
  allowed to Access-list sheep line 8 extended ip 10.22.254.0 255.255.255.0 10.22.1.0 255.255.255.0

• explanation of IPSec gre tunnel

  I've been doing some tests with love tunnels and adding encryption ipsec for them so I can route my phones voip through the tunnels.  I found something interesting and looking for an explanation as to why this is.

  I have 3 sites which one is considered to be the Center and two other sites considered sticks.  I create the following configurations on all three routers:

  crypto ISAKMP policy 5

  aes 128 encryption

  preshared authentication

  Group 2

  key encryption isakmp XXXX address 0.0.0.0 0.0.0.0

  Crypto ipsec transform-set strong esp - aes esp-sha-hmac

  Crypto ipsec profile support

  define the transform-set

  then, under the tunnel interface, I apply the following command:

  protection profile medium ipsec tunnel

  With this config the first tunnel between the hub and the spokes 1 arrives without problems, but the router speaks 2 will never establish a tunnel.

  What I discovered is if I change this command on all three routers all tunnels are up and everything works but why?

  key encryption isakmp XXXX address 0.0.0.0 0.0.0.0 no.-xauth

  Why adding the xauth No. allows all tunnels to establish connectivity?

  What exactly does the n °-xauth didn't and adding it a risk to safety?

  Thanks for any input.

  Hello

  The keyword "no x-auth" says the router not try extended authentication for VPN tunnels.

  Scope of authentication (username and password) is used only when you connect the VPN clients. If you have VPN clients and dynamic keys configured on the router you need to add the keyword "no x-auth" at the end of these lines so that it does not seek to authenticate the routers using a user/pass combination.

  The key word is there for this reason specific, and you do not add a security risk by adding it.

  HTH.

  Raga

• IPSEC & PAT

  Hello

  I have a small request... I have 2 sites on which I have the same LAN network 192.168.0.0/24, who needs to talk to each other through IPSEC. I have a pix of cisco at one end & devices other than cisco vpn to another...

  Server - noncisco - users (192.168.0.0) pix 192.168.0.x

  now... in order for these computers to access the server, I have to do a translation at the remote end. Can I do a PAT and translate all users to a single IP address and use this IP address as a source of valuable traffic? PAT & IPSEC will work fine together?

  Yes, IPSec and nat/pat will work together. You can use the nat/pat address as traffic interesting in card crypto as treatment crypto will take place after the transformation of nat/pat.

  Let me know if you need more information.

• Implementation of VLAN and QoS for VOIP on SG200-18

  We recently purchased the smart switch SG200-18 to replace a Netgear switch. We are moving our phone service to VOIP through our local ISP as well.

  I currently have the VOIP phone plugged into Port 17 on SG200-18 (it is a Grandstream Cordless VOIP phone).

  I want to put the VOIP phone on one VLAN separate from the rest of the network and optimize QoS parameters so that the VOIP phone has exceptional audio quality even during network traffic.

  Here are my questions:

  1. do I need to set anything on the type of port to Port 17 (because it resembles a shape any Combo port)?

  2. How can I do to isolate VOIP telephone it's own VLAN (I see the parameters VLANS and VLAN voice, not sure that one to use;) I've tried to set a VLAN and broke the Internet connectivity on the phone until I went and removed)?

  3. do I need to adjust the QoS settings to switch to better optimize the VOIP phone?

  Some additional questions about the GS200-18 in general:

  1. do I need to adjust the parameters of the system on the switch time? I am in the Central time.

  2. do I need to adjust the Green Ethernet/Energy Saving parameters or should I stay with the default settings?

  In addition, a couple of "getting started" questions for Cisco:

  1. I registered an account My Cisco. What should I do to register my switch with Cisco and associate with my My Cisco account?

  2. What are the benefits of purchasing a contract of Cisco Small Business support, and how much would it cost the SG200-18 (I ordered it from Provantage)? I'm curious to see if it's worth the money.

  Here's my 'features ':

  Switch: SG200-18

  VOIP phone: Grandstream DP715 and 710 handsets

  Plugged in: Port 17 on SG200-18

  Services: Internet Local (Direclynx)

  Type of connection: 3 m down / 500 k up DSL move to a future wireless connection that will give us higher speeds

  Backend VOIP provider: VOIP Innovations

  Router: Apple Airport Extreme AC model (all Macs and iOS devices and the OS X Server on the network, so I use the Apple router facilitates installation, because is not QoS, trying to QoS and VLAN in the switch)

  Thank you all!

  Hello

  I'll just go to the list again:

  1. sounds good in the port from the drop-down list. So can I just connect the VOIP phone and go with it, correct?

  Yes, just plug in ethernet combo port and it will work.

  2. is not an issue, but I agree, Apple likely isn't compatible QoS or VLAN.

  3. thanks for the info on time/NTP settings. If I wanted to go there and try to configure NTP, how much is it and what I have to do? I want to I can give it a quick try.

  To Setup NTP on the switch is quite simple.  Go to Administration > Time Settings > time system and check the boxes to activate the main clock Source (SNTP)

  Then go to the settings of the SNTP page and add a new entry with the IP address of an NTP server.  There is a list of available NTP servers here:

  http://www.pool.ntp.org/en/

  You must also ensure that the switches Administrative default gateway is set correctly (it must be set the to the default gateway, probably the most convenient airport) so the switch can contact the NTP server.  That option is set under Administration > Interface Management > Interface IPv4.  Change the user-defined default gateway and enter the IP address of your airport (or whatever your default gateway for your network)

  4 sounds good on the Green Ethernet settings. I'll leave it as default value.

  Yes, better to just let those unless you have weird problems with ports disconnect, who can sometimes be caused by Green Ethernet, but if there's nothing like leave it on and save a few watts.

  5 sounds good on does not need to attach my passage to my Cisco account. Should I fill out a form any registration of the product with Cisco before calling support?

  It is not a record for support.  The only thing we need you to do is to create a Cisco account, but you have already done this, so if/when you call in support, you just need your ID for Cisco (also called a CCOID sometimes) and the serial number of your switch.

  6. thanks for the info on the Service contract. Is it something that I would need to order directly from Cisco or I who would get my Cisco partner (Provantage)? After the three years is up, treat yourself to renewal or it just falls? Is there a certain amount of time I have to buy the Service Contract forward make me ineligible?

  Support contracts are purchased through a partner Cisco, or you can get them online for the CDW or Newegg for example.  Basically, you have until the expiry of your current aid for the purchase of a new contract.  For example, right now your switch comes with 1 year of technical support.  You can only buy a contract while it is still active.  Once your three-year contract is about to run out, you're in the same situation.  You can renew it before it expires, however if you leave is up, you will not be able to put a contract on it.  Contracts are not my specialty, however, so you can check with your partner for complete details.

  7. sounds good to how data use VOIP calls. His dislikes too. :-)

  I agree, a voice call is not much traffic.  What you have described you probably don't have problems, although of course I can't guarantee that.

  8. because it is from your provider and they specifically mentioned the VOIP, I would say that you'll be fine here.

  You had also placed on your airport using access point behind a router in small businesses.  I would like to say that it is possible, a large number of wireless routers have an option to put access point only mode or something like that, but you should check with Apple on how to do it.

  Insofar as a Small Business router if you decide to upgrade for the options VLAN or QoS, I would recommend the RV180, or perhaps the RV320.  Two of these models are available with or without wire depending on what you decide to do with the airport.

  I think I got all the questions, but if not just let me know,

  Christopher Ebert - Network Support Engineer

  Cisco Small Business Support Center

  * Please note the useful messages *.

• access list for traffic crossing and IPSEC

  Hi, just a question fast and easy if everything goes well as im on thinking that he. IM on the establishment of the IPSEC between a Cisco router to another Cisco router. I want to only allow RDP through IPSEC.

  I of course implement the ACL for the SHEEP, but I'll have to implement another ACL application outside? interface allowing a specific RDP server and denying everything.

  Thank you

  David

  I have extracted this router to work. I changed some details to conceal the source, but it should illustrate what you need to do.

  !
  crypto ISAKMP policy 1
  BA aes 256
  preshared authentication
  Group 2
  address of examplekey key crypto isakmp 2.3.4.5
  !
  !
  Crypto ipsec transform-set esp - aes 256 esp-sha-hmac AES256SHA
  tunnel mode
  !
  cust_map 10 ipsec-isakmp crypto map
  defined peer 2.3.4.5
  game of transformation-AES256SHA
  match the address crypto_acl
  !
  interface GigabitEthernet8
  cust_map card crypto
  !
  crypto_acl extended IP access list
  host ip 192.168.25.52 permit 172.24.0.0 0.0.7.255
  !

  HTH

  Rick

• Microsoft l2tp IPSec VPN site to site ASA on top

  I have a specialized applications casino that requires end-to-end encryption. I'm under the stack of Microsoft IPSec l2tp between my XP machine and my Windows 2003 server on the LAN. Can I use the same type of protocol stack Microsoft l2tp IPSec between my XP machine and the Windows Server 2003 a branch on the SAA to site to site ASA VPN tunnel? The VPN site-to site ASA is a type of key Preshare IPSec VPN tunnelle traffic between our head office and a branch in distance.

  In other words, the ASA site-to-site IPSec VPN will allow Microsoft l2tp through IPSec encrypted traffic? My ACL tunnel would allow full IP access between site. Something like:

  name 192.168.100.0 TexasSubnet

  name 192.168.200.0 RenoSubnet

  IP TexasSubnet 255.255.255.0 RenoSubnet 255.255.255.0 allow Access-list extended nat_zero

  Hello

  Yes, the L2TP can be encapsulated in IPSEC as all other traffic.

  However, make sure that no NAT is performed on each end. L2TP is a default header protection which will see NAT as a falsification of package and reject it.

  See you soon,.

  Daniel

• OSPF on IPSEC?

  Hi guys,.

  Can I run ospf based IPSEC? (No WILL).

  Marco,

  Not really a bug in the right direction, paste the description.

  He explains what you see and why people in the past have seen a different behavior. :-)

  M.

  
      CSCtq94342 - Self originated, multicast traffic handling through IPsec tunnel
  
  
      
  This is a documentation bug only.
  
      Symptom:
  
      A note needs to be added into configuration guide to specify that:
  
      As of release 12.4(9)T multicast traffic originated from the box will be encapsulated into IPsec if proxy identities allow this.
  
      Further description
  
      A typical use case for this is when router is sourcing OSPF packets and traffic selectors for IPsec allows OSPF packets (protocol number 89, group 224.0.0.5 & 224.0.0.6).
  
      As of release 12.4(9)T those packets will be put into the tunnel and encrypted.
  
      At the same time, please be aware that using "any any" as your proxy identities is HIGHLY discouraged.
  
      "any any" proxy identities can be achieved in case of using VTI configuration which is recommended if those proxy identities are desired. 
  		   

• Unable to connect to the Cisco VPN you use native client: El Capitan

  I'm unable to connect to the Cisco VPN using native client server Cisco OSX via IPSec. Before the upgrade for connections VPN El Capitan has worked without any problems. VPN uses the shared secret of group. It seems, I get the error "raccoon [2580] ': could not send message vpn_control: Broken pipe ' during the connection."

  When I upgraded to El Capitan, VPN connection has stopped working. I tried to do the following:

  * connect using the old work VPN connection: without success

  Config: Hand [server address, account name],

  AUTH settings [shared secret, the Group name].

  Advanced [mode to use the passive FTP = TRUE]

  errors:

  "authd [124]: copy_rights: _server_authorize failed.

  "raccoon [2580]: could not send message vpn_control: Broken pipe"

  ...

  * Add new VPN connection using L2TP over IPSec: without success

  Config: Hand [server address, account name],

  Authentication settings [user authentication: password, identification of the Machine: Shared Secret].

  Advanced [send all traffic on the VPN = TRUE]

  errsors:

  "pppd [2616]: password not found in the system keychain.

  "authd [124]: copy_rights: _server_authorize failed.

  ...

  
  

  * Add new connection using Cisco via IPSec VPN: without success

  Main config: [server address, account name].

  AUTH settings [shared secret, the Group name].

  Advanced [mode to use the passive FTP = TRUE]

  errors:

  "authd [124]: copy_rights: _server_authorize failed.

  "raccoon [2580]: could not send message vpn_control: Broken pipe"

  VPN server is high and does not work and accepts connections, this problem is entirely on the client side.

  I. Journal of Console app existing/Legacy VPN connection:

  26/03/16 10:24:01, 000 syslogd [40]: sender ASL statistics

  26/03/16 10:24:01, nesessionmanager 311 [2112]: NESMLegacySession [VPN_CONN_NAME$: B7816CCC-2D2C-4D6D - 83 D 9-B2C8B6EB8589]: received an order to start SystemUIServer [2346]

  26/03/16 10:24:01, nesessionmanager 311 [2112]: NESMLegacySession [VPN_CONN_NAME$: B7816CCC-2D2C-4D6D - 83 D 9-B2C8B6EB8589]: changed to connecting status

  26/03/16 10:24:01, nesessionmanager 313 [2112]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:24:01, 316 nesessionmanager [2112]: phase 1 of the IPSec from.

  26/03/16 10:24:01, racoon 338 [2580]: agreed to the takeover of vpn connection.

  26/03/16 10:24:01, racoon 338 [2580]: agreed to the takeover of vpn connection.

  26/03/16 10:24:01, racoon 339 [2580]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 339 [2580]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 339 [2580]: connection.

  26/03/16 10:24:01, racoon 339 [2580]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:24:01, racoon 339 [2580]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:24:01, racoon 349 [2580]: IKE Packet: forward the success. (Initiator, Aggressive Mode 1 message).

  26/03/16 10:24:01, racoon 350 [2580]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:24:01, racoon 350 [2580]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:24:01, racoon 381 [2580]: no message must be encrypted, 0x14a1, side 0 status

  26/03/16 10:24:01, racoon 381 [2580]: no message must be encrypted, 0x14a1, side 0 status

  26/03/16 10:24:01, 381 nesessionmanager [2112]: Controller IPSec: IKE FAILED. phase 2, assert 0

  26/03/16 10:24:01, 381 nesessionmanager [2112]: Controller IPSec: retry the aggressive mode IPSec with DH group 2

  26/03/16 10:24:01, nesessionmanager 404 [2112]: phase 1 of the IPSec from.

  26/03/16 10:24:01, racoon 404 [2580]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 404 [2580]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 405 [2580]: connection.

  26/03/16 10:24:01, racoon 405 [2580]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:24:01, racoon 405 [2580]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:24:01, 407 raccoon [2580]: IKE Packet: forward the success. (Initiator, Aggressive Mode 1 message).

  26/03/16 10:24:01, 407 raccoon [2580]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:24:01, 407 raccoon [2580]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:24:01, racoon 436 [2580]: port 62465 anticipated, but 0

  26/03/16 10:24:01, racoon 436 [2580]: port 62465 anticipated, but 0

  26/03/16 10:24:01, 463 raccoon [2580]: IKEv1 Phase 1 AUTH: success. (Initiator, aggressive-Mode Message 2).

  26/03/16 10:24:01, 463 raccoon [2580]: > > > > > status of phase change = Phase 1 began with a peer

  26/03/16 10:24:01, 463 raccoon [2580]: > > > > > status of phase change = Phase 1 began with a peer

  26/03/16 10:24:01, 463 raccoon [2580]: IKE Packet: receive a success. (Initiator, Aggressive Mode 2 message).

  26/03/16 10:24:01, 463 raccoon [2580]: initiating IKEv1 Phase 1: success. (Initiator, aggressive Mode).

  26/03/16 10:24:01, 463 raccoon [2580]: IKE Packet: forward the success. (Initiator, Aggressive Mode 3 message).

  26/03/16 10:24:01, 463 raccoon [2580]: IPSec Phase 1 established (initiated by me).

  26/03/16 10:24:01, 463 raccoon [2580]: IPSec Phase 1 established (initiated by me).

  26/03/16 10:24:01, 484 raccoon [2580]: IPSec Extended requested authentication.

  26/03/16 10:24:01, 484 raccoon [2580]: IPSec Extended requested authentication.

  26/03/16 10:24:01, nesessionmanager 485 [2112]: IPSec asking extended authentication.

  [26/03/16 10:24:01, 494 nesessionmanager [2112]: NESMLegacySession[$VPN-CONN-NAME:B7816CCC-2D2C-4D6D-83D9-B2C8B6EB8589]: status changed by disconnecting

  26/03/16 10:24:01, 495 nesessionmanager [2112]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 495 [2580]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 495 [2580]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 495 [2580]: IKE Packet: forward the success. (Information message).

  26/03/16 10:24:01, racoon 495 [2580]: IKEv1-Information Notice: pass success. (Delete the ISAKMP Security Association).

  26/03/16 10:24:01, racoon 495 [2580]: could not send message vpn_control: Broken pipe

  26/03/16 10:24:01, racoon 495 [2580]: could not send message vpn_control: Broken pipe

  [26/03/16 10:24:01, 496 nesessionmanager [2112]: NESMLegacySession[$VPN-CONN-NAME:B7816CCC-2D2C-4D6D-83D9-B2C8B6EB8589]: status changed to offline, last stop reason no

  26/03/16 10:24:01, racoon 496 [2580]: glob found no match for the path "/ var/run/racoon/*.conf".

  26/03/16 10:24:01, racoon 496 [2580]: glob found no match for the path "/ var/run/racoon/*.conf".

  26/03/16 10:24:01, racoon 496 [2580]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:24:01, racoon 496 [2580]: IPSec disconnection from the server $VPN_SERVER_IP

  $VPN_SERVER_IP

  II. new VPN connection using L2TP over IPSec Console app log:

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextSetFillColorWithColor: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextSetStrokeColorWithColor: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextGetCompositeOperation: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextSetCompositeOperation: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextFillRects: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextSetCompositeOperation: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextClipToRect: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextGetShouldSmoothFonts: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextGetFontSmoothingStyle: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 293 com.apple.preference.network.remoteservice [2539]: CGContextGetFontAntialiasingStyle: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextSetFontSmoothingStyle: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextGetCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextGetDefaultUserSpaceToDeviceSpaceTransform: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextSaveGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextConcatCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextSaveGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextDrawImages: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextRestoreGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextRestoreGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextGetCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextGetShouldSmoothFonts: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextGetFontSmoothingStyle: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextSetFontSmoothingStyle: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, 294 com.apple.preference.network.remoteservice [2539]: CGContextSetFontSmoothingStyle: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextGetCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextGetDefaultUserSpaceToDeviceSpaceTransform: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextSaveGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, com.apple.preference.network.remoteservice [2539 295]: CGContextConcatCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextSaveGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextDrawImages: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextRestoreGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextRestoreGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextGetCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextGetCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextGetDefaultUserSpaceToDeviceSpaceTransform: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextSaveGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, com.apple.preference.network.remoteservice [2539 295]: CGContextConcatCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextSaveGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextDrawImages: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextRestoreGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextRestoreGState: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:26, [2539 295] com.apple.preference.network.remoteservice: CGContextGetCTM: context invalid 0x0. If you want to see the trail, please set CG_CONTEXT_SHOW_BACKTRACE environment variable.

  26/03/16 10:37:28, [2539 339] com.apple.preference.network.remoteservice: error in CoreDragRemoveTrackingHandler:-1856

  26/03/16 10:37:28, [2539 339] com.apple.preference.network.remoteservice: error in CoreDragRemoveReceiveHandler:-1856

  26/03/16 10:37:28, com.apple.xpc.launchd [1 393]: (com.apple.SystemUIServer.agent [2346]) Service was released due to the signal: Broken pipe: 13

  26/03/16 10:37:28, Spotlight 461 [459]: spot: logging agent

  26/03/16 10:37:28, [2539 487] com.apple.preference.network.remoteservice: service - area of the one error ERROR = NEConfigurationErrorDomain Code = 9 "configuration is unchanged" UserInfo = {NSLocalizedDescription = configuration is unchanged}

  26/03/16 10:37:28, [2539 487] com.apple.preference.network.remoteservice: service - area of the one error ERROR = NEConfigurationErrorDomain Code = 9 "configuration is unchanged" UserInfo = {NSLocalizedDescription = configuration is unchanged}

  26/03/16 10:37:28, nesessionmanager 519 [2112]: NESMLegacySession [VPN_CONN_NAME$: 04c 10954-16 b 2 - 40BB - B3F1 - 9288F968029E]: received an order to start com.apple.preference.network.re [2539]

  26/03/16 10:37:28, nesessionmanager 519 [2112]: NESMLegacySession [VPN_CONN_NAME$: 04c 10954-16 b 2 - 40BB - B3F1 - 9288F968029E]: changed to connecting status

  26/03/16 10:37:28, com.apple.SecurityServer [75 536]: rules of problem opening the file "/ etc/authorization ': no such file or directory

  26/03/16 10:37:28, com.apple.SecurityServer [75 536]: sandbox has denied authorizing the right "system.keychain.modify" customer "/ usr/libexec/nehelper" [184]

  26/03/16 10:37:28, 536 pppd [2616]: NetworkExtension is the controller

  26/03/16 10:37:28, 538 pppd [2616]: NetworkExtension is the controller

  26/03/16 10:37:28, nehelper 540 [184]: 10954-16 b 2 - 40BB - B3F1 04c - 9288F968029E: cannot copy content, returned SecKeychainItemCopyContent user interaction is not allowed.

  26/03/16 10:37:28, nehelper 540 [184]: 10954-16 b 2 - 40BB - B3F1 04c - 9288F968029E: SecKeychainItemFreeContent returned the user interaction is not allowed.

  26/03/16 10:37:28, 570 pppd [2616]: password not found in the system keychain

  26/03/16 10:37:28, 572 pppd [2616]: publish_entry SCDSet() failed: success!

  26/03/16 10:37:28, 573 pppd [2616]: publish_entry SCDSet() failed: success!

  26/03/16 10:37:28, 573 pppd [2616]: pppd 2.4.2 (Apple version 809.40.5) started by $VPN_SERVER_USER, uid 501

  26/03/16 10:37:28, SystemUIServer 620 [2615]: [BluetoothHIDDeviceController] EventServiceConnectedCallback

  26/03/16 10:37:28, SystemUIServer 620 [2615]: [BluetoothHIDDeviceController] EventServiceDisconnectedCallback

  26/03/16 10:37:28, authd 720 [124]: copy_rights: _server_authorize failed

  26/03/16 10:37:28, sandboxd 748 [120]: nehelper (184) ([184]) refuse the authorization-right-get system.keychain.modify

  III. New connection of Cisco VPN through IPSec Console app log:

  26/03/16 10:18:26, 917 WindowServer [172]: _CGXRemoveWindowFromWindowMovementGroup: 0x10d of window is not attached to the window 0x10f

  26/03/16 10:19:43, 975 WindowServer [172]: _CGXRemoveWindowFromWindowMovementGroup: 0x10d of window is not attached to the window 0x10f

  [26/03/16 10:19:56 nesessionmanager 265 [2112]: NESMLegacySession[$VPN-CONN-NAME:72874CC0-2A89-4B61-80F1-9BB4F3EA953B]: received an order to start SystemUIServer [2346]

  [26/03/16 10:19:56 nesessionmanager 265 [2112]: NESMLegacySession[$VPN-CONN-NAME:72874CC0-2A89-4B61-80F1-9BB4F3EA953B]: changed to connecting status

  26/03/16 10:19:56, nesessionmanager 267 [2112]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:19:56, nesessionmanager 270 [2112]: phase 1 of the IPSec from.

  26/03/16 10:19:56, authd 284 [124]: copy_rights: _server_authorize failed

  26/03/16 10:19:56, 295 raccoon [2576]: agreed to the takeover of vpn connection.

  26/03/16 10:19:56, 295 raccoon [2576]: agreed to the takeover of vpn connection.

  26/03/16 10:19:56, 295 raccoon [2576]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:19:56, 295 raccoon [2576]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:19:56, racoon 296 [2576]: connection.

  26/03/16 10:19:56, racoon 296 [2576]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:19:56, racoon 296 [2576]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:19:56, racoon 308 [2576]: IKE Packet: forward the success. (Initiator, Aggressive Mode 1 message).

  26/03/16 10:19:56, racoon 308 [2576]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:19:56, racoon 308 [2576]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:19:56, 352 raccoon [2576]: no message must be encrypted, 0x14a1, side 0 status

  26/03/16 10:19:56, 352 raccoon [2576]: no message must be encrypted, 0x14a1, side 0 status

  26/03/16 10:19:56, nesessionmanager 352 [2112]: Controller IPSec: IKE FAILED. phase 2, assert 0

  26/03/16 10:19:56, nesessionmanager 353 [2112]: Controller IPSec: retry the aggressive mode IPSec with DH group 2

  26/03/16 10:19:56, nesessionmanager 373 [2112]: phase 1 of the IPSec from.

  26/03/16 10:19:56, 374 raccoon [2576]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:19:56, 374 raccoon [2576]: IPSec to connect to the server $VPN_SERVER_IP

  26/03/16 10:19:56, 374 raccoon [2576]: connection.

  26/03/16 10:19:56, 374 raccoon [2576]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:19:56, 374 raccoon [2576]: IPSec Phase 1 started (initiated by me).

  26/03/16 10:19:56, racoon 376 [2576]: IKE Packet: forward the success. (Initiator, Aggressive Mode 1 message).

  26/03/16 10:19:56, racoon 376 [2576]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:19:56, racoon 376 [2576]: > > > > > status of phase change = Phase 1 began by us

  26/03/16 10:19:56, racoon 404 [2576]: port 62465 anticipated, but 0

  26/03/16 10:19:56, racoon 404 [2576]: port 62465 anticipated, but 0

  26/03/16 10:19:56, racoon 432 [2576]: IKEv1 Phase 1 AUTH: success. (Initiator, aggressive-Mode Message 2).

  26/03/16 10:19:56, racoon 432 [2576]: > > > > > status of phase change = Phase 1 began with a peer

  26/03/16 10:19:56, racoon 432 [2576]: > > > > > status of phase change = Phase 1 began with a peer

  26/03/16 10:19:56, racoon 432 [2576]: IKE Packet: receive a success. (Initiator, Aggressive Mode 2 message).

  26/03/16 10:19:56, racoon 432 [2576]: initiating IKEv1 Phase 1: success. (Initiator, aggressive Mode).

  26/03/16 10:19:56, racoon 432 [2576]: IKE Packet: forward the success. (Initiator, Aggressive Mode 3 message).

  26/03/16 10:19:56, 433 raccoon [2576]: IPSec Phase 1 established (initiated by me).

  26/03/16 10:19:56, 433 raccoon [2576]: IPSec Phase 1 established (initiated by me).

  26/03/16 10:19:56, racoon 453 [2576]: IPSec Extended requested authentication.

  26/03/16 10:19:56, racoon 453 [2576]: IPSec Extended requested authentication.

  26/03/16 10:19:56, 454 nesessionmanager [2112]: IPSec asking extended authentication.

  [26/03/16 10:19:56, nesessionmanager 464 [2112]: NESMLegacySession[$VPN-CONN-NAME:72874CC0-2A89-4B61-80F1-9BB4F3EA953B]: status changed by disconnecting

  26/03/16 10:19:56, nesessionmanager 464 [2112]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:19:56, racoon 465 [2576]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:19:56, racoon 465 [2576]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:19:56, racoon 465 [2576]: IKE Packet: forward the success. (Information message).

  26/03/16 10:19:56, racoon 465 [2576]: IKEv1-Information Notice: pass success. (Delete the ISAKMP Security Association).

  26/03/16 10:19:56, racoon 465 [2576]: could not send message vpn_control: Broken pipe

  26/03/16 10:19:56, racoon 465 [2576]: could not send message vpn_control: Broken pipe

  [26/03/16 10:19:56, nesessionmanager 465 [2112]: NESMLegacySession[$VPN-CONN-NAME:72874CC0-2A89-4B61-80F1-9BB4F3EA953B]: status changed to offline, last stop reason no

  26/03/16 10:19:56, 466 raccoon [2576]: glob found no match for the path "/ var/run/racoon/*.conf".

  26/03/16 10:19:56, 466 raccoon [2576]: glob found no match for the path "/ var/run/racoon/*.conf".

  26/03/16 10:19:56, 466 raccoon [2576]: IPSec disconnection from the server $VPN_SERVER_IP

  26/03/16 10:19:56, 466 raccoon [2576]: IPSec disconnection from the server $VPN_SERVER_IP

  It seems that I solved the problem, but I'm not sure it helped.

  After restart of the operating system, the two connections: old and new Cisco via IPSec connection, began to work.