Re: Cisco VPN client not working

IT Asitis · ‎04-09-2013

Hi,

I have set up cisco vpn client access and it works everywere exept at a wireless (firstspot.org) network that is used in meeting locals that are shared with the other companies in our building.

Is there any possibillity that i need to allow NAT-T for my cisco vpn client Something i read)? if so how can i do this just for the vpn?

Or is there maby another solution?

the error im getting is: Reason 412 - The remote peer is no longer responding.

All help is appriciated.

/Hilmar

IT Asitis · ‎04-09-2013

Update: I get the following in my logs

5

Apr 09 2013

15:24:17

713202

IP = 195.198.115.142, Duplicate first packet detected. Ignoring packet.

IT Asitis · ‎04-09-2013

More update:

Here is the log from the vpn client. Dont know if this helps but it looks to me as if the client is not getting the responce from the ASA and therefore sens again and again until the ASA terminates.

Anyone have a solution for this?

/H

1 19:38:07.129 04/09/13 Sev=Info/6 IKE/0x6300003B

Attempting to establish a connection with 80.181.36.30.

2 19:38:07.144 04/09/13 Sev=Info/4 IKE/0x63000001

Starting IKE Phase 1 Negotiation

3 19:38:07.144 04/09/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 80.181.36.30

4 19:38:12.183 04/09/13 Sev=Info/4 IKE/0x63000021

Retransmitting last packet!

5 19:38:12.183 04/09/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (Retransmission) to 80.181.36.30

6 19:38:17.300 04/09/13 Sev=Info/4 IKE/0x63000021

Retransmitting last packet!

7 19:38:17.300 04/09/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (Retransmission) to 80.181.36.30

8 19:38:22.371 04/09/13 Sev=Info/4 IKE/0x63000021

Retransmitting last packet!

9 19:38:22.371 04/09/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (Retransmission) to 80.181.36.30

10 19:38:27.441 04/09/13 Sev=Info/4 IKE/0x63000017

Marking IKE SA for deletion (I_Cookie=807FD9825CFD1067 R_Cookie=0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING

11 19:38:27.956 04/09/13 Sev=Info/4 IKE/0x6300004B

Discarding IKE SA negotiation (I_Cookie=807FD9825CFD1067 R_Cookie=0000000000000000) reason = DEL_REASON_PEER_NOT_RESPONDING

12 19:38:27.956 04/09/13 Sev=Info/4 IKE/0x63000001

IKE received signal to terminate VPN connection

Julio Carvajal · ‎04-09-2013

Hello,

Exactly,

Can you run a debug crypto isakmp while trying to connect from that site

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

IT Asitis · ‎04-10-2013

Hi

Thanks for the input.

Since there are many using the remote vpn i get lots of traffic. i have set up a new remote access vpn and get the same problem. Is it possible for me te filter the log so i see only the "test" tunnel. The logs run away and when i stop then it is to late

I have tried to run

debug crypto isakmp 1

debug crypto isakmp 2

debug crypto isakmp 50

Is there any one special level i should try?

if i understand there are 255 levels

/Hilmar

is there one in particular that i should try?

Julio Carvajal · ‎04-10-2013

debug crypto condition username xxxx ( The username you are providing)

or

debug crypto condition Peer x.x.x.x ( Ip address of your client) Public ofcourse

Then add the debug crypto isakmp 255

and try to connect

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC

IT Asitis · ‎04-15-2013

Hi,

debug crypto condition user VpnTest

Gives no output

debug crypto condition Peer 197.195.111.153

Gives no output

debug crypto isakmp 2

Apr 15 14:14:18 [IKEv1]IP = 197.195.111.153 , Connection landed on tunnel_group In_VPN

Apr 15 14:14:18 [IKEv1]Phase 1 failure: Mismatched attribute types for class Group Description: Rcv'd: Group 2 Cfg'd: Group 5

Apr 15 14:14:23 [IKEv1]IP = 197.195.111.153 , Duplicate first packet detected. Ignoring packet.

Apr 15 14:14:28 [IKEv1]IP = 197.195.111.153 , Duplicate first packet detected. Ignoring packet.

Apr 15 14:14:33 [IKEv1]IP = 197.195.111.153 , Duplicate first packet detected. Ignoring packet.

debug crypto isakmp 255 it just runs away in the terminal and the information im looking for cant be coppied. Im assuming this is because i have a lot of vpn tunnel up and running.

Does this give you an idea of the problem?

/H

IT Asitis · ‎04-15-2013

Hi,

Hope this gives you guys some more info.

Here is an output from

debug crypto isakmp 7

Apr 15 15:09:22 [IKEv1]IP = 197.195.111.153, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + KE (4) + NONCE (10) + ID (5) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 852

Apr 15 15:09:22 [IKEv1 DEBUG]IP = 197.195.111.153, processing SA payload

Apr 15 15:09:22 [IKEv1 DEBUG]IP = 197.195.111.153, processing ke payload

Apr 15 15:09:22 [IKEv1 DEBUG]IP = 197.195.111.153, processing ISA_KE payload

Apr 15 15:09:22 [IKEv1 DEBUG]IP = 197.195.111.153, processing nonce payload

Apr 15 15:09:22 [IKEv1 DEBUG]IP = 197.195.111.153, processing ID payload