Traffic bypasses VPN client

Olegred12 · ‎03-23-2013

Here is what I get logwise.

Cisco Systems VPN Client Version 5.0.07.0290

Client Type(s): Windows, WinNT

Running on: 6.1.7600

Config file directory: C:\Program Files (x86)\Cisco Systems\VPN Client3\

1 20:27:08.424 03/23/13 Sev=Warning/3 CM/0xA3100027

Adapter address 192.168.1.125 has changed or not detected. Current address(es): 10.7.16.102.

2 20:27:23.508 03/23/13 Sev=Warning/2 CVPND/0xA340000E

Failed to get adapter index.

3 20:27:38.573 03/23/13 Sev=Warning/2 CVPND/0xA340000E

Failed to get adapter index.

4 20:27:38.637 03/23/13 Sev=Warning/2 CVPND/0xA3400015

Error with call to IpHlpApi.DLL: CheckUpVASettings: Found IPADDR entry addr=10.7.16.102, error 0

5 20:27:39.642 03/23/13 Sev=Warning/2 CVPND/0xA3400015

Error with call to IpHlpApi.DLL: CleanUpVASettings: Was able to delete all VA settings after all, error 0

6 20:27:40.308 03/23/13 Sev=Warning/2 IKE/0xA3000067

Received an IPC message during invalid state (IKE_MAIN:512)

Could you PLEASE help me? Adapter works sometimes, sometimes it does not. It connects ok, but then I can not get any intranet traffic.

Javier Portuguez · ‎03-23-2013

Hi Oleg,

Are you connecting over a WWAN adapter (3G, 4G)?

OS?

Have you tried with latest version of the IPsec client for x86 systems?

HTH.

Portu.

Olegred12 · ‎03-24-2013

THANK you for replying. This thing drives me crazy. I connect over wifi (I tried both laptop adaptor and external adaptor). It is a home wifi network via wireless cisco router. Latest client? Sounds good, what is it and how can I get it?

Olegred12 · ‎03-24-2013

following your drift I plugged laptop into modem directly and got the same result

Javier Portuguez · ‎03-24-2013

You can download it from here:

Release 5.0.07.0410

HTH.

Portu.

Olegred12 · ‎03-24-2013

still does not work. For love or money, somebody help me. How come it connects fine and then ALL traffic bypasses the adaptor? I am completly at the dark.

I do catastrophe recovery in NYC peope are suffering because I can't work.

Javier Portuguez · ‎03-24-2013

Oleg,

Could you please confirm whether the Internet Connection Sharing (ICS) service is running or not? If so, please disable it.

Once that has been verified, try this:

1. Enable the adapter without connecting the VPN.

2. Assign a static IP address.

3. Try connecting again. The adapter would disable itself and clear the IP address.

4. Try connecting again.

HTH.

Portu.

Javier Portuguez · ‎03-24-2013

Another option:

Uninstall the Cisco VPN client.

Restart the machine.

Download the Citrix DNE Update and install it (or REPAIR if already installed)

http://www.citrix.com/lang/English/lp/lp_1680845.asp

Restart the machine.

Install the VPN client.

Test.

Javier Portuguez · ‎03-24-2013

And one more thing:

http://www.helpcomp.com/help/pc/f-Iphlpapi.dll.php?keyword=iphlpapi.dll&c1=p&c=14842353279&p=2t1

*Haven't tried this, but it would be a worth try.

HTH.

Olegred12 · ‎03-24-2013

here is what is get now in the log

64 18:05:52.718 03/24/13 Sev=Warning/2 IPSEC/0xA370001F

Cannot find binding for the private address: 10.7.24.160

Javier Portuguez · ‎03-24-2013

Oleg,

So you tried all my suggestions?

If so, then download a third-party VPN client and check if it works (assuming that this is an emergency).

If the issue persists, then probably you may need to reimage the machine.

Olegred12 · ‎03-24-2013

Nothing worked. I am not even able to connect due to authentication issue. Do you know any IPSEC clients with group authenication? Also, here is my last log.

Cisco Systems VPN Client Version 5.0.07.0290

Client Type(s): Windows, WinNT

Running on: 6.1.7600

Config file directory: C:\Program Files (x86)\Cisco Systems\VPN Client\

1 19:27:17.644 03/24/13 Sev=Info/4 CM/0x63100002

Begin connection process

2 19:27:17.659 03/24/13 Sev=Info/4 CM/0x63100004

Establish secure connection

3 19:27:17.660 03/24/13 Sev=Info/4 CM/0x63100024

Attempt connection with server "vpn.crawco.com"

4 19:27:17.958 03/24/13 Sev=Info/4 IPSEC/0x63700008

IPSec driver successfully started

5 19:27:17.958 03/24/13 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

6 19:27:21.846 03/24/13 Sev=Info/4 CM/0x63100026

Abort connection attempt before TCP session up

7 19:27:21.853 03/24/13 Sev=Info/4 CM/0x6310002D

Resetting TCP connection on port 10000

8 19:27:22.025 03/24/13 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

9 19:27:22.026 03/24/13 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

10 19:27:22.026 03/24/13 Sev=Info/4 IPSEC/0x6370000A

IPSec driver successfully stopped

11 19:27:23.233 03/24/13 Sev=Info/4 CM/0x63100002

Begin connection process

12 19:27:23.245 03/24/13 Sev=Info/4 CM/0x63100004

Establish secure connection

13 19:27:23.245 03/24/13 Sev=Info/4 CM/0x63100024

Attempt connection with server "vpn.crawco.com"

14 19:27:23.256 03/24/13 Sev=Info/4 IKE/0x63000001

Starting IKE Phase 1 Negotiation

15 19:27:23.262 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 12.6.40.30

16 19:27:23.450 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?), VID(?)) from 12.6.40.30

17 19:27:23.460 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 12.6.40.30

18 19:27:23.460 03/24/13 Sev=Info/4 IKE/0x63000083

IKE Port in use - Local Port = 0xCE0D, Remote Port = 0x1194

19 19:27:23.461 03/24/13 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

20 19:27:23.510 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:LOAD_BALANCE) from 12.6.40.30

21 19:27:23.510 03/24/13 Sev=Info/4 CM/0x6310001B

Received alternative server address "12.6.40.29" from primary server

22 19:27:23.510 03/24/13 Sev=Info/4 IKE/0x63000017

Marking IKE SA for deletion (I_Cookie=04938828447ECCBE R_Cookie=2AD621C54946D877) reason = DEL_REASON_LOAD_BALANCING

23 19:27:23.510 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to 12.6.40.30

24 19:27:24.053 03/24/13 Sev=Info/4 IPSEC/0x63700008

IPSec driver successfully started

25 19:27:24.053 03/24/13 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

26 19:27:24.053 03/24/13 Sev=Info/4 IKE/0x6300004B

Discarding IKE SA negotiation (I_Cookie=04938828447ECCBE R_Cookie=2AD621C54946D877) reason = DEL_REASON_LOAD_BALANCING

27 19:27:24.053 03/24/13 Sev=Info/4 CM/0x63100014

Unable to establish Phase 1 SA with server "vpn.crawco.com" because of "DEL_REASON_LOAD_BALANCING"

28 19:27:24.053 03/24/13 Sev=Info/4 CM/0x63100010

Try alternative server "12.6.40.29" given by the primary server

29 19:27:24.053 03/24/13 Sev=Info/4 CM/0x63100024

Attempt connection with server "12.6.40.29"

30 19:27:24.064 03/24/13 Sev=Info/4 IKE/0x63000001

Starting IKE Phase 1 Negotiation

31 19:27:24.073 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG (SA, KE, NON, ID, VID(Xauth), VID(dpd), VID(Frag), VID(Nat-T), VID(Unity)) to 12.6.40.29

32 19:27:24.261 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK AG (SA, KE, NON, ID, HASH, VID(Unity), VID(Xauth), VID(dpd), VID(Nat-T), NAT-D, NAT-D, VID(Frag), VID(?), VID(?)) from 12.6.40.29

33 19:27:24.270 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK AG *(HASH, NOTIFY:STATUS_INITIAL_CONTACT, NAT-D, NAT-D, VID(?), VID(Unity)) to 12.6.40.29

34 19:27:24.271 03/24/13 Sev=Info/4 IKE/0x63000083

IKE Port in use - Local Port = 0xCE10, Remote Port = 0x1194

35 19:27:24.271 03/24/13 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

36 19:27:24.316 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 12.6.40.29

37 19:27:24.316 03/24/13 Sev=Info/4 CM/0x63100015

Launch xAuth application

38 19:27:26.868 03/24/13 Sev=Info/4 CM/0x63100017

xAuth application returned

39 19:27:26.868 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 12.6.40.29

40 19:27:27.235 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 12.6.40.29

41 19:27:27.235 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 12.6.40.29

42 19:27:27.236 03/24/13 Sev=Info/4 CM/0x6310000E

Established Phase 1 SA. 1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system

43 19:27:27.241 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to 12.6.40.29

44 19:27:29.377 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK TRANS *(HASH, ATTR) from 12.6.40.29

45 19:27:29.377 03/24/13 Sev=Info/4 CM/0x63100019

Mode Config data received

46 19:27:29.393 03/24/13 Sev=Info/4 IKE/0x63000056

Received a key request from Driver: Local IP = 10.7.24.164, GW IP = 12.6.40.29, Remote IP = 0.0.0.0

47 19:27:29.393 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH, SA, NON, ID, ID) to 12.6.40.29

48 19:27:29.455 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK INFO *(HASH, NOTIFY:STATUS_RESP_LIFETIME) from 12.6.40.29

49 19:27:29.455 03/24/13 Sev=Info/4 IKE/0x63000014

RECEIVING <<< ISAKMP OAK QM *(HASH, SA, NON, ID, ID, NOTIFY:STATUS_RESP_LIFETIME) from 12.6.40.29

50 19:27:29.455 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK QM *(HASH) to 12.6.40.29

51 19:27:30.126 03/24/13 Sev=Info/4 CM/0x63100034

The Virtual Adapter was enabled:

IP=10.7.24.164/255.255.240.0

DNS=10.1.0.110,10.3.2.110

WINS=10.1.0.110,10.3.2.110

Domain=crawco.com

Split DNS Names=crawco.com,crawco.local,kempr.com,krms.com,rskco.com,crawcodev.local,knserv.com,ersg.net

52 19:27:34.198 03/24/13 Sev=Info/4 CM/0x63100038

Successfully saved route changes to file.

53 19:27:38.768 03/24/13 Sev=Warning/2 CVPND/0xE3400003

Function RegisterPrivateInterface failed with an error code of 0x00000000(DRVIFACE:3256)

54 19:27:38.768 03/24/13 Sev=Warning/2 CM/0xE3100008

Failed to register private (virtual adapter) interface

55 19:27:38.815 03/24/13 Sev=Warning/2 CVPND/0xA3400015

Error with call to IpHlpApi.DLL: CheckUpVASettings: Found IPADDR entry addr=10.7.24.164, error 0

56 19:27:39.829 03/24/13 Sev=Warning/2 CVPND/0xA3400015

Error with call to IpHlpApi.DLL: CleanUpVASettings: Was able to delete all VA settings after all, error 0

57 19:27:45.773 03/24/13 Sev=Info/4 CM/0x63100035

The Virtual Adapter was disabled

58 19:27:45.773 03/24/13 Sev=Warning/2 IKE/0xE300009B

Failed to active IPSec SA: Unable to enable Virtual Adapter (NavigatorQM:936)

59 19:27:45.773 03/24/13 Sev=Warning/2 IKE/0xE30000A7

Unexpected SW error occurred while processing Quick Mode negotiator:(Navigator:2263)

60 19:27:45.773 03/24/13 Sev=Info/4 IKE/0x63000013

SENDING >>> ISAKMP OAK INFO *(HASH, DEL) to 12.6.40.29

61 19:27:45.773 03/24/13 Sev=Info/4 IKE/0x63000049

Discarding IPsec SA negotiation, MsgID=C79AD813

62 19:27:45.773 03/24/13 Sev=Info/4 IPSEC/0x63700014

Deleted all keys

63 19:27:45.773 03/24/13 Sev=Info/4 IPSEC/0x63700010

Created a new key structure

64 19:27:45.773 03/24/13 Sev=Info/4 IPSEC/0x6370000F

Added key with SPI=0xc937c635 into key list

65 19:27:45.773 03/24/13 Sev=Info/4 IPSEC/0x63700010

Created a new key structure

66 19:27:45.773 03/24/13 Sev=Info/4 IPSEC/0x6370000F

Added key with SPI=0x2d44ac6d into key list

67 19:27:45.773 03/24/13 Sev=Warning/2 IPSEC/0xA370001F