Hi Cristian,
I got further at the weekend, It now seems to work when I run it via the test option in the ASDM console
Crypto map tag: Outside_map, seq num: 5, local addr: 212.139.167.114
access-list Outside_cryptomap_3 extended permit ip host 212.139.167.114 host 10.38.145.20
local ident (addr/mask/prot/port): (212.139.167.114/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (10.38.145.20/255.255.255.255/0/0)
current_peer: 51.140.251.238
#pkts encaps: 60, #pkts encrypt: 60, #pkts digest: 60
#pkts decaps: 44, #pkts decrypt: 39, #pkts verify: 39
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 60, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 5, #pkts invalid len (rcv): 0
#pkts invalid pad (rcv): 0,
#pkts invalid ip version (rcv): 0,
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0
local crypto endpt.: 212.139.167.114/0, remote crypto endpt.: 51.140.251.238/0
path mtu 1500, ipsec overhead 74(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 1E49B9A2
current inbound spi : ED0FF3E2
inbound esp sas:
spi: 0xED0FF3E2 (3977245666)
SA State: active
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 3799, crypto-map: Outside_map
sa timing: remaining key lifetime (kB/sec): (97199978/3316)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000FFF 0xFFFFC7FD
outbound esp sas:
spi: 0x1E49B9A2 (508148130)
SA State: active
transform: esp-aes-256 esp-sha-hmac no compression
in use settings ={L2L, Tunnel, IKEv1, }
slot: 0, conn_id: 3799, crypto-map: Outside_map
sa timing: remaining key lifetime (kB/sec): (97199994/3316)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
However, when I try to connect with the anyconnect client, I get the the following in the debug log:
[4069] Processing LDAP response for user usertest1 [4069] Message (usertest1): [4069] Authentication successful for usertest1 to 10.38.145.20 * Lots more sensitive info then... [4069] Fiber exit Tx=718 bytes Rx=17970 bytes, status=1
All I get on the vpn client is the following
If I keep trying it, even with the correct details, I get the following and its like it cant see it again.
If i then wait a while, it seems to "work" by connecting again once or twice.
[4075] Session Start [4075] New request Session, context 0x00007f1a6b820c60, reqType = Authentication [4075] Fiber started [4075] Creating LDAP context with uri=ldap://10.38.145.20:389 [4075] Connect to LDAP server: ldap://10.38.145.20:389, status = Failed [4075] Unable to read rootDSE. Can't contact LDAP server. [4075] Fiber exit Tx=0 bytes Rx=0 bytes, status=-2 [4075] Session End
The VPN is stable so I don't know what is going on.
Bit of a strange one this, it was working fine before I moved the LDAP Server. I think we are close now! Any ideas now? Thanks so much!
