VPN Client: proxy identities not supported

Phase 1 is complete since I see this message in the debug output:
*Jan 17 19:41:04.618: ISAKMP:(2029):Input = IKE_MESG_INTERNAL, IKE_PHASE1_COMPLETE
The checking of the IPSec proposal fails because of "proxy identities not supported":
=[ BEGIN debug output ]====================================================================
*Jan 17 19:41:04.634: ISAKMP:(2029):Checking IPSec proposal 4
*Jan 17 19:41:04.634: ISAKMP: transform 1, ESP_AES
*Jan 17 19:41:04.634: ISAKMP: attributes in transform:
*Jan 17 19:41:04.634: ISAKMP: authenticator is HMAC-SHA
*Jan 17 19:41:04.634: ISAKMP: key length is 128
*Jan 17 19:41:04.634: ISAKMP: encaps is 1 (Tunnel)
*Jan 17 19:41:04.634: ISAKMP: SA life type in seconds
*Jan 17 19:41:04.634: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Jan 17 19:41:04.634: ISAKMP:(2029):atts are acceptable.
*Jan 17 19:41:04.634: ISAKMP:(2029):Checking IPSec proposal 4
*Jan 17 19:41:04.634: ISAKMP:(2029):transform 1, IPPCP LZS
*Jan 17 19:41:04.634: ISAKMP: attributes in transform:
*Jan 17 19:41:04.634: ISAKMP: encaps is 1 (Tunnel)
*Jan 17 19:41:04.634: ISAKMP: SA life type in seconds
*Jan 17 19:41:04.634: ISAKMP: SA life duration (VPI) of 0x0 0x20 0xC4 0x9B
*Jan 17 19:41:04.634: ISAKMP:(2029):atts are acceptable.
*Jan 17 19:41:04.634: IPSEC(validate_proposal_request): proposal part #1
*Jan 17 19:41:04.634: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 200.40.164.178, remote= 200.40.164.177,
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
remote_proxy= 192.168.101.22/255.255.255.255/0/0 (type=1),
protocol= ESP, transform= esp-aes esp-sha-hmac (Tunnel),
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0
*Jan 17 19:41:04.634: IPSEC(validate_proposal_request): proposal part #2
*Jan 17 19:41:04.638: IPSEC(validate_proposal_request): proposal part #2,
(key eng. msg.) INBOUND local= 200.40.164.178, remote= 200.40.164.177,
local_proxy= 0.0.0.0/0.0.0.0/0/0 (type=4),
remote_proxy= 192.168.101.22/255.255.255.255/0/0 (type=1),
protocol= PCP, transform= comp-lzs (Tunnel),
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
*Jan 17 19:41:04.638: IPSEC(crypto_ipsec_process_proposal): proxy identities not supported
*Jan 17 19:41:04.638: ISAKMP:(2029): IPSec policy invalidated proposal with error 32
=[ END debug output ]======================================================================
I see that "local_proxy= 0.0.0.0/0.0.0.0/0/0", but it should have the IP address of the router internal interface.

Well, finally a coleague found the cause of the problem: I had added a "match address" command to the "crypto dynamic-map" for the RemoteAccess VPN.
The "match address" command must be used only with VPN L2L.

Similar Messages

Encryption is required to connect to this server but the client library does not support encryption

Hi ,guys
I came cross a trouble when I configured connection encryption.
I met the following problem when I have configured connection encryption done.
Encryption is required to connect to this server but the client library does not support encryption; the connection has been closed. Please upgrade your client library. [client: ip]
environment info:
SQL:SQL2008 \SQL2005\SQL2008R2
SERVER:WIN2003 \WIN2008R2
We use C# to develop asp.net webform app, so the provider I use should be SQL client.
client .NET Framework version:NET Framework 3.5
Pls tell me why I met this weird problem.
Thanks in advance.
Love SQL

Sure,here is the connetion string of java app.
jdbc
db.url=jdbc:jtds:sqlserver://60.x.x.x./TaskSiteInfo
db.username=xxx
db.pwd=xxx
Your initial post stated you were using SqlClient in an ASP.NET 3.5 app. I think this is an issue with the jTDS client based on the error message. Are you using the latest jTDS driver? If so, try posting this issue to
http://sourceforge.net/p/jtds/discussion/
Dan Guzman, SQL Server MVP, http://www.dbdelta.com

How to find the error when client proxy is not successfully triggered?

Hi all,
I want to consume a .NET service in SAP.
But when I want to test the client proxy the following error occur:
GENERAL_ERROR Error duing proxy processing (PART
UNKNOWN (NULL) )
Transaction ST11:
TRACE SOAP RUNTIME - trace records
E CONTEXT 20090518061404.5255720 : CL_SOAP_CONTEXT ->SET_FAULT
SOAP runtime fault handling
E SOAP_RUNTIME 20090518061404.5256990 : CL_SOAP_RUNTIME_CLIENT
->EXEC_PROCESSING Exception handling in SOAP runtime
E CONTEXT 20090518061404.5255620 : CL_SOAP_CONTEXT ->SET_FAULT set
fault loop detected
E SOAP_RUNTIME 20090518061404.5256920 : CL_SOAP_RUNTIME_CLIENT
.NullPointerException:
Transaction SM21:
SOAP Runtime Protocol: SOAP Fault exception occurred in program CL_SOAP_RUNTIME_ROOT==========CP in include CL_SOAP_RU NTIME_ROOT==========CM004 at position 80
SOAP Runtime Protocol: Exception message: Severe processing error; SOAP fault handling required
How can I find what's wrong????
This error logging is not really helpful to me...
Any ideas?
regards

Hello Mr. Bauer,
Will you please elaborate on your solution to fix this issue?
We are facing this issue too.
Thanks in advance.
Regards,
Victor

Client proxy message not reaching to XI system

Hi
I have done one scenario from CRM to FILE. When i am executing the client proxy through my zprogram its executing without any errors. I have checked in SXMB_MONI of CRD system i can see the messages but they are not with successful flag or not with error flag. But in XI system (SXMB_MONI) i didnt find any messages. Could you please tell me what's the problem is?
Regards
Sowmya

Sowmya,
As you are not getting any message in SXMB_MONI, there can be following possibilities:
1. There can be some problem in proxy configuration on your CRM system. Please check with your BASIS team that steps give in this blog are properly followed:
How do you activate ABAP Proxies?
2. Make sure that in
SXMB_ADM --->integration engine config -
>change specific attributes....
The RUNTIME parameter is defined LOGGING and TRACE_LEVEL and the value is 1.
3. Make sure the queues are registered in Tx: SMQR.
Further, I do not think that COMMIT statement or anything like that is missing as in that case you should have got a message in SXMB_MONI with a green flag stating that "Commit statement is missing".

How to configure Multiple PPTP VPN Clients on cisco 3g supported Router

I want the router to be a PPTP VPN client to 2 independent PPTP servers, both are in different cities in Cisco routers. I have tested with one on cisco 1841 aqnd its working fine; but when I add the 2nd, its using vpdn-group 1 and therefore connecting to the wrong PPTP server:
here is the config for the one that works:
vpdn-group 1
request-dialin
protocol pptp
rotary-group 0
initiate-to ip xxx.xxx.xxx.xxx
interface Dialer0
mtu 1450
ip address negotiated
ip pim dense-mode
ip nat outside
ip virtual-reassembly
zone-member security private
encapsulation ppp
ip igmp query-interval 125
dialer in-band
dialer idle-timeout 0
dialer string 123
dialer vpdn
dialer-group 1
no peer neighbor-route
no cdp enable
ppp pfc local request
ppp pfc remote apply
ppp encrypt mppe auto
ppp authentication ms-chap-v2 ms-chap eap chap pap callin
ppp eap refuse
ppp chap hostname xxx@xxx
ppp chap password 7 xxxpassword
But if I create a vpdn-group 2 and a Dialer1 interface, with dialer-group 2, its still attempting to connect to the IP in vpdn-group 1 - how do I get it to use the 2nd vpdn-group, or how do I make this work? and which cisco 3G Router you prefer because these are remote sites and only 3G Internet service is available.

I want the router to be a PPTP VPN client to 2 independent PPTP servers, both are in different cities in Cisco routers. I have tested with one on cisco 1841 aqnd its working fine; but when I add the 2nd, its using vpdn-group 1 and therefore connecting to the wrong PPTP server:
here is the config for the one that works:
vpdn-group 1
request-dialin
protocol pptp
rotary-group 0
initiate-to ip xxx.xxx.xxx.xxx
interface Dialer0
mtu 1450
ip address negotiated
ip pim dense-mode
ip nat outside
ip virtual-reassembly
zone-member security private
encapsulation ppp
ip igmp query-interval 125
dialer in-band
dialer idle-timeout 0
dialer string 123
dialer vpdn
dialer-group 1
no peer neighbor-route
no cdp enable
ppp pfc local request
ppp pfc remote apply
ppp encrypt mppe auto
ppp authentication ms-chap-v2 ms-chap eap chap pap callin
ppp eap refuse
ppp chap hostname xxx@xxx
ppp chap password 7 xxxpassword
But if I create a vpdn-group 2 and a Dialer1 interface, with dialer-group 2, its still attempting to connect to the IP in vpdn-group 1 - how do I get it to use the 2nd vpdn-group, or how do I make this work? and which cisco 3G Router you prefer because these are remote sites and only 3G Internet service is available.

ABAP Client proxy message not reaching AAE

Hi Experts,
I am facing a strange issue in one of my proxy interfaces. ABAP client Proxy is used to post message to AAE in SAP PI 7.3. The messages are being generated and pushed out of ECC successfully. I can see them in the SXMB_MONI t-code with checkered flag. These messages are reaching the Integartion Engine instaed of the Adapter Engine.
I have configured the following:
1. Sender / Receiver ID in SXMSIF:
2. Configured the corresponding Runtime parameter in SXMB_ADM
I have few other such ABAp client proxy i/f's which work fine and their message are being sent to the Adapter engine. Howveere, only this one interface is posing a problem. What can be the issue?
Please advice.
Thanks in advance.
Elizabeth.

Hi Elizabeth,
It will be great if you could please let me know all the user profile configured in userID of Logon&Security tab of SM59 for connecting ECC system to post the message via AAE.
I have used
SAP_XI_APPL_SERV_USER
SAP_XI_DEVELOPER_J2EE and
SAP_XI_IS_SERV_USER
profiles in my UserID for Basic authentication.
Currently I am doing the same scenario what you have done with integrated configuration.The message is getting failed in ECC with 403 Forbidden error.
Please help me.
Thanks
Ray...

Weblogic 8.1 Webservice Client Proxy Authentication not working

We have a desktop console based Weblogic webservices client application that uses client stubs to establish the connection and communicate with the server where the WSDL was hosted.
We are facing a problem in authenticating the Proxy user with valid credentials.
We are using the following code to set the system properties and Authenticator class to authenticate the proxy user.
//Code Segment #1
Code:
System.setProperty("http.proxyHost", proxyHost);System.setProperty("https.proxyHost", proxyHost);
System.setProperty("weblogic.webservice.transport.http.proxy.host",proxyHost);
System.setProperty("weblogic.webservice.transport.https.proxy.host",proxyHost);
System.setProperty("http.proxyPort", proxyPort);
System.setProperty("https.proxyPort", proxyPort);
System.setProperty("weblogic.webservice.transport.http.proxy.port",proxyPort);
System.setProperty("weblogic.webservice.transport.https.proxy.port",proxyPort);
//System.setProperty("http.proxyType", "basic");
//System.setProperty("https.proxyType", "basic");
//System.setProperty("http.proxy.auth.type" ,"ntlm"); //This is not showing any impact
System.setProperty("http.proxyUser", "bsil\\ashok.kumar");
System.setProperty("https.proxyUser", "bsil\\ashok.kumar");
System.setProperty("http.proxyPassword", " xyzddd");
System.setProperty("https.proxyPassword", "xyzddd");
Authenticator.setDefault(new MyAuthenticator());
//Inner class
public static class MyAuthenticator extends Authenticator {
protected PasswordAuthentication getPasswordAuthentication() {
String username = System.getProperty("http.proxyUser");
     String password = System.getProperty("http.proxyPassword");
     return new PasswordAuthentication(username, password.toCharArray());
We are using following code initialize the stubs (Which internally opens a connection to the given endpoint base URL)
//Code Segment #2
Code:
SessionService_Impl sessionService = new SessionService_Impl(getEndPointURL(SessionServicePort.class));
port = sessionService.getSessionServicePort();
return port;
Using above code it always throws the following exception:
Code:
weblogic.webservice.tools.wsdlp.WSDLParseException: Failed to retrieve WSDL from https://apiclienttest.intralinks.com:443/webservices51/SessionService?WSDL. Please check the URL and make sure that it is a valid XML file [java.io.IOException: Proxy authenticator failed: java.lang.ClassNotFoundException: ]
if i replace the above code (Code Segment #2) to as bellow with Code Segment #3 then its working as expected. But we have been told that the Code Segment #2 is required as shwon above for the Weblogic ClientTimeout seconds feature so we cant replace the Code Segment #2 with Code Segment #3 since we don?t want to miss the ClientTimeout seconds feature for the application.
//Code Segment #3
Code:
SessionService_Impl sessionService = new SessionService_Impl();
          SessionServicePort sessionServicePort = sessionService.getSessionServicePort();
          ((SessionServicePort_Stub) sessionServicePort)._setProperty("javax.xml.rpc.service.endpoint.address", endPointBaseURL+"SessionService");
return sessionServicePort ;
why the Proxy authentication is failing with the Code Segment #2 and why it is passing in case of Code Segment #3
The endpoint base URL we are hitting is hosted on Weblogic server 9.0 (which is hosted at client side in US so it is behind our firewall).
Is some thing more do we need to do in Authenticator class???
Please help me if any one has worked on proxy server authenticator in java.

We have a desktop console based Weblogic webservices client application that uses client stubs to establish the connection and communicate with the server where the WSDL was hosted.
We are facing a problem in authenticating the Proxy user with valid credentials.
We are using the following code to set the system properties and Authenticator class to authenticate the proxy user.
//Code Segment #1
Code:
System.setProperty("http.proxyHost", proxyHost);System.setProperty("https.proxyHost", proxyHost);
System.setProperty("weblogic.webservice.transport.http.proxy.host",proxyHost);
System.setProperty("weblogic.webservice.transport.https.proxy.host",proxyHost);
System.setProperty("http.proxyPort", proxyPort);
System.setProperty("https.proxyPort", proxyPort);
System.setProperty("weblogic.webservice.transport.http.proxy.port",proxyPort);
System.setProperty("weblogic.webservice.transport.https.proxy.port",proxyPort);
//System.setProperty("http.proxyType", "basic");
//System.setProperty("https.proxyType", "basic");
//System.setProperty("http.proxy.auth.type" ,"ntlm"); //This is not showing any impact
System.setProperty("http.proxyUser", "bsil\\ashok.kumar");
System.setProperty("https.proxyUser", "bsil\\ashok.kumar");
System.setProperty("http.proxyPassword", " xyzddd");
System.setProperty("https.proxyPassword", "xyzddd");
Authenticator.setDefault(new MyAuthenticator());
//Inner class
public static class MyAuthenticator extends Authenticator {
protected PasswordAuthentication getPasswordAuthentication() {
String username = System.getProperty("http.proxyUser");
     String password = System.getProperty("http.proxyPassword");
     return new PasswordAuthentication(username, password.toCharArray());
We are using following code initialize the stubs (Which internally opens a connection to the given endpoint base URL)
//Code Segment #2
Code:
SessionService_Impl sessionService = new SessionService_Impl(getEndPointURL(SessionServicePort.class));
port = sessionService.getSessionServicePort();
return port;
Using above code it always throws the following exception:
Code:
weblogic.webservice.tools.wsdlp.WSDLParseException: Failed to retrieve WSDL from https://apiclienttest.intralinks.com:443/webservices51/SessionService?WSDL. Please check the URL and make sure that it is a valid XML file [java.io.IOException: Proxy authenticator failed: java.lang.ClassNotFoundException: ]
if i replace the above code (Code Segment #2) to as bellow with Code Segment #3 then its working as expected. But we have been told that the Code Segment #2 is required as shwon above for the Weblogic ClientTimeout seconds feature so we cant replace the Code Segment #2 with Code Segment #3 since we don?t want to miss the ClientTimeout seconds feature for the application.
//Code Segment #3
Code:
SessionService_Impl sessionService = new SessionService_Impl();
          SessionServicePort sessionServicePort = sessionService.getSessionServicePort();
          ((SessionServicePort_Stub) sessionServicePort)._setProperty("javax.xml.rpc.service.endpoint.address", endPointBaseURL+"SessionService");
return sessionServicePort ;
why the Proxy authentication is failing with the Code Segment #2 and why it is passing in case of Code Segment #3
The endpoint base URL we are hitting is hosted on Weblogic server 9.0 (which is hosted at client side in US so it is behind our firewall).
Is some thing more do we need to do in Authenticator class???
Please help me if any one has worked on proxy server authenticator in java.

ARD Client on iMacIntel not supported...

Hello !
I have a big pb
I can't manage my iMac with ARD client 2.2.1 on my local network by the server.
When I try to connect by ARD Admin 2.2 I receive this message : Failure with connection with "iMac INTEL"
Can you help me for resilve this pb ?
thank you
iMac Intel 17" Mac OS X (10.4.5)

OK, I'm not an expert in this area, but I can tell you that I've used the OSX VNC Server from Redstone Software (free) and Chicken of the VNC from GeekSpiff (also free) and they're quite good. Some say BETTER at observing and controlling than Apple Remote Desktop.
However -- the setup is a tiny bit more elaborate with those programs. Not much, but Tiger's built in Remote Desktop client does some critical setup for your clients. Supposedly. (I guess if it did it all correctly we wouldn't be here!).
My big suggestion is to follow the process that Apple's Tech Support gave:
Apple's Tech had me go ethernet cable DIRECTLY from my admin laptop to the affected iMac core duo. Once we did that, we saw the problem was firewall-related. Turning off the firewall on the affected machine did the trick. That gave us the CLUE as to where the problem was, so we could get the firewall settings back up again.
If you turn off all software firewalls, and connect via ethernet on the same subnet to the problem machine, then that takes out any potential router firewall issues and improperly set up port forwarding (not an easy task for those, like me, who haven't done a lot of that!).
If a direct connection with ethernet between the two machines doesn't work (set network TCP/IP to DHCP on BOTH machines) then the affected Mac probably has problems with the installation of Remote Access.
BTW, 90 days of free support comes with the purchase of Remote Desktop. There's a support code on the back of a card -- different than your serial number -- that you use when you call 800-APL-CARE. Make sure to get connected to the XSERVE group, as they support Remote Desktop.
I'm still testing to see if I can punch through my own firewall and observe my wife's iMac via the internet. I've done it with VNC but not yet with Remote Desktop. Once I get that working, I plan on writing an idiot's document on how to do it -- one that even I could've used.
While Apple has done a brilliant job of making these things fairly easy (compared to the Windows world) there's still much more to be done. In my case, I've been an Apple Certified Developer / Partner for 21 years, with my software on every shelf at every Apple Store, and I STILL couldn't figure out all the details without help. So don't feel bad -- and don't give up.
Stephen Greenfield
Write Brothers, Inc.

Client proxy data not reaching XI ?

Hi Guys,
I have a scenario proxy-soap asynchronus. when i execute the report on the R/3 side the report executes successfully and in the sxmb_moni receiver which is IE of xi is not identified and the data is not reaching XI.
But when i execute the report on the same R/3 system for an synchronus proxy-soap scenario the data reaches xi and everyhting is fine. so i think there is no problem with the proxy setings.
Why the EO asynchronus messages are not identifying the receiver which is IE ?
any help would be really appreciated
Thanks,
Raj

did u check moni in r3 side?

I am getting no HTTP proxy not supported error when I try to open HBOGo App on my iPad

When I try to open my HBOGo or MaxGo apps on my iPad, I am getting an error that states "Your current HTTP proxy is not supported by this application. Plese remove it from your Wi-Fi settings to enable video playback". I have reset the iPad, deleted and reinstalled the Apps, synced my iPad. My Wi-Fi settings are defaulted to off. Any help would be appreciated. Thanks.

To all that are getting the http proxy message when trying to view hbogo, Deggie has the right answer: go to wifi settings, when you find your wireless connection tap the arrow on the right and if proxy is on "auto" switch it to "off." I had been watching hbo go just fine then suddenly I got this message about http proxy does not support video playback, I did as Deggie suggested and Bingo.

VPN Client and Windows Folder Synchronisation

We are currently having problems with Windows XP Laptops which have folders Synchronised to Servers.
When they are working remotely, they use the VPN client to connect to the network. Unfortunately, the VPN Client Adapter does not appear in the "Network Connection" drop down menu within the Synchronisation Setup screens. This means that the synchronisation takes place once the Physical Adapter (LAN or Wireless) comes active and an error message appears everytime.
Has anyone come across this and found a fix for it ? There must be a away of getting the VPN LAN Adapter into the Synchronisation Network Connection list.

The only supported IPSec client for Windows 7 is 5.0.6. I would recommend uninstalling the client version that you have, upgrade the DNE package from Citrix, and then install the latest IPSec client.
Release Note:
http://www.cisco.com/en/US/partner/docs/security/vpn_client/cisco_vpn_client/vpn_client5006/release/notes/vpnclient5006.html#wp62415
DNE Update:
http://www.citrix.com/lang/English/lp/lp_1680845.asp
Client Download:
http://tools.cisco.com/support/downloads/go/ImageList.x?relVer=5.0.06.0110&mdfid=281940730&sftType=VPN+Client+Software&optPlat=Windows&nodecount=2&edesignator=null&modelName=Cisco+VPN+Client+v5.x&treeMdfId=268438162&treeName=Security&modifmdfid=&imname=&hybrid=&imst=&lr=Y

Cisco vpn client issue on windows 8.1 pro

I am using Cisco RV325-k9 router, I am configure "Easy vpn" in this router.
Our some users use Windows 7 pro and others users use Windows 8.1 pro with Cisco vpn client version 5.0.070290.
Issue is VPN client connected but not access remote machine and ping on windows 8.1 pro machines. but Working fine on windows 7 pro.
But When i am using wifi through MTS wifi usb device then working fine.
Please find the attached screenshot of VPN Client Statistics.
Please give me a solution.
Regards
Sanjib

Hi Sanjib,
Cisco VPN clinet is not supported for the windows version 8.1. And also it is EOL announced. Might be the below mentioned work around might help you. Try this.
http://www.vmwareandme.com/2013/12/solved-windows-8-and-windows-81-cisco.html#.U9tCdxCrOxo
Regards
Karthik

Installing VPN Client 5.0.07.0240 on Win 7 Pro 64 bit error 1720

I purchased a new laptop last week. It is Win 7 Pro SP1 64 Bit. Old laptop Win XP Pro. Used Laplink's PCMover to move apps rather than to have to re-install. One of the apps was VPN Client 4.8.02.0010 This app did not work properly on new pc after migration. Had customer send me VPN Client 5.0.07.0240 for 64 Bit. They did so. I installed. I believe it uninstalled the old (migrated) VPN Client but did not do the install of the new VPN Client. Every time I attempt to install, I get error 1720. There is a problem with this Windows Installer Package.A script required for this install to complete could not be run. I called Cisco support and they led me here. I am pretty desperate, been trying to get this done for 18 hours. The reason I called support was I thought I could purchase my own VPN Client, whichever one would be best for me to access several sites that use Cisco VPN's (I have sites that use openvpn, etc), perhaps AnyConnect that I have seen herein, and then Cisco could help me install the client. If that is a good path to take, please let me know, otherwise how do I get this vpn client installed, please. John

Hello John, and everyone.
I am aslo face this issue. I tried to install software cisco VPN client "vpnclient-winx64-msi-5.0.07.0290-k9.exe" in my customer's labtop that installed window 7 64bit and it shows message "cisco vpn client not support 64bits". but why in descript say that "vpnclient-winx64-msi-5.0.07.0290-k9.exe"
"VPN Client Software for x86 64-bit version of Vista/Windows 7 - Microsoft Installer"and when I tried to install it why it shows message can not support with 64 bits? what wrong ? Do anyone have experiences with this issue?
Could anyone help me on this issue or do anyone have other version of Cisco vpn client that can support with window 7 64 bits?
I am happy to see your ideas and answers!!
Thanks
sarem

Phonefactor with RRAS(Windows Server 2003) - VPN client timeout after 20 seconds -- too fast!

[Note that I have previously posted this question on Experts Exchange... but have not found a solution yet].
We are a small business and would like to switch to two-factor authentication for VPN connections. We spent nearly a year helping Barracuda debug their small business VPN appliance and finally they took their boxes back and gave us back our money - they
just couldn't get file sharing to work consistently with some new firmware they had to install due to a patent case.
So... now we are trying Phonefactor.
Our VPN setup is RRAS on a Windows Server 2003 domain controller.
We have installed Phonefactor, enabled it as a Radius server, and configured RRAS to point to Phonefactor for Radius authentication. We configured phonefactor to send text messages for authentication, as we figured that would be less disruptive than a phone
call.
It all works except... the timeout for VPN clients is only 20 seconds! By the time we receive the text message on a cell phone, sometimes there is only 5 or 6 seconds to get the six digit code typed into a reply on the cell phone... and unless we are really
nimble, that is frequently not enough time!
When the VPN client times out, it gives an Error 718 "The connection was terminated because the remote computer did not respond in a timely manner."
How can we increase the timeout on the VPN clients, so we can more reliably enter the authentication code in a reply back to phonefactor?
Things we have tried:
1) Connecting (PPTP) from different Windows clients to see if we get different timeout limits. So far we have tried several Windows 7 boxes and a Windows Server 2003 as the client, but in all cases the timeout is 20 seconds.
2) On the windows clients: Searching through the PPTP client settings to see if there is one labeled "connection timeout". So far we have found nothing.
3) On the windows 2003 server: Modifying the RRAS Radius Server time-out to be 30 seconds, 60 seconds, 300 seconds. We've tried restarting RRAS after these changes, but the client connection timeout is still 20 seconds.
4) In the phonefactor configuration: Searching through the radius server settings to see if there is one labeled "connection timeout". So far we have found nothing.
5) Using NTRadPing to connect directly to the phonefactor radius server. With NTRadPing we were able to wait more than 60 seconds without a timeout from phonefactor. So we don't *think* at this point that the issue is within phonefactor.
6) We have asked phonefactor support, but their response is "hmmm... good question, we don't know, that sounds like a problem with your vpn client". And they could well be correct.
7) Search the web for how to increase either the stock windows VPN client timeout, or the RRAS radius authentication timeout. No luck so far.
8) Try this registry hack:
http://windowsitpro.com/networking/solving-ras-718-error. Didn't help.
Any ideas?
thanks!

Hi fdc2005,
Thanks for the post.
However, generally, we first type User Name, Password, then click connect to establish the VPN connection. Such as:
Therefore, I have a little confusion about the timeout you mentioned. Would you please provide us more details.
Regarding error 718, please check if the following could help:
If you have a third-party VPN server which does not support MS-CHAPv2 as an authentication method and supports only MS-CHAPv1, you will need to use either CHAP or PAP to connect from the Windows Vista VPN client until the server you use starts supporting MS-CHAPv2.
Steps to follow for resolution:
(1) Check if the Routing and Remote Access Server (RRAS) is configured to allow connections with MS-CHAPv2
(2) Check if the RADIUS server policy supports MSCHAPv2 (This step is needed if you control access to clients using Remote Access Policies on the IAS/NPS server)
Quote from:
Troubleshooting Vista VPN problems.
Hope this helps.
Jeremy Wu
TechNet Community Support

Windows 8 Cisco VPN Client Issue

I connect to several of my customers with the Cisco VPN Client Version 5.0.07.0290 and all has been working fine. In the last week, virtually every Windows 8 machine has stopped working. The client connects fine, shows it's connected, but if I go to Status -> Statistics it just shows 0 in the Bytes Received and Sent. The Bypassed and Discarded increases, but I am unable to reach any system. Does anyone know what causes this or how to resolve it? This is a HUGE problem for me as all of the work we do for our customers is via their VPNs. Every non-Windows 8 PC still works fine. And these Windows 8 PCs have been working fine until just the last week. Browsing through, I've seen posts with this same issue, but none related to Windows 8 recently. They are all Windows 7, and my Windows 7 machines are working flawlessly.
Someone help!
Thanks,
Brian

Hi Brian,
IPSEC client on Windows 8 machine is not supported.
Cisco VPN Client 5.0.07 supports the following Microsoft OSs:
•Windows 7 on x64 (64-bit)
•Windows 7 on x86 (32-bit) only
•Windows Vista on both x86 (32-bit) and x64
•Windows XP on x86
VPN Client does not support the Tablet PC 2004/2005; and Windows 2000, NT, 98, and ME.
VPN Client supports smart card authentication on Windows 7, Vista, and XP. However, VPN Client does not support the ST Microelectronics smart card Model ST23YL80, and smart cards from the same family.
VPN Client supports up to one Ethernet adapter and one PPP adapter. It does not support the establishment of a VPN connection over a tethered link.
VPN Client 5.0.x is incompatible with the combination of Cisco Unified Video Advantage 2.1.2 and McAfee HIPS Patch 4 Build 688. To avoid system failures, uninstall either of these two applications, upgrade McAfee to the latest version, or use VPN Client 4.6.x.
To install the VPN Client, you need
•Pentium®-class processor or greater
•Microsoft TCP/IP installed. (Confirm via Start > Settings > Control Panel > Network > Protocols or Configuration.)
•50 MB hard disk space.
•128 MB RAM
(256 MB recommended)
•Administrator privileges
The VPN Client supports the following Cisco VPN devices:
•Cisco Series 5500 Adaptive Security Appliance, Version 7.0 or later.
•Cisco VPN 3000 Series Concentrator, Version 3.0 or later.
•Cisco PIX Firewall, Version 6.2.2(122) or Version 6.3(1).
•Cisco IOS Routers, Version 12.2(8)T or later.
you can get more information from following link:-
http://www.cisco.com/en/US/docs/security/vpn_client/cisco_vpn_client/vpn_client5007/release/notes/vpnclient5007.html#wp63537
Regards,
Naresh

VPN Client: proxy identities not supported

Similar Messages

Maybe you are looking for