Anyconnect Failed to Connect using WEBVPN on IOS Router 2800 Series

Hi All,
Kindly need your help. I was trying to built Remote Access VPN connection on my lab environment. The component is Router 2811 with (c2800nm-advsecurityk9-mz.124-22.T5.bin), Anyconnect Client ( anyconnect-win-3.1.05160-k9.pkg ), Laptop ( Firewall and Antivirus disabled, already register webvpndomain.com into hosts file on Win32/Driver/Etc ).
I was able to connect using anyconnect if I'm initiate connection via web (https://webvpndomain.com) and start tunnel connection SVC. I'm also able to reach my LAN and I get my private IP Address assigned by my vpn pool on the router. The problem is when I'm initiate connection to vpn directly from the computer, I mean I'm not using web (https://webvpndomain.com) and I'm just press "connect" on my anyconnect software that already installed on my Laptop the connection always fail. I get error message : Connection attempt has failed
Here I'm also attach my router configuration, so you can see what I've done or what mistake that I've made on the configuration.
Is anybody in here have experience this problem on deploying Remote Access VPN using webvpn and anyconnect as vpn client ?
I'm really appreciate anybody that get into this discussion
Best Regards,
Nanda

Try using webvpndomain.com/myVPNGW as host

Similar Messages

Win 7 Pro 64 occasionally fails to connect using IKEV2 to Win2008R2 Routing and Remote Access server

I'm a networking guy and having this troubling VPM issue that I can't find.
I have a number of VPN connections from my Win7Pro 64 PC to various customers. Their end points are all Windows Routing and Remote Access on Windows 2008R2 STD servers.
Every once and a while I will hang at Verifying User ID and Password and eventually get ERROR 809. Change the security type on my VPN connection from IKEV2 to PPTP - never an issue, connects in right away.
I can also try from another PC (at the same or alternate location) to get into that same server using the same credentials and access - no issue using either IKEV2 or PPTP.
This has happened at various times to various customers. Here is what I know it is not:
- Not the local or remote routers or Firewalls since I can always get in from other PC's going through the same network. Even so, tried rebooting all several times
- Not an ISP issue at either end since I can always get into other IKEV2 servers from the same PC and from other PC's to the server I can't from my PC.
This leads to the only logical conclusion. It is something to do with my Win7Pro 64 PC but for the life of my I can not find it.
I have obviously tried rebooting the Win7Pro PC. I have also tried recreating the VPN connection several times. Nothing.
Help!

Hi,
I know that you've mentioned that it is not a issue about firewall or router settings, but this error usually comes when some firewall between client and server is blocking the ports used by VPN tunnel.
so to allow IKEv2 traffic, please make sure to configure the network firewall to open UDP ports 500 and 4500, and to allow IP protocol 50.
If that is not possible, deploy SSTP based VPN tunnel on both VPN server and VPN client – that allows VPN connection across firewalls, web proxies and NAT
You can refer to this blog
http://blogs.technet.com/b/rrasblog/archive/2006/06/14/which-ports-to-unblock-for-vpn-traffic-to-pass-through.aspx
Regards
Yolanda
TechNet Community Support

NTLM authentication fails to connect using webdav on osX

We are having problems in our organization getting our macs connected via webdav using NTLM authentication.
Our structure is as follows:
Netapp/IBM nSeries gateway/filer model n6040 which is our FTP/CIFS/Webdav host.
Windows Server 2008 R2 Domain Controller with Active Directory
Windows 7, Mac osX clients (various versions).
From the windows side, we are able to connect to our filer via FTP, CIFS, and http/Webdav after we authenticate using our AD credentials. From the Mac side, we can authenticate and connect to our filer using FTP, CIFS (using Connect to Server "smb://ourfiler.com") and through a browser using the address of http://ourfiler.com. This type of connection using webdav works with Firefox but not using Safari or Chrome but isn't adequate enough for our users since the browser based connection is read only. However, when we try to Connect to Server via webdav using our server address of http://ourfiler.com:80, we never get past the "Enter your name and password for the server "ourfiler.com."
We tried a third party webdav client on our macs: Cyberduck, which also fails to connect using webdav. We also tried a separate linux client and were able to connect without any problems.
Since authetication for webdav works on windows and linux, we're thinking there is problem with osX itself. Has anyone else had this problem or can anyone suggest any workarounds/solutions?

Sorry for the late replies gentleman... for some reason I didn't get email alerts when you guys posted....
Anyways, yes the DC is on a different subnet and no we don't have WINS. The way I understand it is the client will contact the master browser in it's local subnet... all the master browsers in all other subnets contacts the Domain master browser ...
and they share the server list this way... I mean it's a little more complicated than that....well to me at least...
Can you try resolving the short name with the domain controller being on another subnet and you having a different master browser in your client subnet?
What is the process the client goes thru when looking up Domain netbios name? LIke for DNS, it's straight forward... the client looks at DNS server, then for the SRV records for the Site the client is in and get's domain controller....... How
does this work for netbios domain name? There is NO WINS in the environment.
Chau

Why does my Iphone 4s connect to my Wi-Fi network and latter in the day fail to connect until I reboot the router

Why does my Iphone 4s connect to my wi-fi with a password and latter in the day fail to connect until I reboot the router? Is there a setting on my router that would avoid this issue. All my other devices connect alright

OK so it now looks like on my iPhone 5 iwth iOS 6.1 the LTE network is conflicting with my home wifi (Airport Extreme). At the Apple store the LTE signal is lost in and wifi works like a charm. At home tired all of the "fixes"
-No security
-WEP
-Reset network,
-Complete reset and reload on the phone
-ETC ETC ETC
Just turned off the cell radio and it worked. Turned on the cell radio but kept LTE off and it worked.
Apple let's get a fix so we can use your "great" phone. I have just received a BB Z10 from work and it seems to work flawlessly.

IOS: AnyConnect 2.5.3055, Windows 7 x64 fails to connect to Webvpn on 2811

I am attempting to add SSLVPN to my 2811 and 2801 production routers. These devices currently run IOS 12.4(24)T4 ADV SECURITY images. I have succesfully configured the SSL VPN gateway via CCP. I can connect via web browser to https://2811IP/sslvpn, log in, and use the web portal. When I attempt to use the full tunnel AnyConnect client on Windows 7 x64 (I have nothing else to test with right now) I get the simple and vague error: "Connection attempt has failed." This error occurs before I would receive a prompt to provide credentials. It never prompts me. There is no further information such as timeout, certificate error, or anything like that.
running term mon and debug webvpn on the router produces only the following when the client attempts to connect:
002121: Oct 23 00:10:35.081: WV: sslvpn process rcvd context queue event
002122: Oct 23 00:10:35.085: WV: sslvpn process rcvd context queue event
002123: Oct 23 00:10:38.973: WV: sslvpn process rcvd context queue event
002124: Oct 23 00:10:38.977: WV: sslvpn process rcvd context queue event
002125: Oct 23 00:10:39.041: WV: sslvpn process rcvd context queue event
002126: Oct 23 00:10:39.041: WV: Entering APPL with Context: 0x47FE4C90,
Data buffer(buffer: 0x4732ABC0, data: 0x3F5BE498, len: 172,
offset: 0, domain: 0)
002127: Oct 23 00:10:39.041: WV: http request: /sslvpn with no cookie
002128: Oct 23 00:10:39.041: WV: Client side Chunk data written..
buffer=0x4732AA20 total_len=188 bytes=188 tcb=0x481CF0A8
I've tried adding a program exception for anyconnect to the windows firewall.
I've tried disabling the windows firewall.
I've tried connecting via different ISPs, both wired and cellular.
I've tried the previous release of AnyConnect for Windows.
The TP certificate on the device is self-signed and valid from 1/23/2006 to 12/31/2019. I am prompted to accept the cert when I client Select (Connect) in the client. After I click Accept on the certificate window the connection fails. If I wait a while (perhaps a minute) the following error pops up, but ONLY if I wait a while before clicking Accept:
"AnyConnect cannot confirm it is connected to your secure gateway. The local network may not be trustworthy. Please try another network"
What else can I check?

Does the iPod work OK?
Does it charge when connect to the computer?
Does it appear in My Computer?
Look at the dock connector on the iPod. Compare with the iPod that does work/connect.
I suspect you have a 2G iPod. Those can only go to iOS 4.2.1
http://support.apple.com/kb/HT1353#iPod_touch_late2009
iPod touch (3rd generation)
iPod touch (3rd generation) features a 3.5-inch (diagonal) widescreen multi-touch display and 32 GB or 64 GB flash drive. You can browse the web with Safari and watch YouTube videos with Wi-Fi. You can also search, preview, and buy songs from the iTunes Wi-Fi Music Store on iPod touch.
The iPod touch (3rd generation) can be distinguished from iPod touch (2nd generation) by looking at the back of the device. In the text below the engraving, look for the model number. iPod touch (2nd generation) is model A1288, and iPod touch (3rd generation) is model A1318.

Cannot push clients - Failed to connect using machine account

After restoring SCCM from old x86 server to new x64 server I cannot install clients.
Current version is SCCM 2007 SP2 without R2. SCCM is in mixed mode, SCCM was installed to SAME path, was successfully restored from backup using "ConfigMgr Site Repair Wizard".
But new clients cannot be installed now.
The following is in ccm.log:
"---> Warning: no remote client installation account found $$<SMS_CLIENT_CONFIG_MANAGER><Date Time Russian Standard Time><thread=3936 (0xF60)>
---> Attempting to connect to administrative share '\\computername\admin$' using machine account.~ $$<SMS_CLIENT_CONFIG_MANAGER><Date Time Russian Standard Time><thread=3936 (0xF60)>
---> Failed to connect to \\computername\admin$ using machine account (1203) $$<SMS_CLIENT_CONFIG_MANAGER><Date Time Russian Standard Time><thread=2900 (0xB54)>"
Account used for push install presents in "Domain Admins" group and can reach this share from SCCM server using explorer or file manager.
Firewall service is stopped and disabled on target computers.
Searching through logs I was confused by this: "Warning: no remote client installation account found". It's impossible because account is present and set coreectly both in "client push installation" and "computer client agent". Account was cleared and set again but warning is the same.
At last I found the problem. In the beginning of SMS_CLIENT_CONFIG_MANAGER initialization there is a string in the ccm.log:
"~WARNING: failed to encrypt account domain\account $$<SMS_CLIENT_CONFIG_MANAGER><Date Time Russian Standard Time><thread=2656 (0xA60)>"
I think that's the source of trouble. But I can't find the reason.
By the way, the same message is in policypv.log:
"~failed to encrypt network access accountdomain\account $$<SMS_POLICY_PROVIDER><Date Time Russian Standard Time><thread=3720 (0xE88)>"
It's exactly so in log, without space between "account" word and "domain\account"!
Any domain account I try to add for push installation appears in these logs with the same encrypt error!
Can anyone help please?
Thanks a lot!

After restoring SCCM from old x86 server to new x64 server I cannot install clients.
Current version is SCCM 2007 SP2 without R2. SCCM is in mixed mode, SCCM was installed to SAME path, was successfully restored from backup using "ConfigMgr Site Repair Wizard".
But new clients cannot be installed now.
The following is in ccm.log:
"---> Warning: no remote client installation account found $$<SMS_CLIENT_CONFIG_MANAGER><Date Time Russian Standard Time><thread=3936 (0xF60)>
---> Attempting to connect to administrative share '\\computername\admin$' using machine account.~ $$<SMS_CLIENT_CONFIG_MANAGER><Date Time Russian Standard Time><thread=3936 (0xF60)>
---> Failed to connect to \\computername\admin$ using machine account (1203) $$<SMS_CLIENT_CONFIG_MANAGER><Date Time Russian Standard Time><thread=2900 (0xB54)>"
We're having the EXACT same problem after our migration today from x86 --> x64. Please tell me you've found a solution. We're ready to revert to a snapshot tomorrow if we can't figure this out.

Anyconnect fails to connect with a message that it tried to set a specific MTU but it was already enabled with a different MTU - (SOLVED)

Cisco Anyconnect 3.1.05160 fails to setup the VPN tunnel, it prompts with this message:
"The VPN client driver encountered an error. Please restart your computer or device, then try again."
Authentication and everything seems to go through but it won't work.
The computer is a brand new HP with Windows 7. I have treid first with some later 2.x Anyconnect with same result.
The follow entries are printed in the event log:
Level Date and Time Source Event ID Task Category
Error 2014-05-10 16:19:28 acvpnagent 2009 None Termination reason code 13:
Unable to start VA, setup shared queue, or VA gave up on shared queue.
Error 2014-05-10 16:19:28 acvpnagent 2 Engineering Debug Details Function: CVpnMgr::main
File: .\VpnMgr.cpp
Line: 1847
Invoked Function: IHostMgr::enableHostMgr
Return Code: -23592949 (0xFE98000B)
Description: HOSTMGR_ERROR_ALREADY_ENABLED_WITH_DIFFERENT_MTU:An attempt was made to enable the tunnel's network interface with a specific MTU but it was already enabled with a different MTU.

This was caused by the good old HP mess-up-your-computer services.
Disable the service "HP Device Locking / Auditing" and the VPN will be able to connect.

Bad connection using facetime with ios 7

when i use facetime its really bad connection keeps feezing since updating to ios 7 on my ipad mini was never like this before i have fibre broadband so its not my internet as that is super fast i have also noticed that the new update is very slow and sluggish when using certain features has anyone else experienced this

I know you can't restore a backup with ios7 and Find My Ipad turned on. I would first set it to Never update device, an don't restore backup and see if that will allow you apply the profile. If that doesn't work. I'd do a complete wipe of the device, prepare it again and then try to install the profile.

UE Boom Bluetooth speaker failed to connect after upgraded to iOS 8.2

After upgraded to iOS 8.2 on 2x iPhone 6 64GB (Gold & Silver) + iPad Mini, UE Boom Bluetooth speaker can never been "detected" nor connected.
Reset all settings does not help.
(UE Boom firmware was upgraded to v1.451 which supports Bluetooth 4.0 for remote power on/off).

Howdy Tampo,
If you are still unable to connect to or see your bluetooth speaker on your iPad I would use the troubleshooting in this article to help you further:
iOS: Troubleshooting Bluetooth connections
Thank you for using Apple Support Communities.
All the best,
Sterling

Toplink fails to connect using Datasource

I'm deploying an EJB project using Toplink persistence to Oracle AS 10.1.3.1 and have defined a datasource/connection pool as:
<managed-data-source name="OAS_Oracle_Datasource"
connection-pool-name="My_Connection_Pool"
jndi-name="jdbc/OAS_Oracle_Datasource"/>
<connection-pool
     name="My_Connection_Pool"
     min-connections="3"
     max-connections="10">
<connection-factory factory-class="oracle.jdbc.pool.OracleDataSource"
user="joeuser"
password="joepasswd"
url="jdbc:oracle:thin:@dbserver:dev01">
</connection-factory>
</connection-pool>
Once deployed I can test the datasource/connection pool successfully from the admin GUI. I can also access the database from an external client using the same connection parameters. However, I see this stack trace in log.xml:
Exception [TOPLINK-4002] (TopLink (Oracle OC4J CMP) - 10g Release 3 (10.1.3.1.0) (Build 061004)): oracle.toplink.exceptions.DatabaseException
Internal Exception: java.sql.SQLException: Io exception: The Network Adapter could not establish the connectionError Code: 17002
     at oracle.toplink.exceptions.DatabaseException.sqlException(DatabaseException.java:276)
     at oracle.toplink.internal.ejb.cmp.oc4j.Oc4jNonJtaConnector.connect(Oc4jNonJtaConnector.java:49)
     at oracle.toplink.sessions.DatasourceLogin.connectToDatasource(DatasourceLogin.java:147)
<SNIP>
     at java.lang.Thread.run(Thread.java:595)
Caused by: java.sql.SQLException: Io exception: The Network Adapter could not establish the connection
     at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:138)
<SNIP>
     at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:608)
     at oracle.jdbc.pool.OracleDataSource.getConnection(OracleDataSource.java:218)
     at oracle.jdbc.pool.OracleConnectionPoolDataSource.getPhysicalConnection(OracleConnectionPoolDataSource.java:114)
<SNIP>
     at oracle.oc4j.sql.ManagedDataSource.getConnection(ManagedDataSource.java:197)
     at oracle.oc4j.sql.ManagedDataSource.getNonTransactionalConnection(ManagedDataSource.java:167)
     at oracle.oc4j.sql.ManagedDataSource.getNonTransactionalConnection(ManagedDataSource.java:153)
     at oracle.toplink.internal.ejb.cmp.oc4j.Oc4jNonJtaConnector.connect(Oc4jNonJtaConnector.java:44)
     ... 27 more
Anyone run into this problem? If so please share your fix.
Thanks,
Gerald

OK, a little more light shines on this mystery...
It turns out that the deployer-generated orion-ejb-jar.xml was using a data-source attribute pointing at the jdbc/OracleDS datasource in the default application, which OAS creates during install. Of course this wasn't set to anything in particular, and if Toplink is using this behind the scenes it wouldn't connect.
Now the question is how do I get my datasource stuffed into the auto-generated orion-ejb-jar.xml data-source? Would be nice if there was a way to specify some Toplink datasource property in the orion-ejb-jar.xml before it gets processed by the deployer into its eventual resting place under application-deplyments.
Gerald

DAC: Failing to connection to INFA Server and INFA Rep Ser

OBIEE APPPS: 7.9.3
Informatica OS: Windows 2003
DB: Oracle 10gR2 on Windows 2003
Informatica is running without any issues. Successfully restored the repository, make sure to configure the repository server in workflow manager as well. Successfully tested 'Physical Data Sources' with out any issues. Successfully validate the DAC connection to Informatica rep server.
Problem: When I am testing my testing my informatica connections from DAC client from tab "Informatica Server" I am failing in both the connection
Whenk I test: my Informatica Server I am getting error "
Failure connecting to "ORACLE_BI_DW_SERVER"!
=======================================
STD OUTPUT
========================================
==========================================
ERROR OUTPUT
===========================================
I am getting following error when I test connection for repository server:
Feb 27, 2008 12:54:57 PM com.siebel.etl.engine.core.ETLUtils logException
SEVERE: MESSAGE:::CreateProcess: pmrep connect -r Oracle_BI_DW_Base -n Administr
ator -x Administrator -h obieewin.ultradent.com -o 5001 error=2
EXCEPTION CLASS::: java.io.IOException
java.lang.ProcessImpl.create(Native Method)
java.lang.ProcessImpl.<init>(ProcessImpl.java:81)
java.lang.ProcessImpl.start(ProcessImpl.java:30)
java.lang.ProcessBuilder.start(ProcessBuilder.java:451)
java.lang.Runtime.exec(Runtime.java:591)
java.lang.Runtime.exec(Runtime.java:429)
java.lang.Runtime.exec(Runtime.java:326)
com.siebel.etl.functional.ExternalProcessExecutor.fire(ExternalProcessExecutor.j
ava:142)
com.siebel.etl.functional.ExternalProcessExecutor.execute(ExternalProcessExecuto
r.java:99)
com.siebel.analytics.etl.infa.interaction.PmrepInvoker.pmrep(PmrepInvoker.java:9
0)
com.siebel.etl.gui.data.StaticDatabaseCalls.testRepositoryServer(StaticDatabaseC
alls.java:946)
com.siebel.etl.gui.data.StaticDatabaseCalls.testInformaticaServer(StaticDatabase
Calls.java:881)
com.siebel.etl.net.ExecutionPlan.getInformaticaStatus(ExecutionPlan.java:261)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.mBeanRequestInformaticaS
tatus(ClientMessageDispatcher.java:403)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.consoleMessage(ClientMes
sageDispatcher.java:220)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.run(ClientMessageDispatc
her.java:140)
10 SEVERE Wed Feb 27 12:54:57 MST 2008 MESSAGE:::CreateProcess: pmrep connect
-r Oracle_BI_DW_Base -n Administrator -x Administrator -h mycompany.company.co
m -o 5001 error=2
EXCEPTION CLASS::: java.io.IOException
java.lang.ProcessImpl.create(Native Method)
java.lang.ProcessImpl.<init>(ProcessImpl.java:81)
java.lang.ProcessImpl.start(ProcessImpl.java:30)
java.lang.ProcessBuilder.start(ProcessBuilder.java:451)
java.lang.Runtime.exec(Runtime.java:591)
java.lang.Runtime.exec(Runtime.java:429)
java.lang.Runtime.exec(Runtime.java:326)
com.siebel.etl.functional.ExternalProcessExecutor.fire(ExternalProcessExecutor.j
ava:142)
com.siebel.etl.functional.ExternalProcessExecutor.execute(ExternalProcessExecuto
r.java:99)
com.siebel.analytics.etl.infa.interaction.PmrepInvoker.pmrep(PmrepInvoker.java:9
0)
com.siebel.etl.gui.data.StaticDatabaseCalls.testRepositoryServer(StaticDatabaseC
alls.java:946)
com.siebel.etl.gui.data.StaticDatabaseCalls.testInformaticaServer(StaticDatabase
Calls.java:881)
com.siebel.etl.net.ExecutionPlan.getInformaticaStatus(ExecutionPlan.java:261)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.mBeanRequestInformaticaS
tatus(ClientMessageDispatcher.java:403)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.consoleMessage(ClientMes
sageDispatcher.java:220)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.run(ClientMessageDispatc
her.java:140)
Feb 27, 2008 12:54:57 PM com.siebel.etl.engine.core.ETLUtils logException
SEVERE:
ANOMALY INFO::: Error while connecting to informatica repository server
MESSAGE:::
pmrep Connect Error
=====================================
STD OUTPUT
=====================================
=====================================
ERROR OUTPUT
=====================================
EXCEPTION CLASS::: com.siebel.analytics.etl.infa.interaction.PmrepConnectExcepti
on
com.siebel.analytics.etl.infa.interaction.PmrepInvoker.pmrep(PmrepInvoker.java:9
3)
com.siebel.etl.gui.data.StaticDatabaseCalls.testRepositoryServer(StaticDatabaseC
alls.java:946)
com.siebel.etl.gui.data.StaticDatabaseCalls.testInformaticaServer(StaticDatabase
Calls.java:881)
com.siebel.etl.net.ExecutionPlan.getInformaticaStatus(ExecutionPlan.java:261)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.mBeanRequestInformaticaS
tatus(ClientMessageDispatcher.java:403)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.consoleMessage(ClientMes
sageDispatcher.java:220)
com.siebel.etl.net.ClientMessageDispatcher$WorkerThread.run(ClientMessageDispatc
her.java:140)
11 SEVERE Wed Feb 27 12:54:57 MST 2008
ANOMALY INFO::: Error while connecting to informatica repository server
MESSAGE:::
pmrep Connect Error
=====================================
STD OUTPUT
=====================================
=====================================
ERROR OUTPUT
=====================================
information about how it is set in DAC client:
Informatica Server: ORACLE_BI_DW_SERVER
PORT: 4001
Repository: Oracle_BI_DW_Base
Port: 5001
Please keep in mind that I have set the environment varialbles correctly, I have never faced these issues. Please help me out ASAP.
Thank you in advance.
P.S: DAC and OLAP repositories have created and loaded without any issues. I am stuck here where I need to make sure DAC can talk to Informatica but failing.

HI,
You can restart your windows box and then see if the error is still coming. From your error log it seems there is some IO issue. I am also facing similar kind of issue. Actually my Informatica server runs and connects properly from DAC client. But when i run Execution plan, my Informatica server crashes? Do you have any idea what might be the cause?
Thanks,
Prasad N

TS1843 i am using iphone 4 ios 6.1.3, after hotmail imap setup, error showing "CANNOT GET MAIL" tHE CONNECTION TO THE SERVER FAILED. its happening since 14 aug. plz help !

i am using iphone 4 ios 6.1.3, after hotmail imap setup, error showing "CANNOT GET MAIL" tHE CONNECTION TO THE SERVER FAILED. its happening since 14 aug. plz help !

I have trouble with sending e-mail and syncing e-mail. Try changing to 1 day sync under settings. It's sluggish but it works for me until they resolve the issue. MS claims all is normal. If you still have a problem you should report it here: https://status.live.com/report/hotmail

SSLVPN with iPhone Anyconnect and Cisco IOS Router, Certificate Authentication failed

Hello,
i have a problem regarding the authentication with a certificate from the iPhone Anyconnect 2.5 Client to a 1802 Cisco Router.
Cisco 1802 Router:
Cisco IOS Software, C180X Software (C180X-ADVENTERPRISEK9-M), Version 15.1(1)T, RELEASE SOFTWARE (fc1)
First i configured SSLVPN with username and password, in this configuration the Anyconnect Client of my iPhone works.
then i enrolled a certificate from my Windows 2008 R2 CA to the Router with the Attributes: Server Authentication and IPSEC
and i enrolled a certificate for my iPhone with Client Authentication and IPSEC
after a bunch of time ( i realy could not find a really good documentation on how to do this) i got it done, in the webvpn context configuration i made this changes here:
no aaa authentication list default
authentication certificate
ca trustpoint CA
as the "SSL VPN Configuration Guide, Cisco IOS Release 15.1M&T" says: if i want only certificate authentication i had to user the "authentication certificate" command and thats it.
as i look into the debugs it seems to me that the Router accepts the certificate of the iPhone, but then i receive a window on the iphone that wants an additional username and password authentication, and no matter what i enter there's always the same dialog coming back..
any ideas what the problem could be???
here is the configuration:
webvpn gateway WEBVPN_GW_OFFICE2
ip interface Dialer0 port 1444
ssl trustpoint CA
inservice
webvpn install svc flash:/webvpn/sslclient-win-1.1.4.179.pkg sequence 1
webvpn install svc flash:/webvpn/anyconnect-win-3.0.4235-k9.pkg sequence 2
webvpn install svc flash:/webvpn/anyconnect-dart-win-2.5.3055-k9.pkg sequence 3
webvpn context WEBVPN_CONTEXT2
secondary-color white
title-color #669999
text-color black
ssl authenticate verify all
policy group WEBVPN_POLICY2
   functions svc-enabled
   mask-urls
   svc address-pool "SSLVPN_OFFICE1"
   svc default-domain "domain.internal"
   svc keep-client-installed
   svc split include 192.168.0.0 255.255.0.0
   svc dns-server primary 192.168.53.33
   svc dns-server secondary 192.168.53.35
virtual-template 3
default-group-policy WEBVPN_POLICY2
gateway WEBVPN_GW_OFFICE2
authentication certificate
ca trustpoint CA
inservice
here is the debug:
OfficeRouter1# PASSING appctx is [0x89FAFFCC]
Nov 19 22:39:53.507: WV: sslvpn process rcvd context queue event
Nov 19 22:39:53.507: WV: sslvpn process rcvd context queue event
Nov 19 22:39:53.607: WV: sslvpn process rcvd context queue event
Nov 19 22:39:53.607: WV: Entering APPL with Context: 0x86529380,
      Data buffer(buffer: 0x86543A40, data: 0x15A07AB8, len: 469,
      offset: 0, domain: 0)
Nov 19 22:39:53.607: WV: http request: / with no cookie
Nov 19 22:39:53.607: WV: validated_tp : CA cert_username : matched_ctx :
Nov 19 22:39:53.607: WV: Received appinfo
validated_tp : CA, matched_ctx : ,cert_username :
Nov 19 22:39:53.607: WV: Trustpoint match successful
Nov 19 22:39:53.607: WV: Extracted username: pass: ?
Nov 19 22:39:53.607: WV: Client side Chunk data written..
buffer=0x86543640 total_len=661 bytes=661 tcb=0x8811FE60
Nov 19 22:39:53.607: WV: Appl. processing Failed : 2
Nov 19 22:39:53.607: WV: sslvpn process rcvd context queue event
BueroRouter1# PASSING appctx is [0x89FAEEC4]
Nov 19 22:40:24.028: WV: sslvpn process rcvd context queue event
Nov 19 22:40:24.032: WV: sslvpn process rcvd context queue event
Nov 19 22:40:24.132: WV: sslvpn process rcvd context queue event
Nov 19 22:40:24.132: WV: Entering APPL with Context: 0x86529380,
      Data buffer(buffer: 0x86543A40, data: 0x160C4038, len: 469,
      offset: 0, domain: 0)
Nov 19 22:40:24.132: WV: http request: / with no cookie
Nov 19 22:40:24.132: WV: validated_tp : CA cert_username : matched_ctx :
Nov 19 22:40:24.132: WV: Received appinfo
validated_tp : CA, matched_ctx : ,cert_username :
Nov 19 22:40:24.132: WV: Trustpoint match successful
Nov 19 22:40:24.132: WV: Extracted username: pass: ?
Nov 19 22:40:24.132: WV: Client side Chunk data written..
buffer=0x86543640 total_len=661 bytes=661 tcb=0x88D11EEC
Nov 19 22:40:24.136: WV: Appl. processing Failed : 2
Nov 19 22:40:24.136: WV: sslvpn process rcvd context queue event
Nov 19 22:40:39.764: WV: sslvpn process rcvd context queue event
Nov 19 22:40:39.880: WV: sslvpn process rcvd context queue event
Nov 19 22:40:39.892: WV: sslvpn process rcvd context queue event
Nov 19 22:40:39.892: WV: Entering APPL with Context: 0x86529380,
      Data buffer(buffer: 0x86543A40, data: 0x1616FD38, len: 610,
      offset: 0, domain: 0)
Nov 19 22:40:39.892: WV: http request: /webvpn.html with domain cookie
Nov 19 22:40:39.892: WV: validated_tp : cert_username : matched_ctx :
Nov 19 22:40:39.892: WV: Received appinfo
validated_tp : CA, matched_ctx : ,cert_username :
Nov 19 22:40:39.892: WV: Trustpoint match successful
Nov 19 22:40:39.892: WV: Client side Chunk data written..
buffer=0x86543640 total_len=607 bytes=607 tcb=0x88D11EEC
Nov 19 22:40:39.892: WV: Appl. processing Failed : 2
Nov 19 22:40:39.892: WV: sslvpn process rcvd context queue event

http://www.cisco.com/en/US/products/ps8411/products_qanda_item09186a00809aec31.shtml
HI,
Refer to
AnyConnect VPN Client FAQ
Q. Is it possible to connect the iPad, iPod, or iPhone AnyConnect VPN Client to a Cisco IOS router?
A. No. It is not possible to connect the iPad, iPod, or iPhone AnyConnect VPN Client to a Cisco IOS router. AnyConnect on iPad/iPhone can connect only to an ASA that runs version 8.0(3).1 or later. Cisco IOS is not supported by the AnyConnect VPN Client for Apple iOS. For more information, refer to the Security Appliances and Software Supported section of the Release Notes for Cisco AnyConnect Secure Mobility Client 2.4, Apple iOS 4.2 and 4.3.

FaceTime connecting fails for international use only

I have always been able to FaceTime locally and internationally. Now it seems international FaceTime use, both incoming and outgoing fails. Connection is fine on local numbers. How can the international connection be solved?

Hello tanyafromjohannesburg
If you are having issues with making FaceTime calls, then check out the article below. You will also want to send this to the person that you are trying to FaceTime because the issue could be on their device.
iOS: Troubleshooting FaceTime
http://support.apple.com/kb/ts3367
Regards,
-Norm G.

TS1398 Still having problems with my ipad wifi connection since upgrading to IOS 6. Can Apple do something about it the soonest possible time. I don't have this kind of problem using IOS 5.1.1 Can you at least put back the 5.1.1 if you cant find a solut

So disappointed with IOS 6. I'm having weak wifi connection since upgrading to it. Can Apple do something about it? Can you at least reset it to IOS 5.1.1?

Sorry Jim for the wrong question because I'm getting frustated with my IPAD since I can't use it for surfing internet with a faster speed. Ipad was very convenient to use until this IOS 6 upgrade. Tried all the suggestions in the forums but still gets back to weak wifi connection.

Anyconnect Failed to Connect using WEBVPN on IOS Router 2800 Series

Similar Messages

Maybe you are looking for