Anyconnect VPN Certificate-matching not working

Cisco Adaptive Security Appliance Software Version 9.1(4); Device Manager Version 7.1(5)100; anyconnect-win-3.1.05152-k9.pkg
Hello, I am trying to implement Certificate Matching for certain client profiles. However 'certificate matching' does not seem to work- another certificate is always selected instead for Anyconnect SSL VPN authentication.
For example the client has two client-certificates installed: masin2 and masin3. I have configured the client-profile certificate-matching to use masin2 for authentication, but Anyconnect still chooses masin3 instead.
The client-profile looks like this:
<CertificateMatch>
           <KeyUsage>
               <MatchKey>Key_Encipherment</MatchKey>
               <MatchKey>Digital_Signature</MatchKey>
           </KeyUsage>
           <ExtendedKeyUsage>
               <ExtendedMatchKey>ClientAuth</ExtendedMatchKey>
           </ExtendedKeyUsage>
           <DistinguishedName>
               <DistinguishedNameDefinition Operator="Equal" Wildcard="Disabled" MatchCase="Disabled">
                   <Name>CN</Name>
                   <Pattern>masin2</Pattern>
               </DistinguishedNameDefinition>
           </DistinguishedName>
       </CertificateMatch>
Any suggestions/ideas? thanks for any input,
heiki.

enabling wildcard did not help. also tried disabling/enabling automatic certificate selection- no luck.
I have also tried with and without different keyusage and extendedkeyusage- no difference.
The Client Profile is correctly updated on the client PC every time a change in made, but it seems like Anyconnect is not evaluating the Certificate Matching fields at all. And it seems like the problem is only with the CertificateMatch fields, because other fields are used as configured (for example: certificatestore, retainvpnonlogoff, usestartbeforelogon and so on).
I even upgraded Anyconnect to the latest version 3.1.05160 and still- anyconnect completely ignores certificatematch configuration in client-profile.

Similar Messages

Music/iTunes Match not working properly since update to iOS 7

Music/iTunes Match not working properly since update to iOS 7

Try a Restart.
Press and hold the Sleep/Wake button for a few seconds until the red "slide to power off" slider appears, and then slide the slider. Press and hold the Sleep/Wake button until the Apple logo appears.
Resetting your settings
You can also try resetting all settings. Settings>General>Reset>Reset All Settings. You will have to enter all of your device settings again.... All of the settings in the settings app will have to be re-entered. You won't lose any data, but it takes time to enter all of the settings again.
Resetting your device
Press and hold the Sleep/Wake button and the Home button together for at least ten seconds, until the Apple logo appears. Apple recommends this only if you are unable to restart it.
Or if this doesn't work and nobody else on the blog doesn't have a better idea you can contact Apple.
Here is a link to their contacts with most of the information below.
http://www.apple.com/contact/

I have just upgraded to Lion and I now find that my VPN network does not work properly. It worked fine with Leopard.

I have just upgraded to Lion and now my VPN connection does not work properly. It was working fine when I was using Leopard. The VPN is My Private Network and we use it to link to BBC iPlayer when abroad. It will actually connect to the VPN site and shows a UK IP address, but then when we try to load an iPlayer programme we get the message from the BBC that we are not in the country and, therefore, cannot access the site. Any suggestions?

Have a look at System Preferences, Accessibility, VoiceOver.
(Command - F5).
charlie

Zone Base Forewall for VPN connections does not work after IOS upgrade

Hi all,
We use cisco router 2911 as corporate gateway - there is Zone Based Firewall implemented - I upgraded IOS to last version (15.2(2)T1) - originaly version 15.1(4)M1 - to solve issue with Anyconnect connections (bug CSCtx38806) but I found that after upgrade the VPN users are not able to communicate with sources in other zones.
More specific
WebVPN use this virtual template interface
interface Virtual-Template100
description Template for SSLVPN
ip unnumbered GigabitEthernet0/1.100
zone-member security INSIDE
There are other zones VOICE, LAB, ...
In the policy any connection is allowed (used inspection of icmp, tcp and udp) from INSIDE zone to VOICE or LAB zone
After VPN connection I am able to reach resources in INSIDE zone (which is the most important), but not in other zones. Before upgrade it worked.
Once I changed zone in Virtual-Template interface to VOICE, I was able to reach sources in VOICE zone but not in any other. I searched more and found the stateful firewall is not working for connections from VPN as ping is blocked by policy on returning way - it means by policy VOICE->INSIDE, once I allowed communication from "destination" zone to INSIDE zone - the connections started to work, but of cause it is not something I want to setup.
Does anybody has the same experiance?
Regards
Pavel

It seems to me I should add one importatant note - if client is connected directly in INSIDE zone, he can reach resources in other zones without any issue - so the problem is only when the client is connected by VPN - not in ZBF policy setup.
Pavel

ITunes Match Not Working After Update to iOS 6.1

I updated my iPhone 5 to 6.1 Now when I select a song using iTunes Match the song/artist/artwork isn't the song that plays. Has anyone else experienced this?I've turned match off to erase all songs and re-enabled it again, but I'm still getting the wrong songs. It works fine in iTunes, just not on the phone. Any ideas?

Since update iTunes Match has not worked on my iPhone. I can see playlists and songs but not albums or artists. Have searched for solution with no joy. Sorry!

ITunes match not working on ipad

iTunes match is not working on y iPad, one day all the music was there now I can't get it to work. It shows the iCloud symbol and after 30 seconds or so it disappears and a massage saying now music appears. What's going on???

Can't help -- on my iPhone, i've turned the toggle switch on in Setting>Music but it says I have not subscribed to iTunes Match and to go to iTunes on my computer and subscribe even though I have already. So, can't get iCloud to update music on my iPhone wirelessly.

NewText.match not working properly

I have a dynamic form that uses extensive Javascript. It works great when I open it in Adobe Reader 11 but when I open it with Adobe Reader 10.01 the following code in a text field change event does not execute correctly:
if (xfa.event.newText.match(/[^0-9-:;,]/))
    xfa.event.change = "";
else
    if (xfa.event.newText.length > 0)
        xfa.resolveNode("this.ui.#textEdit.border.fill.color").value = "255,255,255";
any ideas?
I have also noticed that the toUpperCase() function is not working either in version 10. Oddly, I tested it on the Linux Reader version 9.5 and it worked fine.
Message was edited by: Paul Dokken

Thanks a ton. That really helped a lot. Quick follow-up. There seems to be a problem if I change my second table. Here's my second table (SER_ENITY_USER) now:
ID INTERESTED_POSITIONS
141 SER_JOB_TYPE_PROMOTER:SER_JOB_TYPE_BOUNCER/SECURITY
Now if I run your updated query:
SELECT UNIQUE SER_CONTEST.ID
FROM SER_CONTEST, SER_ENITY_USER
WHERE DRAWING_POINT >= SYSDATE AND
SER_ENITY_USER.ENITY_ID = '141' AND
('%' || SER_CONTEST.TYPE_OF_USER || '%' LIKE '%' || SER_ENITY_USER.INTERESTED_POSITIONS || '%' OR '%' || SER_ENITY_USER.INTERESTED_POSITIONS || '%' LIKE '%' || SER_CONTEST.TYPE_OF_USER || '%')
With this query, it only pulls back the record with ID of 51, but it won't pull back the record with ID of 69.
I also noticed that if I change my table (SER_CONTEST) to the following:
ID TYPE_OF_USER
51 SER_JOB_TYPE_PROMOTER
69 SER_JOB_TYPE_KITCHEN_STAFF:SER_JOB_TYPE_PROMOTER:SER_JOB_TYPE_OTHER
46 -
Then my query pulls back the proper 2 records (with ID's of 51 and 69). Did I mess up on my query, or is this a different issue that hasn't been taken into account? Basically I want to find if any of the items for the value of a field appears in any items of the items for the value of the other field.
Like where if TYPE_OF_USER equals:
SER_JOB_TYPE_PROMOTER:SER_JOB_TYPE_BARBACK/BUSSER/RUNNER
And where if INTERESTED_POSITIONS equals:
SER_JOB_TYPE_KITCHEN_STAFF:SER_JOB_TYPE_PROMOTER:SER_JOB_TYPE_OTHER
This produces a match.
Or like where if TYPE_OF_USER equals:
SER_JOB_TYPE_BARBACK/BUSSER/RUNNER:SER_JOB_TYPE_PROMOTER:SER_JOB_TYPE_BARTENDER
And where if INTERESTED_POSITIONS equals:
SER_JOB_TYPE_KITCHEN_STAFF:SER_JOB_TYPE_BARTENDER:SER_JOB_TYPE_OTHER
This should also produce a match.
Message was edited by:
taneal

RV082 - SRP527W - VPN behind NAT not working

Hello,
I've really strange behaviors with my routers. We managed to get things running but once a week, the VPN link is down.
The connection is not restart, both routers shows "connected" but are not, and we had to click on "disconnect" to get the link back.
That was before an update in our infrastructure. Now, both routers are behind routers, so both NAT.
Now, the connection works for some time, but once a week, the link disconnected but i'm unable to get it back ! NOTHING works.
Last time, i spent 2Hours to configure the link again, setting the same parameters almost 10 time, and suddenly by magic, the 11st time it worked again. I read many people have troubles with RVXXX firmware so i don't know what to think.
Anyway, my BIG concern now, is that the link is down again, and it has been 6hours since we can't got it back. I restarted the routers many times, i've made some changes in the configuration, but if it worked, why should i modify it ?????? Why is it not working anymore ?
The log for the RV082 is almost empty about the link. Here's a snippet :
Feb 10 19:01:52 2014
VPN Log
(g2gips0) #8: initiating Main Mode
Feb 10 19:01:52 2014
VPN Log
(g2gips0) #8: [Tunnel Negotiation Info] >>> Initiator Send Main Mode 1st packet
Feb 10 19:01:52 2014
VPN Log
(g2gips0) #8: [Tunnel Negotiation Info] >>> Initiator Send Main Mode 1st packet
Feb 10 19:01:52 2014
System Log
gateway_to_gateway.htm is changed.
Feb 10 19:09:08 2014
VPN Log
(g2gips0): deleting connection
Feb 10 19:09:08 2014
VPN Log
(g2gips0) #8: deleting state (STATE_MAIN_I1)
Feb 10 19:09:08 2014
VPN Log
added connection description (g2gips0)
Feb 10 19:09:08 2014
VPN Log
listening for IKE messages
Feb 10 19:09:08 2014
VPN Log
forgetting secrets
Feb 10 19:09:08 2014
VPN Log
loading secrets from '/etc/ipsec.d/ipsec.secrets'
Feb 10 19:09:09 2014
System Log
gateway_to_gateway.htm is changed.
The log for the SRP527W is full of this :
Dump pluto log message in syslog : cat /var/log/messages |grep plutoJan 1 02:29:39 TLSR0254 authpriv.warn pluto[1156]: "G2" #187: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1Jan 1 02:29:39 TLSR0254 authpriv.warn pluto[1156]: "G2" #187: STATE_MAIN_R1: sent MR1, expecting MI2Jan 1 02:30:09 TLSR0254 authpriv.warn pluto[1156]: "G2" #186: max number of retransmissions (2) reached STATE_MAIN_R1Jan 1 02:30:19 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [RFC 3947] method set to=109 Jan 1 02:30:19 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109Jan 1 02:30:19 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109Jan 1 02:30:19 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]Jan 1 02:30:19 TLSR0254 authpriv.warn pluto[1156]: "G2" #188: responding to Main ModeJan 1 02:30:19 TLSR0254 authpriv.warn pluto[1156]: "G2" #188: transition from state STATE_MAIN_R0 to state STATE_MAIN_R1Jan 1 02:30:19 TLSR0254 authpriv.warn pluto[1156]: "G2" #188: STATE_MAIN_R1: sent MR1, expecting MI2Jan 1 02:30:25 TLSR0254 authpriv.warn pluto[1156]: pending Quick Mode with 37.1.XXX.XXX "G2" took too long -- replacing phase 1Jan 1 02:30:25 TLSR0254 authpriv.warn pluto[1156]: "G2" #189: initiating Main Mode to replace #185Jan 1 02:30:49 TLSR0254 authpriv.warn pluto[1156]: "G2" #187: max number of retransmissions (2) reached STATE_MAIN_R1Jan 1 02:30:59 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [RFC 3947] method set to=109 Jan 1 02:30:59 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03] meth=108, but already using method 109Jan 1 02:30:59 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02] meth=107, but already using method 109Jan 1 02:30:59 TLSR0254 authpriv.warn pluto[1156]: packet from 37.1.XXX.XXX:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]Jan 1 02:30:59 TLSR0254 authpriv.warn pluto[1156]: "G2" #190: responding to Main Mode
Please help me to get things sorted. I just don't understand why nothing is written in the log about the SRP trying to make a connection. I also don't understand why suddenly the link is broken, and without changing anything, it can't get it back normally !!
Best Regards

Hi again,
Samir, i rebooted all the routers dozens of time when that happened, and it doesn't changed anything. Anyway, i called the Cisco Hotline. They could connect by VPN to RV082, but not the SRP, they didn't know why. Hardware or software failure.
Anyway, i bought another router.
Now i would like to use the SRP527W as a WIFI hotspot only. It doesn't work.
My settings are :
- Router defined as BRIDGE only (using Port lan 4 as Ethernet WAN)
- WAN Interface is assigned 192.168.0.246 / 24
- Gateway for the WAN interface is 192.168.0.254
- Ethernet cable is plugged from LAN4/WAN to my new Modem/Router on LAN3.
- Port LAN2 of SRP527W is defined with VLAN IP Address 192.168.15.254.
When connected to the SRP527W on LAN2, from my computer (192.168.15.200), i can't ping 192.168.0.246 neither 0.254 (gateway is set to 15.254)
Still, when connected to the SRP527W and with the Ping Dagnosis interface, pinging "192.168.0.254" shows "timed out".
I tried almost every configuration, none worked.
Please note that when connected from my computer directly to my new modem/router on port LAN3, with IP Address 192.168.0.200, i can access internet and ping everything. When set as DHCP too, i can grab an IP Address from my DHCP Windows Server.
So, why is the SRP527W unable to work in this configuration ? it seems nothing pass through WAN port.
If i'm right, there is only the WAN port that should be plugged to my modem router. With this settings, SSID should go directly to Internet, and for the other SSID, my LAN (through the modem/router). However, it doesn't work.
Could you help me please ? Thank you

Validation of existing certificate does not work since release 9.3.3

Hi everyone,
Since I updated to Adobe Reader 9.3.3 the validation of digital signatures does not work properly anymore. Though I try to validate the certificate that used to be OK before the upgrade to 9.3.3 I now get an error on the same document and signature that used to work before. In the signature details Adobe Reader now states that "The certificate ...is not trusted...". This has to do with the new Adobe Approved Trusted list (AATL) I assume since nothing else changed.
Does anybody know a workaround or is anybody aware of a bugfix that will be released in the near future?
Thanks in advance,
Mike G

Works for me.
What OS/JDK etc are you using?

STUMPED! VPN into ASA5510 not working

Trying to setup remote vpn into a 5510, ran through the wizard, have the preshare and usernames, along with the pool configured. No errors when uploaded, but the Cisco VPN client does not connect at all, Reason 412. I have all crypto debugs running and I got nothing when I try to connect. If I had fat fingered the preshare or the username, I would at least think I would see some debug info when I tried to connect, but I got nothing. I have done this type of setup via the CLI on PIX and have not had problems, but I am not familiar with the new commands, and all I can find are stinking gui examples.

Well, I rebuilt from scratch through CLI, and at least now I have some debug output, but still stumped. Still get the same error with the client.
Jun 06 15:05:37 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Removing peer from peer table failed, no match!
Jun 06 15:05:37 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Error: Unable to remove PeerTblEntry
Jun 06 15:05:42 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Removing peer from peer table failed, no match!
Jun 06 15:05:42 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Error: Unable to remove PeerTblEntry
Jun 06 15:05:47 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Removing peer from peer table failed, no match!
Jun 06 15:05:47 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Error: Unable to remove PeerTblEntry
Jun 06 15:05:52 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Removing peer from peer table failed, no match!
Jun 06 15:05:52 [IKEv1]: Group = DefaultRAGroup, IP = 10.15.1.121, Error: Unable to remove PeerTblEntry

Itunes match not working on windows

On my windows pc, my itunes match is not working. When i look at my library it is all greyed out and itunes tells me to sign out and then sign back in on the itunes store. But that only fixes the problem temporarily. If i close itunes and reopen it, i have to do this process all over again. If anyone has any insight as to why this is happening it would be much appreciated.
OS: Windows 8
Itunes version: 11.0.5 (newest version at the time of writing this) 64 bit

I am having exactly the same issue and also for me "everything used to work fine". It's only been in the past 2 weeks when I deleted a bunch of songs that now my songs won't play, or the next song in the playlist plays while still showing the former song, or entire albums just don't play at all.
It seems like is started for me when I unchecked "show all music library" in my Music Settings so I would only see the music that I had downloaded to my phone. But I have tried "show all music" again and turning off and on iTunes Match but nothing seems to help.
This is a real problem...hopefully Apple can get this one fixed or someone has a solution...

ITunes match not working on any device?

I cannot get it working at all. When I try to enable on my iPhone it pops up the cloud and loading bar, then disappears almost straight away. If I try to load on Apple TV it says "there was a problem connecting to iCloud. Try again later" If I try on my Macbook it will send results, but will have the cloud with lightning bolt suggesting match is down...
Yet if I got to the iCloud status page everything is apparently fine and should be working. I cannot believe all 3 of my systems are wrong. I even did a full reset of my phone to be sure and still won't work.

iTunes Match has a series of updates / fix underway in the background, sadly no annoucement from Apple to cover. Suggest as a short term free alternate Google Play Music and the gBeats app on IOS - it just works for up to 20000 Songs.
iTunes Match is working in the UK but can be unusually slow, certainly it can not be relied upon - a great pity.

HT5637 Match not working on iPhone

I am on a road trip and I do not have my computer with me so the connect to itunes option that has been discussed will not work for me. How can I force a refresh for iTunes Match. I have tried turning match off and iCloud off with a restart between each. The content does not show up even a greyed out option is not showing.
What's the point of iTunes Match if I can't use it on the road. Pretty bummed without music on this road trip.

Hi Michael,
Thanks for coming back to me. I only subscribed to match a few days ago so definately using the same apple ID. Really frustrating.
When I sign back into the store on my iphone and go to turn on itunes match is gives me the subscribe message and when i go to enable automatic downloads it asks for the password, which I put in, and then it just keeps popping up again asking for the password, even although its the correct one going in.
As I said, my iphone is a device on the left hand side, but when I go to itunes in the cloud on my account its only my Ipad that is showing up.
New problem- since I switched itunes match off and back on again, I can enable the itunes match button on my Ipad but none of the music is showing- so neither device is working now. Really annoyed.

HT204406 itunes match not working

iTunes match is not working on my wife's iphone 4s. I have an ipad, my iphone and 2 pc's all linked to the same itunes account and have no problems connecting with them. The problem started this afternoon only on my wife's iphone 4s - trying to connect to match and it just hangs on the "Loading iTunes Match..." screen. Upgraded to iOS 7 but no cure.
Any ideas?

I had the same problem. My Match songs just did not show up. Here's what worked for me:
Quit iTunes
In the Finder top bar go to Go --> (hold down Option) --> Library
Navigate to the Preferences folder.
Find "com.apple.iTunes.plist" Throw it in the Trash
Restart iTunes.
Sign in to iTunes Store, then go to Store --> Turn On iTunes Match.
All is well.

ITunes match not working after restoring device

Hi!
I enabled iTunes Match on my iPhone 4.
I downloaded some songs to keep them stored on my device.
All worked like a charm.
I restored my iPhone 4 to correct some issue, but now the songs I downloaded doesn't play!
All my iTunes Match is working, except for those songs.
They still appear as downloaded on my device, if I tap on them, they appear as playing, but there is no sound, nor the playing bar goes on.
If I connect the iPhone to iTunes Mac via USB, this songs don't appear in the list.
How can I fix it?

iTunes Match has a series of updates / fix underway in the background, sadly no annoucement from Apple to cover. Suggest as a short term free alternate Google Play Music and the gBeats app on IOS - it just works for up to 20000 Songs.
iTunes Match is working in the UK but can be unusually slow, certainly it can not be relied upon - a great pity.

Anyconnect VPN Certificate-matching not working

Similar Messages

Maybe you are looking for