Cannot establish a working VPN connection...period

I am going nuts. I have been trying to get a vpn connection established for two weeks. I am using a Linksys BEFVP41 router and have tried to connect with Snow Leopard's built-in Cisco ipsec vpn, IPSecuritas, and VPN Tracker. No luck. I'm willing to replace the router with anything that will work. My office network consists of a vpn router, a droboshare that I want to be able to access remotely, and three office macs - two of the macs are MacBook Pros on which I want to be able to set up vpn connections. Any suggestion on a router, vpn client, configuration settings files, etc. would be greatly appreciated.

This may help: Mac OS X 10.5 VPN.

Similar Messages

Server name cannot be resolved using VPN connection

I've just installed Windows Server 2012 and Exchange 2013. I previously was using Windows SBS 2008 with Exchange 2007 and I was able to connect to the server via VPN and create an Outlook account and connect to the Exchange server no problems.
Now with the WS2012 and Exchange 2013 everything is working fine but when I connect to the VPN from outside the network and try to create a new Exchange account in Outlook, I get the error "The name cannot be resolved. The connection to Microsoft Exchange
is unavailable. Outlook must be online or connected to complete this action."
When I'm on the VPN I can ping both server name and IP address no problems so that isn't the issue. I've searched the net and tried multiple things including turning off firewall on both sides.
To clarify my setup I have two WS2012 servers. One is DC and VPN server, other is Exchange 2013 server which has both CAS and Mailbox roles.
I have a suspicion that the issue is to do with certificates. I don't have a valid bought SSL certificate, I am just using self-signed certificate. Can anyone verify that this is the issue or could it be something else?
Thanks.

Hi,
Since you don't have a valid SSL certificate, you can try to manually configure Outlook to connect to your Exchange server by the following steps:
Go to your Outlook mail settings from Start > Control Panel > Mail > Show Profiles > Add.
If you cannot locate the Mail icon in Windows Control Panel, turn on Classic View (click
Classic View on the left side of the Control Panel window).
Specify your Profile Name and click OK.
On the Auto Account Setup page, select Manually configure server settings or additional server types and then click
Next.
On the Choose Service page, select Microsoft Exchange or compatible service and click
Next.
On the Server Settings page:
- Specify your Server FQDN as Exchange server name (you can find it in HostPilot® Control Panel >
Users & Services > Advanced Settings).
- Type your Exchange Mailbox Username (email address).
- For the Offline use option, make sure that Use Cached Exchange Mode is selected.
- Click the More Settings button and switch to Connection tab.
- In Outlook 2013 you can specify the time period for which email items will be kept offline.
Select the Connect to Microsoft Exchange using the HTTP option and click the
Exchange Proxy Settings button.
-Specify Exchange proxy settings.
-Type the URL for your proxy server in the Use this URL to connect to my proxy server for Exchange field.
You can find the correct URL in HostPilot > Users & Services > Advanced Settings.
-Make sure that both the options On fast networks and On slow networks are checked.
-In the Proxy authentication settings box, choose Basic Authentication.
If you want to have Outlook save your password, read the Knowledge Base article on
How do I save my Outlook Password? for more information.
Click OK, then Apply, then OK
to return to the Add New Account window. Click Check Name.
If you have set everything up properly, you will see a window requesting authentication.
Enter the complete primary email address as the username, and enter the password for the mailbox.
If you have entered the username and password correctly, the username will now be underlined, and the entry in the Microsoft Exchange Server field will also be underlined.
Note: If your server is Exchange 2013 the server name will get underlined and will resolve into a name that looks like
[email protected].
Such a conversion is expected behaviour for Exchange 2013 mailboxes.
Click Next, then Finish, then OK to save changes.
Start Outlook and log in, using the same credentials as in step 9.
▲ Vote if Helpful / Mark if Answer
MCSE: Messaging 2013 Charter / Private Cloud / Server Infrastructure
MaximumExchange.ru

Cannot establish site-site vpn tunnel through ASA 9.1(2)

Hi,
We use ASA 9.1(2) to filter traffic in/out of our organisation. A dept within the organisation also have a firewall. They want to establish a site-site VPN tunnel with a remote firewall. We have allowed full access between the public address of the dept firewall and the remote firewall and full access between the remote firewall address and the dept firewall address . We do not use NAT.
The site-site VPN tunnel fails to establish.
The dept sysadmin has requested that we enable IPSec Passthrough. From my reading this will not make any difference as we allow full access between the firewalls in both directions. Is that correct?
Has anyone encountered issues with ASA 9.1(2) interfering with site-site tunnels?
Regards

>The dept sysadmin has requested that we enable IPSec Passthrough. From my reading this will not make any difference as we allow full access between the firewalls in both directions. Is that correct?
Yes, in that case, no IPsec-pass-through is needed. All you need is (in both directions):
UDP/500
UDP/4500 (also if you don't use NAT, the remote gateway could be located behind a NAT gateway)
IP/50
for testing ICMP/Echo
If you allowed full IP-access between these two endpoints, it is more than enough.
When they start testing, do you see a connection on your ASA. There should be at least UDP/500 traffic.
Can the two gateways ping each other?

Cannot establish multiple simultaneous PPTP connections with the CISCO 1841.

Hello everyone;
I have recently tested a PPTP connection with a CISCO 1841 router and got success. I have configured a windows 7 client and successfully connected to the router and was able to access the documents in the server PC that I have mentioned in the attached diagram. I have created number of different users  in the CISCO 1841 too. While some one is having a connection, another user cannot connect to it, which means multiple simultaneous connections aren't possible. Do I have to create a ACL for the PPTP and if yes, How ?
FastEthernet0/0 is up, line protocol is up
Internet address is 192.168.100.1/25
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is 100
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP fast switching on the same interface is disabled
IP Flow switching is disabled
IP CEF switching is enabled
IP CEF Feature Fast switching turbo vector
IP multicast fast switching is enabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Policy routing is disabled
Network address translation is enabled, interface in domain inside
BGP Policy Mapping is disabled
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
Inbound inspection rule is SDM_LOW
--------------------------------------------------------------------------------------------ACL 100-----------------------------
deny icmp any any echo-reply
deny ip host 255.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip host 66.163.169.186 any
permit ip any any (122467027 matches)

As long as you have the inspection engine enabled on the ASA, it shouldn't freak out of the different IP as it will inspect the call signalling and will NAT it accordingly, BUT, for simplicity, I agree with you, it would cause a lot of troubleshooting headache if there is problem as well as reconfiguration of IP on the host ends.
Here is the NAT FYI:
object network obj-10.10.96.0
   subnet 10.10.96.0 255.255.255.0
object network obj-192.168.96.0
   subnet 192.168.96.0 255.255.255.0
object network obj-10.10.14.0
   subnet 10.10.14.0 255.255.255.0
object network obj-10.1.0.0
   subnet 10.1.0.0 255.255.255.0
object network obj-192.168.1.0
   subnet 192.168.1.0 255.255.255.0
object network obj-10.10.11.0
   subnet 10.10.11.0 255.255.255.0
object network obj-192.168.11.0
   subnet 192.168.11.0 255.255.255.0
nat (inside,outside) source static obj-10.10.96.0 obj-192.168.96.0 destination static obj-10.10.14.0 obj-10.10.14.0
nat (inside,outside) source static obj-10.1.0.0 obj-192.168.1.0 destination static obj-10.10.14.0 obj-10.10.14.0
nat (inside,outside) source static obj-10.10.11.0 obj-192.168.11.0 destination static obj-10.10.14.0 obj-10.10.14.0

Cannot establish a correct FAX connection

We has one third party fax server(TOPCALL) to connect cisco IPIPGW(2811) through the H323 protocol to connect cisco voice gateway(2851) again to PSTN.The question is if dials to the fax server from PSTN a interior fax number to be able to hear to correct fax tone,But if interior dials exterior from the fax server the PSNT fax number not to be able to hear to correct fax tone. And if I direct fax server throug the H323 protocol and voice gateway connection,the fax tone in and out all is normal

This URL should help you:
http://www.cisco.com/en/US/tech/tk652/tk777/technologies_tech_note09186a0080114565.shtml

Can't connect to work VPN

Hi,
I've read through some previous posts, but haven't had luck connecting to the corporate VPN at work. I can sucessfully connect using a mobile wireless dongle (that uses the mobile telephony network) connected to my computer. I tested this to make sure everything works. Unfortaunately i cannot conect to work VPN server via my wireless LAN at home.
I'm using WRT54G2 linksys wireless router and have turned on the VPN options.
I can ping the VPN server, but I can't connect. I think it fails to authenicate, keeps trying, and I just have to cancel it after a few minutes.
Any ideas? Is it the router or could it be my service provider (iinet) that block the VPN connection somehow?
Thanks
Tim
Solved!
Go to Solution.

I tried connecting (with an ethernet cable) directly to the modem and I have the same problem.
I can still ping the VPN server at work, and I can access the internet fine except the VPN connection. It fails to connect to the VPN server and eventually times out. I get an error "VPN server failed to respond". I'm using Nortel VPN Client to connect (everything was installed and configured by my work IT).
I've asked by ISP (iinet) to open port 500udp (which is what my work IT guys suggested). I haven't heard back from my ISP yet.
I'll let you know if it works after I hear back from my ISP. Fingers crossed...
Tim

Mac Pro refuses to establish a vpn connection

Hello out there...
I have a 6 month old Mac Pro. Unfortunately this computer refuses to establish a reliable vpn connection to my office. All the other gear I have (powerBook, iPad and iPhone) does it.
The Mac Pro is erratic. Sometimes he connects but then all of a sudden after two or three minutes the vpn connection is beeing closed. The other day it works for hours....
He did so before the system upgrade and does it now after the upgrade to 10.6.8
I am realy desperate to get a solution for that....
All the best
Peter

Hi Kris,
The ASA supports different kinds of VPN, i.e. SSL (aka SVC for Ssl Vpn Client), IPsec or L2TP/IPsec.
For IPsec it suports both IKEv1 and IKEv2 (as of version 8.4).
On the client side,
the legacy Cisco VPN client uses IPsec with IKEv1.
Anyconnect 2.x uses SSL.
Anyconnect 3.x can use either SSL or IPsec/IKEv2.
So the Cisco clients do not use L2TP, but L2TP functionality is built-in in some OS's, like Windows and Android.
Personally I have not had the opportunity yet to lay my hands on an Android device to try this out, so I hope Michael or the people in the other thread can help you out if you need more details.
As to what's different, that's a short question with a long answer
One important difference between SSL and IPsec is that at some places IPsec may not work because the network provider blocks UDP500, while SSL uses TCP443 which is usually not blocked because it's the standard port for HTTPS.
Another one is that for Anyconnect, you need a license on the ASA (it does include a free license for 2 concurrent users).
Just a few pointers:
And probably Wikipedia is a good place to start reading as well if you want the full picture
hth
Herbert

AnyConnect on Apple iOS - VPN-Connect via HTTP-Proxy

Hi,
is it possible, that the AnyConnect-Client for Apple iOS (i.e. iPAD) automatically uses the configured HTTP-Proxy in the WLAN properties for the establishment of the VPN-Connection (via SSL/TLS)?
I've tested it, but it does not work. In the documentation is stated, that VPN establishment via HTTP-Proxy works only in Windows (AnyConnect uses the IE Proxy settings to connect to the ASA for VPN establishment).
Thanks

As per w2k3 sniffer trace, 2851 requesting with user=vpnfamily and encrypted password. The password "Password1" which is VPN group's key sending to IAS?
->I have "vpnfamily" with password "Password1" but no luck
Event log shows "Fully-Qualified-User-Name = INFRA\vpnfamily". INFRA is AD NetBIOS name. 2851 router's domain name is "family.com"
->Is this something wrong?

Cisco VPN Connection Problems

Hello Everyone,
We're having a problem with the Cisco VPN connection capability in Snow Leopard.
The transaction complains that our shared secret is incorrect. What I believe is happening is that certain assumptions are made about the IKE proposals and encryption etc. There doesn't appear to be a place to tailor these in the connection profile. There may be at the system level (which I'm unaware of).
Has anyone else experienced this problem?
I believe the same problem applies to the iPhone's Cisco VPN connector.
Furthermore, Cisco is not providing Snow-Leopard IPSec home-to-network clients any longer; they are promoting the AnyConnect SSL VPN instead, for which they have a BETA build available specifically for Snow Leopard.
So this reduces our options (yes, I'm working on VPNTracker).
Thank you.

It is a known limitation that you are only able to establish a single VPN connection to the same VPN server through a router doing NAT like yours.
What client exactly do you use and what settings did you define there?

Cannot establish a VPN connection in Lion

I have followed the instructions in this support article but cannot create a VPN connection:
http://docs.info.apple.com/article.html?path=Mac/10.6/en/9010.html
I've tried the steps outlined in this article, and successfully completed everything but still cannot create a VPN connection:
http://anders.com/guides/native-cisco-vpn-on-mac-os-x/
I have all the correct credentials for my VPN network (vpn address, group name, shared secret). I always receive a server time out error.
I am able to successfully connect to my work VPN using the Cisco VPNClient. But unfortunately it only runs in 32-bit mode. I prefer to boot in 64-bit mode and would prefer not to reboot everytime I want to establish a VPN connection.
I have been working on this issues for three days straight and am getting nowhere. My work is an unsupported IT environment, and the IT support subscription service we use will not handle any Mac issues.

Hmm, no changes. Still the same issue. I deleted the files described, rebooted and reconfigured the network.
hmm, Finder still remembers his old server connection settings, maybe i should delete those, too. Any idea where finder stores his server connections?
In my perception the message that no secure connection can be established comes up immediately after sending the connect command. I don't think that there is network traffic, there is no noticeable latency...

"Back to My Mac is turned on, your VPN connection cannot be established"?

Hi,
I searched for this recurring notice that I am getting " Because Back to My Mac is turned on, your VPN connection cannot be established", and came up with this thread: http://discussions.info.apple.com/message.jspa?messageID=8436720
However, I am not trying to establish a VPN when I get this message (and don't have one AFAIK).
Any idea what might be causing this message? I can't seem to figure out what triggers it, it just seems to pop up every hour or so. iChat is the only thing I have been using recently that seems to
Is there any way to discover what VPNs my laptop has set up? I don't have any additional software that is specific to VPNs, so it would have to be something already built into the OS. Does the Transmission application create a VPN? That is the only thing I can think of.
Any other ideas on what might be causing this message?
Your help is appreciated!
A.

If you have a VPN installed (by mistake?) you should be able to go to your System Prefs > Network and see the VPN listed in the left hand column along with Aiport and Ethernet. You can un-install by using the minus button at the bottom of the column.
The link provided shows you how to install a VPN client with screen shots, including one of this Network Prefs screen and what a VPN client looks like.
https://www.publicvpn.com/support/MacOSX105.php

AnyConnect 3.1.01065 error - Failed to install AnyConnect VPN Profile because of file move error. A VPN connection cannot be established.

I've got a user running:
AnyConnect 3.1.01065
on
Windows 7 64bit.
Several weeks ago she started encountering the following error:
-after logging into Windows and launching the AnyConnect client, she enters her username and password and successfully authenticates.
-the connection is not established and she's presented with the following message: "Failed to install AnyConnect VPN Profile because of file move error. A VPN connection cannot be established."
After doing some troubleshooting, inlcuding uninstalling/reinstalling the anyconnect client, it seems the culprit is the following file:
C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\<filename>.xml. When the problem occurs (which is not regularly, sometimes it occurs daily, sometimes just once a week) examining that file indicates it has no security or permissions set. Quitting the AnyConnect software, modifying the file so that the user has full control of it, then relaunching AnyConnect fixes the problem (until it happens again). Uninstalling, and making sure to move C:\ProgramData\Cisco to the trash, then reinstalling did not seem to help.
The closest match in these forums is the following thread, https://supportforums.cisco.com/message/3760446 - though no clear resolution was given.
Has anyone else encountered this, and been able to fix it?
Thanks much.

Just FYI, it seems at least in this case, purging all the previous system restore points seems to have resolved this issue...

Aiport Extreme cannot establish VPN connection through router must bypass

Hello - I own an Airport Extreme with the latest firmware update. I cannot connect to my work VPN through the Airport Extreme router. If I bypass the router and connect directly to my modem the VPN works fine. My VPN connections also work fine in any other internet hotspot. Any ideas Apple folks? I am using MacPro, and MacBook with bootcamp MacOSX and Windows XP Pro.

My workaround was taking the router back and getting a D-Link router. Had it set up in 10 minutes with the VPN working, and staying connected. I agree, there is something with the firmware on the router. Good luck!

Cannot establish VPN connection

I am using wicd to manage my network connections.
I am now trying to establish a VPN connection via pptpsetup, but it turned out that it failed to get a sucessful connection. The following is some debuging information:
PS:
I can use the VPN on my Android phone and Windows 8 computer with their default settings.
The router used is TP-LINK WR841N. I also tried to make the VPN connection throgh a Windows XP guest in my Virtualbox, but I get a 619 ERROR.
jiang:~/ $ sudo pon kierk debug dump logfd 2 nodetach
pppd options in effect:
debug # (from command line)
nodetach # (from command line)
logfd 2 # (from command line)
dump # (from command line)
noauth # (from /etc/ppp/peers/kirk)
name jiang # (from /etc/ppp/peers/kirk)
remotename kirk # (from /etc/ppp/peers/kirk)
# (from /etc/ppp/peers/kirk)
pty pptp xxx.xxx.xxx.xxx --nolaunchpppd # (from /etc/ppp/peers/kirk)
crtscts # (from /etc/ppp/options)
# (from /etc/ppp/options)
asyncmap 0 # (from /etc/ppp/options)
lcp-echo-failure 4 # (from /etc/ppp/options)
lcp-echo-interval 30 # (from /etc/ppp/options)
hide-password # (from /etc/ppp/options)
ipparam kierk # (from /etc/ppp/peers/kirk)
proxyarp # (from /etc/ppp/options)
nobsdcomp # (from /etc/ppp/peers/kirk)
nodeflate # (from /etc/ppp/peers/kirk)
require-mppe-128 # (from /etc/ppp/peers/kirk)
noipx # (from /etc/ppp/options)
using channel 21
Using interface ppp0
Connect: ppp0 <--> /dev/pts/1
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x71ca3d38> <pcomp> <accomp>]
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x71ca3d38> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x2c64d2c3> <pcomp> <accomp>]
sent [LCP ConfAck id=0x1 <asyncmap 0x0> <auth chap MS-v2> <magic 0x2c64d2c3> <pcomp> <accomp>]
rcvd [CHAP Challenge id=0x2b <a88a56750015778c17b36c340ab95b54>, name = "pptpd"]
Discarded non-LCP packet when LCP not open
sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x71ca3d38> <pcomp> <accomp>]
rcvd [LCP ConfReq id=0x2 <asyncmap 0x0> <auth chap MS-v2> <magic 0x170af2bc> <pcomp> <accomp>]
sent [LCP ConfAck id=0x2 <asyncmap 0x0> <auth chap MS-v2> <magic 0x170af2bc> <pcomp> <accomp>]
rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x71ca3d38> <pcomp> <accomp>]
sent [LCP EchoReq id=0x0 magic=0x71ca3d38]
rcvd [CHAP Challenge id=0x4f <e7fbc765e5caffc883e1fd5ac7ddd514>, name = "pptpd"]
Warning - secret file /etc/ppp/chap-secrets has world and/or group access
added response cache entry 0
sent [CHAP Response id=0x4f <6d44c943c527b9747f3a45fc527d2fe0000000037d7cd2d3359f8489fd322782173df80a2eb90bf200>, name = "jiang"]
rcvd [LCP EchoRep id=0x0 magic=0x170af2bc]
rcvd [CHAP Success id=0x4f "S=08E4FE5840F9196A9EF5377E65C8D20A2C030 M=Access granted"]
response found in cache (entry 0)
CHAP authentication succeeded
Couldn't set pass-filter in kernel: Invalid argument
sent [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
rcvd [CCP ConfReq id=0x1 <mppe +H -M +S -L -D -C>]
sent [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>]
rcvd [CCP ConfAck id=0x1 <mppe +H -M +S -L -D -C>]
MPPE 128-bit stateless compression enabled
sent [IPCP ConfReq id=0x1 <compress VJ 0f 01> <addr 192.168.0.103>]
rcvd [IPCP ConfReq id=0x1 <addr 172.16.36.1>]
sent [IPCP ConfAck id=0x1 <addr 172.16.36.1>]
rcvd [IPCP ConfRej id=0x1 <compress VJ 0f 01>]
sent [IPCP ConfReq id=0x2 <addr 192.168.0.103>]
rcvd [IPCP ConfNak id=0x2 <addr 172.16.36.5>]
sent [IPCP ConfReq id=0x3 <addr 172.16.36.5>]
rcvd [IPCP ConfAck id=0x3 <addr 172.16.36.5>]
Cannot determine ethernet address for proxy ARP
local IP address 172.16.36.5
remote IP address 172.16.36.1
Script /etc/ppp/ip-up started (pid 13121)
Script /etc/ppp/ip-up finished (pid 13121), status = 0x0
Last edited by hellolj (2014-06-24 03:13:14)

Hi,
I don't want to sound sarcastic but why didn't you try moving to the NetworkManager utility, I remember well that (yeah it's a Shitian) back in Backtrack 5 and even the fourth connexions were managed by wicd and always caused troubles at some point. NetworkManager handles very well VPN connections without problems and still allows you to make advances configurations. Maybe you should consider trying it in your Virtual Box and post results. Sometimes thiking easy avoids headaches and lets you relax.
On the other hand, it is true that router's "PPTP & VPN passthrough" option can cause troubles when using VPNs, and catalin's solution might be the best, but unless you absolutely need to use wicd (I can't think of a reason right now), you should consider easing things up with NetworkManager. Again just my belief.
Are you trying to connect a VPN or create a VPN connection betweed two points ?
Hope this helps.
Last edited by sugartest (2014-07-10 13:12:57)

I started getting messages 3 days ago that my Safari cannot establish a secure connection to Facebook, and it will not open that website. It worked fine for years before this occurred 3 days ago, what can I do to fix it?

I started getting messages 3 days ago that my Safari cannot establish a secure connection to Facebook, and it will not open that website. It worked fine for years before this occurred 3 days ago, what can I do to fix it? OS 10.8.3, Safari 6.0.4

From your Safari menu bar click Safari > Preferences then select the Privacy tab.
Click: Remove All Website Data
Then delete the cache.
Open a Finder window. From the Finder menu bar click Go > Go to Folder
Type or copy paste the following
~/Library/Caches/com.apple.Safari/Cache.db
Click Go then move the Cache.db file to the Trash.
Quit and relaunch Safari to test.
If nothing above helped, troubleshoot Safari extensions.
From the Safari menu bar click Safari > Preferences then select the Extensions tab. Turn that OFF, quit and relaunch Safari to test.
If that helped, turn one extension on then quit and relaunch Safari to test until you find the incompatible extension then click uninstall.

Cannot establish a working VPN connection...period

Similar Messages

Maybe you are looking for