Cisco AnyConnect VPN client and 256 AES encryption in IE8

Hey,
We have a site that we are trying to connect to with the AnyConnect VPN client version 2.5.3055 on Windows XP SP3. As soon as we enter the site info and hit select, it says a connection was unable to be established.
I believe this has to do with the encryption, its set up with 256 bit AES. We are only able to install IE8, which on XP only supports up to 128 bit encryption, so in IE8 the page will not load. To fix that issue we installed firefox which supports 256 bit encryption. We can get to the page there, but when we go to connect to the same site VIA the VPN client it still will not connect. It will work fine on a windows 7 box with IE9 installed from the same network.
My question mainly pertains to how the AnyConnect client connects on the back end. Does it use Internet explorer's SSL layer by default? Or does it have its own? If it connects through internet explorer, is there a way to change it to firefox so it will actually be able to open up a connection?
Thank you for your answers in advance,
John

Hey Jeff,
Thanks for answering that question. Hmm, so it doesnt go through the browsers SSL layer. We have systems on the same network (same proxy, firewall, vlan, etc). All the systems with windows XP SP3 and IE8/IE7 can not connect to the VPN (they arent even able to start the connection and ask for proxy/logon info.), all the systems with windows 7 and IE9 can. Same setups on each one as far as the security policies go as well. I thought it may have to do with the 256 bit encryption that they are using.
If thats not the case, what else could be causing the problem? weve tested it on about 5 XP machines and 5 Win 7 machines, same results on each. Connects on Win 7, does not connect on Win XP.
Thanks,
John

Similar Messages

Trouble with Cisco Anyconnect VPN Client

Hello,
our Cisco AnyConnect VPN Client has stopped working, we are a medical office and we are attempting to connect to "clientvpn.e-mds.com" however it will not connect, the username and password we input are irrelevant it doesnt come up with a "wrong credentials" window it just erases the password and at the bottom of the window it says "Please enter your username and password". our version is 2.5.0217 does anyone know anything to try? any help would be appreciated

you may want to try the OS X networking forums:
http://discussions.apple.com/forum.jspa?forumID=733

Problem using SunRay with Cisco AnyConnect VPN Client

I am using Cisco AnyConnect VPN Client Version 2.5.3046
I have a PC and a SunRay connected to my router. I use VPN to connect my SunRay and my PC to my work computer. My PC works fine, I am able to connect to the internet and also run cisco VPN to connect to my work computer. But when I try to use my SunRay, I get a window on the screen with the message:
VPN IKE Phase 1 agg I msg1This window keeps moving around on the screen. I am not able to connect my SunRay through VPN to my work computer. Any idea what could be wrong and how I can fix this?

2.2 is definitely better.
On one PC, I'm fine. On another -- very similar -- it tells me it can't start the VPN even after uninstalling and re-installing and everything else I can think of, with plenty of re-boots inbetween.
Aaaaarrrrrrggggggghhhh.

Cisco IPSec VPN Client and sending a specific Radius A-V value to ACS 5.2

This setup is to try routing Cisco VPN to either RSA or Entrust from Cisco ACS 5.2, depending on some parameter in incoming AUTH request from Cisco IPSec VPN Client 5.x. Tried playing with pcf files and user names/identity stores, none seems working

Hi Tony,
to the best of my knowledge this is currently not possible, but will be once this enhancement is implemented:
CSCsw31922 Radius upstream VSAs (Tunnel Group,Client type) for VPN policy decisions
You may want to try and ask in the AAA forum if there is anything you can do on ACS...
hth
Herbert

Idle timeout for cisco anyconnect vpn client

Hi All,
Can you please let me know how to set idle timeout for the cisco vpn client, I configured the idle timeout setting under the group policy for the ssl vpn but it is not making any difference, is there any bug in asa firmware ? but I am using the latest version 9.3(2) now but this change is not taking any effect.
Please let me know if you need more information, config etc ?
Thanks

Hi Alex,
That file is indeed subjected to the same download restrictions than the other Anyconnect client files. You should contact the person who provided you with the Anyconnect client installer, or who is managing the ASA that you are connecting to, asking her/him to get the file and provide it to you - that person should have the necessary access rights.
Alternatively there is a command line interface executable provided as part of the Anyconnect client, which can return tunnel statistics (among which tunnel status) - invoking that program and parsing the output should be doable from pretty much any programming/scripting tool - not the most optimal approach in C++ though, but you wouldn't need anything else than what is provided with the client software.
The executable is with the other Anyconnect client files and is named vpncli.exe.
Try vpncli -h to get the argument syntax.
I hope it helps, please let me know.
Best regards,
Christophe

Inbuilt cisco IPSEC vpn client and KeyLife Timeout setting...

Hi Guys
I am having issues with the in built cisco vpn client on the mac, I am currrently using Mac OSx 10.7.4
I have a Fortigate 200B device and have setup the IPSec VPN settings to have a keylife of 86400 seconds.
However the expereince I am having with the mac clients is that after about 50 minutes the users are being asked to re-authencate to the VPN...
When checkin the debug logs I can see that the peer (mac client) is setting the phase 2 tunnel key lifetime to 3600 seconds which is 1 Hour...
Usually in IPSec a re-negeotiation process takes place about 10 minutes or so before the key expires..
My question is where are the VPN settings kept in the Mac... I know it uses Racoon for the IPSec exchange of key and so I would like to tweak the VPN profiles so that the mac sets the lifetime of the key to 86400 instead of 3600 by default...
Also want to be able to set logging to debug mode for the Racoon application on mac clients.
Your help is much appreciated
Kind Regards
Mohamed

Hi Tony,
to the best of my knowledge this is currently not possible, but will be once this enhancement is implemented:
CSCsw31922 Radius upstream VSAs (Tunnel Group,Client type) for VPN policy decisions
You may want to try and ask in the AAA forum if there is anything you can do on ACS...
hth
Herbert

Cisco AnyConnect VPN won't install, says There is a newer version of the AnyConnect client already installed

I had an issue with my Cisco Anyconnect VPN not working, so uninstalled it. I've tried a new install and now I get the message "There is a newer version of the AnyConnect client installed" and it won't tell me install it at all. I've gone through various recommendations on the site included this :-
Go to "Regedit" and search for "Deterministic Networks" and delete it.
HKEY_LOCAL_MACHINE \SOFTWARE\Deterministic Networks
Search with the following keywords in the registry, under "Uninstall" or "Components" folders and delete any related entries.
Vpnapi
Vpngui
Cisco
CVPND
CVPNDRA
Ipsecdialer
Source: https://supportforums.cisco.com/message/3728011#3728011
But I've still got the same problem, and just cant find anything to help !

Disable Internet Connection Sharing (ICS) and then try You can disable ICS in two ways:
Per Adapter:
Click the Start button.
Click on Control Panel.
Click on View Network Status and Tasks
Click on Change adapter settings
Right-click the shared connection and choose Properties
Click the Sharing tab
Clear the Allow other network users to connect through this computer's Internet connection checkbox
Click OK
System Wide:
Click the Start button (Windows' orb)
Type: services.msc and press ENTER
Double-Click on Internet Connection Sharing (ICS)
Change Startup Type to Disabled
Reboot the computer
You can now try reinstalling the WiscVPN client again

Issue with Mac OS 10.8.3 and Anyconnect VPN Client 3.1.02026

Hi all,
I am running Anyconnect VPN Client 3.1.02026 on Mac OS X 10.8.3. I am unable to connect to my corporate network as the connection fails with following error :
The VPN client was unable to successfully verify the IP forwarding table modifications. A VPN connection will not be established.
Can anyone suggest remedies. I am completely stuck. I had an older AnyConnect client and it was working until a few days back when it stopped working. I then upgraded to 3.1.02026.
As suggested in some of the pots on the web, i have disabled the following AirPort, Bonjour, Bluetooth, Adium, restarted after these changes and yet i am seeing this.
My company has corporate license for Cisco AnyConnect VPN.
TIA
kumar

MartyP wrote:
Or is there a problem with both OS's writing stuff to the
~/Home/Library folder that may be incompatible?
Yes, big time. Mail, for sure, has a different file/folder structure, and would not be happy.
Plus, a number of apps (Apple and 3rd-party) are "Sandboxed." That's a security feature, to prevent malware or bad coding from affecting things it shouldn't. Some of their files, including the preferences files, aren't even stored in the same places!
Or to other places I'm not aware of?
Probably. If you have two versions of the same app, they may or may not expect the same data setup.
To have one User folder for both OS's would save a lot of drive space
Not if you use some or all of woodmeister50's suggestions.
But I'm also not sure how I'd use Time machine with such a set up.
Just as you do now. By default, Time Machine backs-up everything (except things like system work files, most caches and logs, trash) for all users and all internal drives & partitions. By default, it excludes external drives.
You can change those defaults, of course, via TM Preferences > Options.
See Time Machine - Frequently Asked Question #32 for details and considerations of multiple drives.
Presently I backup with . . . clones to other HD's
Good. Yes, clones are different. You need multiple "tasks" to back up multiple drives/partitions. But once set up, that shouldn't be a big deal.

Mail and SMTP server settings of ASA Certificate Authority for cisco anyconnect VPN

Dear All,
i have the folloing case :
i am using ASA as Certificate authority for cisco anyconnect VPN users,the authentication happens based on the local database of the ASA,
i want to issue a new certificate every 72 hours for the users ,and i want to send the one time password via email to each user.
so what the setting of the mail and smtp server should be ,
was i understand i should put my smtp server ip address then i have to create the local users again under(Remte VPN VPN--Certificate management--Local certificate authority --Manage user Database) along with their email addresses to send the one time passsword to them via their emails.
i sent the email manually ,hwo can automate sending the OTP to our VPN users automatically vi their emails?
Best regards,

Thanks Jennifer.
I did manage to configure LDAP attribute map to the specific group policy.
Nevertheless, I was thinking whether I can have fixed IP address tied to individual user.
Using legacy Cisco VPN Client, I can do it using IPSEC(IKEv1) Connection profile, where I set Pre-Shared Key and Client Address Pools. Each Client Address Pools has only 1 fix IP address.
Example: let say my username is LLH.
Connection Profile for me is : LLH-Connection-Profile, my profile is protected by preshared key.
Client Address Pool for me is : LLH-pool, and the IP is 172.16.1.11
Only me know the preshared key and only me can login with my Connection Profile.
Using AnyConnect, I have problem. User can use any connection profile because I cannot set preshared key for AnyConnect. In that case, I cannot control who can use my Connection Profile and pretend to be me.
Example:
AnyConnect Connection Profile for me is : LLH-Connection-Profile, without any password
Client Address Pool for me is : LLH-pool, IP is 172.16.1.11
Any body can use LLH-Connection-Profile, login with another user name, let say user-abc which is a valid user in LDAP server. In that case, ASA assign 172.16.1.11 to user-abc and this user-abc can access server which only allow my IP to access.
I hope above description can paint the scenario clearer.
Thanks in advance for all the help and comment given.

Mavericks VPN dropouts with native VPN client and Cisco IPSec

Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
I am connecting via a WIFI router to a remote VPN server
The conenction is good for a while but eventually it drops out.
I had Zero issues in mountain lion and only have issues since the update to 10.9
I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
My thoughts are:
1 -issue with mavericks ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
2- Issue with cisco router compaitibility or timing with Cisco IPSEC
3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
Any thousuggestions?

Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
I am connecting via a WIFI router to a remote VPN server
The conenction is good for a while but eventually it drops out.
I had Zero issues in mountain lion and only have issues since the update to 10.9
I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
My thoughts are:
1 -issue with mavericks ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
2- Issue with cisco router compaitibility or timing with Cisco IPSEC
3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
Any thousuggestions?

Cisco ASA 5505, Cisco VPN Client and Novell Netware

Hi,
Our ISP have installed Cisco ASA 5505 firewall. We are trying to connect to our Novell 5.1 server using VPN client.
I installed VPN client on a laptop that is using wireless connection. I connect using wireless signal from near by hotel and I am able to connect to my firewall usinging vpn client and also able to login in using Novell client for XP.
When I use same vpn client and Novell client at home that is not using wireless connection, but DSL connection amd not able to login or find the tree.
The only difference in two machine is laptop using wireless connection and my home machine is using wired connection using DSL.

If your remote end of the services in question support IPsec IKEv1 as the VPN type then, yes - the 5505 can be a client for that service. At that point it looks like a regular LAN-LAN VPN which is documented in many Cisco and 3rd party how-to documents.

Boot camp with Cisco VPN client and smart card

Looking at a Macbook or Macbook Air and the only reason I need to run windows is to be able to access my work network through the Cisco VPN client and my Smartcard then use remote desktop. From my understanding if I run Bootcamp it should work am I correct? Im going to an Apple store tomorrow hopefully they can help too.
Thanks

mrbacklash wrote:
Ok with that being said will the MBA 11.6 1.4ghz have the guts to make it run mostly internet based programs over the VPN connection?
I think if you are running apps over the Internet the bottleneck will be the Internet and your VPN bandwidth. Your computer can certainly execute faster than Internet communications.
Besides, Internet or remote applications run on the remote server. All your local computer does is local processing of the data if necessary.
Message was edited by: BobTheFisherman

Problem with Cisco VPN client and HP elitebook 2530p windows 7 64-bit

Hi there
I have a HP Elitebook 2530p which i upgraded to windows 7 64-bit. I installed the Cisco VPN client application (ver. 5.0.07.0290 and also 64-bit) and the HP connection manager to connect to the internet through a modem Qualcomm gobi 1000 (that is inside the laptop). When I connect to the VPN, it connects (I write the username and password) but there is no traffic inside de virtual adapter for my servers. When I connect to the internet through wire or wireless internet, I connect de VPN client and there is no problem to establish communication to my servers.
I tried everything, also change the driver and an earlier version of the HP connection manager application. I also talked to HP and they told me that there was a report with this kind of problem and it was delivered to Cisco. I don’t know where is the problem.
Could anyone help me?
Thanks to all.

You can try to update Deterministic Network Enhancer to the below listed release which supports
WWAN Drivers.
http://www.citrix.com/lang/English/lp/lp_1680845.asp.
DNE now supports WWAN devices in Win7. Before downloading the latest version of DNEUpdate from the links below, be sure you have the latest
drivers for your network adapters by downloading them from the vendors websites.
For 64-bit: ftp://files.citrix.com/dneupdate64.msi
Hope that helps.

Cisco VPN Client and Border Manager

Don't know if this is the correct spot, but here goes. We are using BM 3.8sp4 using proxy, and NAT. We have a contractor that needs to access his company network using a Cisco VPN Client Ver 5. They have Enable Transparent Tunneling checked in the client and IPSec over TCP port 1000.
Is this a filter exception to let it out or something else I need to set up?

Port 1000, or 10000? (10,000 is something I've seen in the past, and
is what I used for the example in my BMgr filtering book. See URL
below).
You would probably need to open two ports up, in FILTCFG, from private
to public interfaces. First, IKE-st (UDP 500). Next, make a custom
stateful one for port 1000 (or whatever), probably UDP.
The last Cisco IPSec VPN client I used through BMgr needed UDP 500 and
UDP 4500 opened, just like the Novell IPSec VPN client. So I was able
to use the definitions supplied by Novell in FILTCFG. In your case,
you will probably have to add at least one custom exception.
Filter debug will tell you what is being filtered, if you know how to
use it. Or get PKTSCAN.NLM from download.novell.com, load it on the
server, and capture packets. Look at them on the server, or use
Wireshark, and you will see what protocol/ports are being sent from the
client IP address.
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***

Unable to unistall Cisco AnyConnect VPN - please help

I have upgraded to Windows 8.1 preview on my Surface Pro. My Cisco AnyConnect VPN stopped working. When I uninstalled the software it left the ‘Cisco AnyConnect VPN Virtual Miniport Adapter for Windows x64’ under the network adapters in Device Manager. No matter what I do, I cannot uninstall it from there. I tried everything including uninstalling in safe mode. I says it uninstalled but still appears there. I believe because of this, my internet connection performance has decreased tremendously. It also disconnects and reconnects sometime after. My other computers work perfectly with maximum speed.
Please Help.
Thanks,
Mike

Windows Event Log detail as follows:
Faulting application name: vpnagent.exe, version: 3.1.4066.0, time stamp: 0x52211732
Faulting module name: Dbghelp.dll, version: 6.3.9600.16520, time stamp: 0x52e690ac
Exception code: 0xc0000005
Fault offset: 0x00029132
Faulting process id: 0x1e74
Faulting application start time: 0x01d02328f37bd890
Faulting application path: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
Faulting module path: C:\Windows\SYSTEM32\Dbghelp.dll
Report Id: 31beb6d1-8f1c-11e4-8278-54271ebdf9a6
Faulting package full name:
Faulting package-relative application ID:

Cisco AnyConnect VPN client and 256 AES encryption in IE8

Similar Messages

Maybe you are looking for