Problem establishing SSL VPN from only 1 IP address

Hi,
I'm experiencing strange problem.
I can't establish SSL VPN connection from 1 IP address, but I don't have problem establishing SSL VPN from any other IP address.
Remote IP address: 10.0.0.1
ASA's public IP address: 192.168.1.1
Output of packet-tracer:
1. with problematic source IP address:
packet-tracer input wan tcp 10.0.0.1 50601 192.168.1.1 443 detailed
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.1.1   255.255.255.255 identity
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff37573f00, priority=119, domain=permit, deny=false
        hits=861, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=443, dscp=0x0
        input_ifc=wan, output_ifc=identity
Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff38a10a50, priority=8, domain=conn-set, deny=false
        hits=4069, user_data=0x7fff38770910, cs_id=0x0, reverse, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
        input_ifc=wan, output_ifc=identity
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff395c7d70, priority=0, domain=inspect-ip-options, deny=true
        hits=4044934, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=wan, output_ifc=any
Phase: 5
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff37560700, priority=13, domain=ipsec-tunnel-flow, deny=true
        hits=2268518, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=wan, output_ifc=any
Phase: 6
Type: TCP-MODULE
Subtype: webvpn
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff38a10cc0, priority=13, domain=soft-np-tcp-module, deny=false
        hits=4627, user_data=0x7fff38c14300, cs_id=0x0, reverse, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
        input_ifc=wan, output_ifc=identity
Phase: 7
Type: VPN
Subtype: encrypt
Result: DROP
Config:
Additional Information:
Reverse Flow based lookup yields rule:
out id=0x7fff375504a0, priority=69, domain=encrypt, deny=false
        hits=40747, user_data=0x0, cs_id=0x7fff3754fa40, reverse, flags=0x0, protocol=0
        src ip/id=192.168.1.1, mask=255.255.255.255, port=0
        dst ip/id=10.0.0.1, mask=255.255.255.255, port=0, dscp=0x0
        input_ifc=any, output_ifc=wan
Result:
input-interface: wan
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
If I run packet-tracer with any other source IP address, let's say 10.0.0.2, everything is OK:
packet-tracer input wan tcp 10.0.0.2 50601 192.168.1.1 443 de
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.1.1   255.255.255.255 identity
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff37573f00, priority=119, domain=permit, deny=false
        hits=862, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=443, dscp=0x0
        input_ifc=wan, output_ifc=identity
Phase: 3
Type: CONN-SETTINGS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff38a10a50, priority=8, domain=conn-set, deny=false
        hits=4090, user_data=0x7fff38770910, cs_id=0x0, reverse, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
        input_ifc=wan, output_ifc=identity
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff395c7d70, priority=0, domain=inspect-ip-options, deny=true
        hits=4047886, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=wan, output_ifc=any
Phase: 5
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff37560700, priority=13, domain=ipsec-tunnel-flow, deny=true
        hits=2270040, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=wan, output_ifc=any
Phase: 6
Type: TCP-MODULE
Subtype: webvpn
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff38a10cc0, priority=13, domain=soft-np-tcp-module, deny=false
        hits=4648, user_data=0x7fff38c14300, cs_id=0x0, reverse, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=192.168.1.1, mask=255.255.255.255, port=443, dscp=0x0
        input_ifc=wan, output_ifc=identity
Phase: 7
Type: USER-STATISTICS
Subtype: user-statistics
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
out id=0x7fff3a1cc320, priority=0, domain=user-statistics, deny=false
        hits=4902651, user_data=0x7fff3a0043c0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
        input_ifc=any, output_ifc=wan
Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 4384689, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_tcp_mod
snp_fp_adjacency
snp_fp_fragment
snp_fp_drop
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-interface: wan
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: allow
I run packet capture on WAN interface - and I can only see incoming packets (SYN) with destination to tcp/443 but there isn't any outgoing packet (SYN/ACK).
I even can't open web page from internet browser (url https://192.168.1.1) when source IP is 10.0.0.1, but I can open "SSL VPN Service" web page from any other source IP address.
The only thing different with this IP address is that there's configured site-to-site (IPsec) vpn tunnel from same source to same destination IP address.
Here is the configuration of the tunnel:
group-policy GroupPolicy_10.0.0.1 internal
group-policy GroupPolicy_10.0.0.1 attributes
vpn-filter value VPN-ACL
vpn-tunnel-protocol ikev1 ssl-client
access-list VPN-ACL:
access-list VPN-ACL extended permit ip object-group DM_INLINE_NETWORK_83 object-group DM_INLINE_NETWORK_84
object-group network DM_INLINE_NETWORK_83
network-object 10.11.217.0 255.255.255.0
network-object 192.168.201.0 255.255.255.0
object-group network DM_INLINE_NETWORK_84
network-object 10.11.217.0 255.255.255.0
network-object 192.168.201.0 255.255.255.0
tunnel local & remote networks:
access-list wan_cryptomap_5 extended permit ip 10.11.217.0 255.255.255.0 192.168.201.0 255.255.255.0
crypto map wan_map 5 match address wan_cryptomap_5
crypto map wan_map 5 set connection-type answer-only
crypto map wan_map 5 set peer 10.0.0.1
crypto map wan_map 5 set ikev1 transform-set ESP-3DES-SHA
I've configured the same setup in my lab and I can't reproduce the error.
The SW version running on ASA is asa861-12.
I'm out of ideas.

Just collected some other information:
1. traceroute shows that traffic is not leaving ASA at all
1   * * *
2   * * *
3   * * *
I double checked that there is no "strange" entry for remote public IP in routing. Traffic with destination to remote IP should be sent via default gateway like all other traffic.
2. debug crypto ipsec shows this information when I ping public IP address of the remote host (with VPN
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=192.168.1.1, sport=30647, daddr=10.0.0.1, dport=30647
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 1: skipping because 5-tuple does not match ACL wan_cryptomap_1.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 2: skipping because 5-tuple does not match ACL wan_cryptomap_2.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 3: skipping because 5-tuple does not match ACL wan_cryptomap_3.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 4: skipping because 5-tuple does not match ACL wan_cryptomap_4.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 5: skipping dormant map.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 5: skipping dormant map.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 6: skipping because 5-tuple does not match ACL wan_cryptomap_6.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 7: skipping because 5-tuple does not match ACL wan_cryptomap_7.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 8: skipping because 5-tuple does not match ACL wan_cryptomap_8.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 9: skipping because 5-tuple does not match ACL wan_cryptomap_9.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 10: skipping because 5-tuple does not match ACL wan_cryptomap_10.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 11: skipping because 5-tuple does not match ACL wan_cryptomap_11.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 13: skipping because 5-tuple does not match ACL wan_cryptomap_13.
IPSEC(crypto_map_check)-5: Checking crypto map wan_map 65535: skipping dynamic_link.
IPSEC(crypto_map_check)-1: Error: No crypto map matched.
It really seems that the whole problem is that ASA is trying to encrypt traffic sent from public IP address of one VPN endpoint and targeted to public IP address of another VPN endpoint and send it to remote VPN endpoint via IPcec tunel.
There is indeed VPN tunnel established between both VPN endpoints, but there are just local and remote networks defined with private IP address space for this tunnel, VPN endpoint's public IP addresses are not included in the definition of this IPsec VPN tunnel.
And there are at least two more IPsec VPN tunnels configured the same way and I can't reprodure this error on there two VPN tunnels.
Any idea?

Similar Messages

SSL VPN and dedicated IP address

Hello
I have an ASA 5505 8.3 and i setup it with ADSL 6.3
I am trying to dedicate IP addresses to clientless SSL VPN user: is it possible ?
If not is it possible with Anyconnect client ?
If yes i can't perform it !
I have a user test and i want dedicated him an IP address . After authentification user can connect to a web application but when i see the netstat, it is the IP adress of the ASA which is connected ...
Could you help me ?
Regards
L.Malandain

Two ways -
Frist create pool with one IP address and assign that to group policy.
Second- modify the user atributes-
username test password xxxxx
username test attributes
vpn-framed-ip-address
Thanks
Ajay

Strange problem with ORA-12154 from only one client

Hi all,
I have a strange problem.
I have three 11.2.0.1 databases on three different hosts.
For simplicity lets say:
Host1: database ovm1a
Host2: database ovm7a
Host3: database ovm8a
I have a database schema in all three databases named EHJ. In all three databases, there are fixed user
database links to the other databases. So EHJ in ovm1a has two links, one to ovm7a and one to ovm8a. The EHJ schema in ovm7a has two fixed user links to the EHJ schema in the ovm1a and ovm8a databases. And the same is true for the EHJ schema in the third database, ovm8a.
If I log into the EHJ schema for each of the three databases, I can successfully select over the database links. I've been using the SQL statement: select count(*) from user_users@dblink_name;
For each of the two links in each of the three databases, the query returns 1 so I know the database links are working properly and I have my networking setup properly.
Now, here is the weirdness.
I have an Oracle Application Server where our Oracle Forms and Reports run. The Oracle client on this install is 10.1.0.5. I've got a tnsnames.ora file setup on this Oracle App server to connect to all three databases ovm1a, ovm7a and ovm8a. I can successfully use the 10.2.0.5 client SQL*PLUS to connect to the EHJ schema in the ovms1, ovms7 and ovms8 databases.
However, (and only when) connected to the ovm1a database from this client, attempts to select over the link throw the famous error: ORA-12154: TNS:could not resolve the connect identifier specified
This error happens with both links in the ovm1a database when connected via this one client.
BUT, if I connect using the same 10.1.0.5 client to the EHJ schema in the ovm7a or ovm8a databases, the database links in those two databases are working just fine.
I'm pulling my hair out trying to figure this out.
I've tried using SQL*PLUS from my desktop machine (10g R2 client) connecting to the EHJ schema on all three databases and the db links all work fine.
Any help in trying to troubleshoot this would be greatly appreciated.
Cheers

JSebastian wrote:
I have an Oracle Application Server where our Oracle Forms and Reports run. The Oracle client on this install is 10.1.0.5. I've got a tnsnames.ora file setup on this Oracle App server to connect to all three databases ovm1a, ovm7a and ovm8a.But the client (and tnsnames.ora) in question here is actually one (each) of the three databases, right? I.e. error is thrown by the db server, acting as client (db link side).
>
However, (and only when) connected to the ovm1a database from this client, attempts to select over the link throw the famous error: ORA-12154: TNS:could not resolve the connect identifier specified Connected how, as opposed to when you "successfully select..."?
This error happens with both links in the ovm1a database when connected via this one client.Does Oracle config files on ovma1 host differ from the other two db hosts?
Does
SQL> select property_name,property_value from database_properties
2 where property_name in ('GLOBAL_DB_NAME','NLS_RDBMS_VERSION');
SQL> select owner,db_link,host from dba_db_links;return as expected on all three db's?
I've tried using SQL*PLUS from my desktop machine (10g R2 client) connecting to the EHJ schema on all three databases and the db links all work fine.Make sure you are connecting to correct databases. (Simply, three tns aliases could all be pointing to the same database.)
Edited by: orafad on May 25, 2011 11:24 PM

Why does SSL VPN require client for full functionality?So What's the point?

I was interested in SSL VPN because I thought that I could have the same functionality I have when connecting via Cisco VPN 3000 concentrator (IPSec with AH and ESP enabled), but without the hassle to deploy and maintain client VPN's for thousands of users.
However, to my disappointment, based on the information below from www.cisco.com (and I believe that it is the case from other vendors, right?) SSL VPN offers limited functionality if deployed clientless. Why is like that?
Imagine I have a VPN (IPSec) solution functional today. If I deploy SSL VPN (clientless) what lack in functionality should I experience? Why a VPN client is required if SSL VPN can successfully establish the tunnel? I don't get it.
"...SSL VPNs provide two different types of access: clientless access and full network access. Clientless access requires no specialized VPN software on the user desktop; all VPN traffic is transmitted and delivered through a standard Web browser. Because all applications and network resources are accessed through a browser, only Web-enabled and some client-server applications-such as intranets, applications with Web interfaces, e-mail, calendaring, and file servers-can be accessed using a clientless connection. This limited access is suitable for partners or contractors that should be provided access to a limited set of resources on the network. And because no special-purpose VPN software has to be delivered to the user desktop, provisioning and support concerns are minimized."

Hi,
Clientless SSL VPN only able to access application through browser (i.e. HTTP and HTTPS). If you need to acces other application like RDC, you need full SSL client.
Full SSL Client is deployed automatically depends on how you configure the SSL VPN box (temporary or permanently);
1. From the SSL VPN box, you can configure it to download and be installed to user PC permanently (500KB+). When the user successfully authenticated by the SSL VNP box, it will download the client and install automatically/permanently without any help from the network administrator. The user need to login on his/her PC with administrator priviledge.
2. From the SSL VPN box, you can configure it to download and be installed to user PC temporary (500KB+). When the user successfully authenticated by the SSL VPN box, it will download the client and install temporary without any help from the network administrator. The user need to login on his/her PC with administrator priviledge.
In one of my deployment, I have 1000+ SSL VPN user. I just need to create a 10 page User Manual/Guide complete with troubleshooting on their own. I use the first option which is automatically download and permanently install in their PC. Patching the SSL VPN Full Client need to upload the new client in the SSL VPN box only and it will automatically patch the client in user PC.
Dandy

FortiClient SSL VPN Client Not Functioning Correctly

Hello,
I use the FortiClient SSL application to connect to work. In Windows 7 x64 it works without issue. In Windows 8 Build 9200 it exhibits and odd behaviour.
I can connect using FortiClient version 4.4.3.445. Once connected my sent bytes continues to increase which is correct. However received bytes stays at 0.
If I try to Remote Desktop it fails. This is obviously due to no inbound packets coming back from the Fortigate appliance being allowed back to Windows 8.
Disabling the Firewall doesn't have any affect on the condition. Received bytes stays at 0.
This is a clean install with no 3rd party applications, other than the Forticlient software. This is only the SSL VPN portion of the the FortiClient software and does not included AV or Firewall options.
Doing some Googling, I've seen some other people with the same problem but no resolution. Another FortiClient user and Sophos & Juniper SSL VPN clients having the same problem.
Does anybody have any idea what would be causing the SSL VPN to only send bytes but not receive.
Thanks!
UPDATE 2:
In the built in MSTSC.exe "Remote Desktop" I went into Options/Advanced/Server Authentication. I switched the setting to "Connect and don't warn me" and that fixed the problem. The default was "Warn Me' However the warning screen was not coming up.
Just for the heck of it I switched it back to the default settings and saved. Strangely I now get the "Warning" screen that you would normally see. So now both the built-in and App Store Remote Desktop applications are working. FortiClient still shows Bytes
received as 0.....which is odd.
UPDATE: Solved Workaround
I was using the built-in Remote Desktop Application without success. I went into the APP Store and saw their was an APP called "Remote Desktop" I installed that and connected my FortiClient SSL to work. Still no received bytes like I would get in
Win7. I then launched the "APP" Remote Desktop, punched in my PC name at work and creds and boom I can login to my work PC. FortiClient SSL still showing no received bytes, but the "Remote Desktop" from the APP store does work. Not sure why MSTSC.exe will
not work, and why FortiClient shows no received bytes is still unsolved. At least the APP Store Remote Desktop works with the SSL Client.

Hello Everyone,
I finally able to track down the issue .
After spending 3 days i found that VPN Client may bind some setting with user. I tried to install the same on my personal laptop and another machine where the user bind with same account
(hotmail).
Then I realize may be this is user issue so I follow below steps and it work fine.
1. Uninstall Client from Machine
2. Remove same from IE ( Options =>> Connections)
3. Restart System
4. Create Local user and provide administrator rights.
5. Login with new user and logoff all other.
6. Install Client.

Client SSL Vpn question`

not sure if this is possible /device asa 5550 - But can a Client establish a SSL VPN to remote network and devices on the remote network access local network printers?
so you got one client one network A that creates a SSL VPN to network B , can network B be configured so that automatic job come across the same ssl vpn to a Different IP?

I do not know if its just me but I do not understand what you mean with this:
so you got one client one network A that creates a SSL VPN to network B , can network B be configured so that automatic job come across the same ssl vpn to a Different IP?
Can you try it to explain it one more time?
Now, I think you are saying the following, please look this:
HQ----ASA----INTERNET----------Office2
Now the Office2 will do a clientless SSL vpn to the ASA and afterwards you want the HQ to be able to contact some printers or servers on office 2 via the clientless SSL vpn, If that is the question the answer is NO. the clientless SSL vpn will only allow traffic to go from office2 to the HQ, and not all traffic, it will depend on what you use to configure the clientless ssl ( Smart tunnels, Port-forwarding,Plugins).
Again I am not sure if that was the question.
Regards,
Julio
Do rate all the helpful posts

SSL VPN IP Address Assignment from IAS radius server

Can I use SSL VPN IP Address Assignment from IAS radius server?it can be done with acs server.are there some differ from the acs and IAS?

Hi,
I will suggest to setup a sniffer capture with ACS and look for the attribute that ACS sends for IP Address Assignment, once you know the attribute apply it on the IAS.
If you have any question do not hesitate to contact me.

No SSL VPN tunnel from AnyConnect to IOS

Dear all
Due to the annoying WWAN issues with the old Cisco VPN client (IPsec) I am trying to establish remote access to a LAN behind a Cisco 1803 using Anyconnect and SSL VPN.
But I simply cannot make it work.
I have a Cisco 1803 running IOS Version 12.4(15)T15 and I have tried Anyconnect 3.0 and 2.4 on Windows XP and MacOS 10.5, none of them established a VPN connection to the router, saying not a single word more but "Connection attempt has failed".
Here is my configuration on the router:
crypto pki trustpoint TP-self-signed-595019360
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-595019360
revocation-check none
rsakeypair TP-self-signed-595019360
crypto pki certificate chain TP-self-signed-595019360
certificate self-signed 01
3082024E 308201B7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
[......skipped....]
interface Loopback123
ip address 192.168.123.254 255.255.255.0
ip local pool GS-POOL 192.168.123.1 192.168.123.10
webvpn gateway GS-GW
hostname GS-VPN-test
ip address x.x.x.x port 443
ssl trustpoint TP-self-signed-595019360
inservice
webvpn install svc flash:/webvpn/svc.pkg
webvpn context GS-CONTEXT
ssl authenticate verify all
policy group GS-POLICY
   functions svc-required
   svc address-pool "GS-POOL"
default-group-policy GS-POLICY
gateway GS-GW
inservice
These are my debug settings:
#sh debug
WebVPN Subsystem:
WebVPN (verbose) debugging is on
debug webvpn entry GS-CONTEXT
WebVPN HTTP (verbose) debugging is on
WebVPN AAA debugging is on
WebVPN tunnel (verbose) debugging is on
WebVPN Single Sign On debugging is on
And these are all debug messages I get upon incoming connection:
Sep 13 13:12:03.267 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:12:03.271 MEST: WV: sslvpn process rcvd context queue event
At this poibnt I have to accept the self-sigbned certificate in the AnyConnect client. Doing so repeats these messages again five times. Then I hav to accept the certificate in the client a second time (WHY?) Then the router gives these messages:
Sep 13 13:14:10.754 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:10.754 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:10.766 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:10.766 MEST: WV: http request: / with no cookie
Sep 13 13:14:10.766 MEST: WV-HTTP: Deallocating HTTP info
Sep 13 13:14:10.766 MEST: WV: Client side Chunk data written..
buffer=0x84E54AA0 total_len=191 bytes=191 tcb=0x85066820
Sep 13 13:14:10.766 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:11.050 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:11.054 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:11.354 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:11.354 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:11.366 MEST: WV: sslvpn process rcvd context queue event
Sep 13 13:14:11.366 MEST: WV: http request: /webvpn.html with domain cookie
Sep 13 13:14:11.366 MEST: WV-HTTP: Deallocating HTTP info
Sep 13 13:14:11.366 MEST: WV: [Q]Client side Chunk data written..
buffer=0x84E54AA0 total_len=1009 bytes=1009 tcb=0x83DABBF4
Sep 13 13:14:11.366 MEST: WV: [Q]Client side Chunk data written..
buffer=0x84E54A80 total_len=1009 bytes=1009 tcb=0x83DABBF4
Sep 13 13:14:11.366 MEST: WV: [Q]Client side Chunk data written..
buffer=0x84E54A60 total_len=1009 bytes=1009 tcb=0x83DABBF4
Sep 13 13:14:11.366 MEST: WV: [Q]Client side Chunk data written..
buffer=0x84E54A40 total_len=1009 bytes=1009 tcb=0x83DABBF4
Sep 13 13:14:11.370 MEST: WV: Client side Chunk data written..
buffer=0x84E54A20 total_len=641 bytes=641 tcb=0x83DABBF4
Sep 13 13:14:11.370 MEST: WV: sslvpn process rcvd context queue event
At this point the Anyconnect client says "Connection attempt failed" and that's all.
So please, any advice how to solve this?
And do I have to install any particular svc.pkg in the flash? As far as I have found out you can install only one client package (how do you server different clients then?). But if I use permanently installed AnyConnect on my client system the installed svc.pkg on the router doesn't matter at all, right?
Thanks a lot for any suggestions,
Grischa

Some more restrictions:
12.4(15)T does not support Anyconnect in standalone mode, only web-launch (i.e. starting AC from the clientless portal). You need 12.4(20)T or later for standalone mode.
In addition with an untrusted certificate you will run into this bug which is not resolved in 12.4(15)T:
CSCtb73337    AnyConnect does not work with IOS if cert not trusted/name mismatch
In short, if it's possible to upgrade, go to 15.0(1)M7 (or latest 12.4(24)Tx if 15.0 is out of the question)
If you're stuck with 12.4(15)T, only use AC 2.x with weblaunch and make sure the host trusts the router's certificate (create a trustpoint, enroll it, import the certificate on the client into the trusted root store).
hth
Herbert

Problems syncing from contacts to address book

I have an iMac which now runs OSX 10.6.8 and an iPhone 3GS that runs the latest iOS 5.
Long story short, I downgraded from OSX Lion back to OSX 10.6.8 a few months ago. Got quite a few problems doing so... ended up creating a brand new user and transferring music, videos and photos manually. Then, the iOS 5 got out and I upgraded my phone right away. I couldn't figure out icloud at first but understood yesterday that it works only with Lion. I thought I'd keep it on my phone if I ever want to install Lion again.
I also realised that I never transfered back in my iMac all my iCal events and Contacts.
So yesterday, I tryied to sync my Contacts, iCal and Notes from my iPhone to my iMac. In the iTune info tab, under each section, there was a message mentioning that since I use iCloud, I don't need to sync my info through iTune and doing so would possibly create duplicates. I try to sync them anyway since I only had to in Address Book. I got the message to merge or replace. I selected merge (yes I had at least one contact in Address Book). Nothing happened... iCal didn't merge anything and neither Address Book. I tried to create new events in my phone and iMac and these were syncing but not the original ones. Also added a contact in Address Book and it got sync with my phone. I didn't try creating one on the phone to sync it through but assumed that it was working.
After going through a few discussion threads, I decided to delete the iCloud account on my phone since I didn't need it and try re-syncing. The iCloud message in the iTune's info tab was gone so I thought everything would be good and I could select merge my contact again without any problem. I was wrong... I lost all my contacts... I freeeeeeeeaked out !! Thank God I didn't unplug the phone and restored it right away to get everything back.
I tried it again this afternoon but only tried to sync iCal. I didn't get to choose between merge and replace and the same thing happened again... lost everything... iCal but also Contacts which I find strange because I didn't check the Contact option in iTune.... I got everything restored back even thought it's always scary to try things like this.... So for now on, I don't delete my iCloud info on my Phone and do not sync any other info. I'm actually scared to plug it in and always double check that my contacts are all there before unplugging.
So here I am... don't really know what to do... I read stuff about removing apple.isync files or something... or other options but they never quite answer my problem...
There is still the option to type all my contacts back in Address Book.. I don't have that many... but it's a pain...
Sorry about the long message here
Thanks for your help and for your time.
Ben

Clearly iSync has got confused about what new data it needs to pull from the phone. Usually resetting the sync history solves this, but as it hasn't for you... try this:
I would suggest sending all the contacts from the phone to the Mac manually via Bluetooth: *Contacts > Options > More > Advanced > Send all Contacts > Via Bluetooth* (or similar, depending on the exact phone model)
This will send vCard(s) which can be imported into the Mac Address Book simply by double-clicking the file that arrives on your Mac.
Merge or remove any duplicates as they are imported. You can also use the *Card > Look for Duplicates* command in Address Book.
Once all your Contacts are exactly as you want them in Address Book do a full backup of them:
*File > Export > Address Book archive...*
Finally, load iSync, click your phones icon and choose *Reset Device...* from the Devices menu.
This will force iSync to remove all the existing contacts from the phone and completely replace them with all the new nicely sorted out ones from the Mac Address Book.
From this point on, iSync should keep track of what needs updating on each subsequent sync.

SSL VPN Problem - ACL Parse Error

Hi there.
Testing some features in Cisco ASA SSL VPN(Clientless).
But when i connect to the portal, trying to login i get the following error, anybody seen this before?
It works if i ADD a ACL to the DAP, but dosn't if there is only a WEBACL applied??
It also works if i remove my "check" in "ssl-client" box in the global_policy (Group Policy).
6|Mar 20 2014|16:45:09|716002|||||Group <global_policy> User <[email protected]> IP <X.X.X.X> WebVPN session terminated: ACL Parse Error.
7|Mar 20 2014|16:45:09|720041|||||(VPN-Primary) Sending Delete WebVPN Session message user [email protected], IP X.X.X.X to standby unit
4|Mar 20 2014|16:45:09|716046|||||Group <global_policy> User <[email protected]> IP <X.X.X.X> User ACL <testcustomer_attribute> from AAA dosn't exist on the device, terminating connection.
7|Mar 20 2014|16:45:09|720041|||||(VPN-Primary) Sending Create ACL List message rule DAP-web-user-E4EAC90F, line 1 to standby unit
7|Mar 20 2014|16:45:09|720041|||||(VPN-Primary) Sending Create ACL Info message DAP-web-user-E4EAC90F to standby unit
6|Mar 20 2014|16:45:09|734001|||||DAP: User [email protected], Addr X.X.X.X, Connection Clientless: The following DAP records were selected for this connection: testcustomer_common_dap
7|Mar 20 2014|16:45:09|734003|||||DAP: User [email protected], Addr X.X.X.X: Session Attribute aaa.cisco.tunnelgroup = common_tunnelgroup
7|Mar 20 2014|16:45:09|734003|||||DAP: User [email protected], Addr X.X.X.X: Session Attribute aaa.cisco.username2 =
7|Mar 20 2014|16:45:09|734003|||||DAP: User [email protected], Addr X.X.X.X: Session Attribute aaa.cisco.username1 = [email protected]
7|Mar 20 2014|16:45:09|734003|||||DAP: User [email protected], Addr X.X.X.X: Session Attribute aaa.cisco.username = [email protected]
7|Mar 20 2014|16:45:09|734003|||||DAP: User [email protected], Addr X.X.X.X: Session Attribute aaa.cisco.grouppolicy = global_policy
7|Mar 20 2014|16:45:09|734003|||||DAP: User [email protected], Addr X.X.X.X: Session Attribute aaa.radius["11"]["1"] = testcustomer_attribute
6|Mar 20 2014|16:45:09|113008|||||AAA transaction status ACCEPT : user = [email protected]
6|Mar 20 2014|16:45:09|113009|||||AAA retrieved default group policy (global_policy) for user = [email protected]
6|Mar 20 2014|16:45:09|113004|||||AAA user authentication Successful : server = X.X.X.X : user = [email protected]

If you have implemented SSLVPN i18n then I think you are hitting bug.

I have a 13.5 month old Ipad2, wifi only that has had problems with wifi com from the beginning. I am learning that this is not unusual for apple. Any suggestions?

I have a 13.5 month old Ipad2, wifi only that has had problems with wifi com from the beginning. I am learning that this is not unusual for apple. Any suggestions?
ronald1094

Try #5.
Some things to try first:
1. Turn Off your iPad. Then turn Off (disconnect power cord for 30 seconds or longer) the wireless router & then back On. Now boot your iPad. Hopefully it will see the WiFi.
2. Go to Settings>Wi-Fi and turn Off. Then while at Settings>Wi-Fi, turn back On and chose a Network.
3. Change the channel on your wireless router (Auto or Channel 6 is best). Instructions at http://macintoshhowto.com/advanced/how-to-get-a-good-range-on-your-wireless-netw ork.html
4. Go into your router security settings and change from WEP to WPA with AES.
5. Renew IP Address: (especially if you are droping internet connection)
    •    Launch Settings app
    •    Tap on Wi-Fi
    •    Tap on the blue arrow of the Wi-Fi network that you connect to from the list
    •    In the window that opens, tap on the Renew Lease button
~~~~~~~~~~~~~~~~~~~~~~~~~
iOS 6 Wifi Problems/Fixes
How To: Workaround iPad Wi-Fi Issues
http://www.theipadfan.com/workaround-ipad-wifi-issues/
Another Fix For iOS 6 WiFi Problems
http://tabletcrunch.com/2012/10/27/fix-ios-6-wifi-problems-ssid/
Wifi Doesn't Connect After Waking From Sleep - Sometimes increasing screen brightness prevents the failure to reconnect after waking from sleep. According to Apple, “If brightness is at lowest level, increase it by moving the slider to the right and set auto brightness to off.”
Fix For iOS 6 WiFi Problems?
http://tabletcrunch.com/2012/09/27/fix-ios-6-wifi-problems/
Did iOS 6 Screw Your Wi-Fi? Here’s How to Fix It
http://gizmodo.com/5944761/does-ios-6-have-a-wi+fi-bug
How To Fix Wi-Fi Connectivity Issue After Upgrading To iOS 6
http://www.iphonehacks.com/2012/09/fix-wi-fi-connectivity-issue-after-upgrading- to-ios-6.html
iOS 6 iPad 3 wi-fi "connection fix" for netgear router
http://www.youtube.com/watch?v=XsWS4ha-dn0
Apple's iOS 6 Wi-Fi problems
http://www.zdnet.com/apples-ios-6-wi-fi-problems-linger-on-7000004799/
~~~~~~~~~~~~~~~~~~~~~~~
How to Fix a Poor Wi-Fi Signal on Your iPad
http://ipad.about.com/od/iPad_Troubleshooting/a/How-To-Fix-A-Poor-Wi-Fi-Signal-O n-Your-iPad.htm
iOS Troubleshooting Wi-Fi networks and connections http://support.apple.com/kb/TS1398
iPad: Issues connecting to Wi-Fi networks http://support.apple.com/kb/ts3304
WiFi Connecting/Troubleshooting http://www.apple.com/support/ipad/wifi/
How to Fix: My iPad Won't Connect to WiFi
http://ipad.about.com/od/iPad_Troubleshooting/ss/How-To-Fix-My-Ipad-Wont-Connect -To-Wi-Fi.htm
iOS: Connecting to the Internet http://support.apple.com/kb/HT1695
iOS: Recommended settings for Wi-Fi routers and access points http://support.apple.com/kb/HT4199
How to Quickly Fix iPad 3 Wi-Fi Reception Problems
http://osxdaily.com/2012/03/21/fix-new-ipad-3-wi-fi-reception-problems/
iPad Wi-Fi Problems: Comprehensive List of Fixes
http://appletoolbox.com/2010/04/ipad-wi-fi-problems-comprehensive-list-of-fixes/
Connect iPad to Wi-Fi (with troubleshooting info)
http://thehowto.wikidot.com/wifi-connect-ipad
Fix iPad Wifi Connection and Signal Issues http://www.youtube.com/watch?v=uwWtIG5jUxE
Fix Slow WiFi Issue https://discussions.apple.com/thread/2398063?start=60&tstart=0
How To Fix iPhone, iPad, iPod Touch Wi-Fi Connectivity Issue http://tinyurl.com/7nvxbmz
Unable to Connect After iOS Update - saw this solution on another post.
https://discussions.apple.com/thread/4010130
Note - When troubleshooting wifi connection problems, don't hold your iPad by hand. There have been a few reports that holding the iPad by hand, seems to attenuate the wifi signal.
~~~~~~~~~~~~~~~
If any of the above solutions work, please post back what solved your problem. It will help others with the same problem.
 Cheers, Tom

Niggly problem with Hotmail - Sending from a third party email address

I need true push email on my BlackBerry, but also need access from a PC and need to send from my own email address. The easiest way I've found to do this is to forward all emails to my own address to a Hotmail address and use Hotmail as my main provider. Everything works as it should - I've got Windows Live Mail setup on my PC and all emails are sent to the BlackBerry the instant they're received. However, I've got a niggling problem with sending emails from the BlackBerry...
On the Hotmail website, I've set my own email address as the default "From" address and in Windows Live Mail, I've set my email address as my own address. So, if I send email from the Hotmail site or from Windows Live Mail, my own email address is used as the "From" address and not the Hotmail address. If I send email from the BlackBerry, it uses the Hotmail address as the "From" address and not my own address. I've set my own email address as the "Reply To" address in BlackBerry Internet Service but it still shows the Hotmail address. I can't see anyway to change this and it's the only problem I have...
I have tried the GoogleMail service, and this worked fine but every email I sent (either from Google Mail, Outlook or the BlackBerry) would copy itself to the BlackBerry and was getting a bit of a pain.
I have also tried Yahoo Mail but this wouldn't allow me to send email from another email address.
Any ideas from anyone? Either to allow emails sent from my BlackBerry to show my own email address as the "From" address, or to stop emails sent through Google Mail to copy themselves to the BlackBerry?

clnock wrote:
I need true push email on my BlackBerry, but also need access from a PC and need to send from my own email address. The easiest way I've found to do this is to forward all emails to my own address to a Hotmail address and use Hotmail as my main provider. Everything works as it should - I've got Windows Live Mail setup on my PC and all emails are sent to the BlackBerry the instant they're received. However, I've got a niggling problem with sending emails from the BlackBerry...
On the Hotmail website, I've set my own email address as the default "From" address and in Windows Live Mail, I've set my email address as my own address. So, if I send email from the Hotmail site or from Windows Live Mail, my own email address is used as the "From" address and not the Hotmail address. If I send email from the BlackBerry, it uses the Hotmail address as the "From" address and not my own address. I've set my own email address as the "Reply To" address in BlackBerry Internet Service but it still shows the Hotmail address. I can't see anyway to change this and it's the only problem I have...
I have tried the GoogleMail service, and this worked fine but every email I sent (either from Google Mail, Outlook or the BlackBerry) would copy itself to the BlackBerry and was getting a bit of a pain.
I have also tried Yahoo Mail but this wouldn't allow me to send email from another email address.
Any ideas from anyone? Either to allow emails sent from my BlackBerry to show my own email address as the "From" address, or to stop emails sent through Google Mail to copy themselves to the BlackBerry?
Hi,
I've had this sent items in my inbox, problem with Gmail. You can add a filter from the settings page of your gmail account. The filter should be applied to all emails from your email address [[email protected]] and skip the Inbox should be selected.
Have you tested the "Reply to" option properly? Send a mail from your BB to a friend and ask them to hit the reply button, see which account it goes to.
===========================================================
If I've helped, please click the Kudos button.
If your issue has been resolved, please mark it as solved.
Joe
===========================================================

Watchguard SSL VPN client on OSX 10.7 Lion TUN/TAP Kernel Problem

I upgraded to OSX 10.7 Lion and lost the use of the Watchguard VPN client.
I eventually found a solution at http://lesmond.net/2011/07/watchguard-ssl-vpn-client-on-osx-10-7-lion/
I had already uninstalled Watchguard VPN and tried to reinstall to see if that worked (poor advice from another forum)
I hadn't manually removed Watchguard icon from the dock.
When you try to reinstall the dialog tells you to run an postupgrade script on the TUN/TAP kernel and then quits with a fail.
If you install openVPN in this scenario you get an openVPN app and menu item, both of which do nothing.
Click on the Watchguard dock icon and connect.
I was then asked to upgrade and ended up with the run post upgrade script dialog and quit with a fail.
I then clicked on the Watchguard doc icon again and connected.
This time it connected with no problem.
Hope this helps!

WG has new firmware that will fix the problem, once flashed, download the new client vpn client (11.5.1) and you should be good to go.
I had to contact WG to get the patch as it was not in the portal Version 11.3.4 CSP6 for my device. Hope this helps someone.

The server license allows connections from only 5 unique IP addresses

Hi All,
For a project, i did "/Installing Oracle BPEL Process Manager with the
BEA WebLogic Server/".
While accessing the BPEL Console from more than 2 machine, i am
getting the following error message.
"/The Server is not able to service this request:
[Server:002621]Connection rejected, the server license allows
connections from only 5 unique IP addresses./"
I am running the " /Oracle WebLogic Server 9.2 MP3/" weblogic server,
which i downloaded from the following oracle internal site.
/http://www.oracle.com/technology/software/products/ias/bea_main.html/
I have downloaded the license key from the following location.
/http://licensecodes.oracle.com/
/I have updated the license key using the "/UpdateLicense.cmd" /file.
I manually checked the "/license.bea/" file it got changed
"/expiration="never"/" mode.
But still i wasn't able to get rid of the above error message. Still
the license is not updated to the server.
Regards,
Vijay.B

Hi James,
Thanks a lot for your answer.
I tried all the possible way to update the license file, i was able to update the file but the problem was not solved.
I just tried downloading the software from another location and tried updating the license key and now its working fine, i don't see the issue.
The below link is where i downloaded the software, you can get the license key also.
"/http://aseng-wiki.us.oracle.com/asengwiki/display/ASHotPlug/Software+Page+-+Internal+Use/"
Regards,
Vijay.B

IOS SSL VPN problem

I am implementing a SSL VPN with IOS version 12.4(13r)T5 on a 2801 but when I try to connect to the tunnel mode with the latest svc (anyconnect-win-2.2.0133-web-deploy-k9.exe) with https://1.2.3.4/tunnel the ssl vpn client can't connect.
The error on the router is:
Jun 5 16:07:55.755: WV: Appl. processing Failed : 2
Jun 5 16:07:55.755: WV: server side not ready to send.
The following is the configuration:
ip local pool WEBVPN 10.0.0.140 10.0.0.150 group vpn2
webvpn gateway ISR2801-RM
hostname ISR2801-RM
ip address 1.2.3.4 port 443
ssl trustpoint TP-self-signed-50153718
inservice
webvpn install svc flash:/webvpn/svc.pkg
webvpn install csd flash:/webvpn/sdesktop.pkg
webvpn context vpn1
ssl authenticate verify all
url-list "eng"
url-text "wwwin-eng" url-value "http://wwwin-eng.cisco.com"
policy group vpn1
url-list "eng"
default-group-policy vpn1
gateway ISR2801-RM domain clientless
inservice
webvpn context vpn2
ssl authenticate verify all
policy group vpn2tunnel
functions svc-enabled
svc address-pool "WEBVPN"
svc split include 10.0.0.2 255.255.255.255
default-group-policy vpn2tunnel
gateway ISR2801-RM domain tunnel
inservice

Thanks for the reply !!!!
the configation is the following:
interface Ethernet 0
ip address 10.0.0.128 255.255.255.0
ip http secure-server
ip local pool WEBVPN 10.0.0.140 10.0.0.150 group policy-sslvpn2
webvpn gateway ISR2801-RM
hostname ISR2801-RM
ip address 1.2.3.4 port 443
ssl trustpoint TP-self-signed-50153718
ssl encryption aes-sha1
inservice
webvpn install svc flash:/webvpn/svc.pkg
webvpn install csd flash:/webvpn/sdesktop.pkg
webvpn context context-sslvpn1
ssl authenticate verify all
user-profile location flash:webvpn/sslvpn/context-sslvpn1/
url-list "eng"
url-text "wwwin-eng" url-value "http://wwwin-eng.cisco.com"
nbns-list cifs-servers
nbns-server 172.16.1.1 master
nbns-server 172.16.2.2 timeout 10 retries 5
nbns-server 172.16.3.3 timeout 10 retries 5
login-message "UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED. You must have explicit permission to access this device. All activities performed on
this device are logged and violations of this policy may result in disciplinary action."
port-forward "portlist"
local-port 30019 remote-server ssh-server remote-port 22 description SSH
local-port 30020 remote-server mailserver remote-port 143 description IMAP
local-port 30021 remote-server mailserver remote-port 110 description POP3
local-port 30022 remote-server mailserver remote-port 25 description SMTP
policy group policy-sslvpn1
url-list "eng"
port-forward "portlist"
nbns-list "cifs-servers"
functions file-access
functions file-browse
functions file-entry
citrix enabled
default-group-policy policy-sslvpn1
gateway ISR2801-RM domain clientless
inservice
webvpn context context-sslvpn2
ssl authenticate verify all
user-profile location flash:webvpn/sslvpn/context-sslvpn2/
policy group policy-sslvpn2
functions svc-enabled
svc address-pool "WEBVPN"
svc keep-client-installed
svc dpd-interval gateway 30
svc dpd-interval client 300
svc rekey method new-tunnel
svc rekey time 3600
svc split include 10.0.0.0 255.255.255.0
svc default-domain cisco.com
svc dns-server primary 192.168.3.1
svc dns-server secondary 192.168.4.1
default-group-policy policy-sslvpn2
gateway ISR2801-RM domain tunnel
inservice
ISR2801-RM#show webvpn install status svc
SSLVPN Package SSL-VPN-Client version installed:
CISCO STC win2k+
2,2,0133
Mon 05/19/2008 12:58:52.34 v
ISR2801-RM#
WHEN I TRY TO CONNECT TO THE SSL CONTEXT 2 with a client
https://1.2.3.4/tunnel
* the ssl client installed on the pc tell me can't connect.
* on the router the log:
Jun 6 10:28:08.283:
Jun 6 10:28:08.283:
Jun 6 10:28:08.283: WV: Entering APPL with Context: 0x6AA85130,
Data buffer(buffer: 0x6C4B4280, data: 0xF5C043D8, len: 560,
offset: 0, domain: 0)
Jun 6 10:28:08.283: CONNECT /CSCOSSLC/tunnel HTTP/1.1
Jun 6 10:28:08.283: Host: host4-234-static.105-80-b.business.telecomitalia.it
Jun 6 10:28:08.283: User-Agent: Cisco AnyConnect VPN Agent for Windows 2.2.0133
Jun 6 10:28:08.283: Cookie: webvpn=00@1566900393@00025@3421729574@3982902438@context-sslvpn2
Jun 6 10:28:08.287: X-CSTP-Version: 1
Jun 6 10:28:08.287: X-CSTP-Hostname: telefonicadata
Jun 6 10:28:08.287: X-CSTP-Accept-Encoding: deflate;q=1.0
Jun 6 10:28:08.287: X-CSTP-MTU: 1406
Jun 6 10:28:08.287: X-CSTP-Address-Type: IPv6,IPv4
Jun 6 10:28:08.287: X-DTLS-Master-Secret: 27EA2210E377A9E039E458FA604F523C69BEB2BF8D9B40334F72C9F424B83EE26C6D5D57D0F84419DC7A1139D3F08EE9
Jun 6 10:28:08.287: X-DTLS-CipherSuite: AES256-SHA:AES128-SHA:DES-CBC3-SHA:DES-CBC-SHA
Jun 6 10:28:08.287:
Jun 6 10:28:08.291:
Jun 6 10:28:08.291:
Jun 6 10:28:08.291: WV: Appl. processing Failed : 2
Jun 6 10:28:08.291: WV: server side not ready to send.
SSLVPN sock pid 182 sid 161: closing

Problem establishing SSL VPN from only 1 IP address

Similar Messages

Maybe you are looking for