VPN Client and Clientless users not authenticating with AD

Web clients are receiving login failed messages and VPN clients are getting disconnected by host messages. I am able to ping the server from the ASA5510. Users authenticate in AD. I am not sure if the problem is on the server or the ASA.
CP

Hi,
Are you using LDAP for user authentication, is this a new setup or was this working at one point?
If using LDAP please use "debug ldap 255" and reproduce, If you are using radius what are you using?
Thanks,
Sent from Cisco Technical Support iPad App

Similar Messages

WRV200 - Problems with VPN Client and Internal network access

I have a WRV200 router and want to access the internal (Private Network) connected on the inside. I have successfully conected to the router with the Linksys VPN Client, but it does not appear to allow access to the internal network.
How do I enable NAT Transversal or Passthru? I have already selected all of the PPTP, L2TP and IPSEC Pass Through.
Has anyone gotten this to work?

I have actually gotten this to work. Issues surround this include the ability to get to the VPN if the main DNS is down (it does not fail over to the next DNS in the list).
If you unselect all of the boxes in the firewall General configuration, you can connect, but if you need to have all of this unchecked, what's the sense of having it?
Anyway, you can use the DoS Prevention, this is not interfering.
HTH.

Anyconnect client and clientless connections hang for two users

ASA 5525, v. 9.1(5)19
Anyconnect client 3.1.02026
I have two users who are unable to connect via the AC client or clientless through the web portal. Using the client, it will get stuck in a loop of "checking for updates". On the portal, the connection will proceed to the point of "Cisco Secure Desktop successfully validated... Success.. Reloading..please wait." Then it hangs there.
The issue occurs for the user regardless of which company laptop she logs onto. A help desk tech can use her laptop and successfully connect, but she cannot connect on her own laptop or on another laptop. (Same for the other user.) So the issue doesn't seem to be related to her laptop or the AC installation. (Help desk did reimage her machine early in the troubleshooting process before they realized that the issue seemed to follow the user.)
I've updated the hostscan file - no change in results. Client and clientless connections seem to be working fine for all other users. We're stumped. Suggestions, anyone? thanks!

The LDAP should be server folks -- Active Directory. Chances are whoever manages the ASA's should have access to at least look in Active Directory to look that up. If they don't they need it.
I obviously don't know a lot about what devices you are using, but if you are using ISE, there should be some type of MNT device (Monitoring and Troubleshooting) -- which is collecting the logs and, hopefully, sending them to some type of syslog aggregate collection tool (splunk?).
Otherwise, there should be a device called a CAM (Clean Access Manager) that is collecting logs -- which may also be propagated to a syslog aggregate tool -- although with CAM's, you can pull the reports right out of them in a comma deliminated file (.csv) and go through them that way.
-- The thing that gets me is that it happens to two users no matter what computer they try to connect from, no matter what network they connect from, and other users can authenticate and gain network access on those same devices.
-- That is why it is rather perplexing. Pretty much saying it has to be something with:
- the IP pool they are getting an IP from
- their AD credentials
- their username
- something along those lines, if the information provided was fully accurate.

Mavericks VPN dropouts with native VPN client and Cisco IPSec

Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
I am connecting via a WIFI router to a remote VPN server
The conenction is good for a while but eventually it drops out.
I had Zero issues in mountain lion and only have issues since the update to 10.9
I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
My thoughts are:
1 -issue with mavericks ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
2- Issue with cisco router compaitibility or timing with Cisco IPSEC
3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
Any thousuggestions?

Since update to Maverics I am experiencing VPN dropouts with native VPN client and Cisco IPSec
I am connecting via a WIFI router to a remote VPN server
The conenction is good for a while but eventually it drops out.
I had Zero issues in mountain lion and only have issues since the update to 10.9
I had similar issues in teh past with an unrelaibel wifi router but i am using a Verizon Fios router and it has worked impecably until mavericks
My thoughts are:
1 -issue with mavericks ( maybe the app sleep funciton affecting eithe VPN or WIFI daemons)
2- Issue with cisco router compaitibility or timing with Cisco IPSEC
3- Issue with WIFI itself on mavericks - some sort of WIFI software bug
Any thousuggestions?

Boot camp with Cisco VPN client and smart card

Looking at a Macbook or Macbook Air and the only reason I need to run windows is to be able to access my work network through the Cisco VPN client and my Smartcard then use remote desktop. From my understanding if I run Bootcamp it should work am I correct? Im going to an Apple store tomorrow hopefully they can help too.
Thanks

mrbacklash wrote:
Ok with that being said will the MBA 11.6 1.4ghz have the guts to make it run mostly internet based programs over the VPN connection?
I think if you are running apps over the Internet the bottleneck will be the Internet and your VPN bandwidth. Your computer can certainly execute faster than Internet communications.
Besides, Internet or remote applications run on the remote server. All your local computer does is local processing of the data if necessary.
Message was edited by: BobTheFisherman

Problem with Cisco VPN client and HP elitebook 2530p windows 7 64-bit

Hi there
I have a HP Elitebook 2530p which i upgraded to windows 7 64-bit. I installed the Cisco VPN client application (ver. 5.0.07.0290 and also 64-bit) and the HP connection manager to connect to the internet through a modem Qualcomm gobi 1000 (that is inside the laptop). When I connect to the VPN, it connects (I write the username and password) but there is no traffic inside de virtual adapter for my servers. When I connect to the internet through wire or wireless internet, I connect de VPN client and there is no problem to establish communication to my servers.
I tried everything, also change the driver and an earlier version of the HP connection manager application. I also talked to HP and they told me that there was a report with this kind of problem and it was delivered to Cisco. I don’t know where is the problem.
Could anyone help me?
Thanks to all.

You can try to update Deterministic Network Enhancer to the below listed release which supports
WWAN Drivers.
http://www.citrix.com/lang/English/lp/lp_1680845.asp.
DNE now supports WWAN devices in Win7. Before downloading the latest version of DNEUpdate from the links below, be sure you have the latest
drivers for your network adapters by downloading them from the vendors websites.
For 64-bit: ftp://files.citrix.com/dneupdate64.msi
Hope that helps.

How to configure full tunnel with VPN client and router?

I know the concept of split tunnel....Is it possibe to configure vpn client and router full tunnel or instead of router ASA? I know filter options in concentrators is teher options in ISR routers or ASA?

I think it is possible. Following links may help you
http://www.cisco.com/en/US/products/hw/routers/ps274/products_configuration_example09186a0080819289.shtml

Cisco VPN Client and Quick VPN interaction?

I have both a Cisco VPN client for connecting to my company LAN and a QuickVPN client for connecting to my home LAN installed on my W2K laptop. Both start and run correctly, and both connect just as they should. My home LAN uses a WRV54G router to provide VPN connection. I can alternate back and forth between the two clients and connect to each LAN with no obvious issues, but not at the same time, of course.
Here's the question. When I connect to the home LAN, I can log on with no problem and I can remotely administer the WRV54G with no problem. I can ping all of the wired and wireless W2K computers on my home LAN with no problem. However, I cannot "see", browse or map any of the shared resources on my home LAN. I have created user accounts on the home LAN computers for my laptop and router logins and I have given these accounts permissions to my shared resources, but I still cannot get to them. Linksys tech support has been absolutely no help whatsoever, even after repeated attempts.
While trying to troubleshoot this myself, I've noticed that when the Cisco VPN client is running and I'm connected to my company LAN, the IP address and subnet of my computer is changed to ones assigned by the DHCP server at my company. This seems to happen because the Cisco client activates the "Local Area Connection Number 2" on my laptop and assigns IP addresses using it. However, when I'm using the QuickVPN client to connect to my home, the IP address and subnet of my laptop continues to be those assigned by whatever local network I'm connected to (e.g. hotel, etc).
I'm wondering if the QuickVPN is supposed to be assigning an IP address and subnet to my laptop from the WRV54G's DHCP server when I connect to my home LAN. If so, could the Cisco VPN client installed on my laptop be preventing that from happening?
Sorry for the long post, but I'm at my wit's end on this one and Linksys is just no help at all.

1. The Cisco VPN client creates a virtual interface on your computer. This allows you to route traffic to the tunnel. The QuickVPN client is simpler. It only encrypts the traffic to the other end. It does not use a virtual interface. That's why you don't have another IP address when connected with QuickVPN. QuickVPN only encrypts IP packets with IPSec from your computer to 192.168.1.* (or whatever you may use on your WRV LAN) and sends them to the WRV's public IP address.
2. Microsoft Windows file sharing and LAN network browsing depends on network broadcasts. Those only work inside a LAN. If you connect from the outside to a LAN, broadcasts won't go through the VPN tunnel. This means you cannot use standard name windows workgroup name resolution to access shares. Those are propagated with broadcasts which will never go through the VPN tunnel. This means you are not able to use workgroup browsing. All you can to do access your shares is to use the IP address of the other computer.
In short:
\\mycomputer\share won't work
\\192.168.1.50\share works
(assuming the general sharing setup is O.K., i.e. you can use sharing correctly inside your LAN).
Of course, firewalls on the server end may cause problems. Access comes in from a public IP address. This may be blocked. Check the firewall logs on the server to find out if this is the case or not.
Moreover, establishing the VPN connection from a private LAN to a private LAN may not work. This is due to the double network address translation which breaks IPSec and thus the connection. If the hotel uses private IP addresses, this may be the case. But in that case you won't get ping responses from your WRV LAN.
What definitively won't work is in case when the hotel uses the same IP address subnet as you. If the hotel uses 192.168.1.* addresses and your WRV uses 192.168.1.* addresses you cannot connect. QuickVPN does only IPSec tunneling. There is no address translation in QuickVPN. Therefore connecting the identical private IP address subnet through QuickVPN will never work because all addresses exists twice, once on either side.

Cisco IPSec VPN Client and sending a specific Radius A-V value to ACS 5.2

This setup is to try routing Cisco VPN to either RSA or Entrust from Cisco ACS 5.2, depending on some parameter in incoming AUTH request from Cisco IPSec VPN Client 5.x. Tried playing with pcf files and user names/identity stores, none seems working

Hi Tony,
to the best of my knowledge this is currently not possible, but will be once this enhancement is implemented:
CSCsw31922 Radius upstream VSAs (Tunnel Group,Client type) for VPN policy decisions
You may want to try and ask in the AAA forum if there is anything you can do on ACS...
hth
Herbert

VPN Client and DNS settings

Hello,
here are few posts (quite some time ago) telling the same trouble:
The VPN Client does *NOT* restore the original DNS settings.
Upon BM3.8.2 Massimo told, that this is a bug in that version of the VPN
client. I face this issue with 3.8.16 and nwclient 4.91.4 with or without
the three currently available hotfixes [1]
Anybody else facing this trouble with the current VPN client release?
May be an older one works better, any experiences?
This trouble is fact even after clean disconnects. But it happens only now and then,
I might need to try it 50 times to see it once.
a followup in CMD boxes with ipconfig /all does show, that the times
to restore the original DNS settings vary from 2 to 30 seconds. Mostly about 5 seconds.
Massimo also told, that a "VPN-down" due to a Win-Shutdown can cause this: So is
there a possibility to trigger a "clean-VPN down" in the Win-shutdown sequence?
As a workaround I packed this line into all users "run" key:
netsh int ip set dns name="LAN-Verbindung" source=dhcp
so at least after a reboot it's corrected.
Any suggestions appreciated,
[1]
Novell Client 4.91 Post-SP2/3/4 NWSPOOL.DLL
Novell Client post-4.91 SP4 LGNCXW32.DLL
Novell Client 4.91 Post-SP4 NWGINA.DLL 1
IT-Beratung Rudolf Thilo
Schweinfurter Str. 131
97464 Niederwerrn
t: +49 (0)9721/6464840
f: +49 (0)9721/6464841
m: +49(0)171/685 9 685

Hello Craig,
thanks for your answer.
[VPN Client sometimes doesn't restore DNS settings after disconnecting]
e.g. TID 10096552 is telling such a trouble, that should be fixed with
BM VPN Client 3.8.10
> > Any suggestions appreciated,
> >
> This one seems to be so related to the design of the VPN client that
> you may need to open an incident to get it fixed, if that even would
> help.
>
> There used to be a utility designed to clean up after the VPN client,
> but I can't remember now what it was. I never tried it that I can
> remember.
Anybody else who knows about that tool?
After doing some "teachment" to these VPN users the incidents of this
trouble didn't show up as frequent as before. So I assume, that one
reason might be this:
Scenario
VPN connect
PCA connect to host in corporate LAN
PCA full screen *SHOULD* be activated (ALT+ENTER)
working, working, working
shutdown PC in corporate LAN
close VPN tunnel
shutdown local home office PC.
When it was missed to activate PCA fullscreen without noticing this,
then the "remote" start button is not visible.
So instead of shutting down the remote PC, the local PC is shut down.
By that, the local shutdown is killing (not cleanly disconnecting)
the VPN client. When this happened (and I 100% can reproduce this)
after the next boot of the home office PC the VPN connect will *ALWAYS*
fail. After another reboot the VPN connect will succeed again without
any problems.
Is this a known issue? (I cannot find that TID I found before telling
missbehaviour when VPN connects are not disconnected clean. IIRC this
was something fixed in a VPN client version /several/ subversions ago)
Home Office PC = XPSP2+Hotfixes, VPN Client BM 3.8.16, nici from that
one first, now taken from NWClient 4.91.4, no difference.
Regards, Rudi.
IT-Beratung Rudolf Thilo
Schweinfurter Str. 131
97464 Niederwerrn
t: +49 (0)9721/6464840
f: +49 (0)9721/6464841
m: +49(0)171/685 9 685

Apple built-in vpn client and dhcp hostnames

We have a number of Mac clients in our office which uses MS for dhcp and dns.
I've noticed that the mac clients when wired directly into the office network successfully get a dhcp lease and report their hostnames accurately to the dhcp server. However when these same clients connect to the office network via VPN (using the built-in vpn utility with Cisco IPSEC) they get a dhcp lease as expected, but do not register a hostname with the lease on the dhcp server. The lease is assigned to a blank hostname.
I assume this is a pretty common issue. Has anyone found a way to configure the vpn client to send the hostname along with the connection, either via the client config or through some other method?
Thanks.

The VPN server is a Cisco 3030, however only the Mac clients have this issue. Windows and linux clients report their hostnames to dhcp properly even when VPN connected.

Cisco AnyConnect VPN client and 256 AES encryption in IE8

Hey,
We have a site that we are trying to connect to with the AnyConnect VPN client version 2.5.3055 on Windows XP SP3. As soon as we enter the site info and hit select, it says a connection was unable to be established.
I believe this has to do with the encryption, its set up with 256 bit AES. We are only able to install IE8, which on XP only supports up to 128 bit encryption, so in IE8 the page will not load. To fix that issue we installed firefox which supports 256 bit encryption. We can get to the page there, but when we go to connect to the same site VIA the VPN client it still will not connect. It will work fine on a windows 7 box with IE9 installed from the same network.
My question mainly pertains to how the AnyConnect client connects on the back end. Does it use Internet explorer's SSL layer by default? Or does it have its own? If it connects through internet explorer, is there a way to change it to firefox so it will actually be able to open up a connection?
Thank you for your answers in advance,
John

Hey Jeff,
Thanks for answering that question. Hmm, so it doesnt go through the browsers SSL layer. We have systems on the same network (same proxy, firewall, vlan, etc). All the systems with windows XP SP3 and IE8/IE7 can not connect to the VPN (they arent even able to start the connection and ask for proxy/logon info.), all the systems with windows 7 and IE9 can. Same setups on each one as far as the security policies go as well. I thought it may have to do with the 256 bit encryption that they are using.
If thats not the case, what else could be causing the problem? weve tested it on about 5 XP machines and 5 Win 7 machines, same results on each. Connects on Win 7, does not connect on Win XP.
Thanks,
John

RV220W, VPN client, and Full Tunnel vs Split Tunnel capabilities

For an RV220W, which VPN client mode (of the three possibilities) supports which Tunnel mode?
This is mostly a question, and partly "in use" observations.
Background: I have been able to get all three different VPN clients to work with an RV220W, but only one of the three works in "Full Tunnel" mode (SSL VPN). And since I know one of the three -- the Cisco QuickVPN client -- will never with in that mode, do we know if an RV220W will with an IPSec client in Full Tunnel Mode?
If anyone answers yes, the next question will be vpn client and how did you configure it, client and RV220W, to make full tunnel work.
Summary of VPN modes I've gotten to work with an RV220W:
Client
Split Tunnel Works?
Full Tunnel Works?
OS?
Notes
SSL VPN
Yes
Yes
Win7/64
IE10 or IE11
QuickVPN
Yes
No
Win7/64
IPSec VPN
Yes
No
Win7/64
Shrew Soft VPN Client

I have to mark this as not a correct answer.
Reason: 0.0.0.0 will not go into either of the fields listed above, message is "Invalid IP address Please enter a value between 1 - 223 at xxx.0.0.0.".
To Michal Bruncko who posted this:
1.) 0.0.0.0 will not work in my router nor in the RV220W online emulator here, (general emulator page here), am I missing something obvious?
2.) Have you used these actual settings on your router, or did you answer in a theoretical, "this should work" way?

VPN Client and Windows 7 Issue

Using VPN Client, V5.0.07.0440 a Dell Vostro W7 Professional system, 64 bit. The client installs and runs the same way it has on at least 20 other systems without issue. When I try to remote into the network, I get a "can not connect" error attempting to connect to any system or server. I placed a known good laptop using XP on the same internet line, it connects without issue. The remote access (mstsc.exe) verson is 6.1.7601.17514 there is no Admin switch in the shortcut. This is the first time anything like this has happened, numerous W7 32 and 64 bit and XP systems. Any help greatly appreciated.
Thanks
It's like the VPN connects to the network, but the remote access is not using the same connection. I get the same results whether the VPN Client is loaded or not.
Sure could use some help on this.

The system that I am trying to connect with is a Dell Vostro desktop, W7 64bit Pro. I am attempting to connect to a Windows 2003 domain thru a PIX 501 firewall. The desktop system uses an onboard Ethernet adaptor connected to the Internet thru Charter. I do not have ready access to the computer as it's my employers home system. The frustrating thing is, I have installed and set this up on at least 30 other systems and all of them worked flawlessly. Of course, this one would be the problem as it belongs to my boss.
Thanks for responding, I plan on picking up the unit so I can devote some real time to fixing it.
Thanks again

Error Message For BISystemUser: User not authenticated

We have migrated from DEV to PROD env.(11.1.1.1 -> 11.1.1.3). Along problems with bipublisher - there are some strange thingths: we successfully loging using weblogic account into AdminConsole и Enterprise Manager, but in Answers we get an error: invalid username or password.
nqserver.log:
...[ERROR:1] [] [] ... [tid: 1090] Error Message For BISystemUser: User not authenticated.
...[ERROR:1] [] [] ... [tid: 1090] [nQSError: 43126] Authentication failed: invalid user/password.
In oracle support we found such issue (Doc ID 1308389.1):
OBIEE 11g Error: "Unable to Sign in. invalid username or password was entered" After Changing Repository, Deleting BISystem User, Adding it Back (Doc ID 1308389.1)
Applies to: Business Intelligence Server Enterprise Edition - Version: 11.1.1.3.0 [1905] to 11.1.1.5.0 [1308] - Release: 11g to 11g
Symptoms: In OBIEE 11.1.1.3.0 using default authenticator, it is not possible to log in to OBIEE after changing repository. To troubleshoot, BIsystemuser was removed from global roles and added back again.
Getting error: Unable to Sign in. invalid username or password was entered
Changes: Changed repository, deleted BISystemuser, added the user back
Cause: Several changes e.g changing rpd, deleting bisystem user, adding the user back etc. occurred in the environment and caused log in to OBIEE to stop working
Solution: After a lot of troubleshooting e.g re-starting system in the correct order, refreshing GUIDs, re-start OBIEE with default SampleAppLite.rpd and web catalog, the error persists. The system was uninstalled and re-installed to avoid further corruption and configuration problems in the new installation. This resolved the problem
Does we have to 'reinstall or make a lot of troubleshooting e.g re-starting system ' to solve this error?
It seem to be funny for PROD environment. How we cam resolve this problem?

Are you saying you upgraded both dev and prod from 11.1.1.1 to 11.1.1.3 or that you migrated a dev 11.1.1.1 to a prod 11.1.1.3? What did you migrate?
At a rough guess the BISystemUser password is different in dev and prod (created by system on install) and in your 'migration' you've moved the dev credential across to prod.
If that's the case you need to change the bisystemuser password to something known and update the credential store password.
Another possibility might just be that you need to regenerate the GUIDs:
http://download.oracle.com/docs/cd/E21764_01/bi.1111/e10543/privileges.htm#BIESC721

VPN Client and Clientless users not authenticating with AD

Similar Messages

Maybe you are looking for