VPN passthru problem

I have on Win 2003 server install VPN server.
When I tryed connect i get following error in server's Event log:
A connection between the VPN server and the VPN client [MYPUBLICIP] has been established, but the VPN connection cannot be completed. The most common cause for this is that a firewall or router between the VPN server and the VPN client is not configured to allow Generic Routing Encapsulation (GRE) packets (protocol 47). Verify that the firewalls and routers between your VPN server and the Internet allow GRE packets. Make sure the firewalls and routers on the user's network are also configured to allow GRE packets. If the problem persists, have the user contact the Internet service provider (ISP) to determine whether the ISP might be blocking GRE packets.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
How I can configure ruter in my case?

I use PPTP VPN protocol.
This means that I must forward following ports:
TCP 1723
IP Protocol ID of 47 (0x2F). => This filter allows PPTP tunneled data to the PPTP server
How can I forward IP protocol?

Similar Messages

Out of ideas diagnosing VPN connection problems

I'm having trouble narrowing down what's causing the VPN connection problems to my new Mini Server. Sometimes I can connect just fine with my MacBookPro and use all the resources like file sharing, etc. So, this leads me to believe it has been setup correctly. But then, for no reason at all (maybe it's later in the same day, or a completely different day) it will just stop working and I cannot connect at all.
*MacBook and iMac at home cannot connect, but iPhone can*
This is what's really throwing me off. This afternoon, I cannot connect to the server from home with my MacBook or my iMac. BUT, my iPhone can -using the same WiFi network my computers are on, not the cellular network. How could that be? The VPN settings on all 3 devices match exactly.
*Colleagues with other ISP's can connect, while I cannot*
I've called Comcast business (which provides the static IP for our office server) and they tell me all my settings are correct for allowing VPN traffic through. Likewise, Comcast Residential tells me there is nothing that would block VPN traffic from my home. They tell me to talk with Apple. argh!
*Web and Server Admin services are still accessible when VPN is not working*
We have exposed the Server's Web and Admin services without needing a VPN connection to access them. Since these services are accessible to me even when the VPN is not working, this leads me to believe the server is operating normally and capable of receiving incoming traffic.
I'm out of ideas and I'm starting to lose my mind!!! Any ideas on why my 2 computers sometimes can connect, yet sometimes cannot...all the while, my iPhone can connect just fine over the same network???

I don't have an explanation for the erratic nature of your connections. It's only as I've said before, in my experiences with such problems it has always traced back to misconfigured network or DNS settings. mDNS is multicast DNS and it's a protocol Apple uses so its devices can find each other easily. That may be the reason why your iPhone can connect when other things can't.
To take a step back, here is how I think things should be set up:
\- Your dedicated IP address should be assigned to your router automatically through PPPoE
\- The name servers as set in your router should be your ISP's name servers
\- Make sure the server has only one connection to the router that is managing the dedicated IP, either wired or wireless, but not both
\- A static network address should be assigned to your server's MAC address in the router's DHCP settings
\- The server's network address should be put in the DMZ on the router or set as the default server in the NAT settings, depending on the router
\- The network settings in System Preferences on the server should be set to DHCP with manual address and the server's network address entered correctly
\- The router address should be listed correctly in the network settings in System Preferences on the server
\- The name servers in the network settings in System Preferences on the server should be 127.0.0.1 and the router's IP address, nothing else.
\- The zone files on the server should have a primary and reverse zone for each domain name and its network address. Do not use the dedicated IP address in the zone files on the server.
If everything is set as I described, it should work. If it doesn't, it's time to call a witch doctor or an exorcist.

Remote access vpn ESP problem

I have remote access vpn configured on cisco 2901 router. Everything works good exept ipad 2 3g. When i am connecting with ipad from 3g network it connects but it is unable to access corporate resources. I talked to my telephone provaider and they told me that they have some nat problems with ESP. and adviced me to force vpn clients to use udp ports 500 and 4500. How i have to configure my router to accomplish this ?
Thanks in advance

Hello,
Isakmp uses port UDP 500 for the managment connection establishment ( Phase 1).
NAT-T ( used when they are nat devices in between two VPN endpoints) uses port UDP 4500.
So on your Router NAT-T is configured by default, all you got to do is if you have an ACL on the outside interface allow this traffic (Isakamp and NAT T) On some of the newer IOS versions you do not have to apply the ACL as by default the VPN traffic (encrypted traffic bypasses the ACL).
So your requirement is done by default, great thing right!! You can let your Telephone provider you are ready for the test.
Julio
Do rate all helpful posts!!

VPN connection problem

I am currently unable to connect to my VPN server with either of 2 Lion machines 2010 white MacBook and a black MacBook . I run iVPN (L2TP) on an old PPC Mac Mini, my iPhone and iPad still connect instantly. When the Lion machines try to connect for they try for about a minute and fail returning "The L2TP-VPN server did not respond. Try reconnecting. If the problem continues, verify your settings and contact your Administrator." I currently have my router setup to port foward and use a dynamic DNS. I tried connecting straight to the VPN directly by changing to the internal LAN IP still no luck. Any suggestions

I've been out of my SonicWall VPN since I upgraded to Lion last week. Found a trick and succeeded. I had to reconfigure the settings on the Sonicwall and make sure that the phase 1 and phase 2 authentications were using AES encryption rather than 3DES.
That did the trick and I was back in.
Of course now my 10.6.8 clients are out - I'll post more on that front if I figure it out.

Vpn authentication problem

I have 2 AD account in 2 domain, Singapore and China. Both dom are under 1 forest. Problem is when I used Cisco VPN to connect to Singapore firewall but used China AD account & password, authentication failed. But when I used Cisco VPN to connect to China firewall but used Singapore AD account & password, authentication works. Why ? Please help an thanks.

Muhammad,
I think you have an issue with your AD search order....try adding the domain OU prefix with a "\" then the username i.e:-
domain\username
HTH.

VPN tunnel Problem

Hi all ,
I need create VPN tunnels between two ASAs devices . And these devices are connected through DSL . And as you know in this case we use private outside IP address , because there is a NAT device at the outside . The problem is that no VPN tunnel is created even though all the parameters and the pre-shared-key are typical .

I hve allready configured following configuration.
no crypto map newmap interface outside
no crypto map newmap 171 set peer 195.11.199.144
no isakmp key ********* address 195.11.199.144 netmask 255.255.255.255 no-xauth no-config-mode
crypto map newmap 171 set peer 195.11.204.5
isakmp key ******** address 195.11.204.5 netmask 255.255.255.255 no-xauth no-config-mode
clear crypto ipsec sa
clear crypto isakmp sa
crypto map newmap interface outside
Setting were applied successfully however Still VPN tunnel is not been initiated.

VPN Communication Problem

I have created a working VPN between a remote PC with Cisco VPN Client and Easy VPN server on Cisco 1802 (DSL). The Router has an dynamic external IP and is accessible over DynDNS. The problem is not the VPN connetion, but the communication between the remote PC and LAN behind the router.
Ping functions to all devices on the LAN
telnet 25 functions
DNS functions
Access to shares is taking ages, functions then sometimes, usually runs it into a Timeout
HTTP is taking ages and breaks then
Remotedesktop to a 2k server breaks
Remotedesktop to a 2k3 server opens the server window, but before the login mask breaks
Application Security Log of the SDM:
JAN 16 14:09:35.902 PC Time DROP PKT Dropping tcp pkt 192.168.121.15:80 => 192.168.122.5:4293
JAN 16 14:11:35.662 PC Time DROP PKT Dropping tcp pkt 192.168.122.5:4302 => 192.168.121.15:3389
Any idea's what's wrong with the config?

Hi there,
I see some issues here:
1. Increase the value in the command:
ip tcp synwait-time 10
2. Remove following command from the interface Dialer0 config:
ip route-cache flow
3. On the VPN client PC, open the SetMTU utiliy (in the VPN client folder) and set the MTU on the interface to 1300.
Start the above steps and test after each.
Please rate if this helped.
Regards,
Daniel

VPN CLIENT PROBLEM

Hi
I have a problem with ping in VPN Client,
In this senario, the VPN client should be able to ping PC-4 through ASA-1 (Site-A)but it could not.
The router is able to ping Z.Z.Z.0/24.
The Tunnel and VPN client are working.
1. PC-1 can connect to ASA-1 and ping Network 20.20.0.0/16 and 10.10.10.0/24 but cannot ping PC-4.
2. PC-2 can ping PC-1 and PC-3 but cannot ping PC-4.
3. If PC-3 gateway be 10.10.10.1 , It can ping Z.Z.Z.2.
4. If PC-3 gateway be 10.10.10.20 , It cannot ping Z.Z.Z.2.
5. ASA-1 can ping ASA-2 and 10.10.10.1/24 but cannot ping Z.Z.Z.2.
6. ASA-2 can ping ASA-1 and Z.Z.Z.2.
This is my config on ASA-1 and ASA-2:
hostname ASA-1
interface G0/0
nameif Outside
security-level 0
ip address x.x.x.1 255.255.255.224
NO SHUT
interface G0/3
nameif Inside
security-level 100
ip address 20.20.0.1 255.255.0.0
NO SHUT
route Outside 0.0.0.0 0.0.0.0 x.x.x.2 1
object-group network DM_INLINE_NETWORK_1
network-object 10.10.10.0 255.255.255.0
network-object 20.20.0.0 255.255.0.0
network-object z.z.z.0 255.255.255.0
ip local pool ATA 20.20.0.20-20.20.20.255 mask 255.255.0.0
access-list 100 extended permit icmp any any
access-group 100 in interface Outside
global (Outside) 1 interface
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp enable Outside
tunnel-group y.y.y.1 type ipsec-l2l
tunnel-group y.y.y.1 ipsec-attributes
pre-shared-key 1234
group-policy ATA internal
group-policy ATA attributes
vpn-tunnel-protocol IPSec
username TEST password TEST privilege 0
username TEST attributes
vpn-group-policy ATA
tunnel-group ATA type remote-access
tunnel-group ATA general-attributes
address-pool ATA
default-group-policy ATA
tunnel-group ATA ipsec-attributes
pre-shared-key 1234
access-list Outside_1_Cryptomap extended permit ip 20.20.0.0 255.255.0.0 z.z.z.0 255.255.255.0
access-list Outside_1_Cryptomap extended permit ip 20.20.0.0 255.255.0.0 10.10.10.0 255.255.255.0
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map Outside_map 1 set pfs group1
crypto map Outside_map 1 set peer y.y.y.200
crypto map Outside_map 1 match address Outside_1_Cryptomap
crypto map Outside_map 1 set transform-set ESP-3DES-SHA
crypto map Outside_map 1 set security-association lifetime kilobytes 10000
crypto map Outside_map interface Outside
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group2
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-3DES-SHA
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
access-list Inside_nat0_Outside extended permit ip 20.20.0.0 255.255.0.0 10.10.10.0 255.255.255.0
access-list Inside_nat0_Outside extended permit ip 20.20.0.0 255.255.0.0 z.z.z.0 255.255.255.0
access-list Inside_nat0_Outside extended permit ip object-group DM_INLINE_NETWORK_1 20.20.0.0 255.255.224.0
nat (Inside) 0 access-list Inside_nat0_Outside
nat (Inside) 1 0.0.0.0 0.0.0.0
policy-map global_policy
class inspection_default
inspect icmp
same-security-traffic permit intra-interface
management-access Inside
hostname ASA-2
interface E0/0
nameif Outside
security-level 0
ip address y.y.y.1 255.255.255.192
NO SHUT
interface E0/3
nameif Inside
security-level 100
ip address 10.10.10.20 255.255.255.0
NO SHUT
route Outside 0.0.0.0 0.0.0.0 y.y.y.2 1
route Inside z.z.z.0 255.255.255.0 10.10.10.1 1
access-list 100 extended permit icmp any any
access-group 100 in interface Outside
global (Outside) 1 interface
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
crypto isakmp enable Outside
tunnel-group x.x.x.1 type ipsec-l2l
tunnel-group x.x.x.1 ipsec-attributes
pre-shared-key 1234
access-list Outside_1_Cryptomap extended permit ip 10.10.10.0 255.255.255.0 20.20.0.0 255.255.0.0
access-list Outside_1_Cryptomap extended permit ip z.z.z.0 255.255.255.0 20.20.0.0 255.255.0.0
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto map Outside_map 1 set pfs group1
crypto map Outside_map 1 set peer x.x.x.1
crypto map Outside_map 1 match address Outside_1_Cryptomap
crypto map Outside_map 1 set transform-set ESP-3DES-SHA
crypto map Outside_map 1 set security-association lifetime kilobytes 10000
crypto map Outside_map interface Outside
access-list Inside_nat0_Outside extended permit ip 10.10.10.0 255.255.255.0 20.20.0.0 255.255.0.0
access-list Inside_nat0_Outside extended permit ip z.z.z.0 255.255.255.0 20.20.0.0 255.255.0.0
nat (Inside) 0 access-list Inside_nat0_Outside
nat (Inside) 1 0.0.0.0 0.0.0.0
policy-map global_policy
class inspection_default
inspect icmp
same-security-traffic permit intra-interface
management-access Inside
Regards

Hi,
My suggestion to your puzzle is to either load your ASDM real time log and observe the logs while one host tries to ping each other and take notes on the log , this should provide you with information and some clues on what the issue could be. You may also try to packet capture in ASA-2 , either way, I would start with easiest one which is realtime log on ASDM.
Could you provide the folloing:
1 - Post output of c:\ipconfig /all from PC-4 z.z.z.2/24
2 - Post output of show ip route from Router where PC-4 subnet is routed from
Regards

VPN / NAT Problem

Hi I have quite a complex (to explain) VPN problem, I've built a model in GNS3 but I still cant get it to work. here is the topology
1. SiteW is the main site, if W-CLient wants to talk to S-Client (on SiteS) the traffic is simply NATTED to 106.200.194.240 and sent there (this works fine).
2. SiteB is a new site, Ive set that up with a Site to Site VPN, that works fine.
New Requirement
If a user at SiteB wants to Talk to a Client at SiteS, then the traffic should go over the existing VPN to W-FW1 then get decrypted and routed there. This is the bit I CANNOT despite HOURS of tweaking and testing get to work.
What I've done
On W-FW2
Added Site S to the existing interesting traffic ACL and added a 'NO NAT' for it like so;
object network S-CLIENTS
subnet 65.253.1.0 255.255.255.0
access-list VPN-INTERESTING-TRAFIC extended permit ip object B-CLIENTS object S-CLIENTS
nat (inside,outside) source static B-CLIENTS B-CLIENTS destination static S-CLIENTS S-CLIENTS
On W-FW1
Added Site S to the existing interesting traffic ACL and added a 'NO NAT' for it like so;
object network S-CLIENTS
subnet 65.253.1.0 255.255.255.0
access-list VPN-INTERESTING-TRAFIC extended permit ip object S-CLIENTS object B-CLIENTS
nat (inside,outside) source static S-CLIENTS S-CLIENTS destination static B-CLIENTS B-CLIENTS
At this point packet tracer said the traffic was being blocked by ACL so I added
access-list inbound extended permit ip object B-CLIENTS object S-CLIENTS
access-list inbound extended permit icmp object B-CLIENTS object S-CLIENTS
access-group inbound in interface outside
Now Packet Tracer was happy, Still B-Client Cannot Ping S-Client!
W-FW1 can ping S-Client
Attempting to ping S-Client from B-Client brings up the tunnel (phase 1 and 2) but no traffic ever travels BACK to B-Client.
Running Wireshark on the 106.200.194.1 interface of S-FW1 whilst attempting to ping 65.253.1.10 from S-FW1 shows traffic (as expected) but if I ping from B-Client it gets nothing (so I'm assuming the traffic never gets out of W-FW1
Help!

First check if the packet from the S client is making it back to the W-F1.
Configure Captures on the interface that is connected to the 106.200.194 subnet.
#cap capin interface <interface name> match ip host <sclient ip> host <bclient ip>
#show cap capin
Capture is bidirectional. Hence no need to enable it in the opposite direction.
If the packet is seen coming back from the Sclient and still not getting encrypted then do asp drop capture to see if the ASA is dropping it
#capture asp type asp-drop all
send the traffic.
#show cap asp | in <Sclient IP>
If the packet is see in this capture then the ASA is dropping it.
Then do a packet tracer to see why it is dropping it.
#packet-t input <Sclient connected interface name> icmp <sclient IP> 8 0 <b client IP> det.
Check why the packet is dropping.
if the capin capture does not see the reply packet then check the reply path and routing.

VPN (PPTP) problem

Hi
I have a weird VPN problem on my macbook. I'm trying to connect to a Windows 2000 Server though VPN dialup (PPTP), it connects, seems like I'm getting an IP, but I cannot access anything on the network.
VPN dialup works fine from my iMac, so I know it's not a server issue.
Any one have any suggestions?
Thanks

I had this issue too.
I don't know much about this sort of thing, but my network admin makes me go to terminal every time and enter this in
sudo route add 10.10.0.0/16 10.10.7.1

ASA5505 - SG300 VPN site2site problem

Hello,
I have a problem with a site2site VPN between a SG300 and an ASA5505. On the SG300 we have two internal connected networks, the second one is an alias. The VPN goes up and works correctly for hours or even for days. Then I don't know why, for some reason, the VPN is up but works only for one of the two networks. When the users try to connect I get this error on the ASA: ASA-7-710006: ESP request discarded from SG300PubblicInterface to outside:ASAPubblicInterface. To solve this problem I have to restart the VPN or make a ping from the ASA's LAN to the SG's LAN that isn't working. We have other VPNs on both firewalls that work correctly. ASA's Software Version is 8.0(3). I saw that I'm not the only one having this problem but nobody found the right answer...

Hi Vinay,
As per your below config
crypto map vpnmap 10 match address vpnfr
crypto map vpnmap 10 set peer 193.242.9.126
crypto map vpnmap 10 set transform-set myvpn
crypto map vpnmap 20 ipsec-isakmp dynamic dynmap
crypto map vpnmap 30 match address vpnsing
crypto map vpnmap 30 set peer 203.126.186.226
crypto map vpnmap 30 set transform-set myvpn2
crypto map vpnmap 40 match address vpnbl
crypto map vpnmap 40 set peer 61.8.153.122
crypto map vpnmap 40 set transform-set myvpn2
crypto map vpnmap 50 match address vpnde
crypto map vpnmap 50 set peer 61.8.129.170
crypto map vpnmap 50 set transform-set myvpn2
crypto map vpnmap interface outside
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 193.242.9.126
crypto map outside_map 1 set transform-set ESP-3DES-SHA
vpnmap is your original crypto map if this is the crypto map its applied to oustide interface which is correct
now if you have added a new crypto map say " outside_map" its not going to work as we can only apply one crypto map per interface i dont see any resundant ISP on the config so i suppose the crypto map
"outside_map" might be the newly added crypto map if that is true please try below config changes and let me know if it helps
=============================================================
crypto map vpnmap 60 match address outside_1_cryptomap <<<<
crypto map vpnmap 60 set pfs <<<<<<<<<<<<<<<<<<<<<<<<<
crypto map vpnmap 60 set peer 193.242.9.126
crypto map vpnmap 60 set transform-set ESP-3DES-SHA
===============================================================
make sure the crypto acl "outside_1_cryptomap" is mirrored on the remote end and you also have PFS enabled on remote end
Thanks
Rohan

VPN 3000 problem

I have 2 CVPN 3000 at my institution. They have both software version 4.7.2.L-k9. Thay also have WebVPN running.
Lately something strange has been happening. One VPN loses connection (ping keepalives stop working) and no one can connect. When this happens I change the dns A record of the vpn service to the 2nd CVPN and, after a while, that 2nd CVPN stops responding. Can this be an attack? What can I search for in the logfile? The logfile cannot handle more than 15, 20 minutes.
Thanks in advance.

I have captured some traffic directed to the SSL port. There alots of TCP retransmission packets (ack dup).
Disabling SSL service I have the CVPN running for a day now.. it seems the problems have stopped. Of course nw I don?t have WebVPN service.
Any suggestions? Has anyone experienced such a problem?
Tx

VPN setup problem

I have installed Snow Leopard Server on a new XServe. I have updated to 10.6.2.
Other services are working Related to VPN I have configured the VPN Service using L2TP.
I have no additional network routing defined.
Every time I try to setup a connection (from my macbook pro --> running snow leopard 10.6.2) I get the following log messages:
2009-11-15 14:44:41 CET Incoming call... Address given to client = 192.168.1.160
Sun Nov 15 14:44:41 2009 : Directory Services Authentication plugin initialized
Sun Nov 15 14:44:41 2009 : Directory Services Authorization plugin initialized
Sun Nov 15 14:44:41 2009 : L2TP incoming call in progress from '192.168.1.15'...
Sun Nov 15 14:44:41 2009 : L2TP received SCCRQ
Sun Nov 15 14:44:41 2009 : L2TP sent SCCRP
Sun Nov 15 14:44:41 2009 : L2TP received SCCCN
Sun Nov 15 14:44:41 2009 : L2TP received ICRQ
Sun Nov 15 14:44:41 2009 : L2TP sent ICRP
Sun Nov 15 14:44:41 2009 : L2TP received ICCN
Sun Nov 15 14:44:41 2009 : L2TP connection established.
Sun Nov 15 14:44:41 2009 : using link 0
Sun Nov 15 14:44:41 2009 : Using interface ppp0
Sun Nov 15 14:44:41 2009 : Connect: ppp0 <--> socket[34:18]
Sun Nov 15 14:44:41 2009 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <auth eap> <magic 0x7dd4d1cd> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x1e217556> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : lcp_reqci: returning CONFACK.
Sun Nov 15 14:44:41 2009 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x1e217556> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <auth eap> <magic 0x7dd4d1cd> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : sent [LCP EchoReq id=0x0 magic=0x7dd4d1cd]
Sun Nov 15 14:44:41 2009 : sent [EAP Request id=0x1 Identity ]
Sun Nov 15 14:44:41 2009 : rcvd [LCP EchoReq id=0x0 magic=0x1e217556]
Sun Nov 15 14:44:41 2009 : sent [LCP EchoRep id=0x0 magic=0x7dd4d1cd]
Sun Nov 15 14:44:41 2009 : rcvd [LCP EchoRep id=0x0 magic=0x1e217556]
Sun Nov 15 14:44:41 2009 : rcvd [EAP Response id=0x1 Identity <"]
Sun Nov 15 14:44:47 2009 : LCP terminated by peer (Failed to authenticate ourselves to peer)
Sun Nov 15 14:44:47 2009 : sent [LCP TermAck id=0x2]
Sun Nov 15 14:44:47 2009 : L2TP received CDN
Sun Nov 15 14:44:47 2009 : Connection terminated.
Sun Nov 15 14:44:47 2009 : L2TP disconnecting...
Sun Nov 15 14:44:47 2009 : L2TP sent CDN
Sun Nov 15 14:44:47 2009 : L2TP sent StopCCN
Sun Nov 15 14:44:47 2009 : L2TP disconnected
2009-11-15 14:44:47 CET --> Client with address = 192.168.1.160 has hungup
What does that mean:
"Failed to authenticate ourselves to peer" ???
Are there some configurations which can solve this problem ???
Best regards
Andreas

This are the related client side log entries:
Sun Nov 15 14:44:40 2009 : L2TP connecting to server '192.168.1.10' (192.168.1.10)...
Sun Nov 15 14:44:40 2009 : IPSec connection started
Sun Nov 15 14:44:40 2009 : IPSec phase 1 client started
Sun Nov 15 14:44:40 2009 : IPSec phase 1 server replied
Sun Nov 15 14:44:41 2009 : IPSec phase 2 started
Sun Nov 15 14:44:41 2009 : IPSec phase 2 established
Sun Nov 15 14:44:41 2009 : IPSec connection established
Sun Nov 15 14:44:41 2009 : L2TP sent SCCRQ
Sun Nov 15 14:44:41 2009 : L2TP received SCCRP
Sun Nov 15 14:44:41 2009 : L2TP sent SCCCN
Sun Nov 15 14:44:41 2009 : L2TP sent IRCQ
Sun Nov 15 14:44:41 2009 : L2TP received ICRP
Sun Nov 15 14:44:41 2009 : L2TP sent ICCN
Sun Nov 15 14:44:41 2009 : L2TP connection established.
Sun Nov 15 14:44:41 2009 : using link 0
Sun Nov 15 14:44:41 2009 : Using interface ppp0
Sun Nov 15 14:44:41 2009 : Connect: ppp0 <--> socket[34:18]
Sun Nov 15 14:44:41 2009 : sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0x1e217556> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : rcvd [LCP ConfReq id=0x1 <asyncmap 0x0> <auth eap> <magic 0x7dd4d1cd> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : lcp_reqci: returning CONFACK.
Sun Nov 15 14:44:41 2009 : sent [LCP ConfAck id=0x1 <asyncmap 0x0> <auth eap> <magic 0x7dd4d1cd> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0x1e217556> <pcomp> <accomp>]
Sun Nov 15 14:44:41 2009 : sent [LCP EchoReq id=0x0 magic=0x1e217556]
Sun Nov 15 14:44:41 2009 : rcvd [LCP EchoReq id=0x0 magic=0x7dd4d1cd]
Sun Nov 15 14:44:41 2009 : sent [LCP EchoRep id=0x0 magic=0x1e217556]
Sun Nov 15 14:44:41 2009 : rcvd [EAP Request id=0x1 Identity ]
Sun Nov 15 14:44:41 2009 : sent [EAP Response id=0x1 Identity <"]
Sun Nov 15 14:44:47 2009 : Connection terminated.
Sun Nov 15 14:44:47 2009 : rcvd [EAP Request id=0x2 EAP KRB <00003f000001000101>]
Sun Nov 15 14:44:47 2009 : L2TP disconnecting...
Sun Nov 15 14:44:47 2009 : L2TP sent CDN
Sun Nov 15 14:44:47 2009 : L2TP sent StopCCN
Sun Nov 15 14:44:47 2009 : L2TP disconnected

VPN Connections problem

Hi there.
I have a customer that runs two ASA devices (Version 7.2(2)) in failover scheme, and several users that connect to the network using VPN Clients with different versions. Actually, just a few users have been facing a weird problem, when they connect to the VPN, sometimes they can access all the services, sometimes they don't; nor even can ping a device. At other times, they can connect, can access the network resources but with 4 or 5 five minutes since the session start, they are disconnected receiving an error specifying that the remote peer is no longer responding. I checked the settings, and there are users with exactly the same configuration that do not have any problem, and until this moment I don't realize what could be causing this strange behavior. Do anyone faced this issue before? Any suggests? Thanks in advance.
Regards.

Just to clarify: the users that are having problems access the network using different ISPs.

Cisco RV130W VPN firewall problems

Dear Supports:
I am newbie with Cisco, and I bought a Cisco RV130W wireless VPN router last week but
I got same problem with this router.
1)I have installed a DHCP server in our internal network so I have disabled the DHCP
service under network > LAN > LAN configuration > Server Settings(DHCP), but after
this action, all of our wireless device can not get IP again, finally I have
enabled the DHCP relay and put the DHCP server IP to "Remote DHCP Server" field, and
the problem seems fixed, may I know I have take a right action ? And if the answer
is yes, what is the usage for the DHCP Server "Disable" option ?
2)When I set DHCP to Disable, I find that dashboard still showing that the DHCP
server still in "Enabled" status (Dashboard right top corner > LAN (local network)
Interface > DHCP Server: Enabled), may I know it is a firmware bug or just some
setting I missed ?
3)WiFi signal is weak but I can not find any setting to control signal strong, some
times the SSID disappeared, finally I find that because I placed a Ext. USB 3.0 HDD
aside the router, after I remove the HDD and the SSID never disappear again, but I
don't know why this case happened and how can I prevent those case happened again?
4)In dashboard I find that VPN server > PPTP User: 0/1 , but in user manual I also
find that PPTP VPN > 10 PPTP tunnels for remote client access, may I know in
actually the router supports 1 or 10 PPTP user(s) ?
5)The PPTP VPN will disconnect automatically after connected 10~15 mins, I have try with 2 android device , one is running android 4.2 with native VPN client , and another one is running android 4.4.2 with apps "VpnRoot" , can you let me some hints how to trace and fix the problem ?
Thank for the support and I am wait for the reply , thanks.

This document demonstrates how to configure a connection between a router and the Cisco VPN Client 4.x using Remote Authentication Dial-In User Service (RADIUS) for user authentication. Cisco IOS? Software Releases 12.2(8)T and later support connections from Cisco VPN Client 3.x. The VPN Clients 3.x and 4.x use Diffie Hellman (DH) group 2 policy. The isakmp policy # group 2 command enables the VPN Clients to connect.
http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800946b7.shtml

VPN passthru problem

Similar Messages

Maybe you are looking for