Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Computing > Cisco > Cisco VPN client problems

Reply
Thread Tools

Cisco VPN client problems

 
 
mcaissie
Guest
Posts: n/a
 
      09-01-2004
Hi,

i have problems with a PIX 506 and the Cisco VPN client.

Basically , users running the cisco vpn client get disconnected and
eventually can't connect anynore.

The clients traverse a PIX 515 ( ipsec over udp)


***vpnclient-------PIX515(allow udp4500)------PIX506(running isakmp
nat-traversal)***

The connection works , but some users gets disconnected even if they are
not idle.


PIX506
vpngroup level4user address-pool level4
vpngroup level4user dns-server DNSSRV1
vpngroup level4user default-domain bozo.com
vpngroup level4user split-tunnel level4split
vpngroup level4user idle-time 3600
vpngroup level4user password ********

isakmp identity address
isakmp nat-traversal 20
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400


I was suspecting a licence problem , so i transfered a couple of users on
another PIX
with a similar config except for the ip local pool , but they get the same
problem.
And in some case they cannot connect anymore , i have to clear cry isakmp
sa

For example,

i am now no able to connect

sh cry ipsec sa on PIX506 shows

a.b.c.31 x.y.z.126 QM_IDLE 0 1
a.b.c.31 x.y.z.126 QM_IDLE 0 1
a.b.c.31 x.y.z.126 QM_IDLE 0 3
a.b.c.31 x.y.z.126 QM_IDLE 0 1
a.b.c.31 x.y.z.126 QM_IDLE 0 2
a.b.c.31 x.y.z.126 QM_IDLE 0 1
a.b.c.31 x.y.z.126 QM_IDLE 0 1
a.b.c.31 x.y.z.126 QM_IDLE 0 3
a.b.c.31 x.y.z.126 QM_IDLE 0 1
a.b.c.31 x.y.z.106 QM_IDLE 0 1
a.b.c.31 x.y.z.71 QM_IDLE 0 1
a.b.c.31 x.y.z.71 QM_IDLE 0 1
a.b.c.31 x.y.z.71 QM_IDLE 0 1
a.b.c.31 x.y.z.71 QM_IDLE 0 1
a.b.c.31 x.y.z.90 QM_IDLE 0 1

x.y.z.126 is the PAT address of the PIX 515 so it's normal to have more
than one.

x.y.z.71 is my NAT translation in the PIX515 ( i got an ip from the NAT
pool before it got full).
As you can see there is 4 sa establish with that IP . It's because everytime
i get disconnected
the PIX keeps the sa for the idle period ( 1 hour ) . But in the mean time
i can't connect, without
doing a clear cry isakmp sa ( and disconnecting everyone )

Log on the client shows
Discarding IKE SA negotiation (I_Cookie=EA55B9C8507147AB
R_Cookie=6C39B990E77697B reason = DEL_REASON_RESET_SADB

any hints,

thanks


 
Reply With Quote
 
 
 
 
PES
Guest
Posts: n/a
 
      09-02-2004

"mcaissie" <(E-Mail Removed)> wrote in message
news:2WlZc.84519$X12.76995@edtnps84...
> Hi,
>
> i have problems with a PIX 506 and the Cisco VPN client.
>
> Basically , users running the cisco vpn client get disconnected and
> eventually can't connect anynore.
>
> The clients traverse a PIX 515 ( ipsec over udp)
>
>
> ***vpnclient-------PIX515(allow udp4500)------PIX506(running isakmp
> nat-traversal)***
>
> The connection works , but some users gets disconnected even if they are
> not idle.
>
>
> PIX506
> vpngroup level4user address-pool level4
> vpngroup level4user dns-server DNSSRV1
> vpngroup level4user default-domain bozo.com
> vpngroup level4user split-tunnel level4split
> vpngroup level4user idle-time 3600
> vpngroup level4user password ********
>
> isakmp identity address
> isakmp nat-traversal 20
> isakmp policy 20 authentication pre-share
> isakmp policy 20 encryption 3des
> isakmp policy 20 hash md5
> isakmp policy 20 group 2
> isakmp policy 20 lifetime 86400
>
>
> I was suspecting a licence problem , so i transfered a couple of users on
> another PIX
> with a similar config except for the ip local pool , but they get the
> same
> problem.
> And in some case they cannot connect anymore , i have to clear cry isakmp
> sa
>
> For example,
>
> i am now no able to connect
>
> sh cry ipsec sa on PIX506 shows
>
> a.b.c.31 x.y.z.126 QM_IDLE 0 1
> a.b.c.31 x.y.z.126 QM_IDLE 0 1
> a.b.c.31 x.y.z.126 QM_IDLE 0 3
> a.b.c.31 x.y.z.126 QM_IDLE 0 1
> a.b.c.31 x.y.z.126 QM_IDLE 0 2
> a.b.c.31 x.y.z.126 QM_IDLE 0 1
> a.b.c.31 x.y.z.126 QM_IDLE 0 1
> a.b.c.31 x.y.z.126 QM_IDLE 0 3
> a.b.c.31 x.y.z.126 QM_IDLE 0 1
> a.b.c.31 x.y.z.106 QM_IDLE 0 1
> a.b.c.31 x.y.z.71 QM_IDLE 0 1
> a.b.c.31 x.y.z.71 QM_IDLE 0 1
> a.b.c.31 x.y.z.71 QM_IDLE 0 1
> a.b.c.31 x.y.z.71 QM_IDLE 0 1
> a.b.c.31 x.y.z.90 QM_IDLE 0 1
>
> x.y.z.126 is the PAT address of the PIX 515 so it's normal to have more
> than one.
>
> x.y.z.71 is my NAT translation in the PIX515 ( i got an ip from the NAT
> pool before it got full).
> As you can see there is 4 sa establish with that IP . It's because
> everytime
> i get disconnected
> the PIX keeps the sa for the idle period ( 1 hour ) . But in the mean
> time
> i can't connect, without
> doing a clear cry isakmp sa ( and disconnecting everyone )
>
> Log on the client shows
> Discarding IKE SA negotiation (I_Cookie=EA55B9C8507147AB
> R_Cookie=6C39B990E77697B reason = DEL_REASON_RESET_SADB
>
> any hints,
>
> thanks
>
>


Can you place a sanatized copy of your entire config? I'm particularly
interested in the ip addresses of your interfaces, the pool, global, nat and
the acl labeled level4split. I suspect that the isakmp from/to a.b.c.31 <>
x.y.z.? is being encrypted. This doesn't seem to work. The bigger question
is why not do a lan to lan tunnel and eliminate the clients?


 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
USB Keys and Cisco VPN Concentrator / Cisco VPN Client ? TechGuy Cisco 3 02-05-2009 01:05 PM
Cisco VPN client OK - Checkpoint VPN client not OK Ned Cisco 0 10-12-2007 01:02 PM
VPN Connection Problems between Cisco PIX 506E and Cisco VPN Concentrator 3005 Kai Cisco 0 02-15-2005 02:03 PM
Cisco VPN Client vs MS VPN Client jarcar Cisco 0 02-12-2004 12:22 PM
Help with Cisco VPN client 4.0.1 (and 4.0.3) - The VPN client could not find the adapters GUID MP Cisco 2 12-30-2003 03:55 PM



Advertisments